ck_size) [ 149.639987] binder: 5904:5907 transaction failed 29201/-22, size 88-24 line 3493 [ 149.645985] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 149.645992] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 149.671507] binder: undelivered TRANSACTION_ERROR: 29201 17:03:06 executing program 2: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:06 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x3) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f00000001c0)=ANY=[], @ANYBLOB="0000000001000000"], 0x0, 0x0, 0x0}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/self/net/pfkey\x00', 0x400, 0x0) getsockopt$inet6_udp_int(r3, 0x11, 0xb, &(0x7f0000000400), &(0x7f0000000440)=0x4) 17:03:06 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:06 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000080)='./file0\x00', 0x2, 0x5, &(0x7f00000002c0)=[{&(0x7f0000000140)="42b2e0b1828312443091effcd0138986839c067d", 0x14, 0x6}, {&(0x7f0000000180)="c3a15129bae9ae66c32763869fdf2ade8c83996bdd7fdc5d7b09df8828667da467c05a7e20c6b8619b416a740e0984da6d084938388b291bada6b00c", 0x3c, 0x10}, {&(0x7f00000001c0)="912b90862ba21feb", 0x8, 0x401}, {&(0x7f0000000440)="05b0eb1ad726ec41d7cb7ddf29c72533d6a88053ef5272dacfb235c7e47d36765e5143bd5b7639ca775e6e7e1c8fa51329a878ccb0510e675309005eb11614a0942f30c72b43ee5f3ed1d5c5190b15246009abcbdeb545a590c24dafb0c7ee88b8cd40f28fd4b137980c6ad34f28e02ca5d524625acf1dde9756724d6f6fda638e145b4e7d91c94ff0fcd4fcc6a664348fdd98eef38f6b452417f37436a204d507a5", 0xa2, 0x80000001}, {&(0x7f0000000380)="92df3f8c747f4e7541d655c33ec88c2209551c6c017e3f506ff27a8a0d82e948c02b755ef4d2a44b2e50d6b2ed694ae7e2038c37dcacc169e7601b02620f4ad360f0a5710e3e1dba8399ca5a58863b18357a28e50645f2496614224082b4e101eea7aded9507aa8198eddd8d409b70f8c3087ff45fca926de431725db9a16b65b2b6f923e879468f84e57e95f1e5102b51e51aae56de1c626f7efdd54c3db1fefffdce7e9c62260e58e71be60299fb5b9ec95d3f9b6d13931a9d9e", 0xbb, 0x8f}], 0x1000000, 0x0) lsetxattr$security_evm(&(0x7f0000000000)='./file0/file0\x00', &(0x7f00000000c0)='security.evm\x00', &(0x7f0000000100)=@md5={0x1, "c865f8fc6b003e55d6a7b4dbdccd3836"}, 0x11, 0x1) stat(&(0x7f0000000200)='./file0/file0\x00', &(0x7f0000000240)) 17:03:06 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/policy\x00', 0x0, 0x0) ioctl$BLKRRPART(r2, 0x125f, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000040000000000000000000000000852a647bf8663200", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/status\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r4, 0x80404509, &(0x7f0000000380)=""/70) ioctl$FS_IOC_SETVERSION(r3, 0x40087602, &(0x7f0000000300)=0x2) ioctl$UI_GET_SYSNAME(0xffffffffffffffff, 0x8040552c, &(0x7f0000000280)) 17:03:06 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) write$FUSE_STATFS(0xffffffffffffffff, &(0x7f0000000280)={0x60, 0x0, 0x4, {{0x8001, 0x1, 0xe54, 0x0, 0x1, 0x0, 0x4, 0x1}}}, 0x60) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 150.157257] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 150.168267] binder_alloc: 5933: binder_alloc_buf size 4294967408 failed, no address space 17:03:06 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) [ 150.168274] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) [ 150.168292] binder: 5933:5938 transaction failed 29201/-28, size 88-24 line 3284 17:03:06 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000580)={@fda={0x66646185, 0x6, 0x1, 0x3c}, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x20, 0x48}}}], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000300)={0xffffffffffffffff}, 0x80000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r4) r5 = geteuid() mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='fuse\x00', 0x400000, &(0x7f0000000340)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}, {@max_read={'max_read', 0x3d, 0x3}}, {@max_read={'max_read', 0x3d, 0x9}}, {@blksize={'blksize', 0x3d, 0x1a00}}, {@blksize={'blksize', 0x3d, 0x1700}}, {@max_read={'max_read', 0x3d, 0x7}}, {@blksize={'blksize', 0x3d, 0x600}}], [{@appraise_type='appraise_type=imasig'}, {@fscontext={'fscontext', 0x3d, 'system_u'}}, {@smackfshat={'smackfshat', 0x3d, '}mime_typesystem'}}, {@uid_eq={'uid', 0x3d, r5}}, {@fsuuid={'fsuuid', 0x3d, {[0x34, 0x34, 0x64, 0x0, 0x62, 0x30], 0x2d, [0x66, 0x37, 0x64, 0x39], 0x2d, [0x37, 0x51, 0xe1, 0x62], 0x2d, [0x34, 0x65, 0x64, 0x38], 0x2d, [0x26, 0x35, 0x65, 0x35, 0x164f870b88222219, 0x0, 0x36]}}}, {@fowner_gt={'fowner>', 0xffffffffffffffff}}]}}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000540)='/proc/self/net/pfkey\x00', 0x100, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) [ 150.168845] binder: undelivered TRANSACTION_ERROR: 29201 [ 150.249393] binder: 5954:5956 got transaction with too large buffer [ 150.249439] binder: 5954:5956 transaction failed 29201/-22, size 88-24 line 3493 [ 150.249789] binder: undelivered TRANSACTION_ERROR: 29201 [ 150.277653] binder: 5952:5955 got transaction with too large buffer [ 150.277697] binder: 5952:5955 transaction failed 29201/-22, size 88-24 line 3493 [ 150.278781] binder: undelivered TRANSACTION_ERROR: 29201 [ 150.315297] binder: 5952:5962 got transaction with too large buffer [ 150.315340] binder: 5952:5962 transaction failed 29201/-22, size 88-24 line 3493 [ 150.317023] binder: undelivered TRANSACTION_ERROR: 29201 [ 150.394378] binder: 5967:5968 got transaction with invalid parent offset or type [ 150.394410] binder: 5967:5968 transaction failed 29201/-22, size 96-24 line 3454 [ 150.395248] binder: BINDER_SET_CONTEXT_MGR already set [ 150.395256] binder: 5967:5968 ioctl 40046207 0 returned -16 [ 150.395899] binder: undelivered TRANSACTION_ERROR: 29201 [ 150.396949] binder: 5967:5970 got transaction with invalid parent offset or type [ 150.396979] binder: 5967:5970 transaction failed 29201/-22, size 96-24 line 3454 [ 150.397443] binder: BINDER_SET_CONTEXT_MGR already set [ 150.397451] binder: 5967:5970 ioctl 40046207 0 returned -16 [ 150.398042] binder: undelivered TRANSACTION_ERROR: 29201 [ 150.633411] EXT4-fs (loop1): VFS: Can't find ext4 filesystem 17:03:08 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:08 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendmmsg$inet6(r2, &(0x7f0000000540)=[{{&(0x7f00000002c0)={0xa, 0x4e24, 0x5, @remote, 0x3}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000000300)="58993e4d1bb894a5d6c26ac98640407123abe3bbc256e185607f7833346fe890e58646b1848b27f7a3671c4c3eb924575799aa6772f497ea78b3bf9935601209359377ac21ebeadd05ba49990ec05c660c82f7b6795f2ea5cc85f72c582e26208c01d2340dfc9199acc29224d33c8f3ef12a337ff1c7c040e260f3ec74073ff474f1eabb2ff46ea445bc0591472defdda9959de4c7a3ebe8f4078152dee977540b9a142ff0c77c747748d9d9375ed74b1a93fabf8fa9047dfcca92e923f8734be83e14e3445868d9008356cfe49a4f04ce7fe0ab717cf6fe7ff41e5d856d35bfcc4d55fba8210d46a6a788aef87aee23e614beaa3acc8a4236aee3264ad3", 0xfe}, {&(0x7f0000000400)="7bc42143886a2f7d7590488f61c9d7b64a608ad25723b0106ff8f59577d3c31b656432e01b724a2fc60dffd2a63f6197dfdc40f7be72e20af82b5699ddecf2ba850050252126b71f53b3eef25f2491908ba896f06038d7210c0f6848cbdc20246ce39ec5011a77af83227528385455a42a054adeb02bfeaaa6a09b36ab1a44c5eb4a2973e46ac5e1df7c578f5eb688ce045ce7cee812609e0db654bb4991f9e39f3f39d32467d04c2f6f819902197b092631b2e9b48489b56be6e1c89d27597fb9440f9ac9cdac0176b1c1df0612c9db0a76c204a4ab3dbb5a5b0fdb3a6c29cc218f1e5b581822de59d7062dd1691f9fc3709164f64d841af77d67b5b3", 0xfd}], 0x2}}], 0x1, 0x6480) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/mls\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000001700)={0x7c, 0x0, &(0x7f0000000680)=[@clear_death={0x400c630f, 0x1}, @enter_looper, @dead_binder_done, @request_death={0x400c630e, 0x2}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f00000005c0)={@flat=@handle={0x73682a85, 0x0, 0x3}, @fda={0x66646185, 0x1, 0x0, 0x6}, @flat=@weak_handle={0x77682a85, 0x100, 0x3}}, &(0x7f0000000640)={0x0, 0x18, 0x38}}, 0x9aa7f9eaa2651a60}], 0x1000, 0x0, &(0x7f0000000700)="a7ce65c6f3df545b0372dd7053bd1d0bcfe279a079b2b7a167ec1b46b07ed2b9c6171ae7a7c41517b09d7cda56b99901ca3456445cc7b0bf22a57ddc5a3eae7a4e314c4790b91d57dc1984b33935d75a09af0cf56326c81ffb87bac5c6a6b77348f0fac0eba23cca1715be690556c246400d2a5facb5efa52575b9b3f36159e16ac5cdf4d1b5c58cfe46210481fbcfda2fbedc76a777f6e18110476bc04c83c0f59920662ba5aab70cffc64de3803d0cf342a664a6320c6759bac24519bafd47a5d45b8346ba8a4cae578220877f0d04ca1c7010b832590b26acca26f0b8f7da40725e29c2a095ffcf14c78b59aa1a7235157e93826c0d7c4b5765303a08c167f1b540042789fd25725f1ab82bd44748e8b2c7911d8cbc414dbef8dec178df44c2ef362c8f6b12dc33f877c4dca1de0b91e7242a50f08ff138d40a5f791cbab37879b778b984ff0414c7d0822638efda79f8d7ece3c765389ba104cfdcac1a4120eb8f894cf2847fa8c98b17ad948fcad3e7feb015a7ebcec4fbb5fea3d97b2a178d3d99e145b808212f9bea66dc15dd6a1f30b3d59952ede67e0065141bc49d8731348e38877e09aa5d1bbe2ec4f02ffeb0f37b7507df16e1d921566b3ed8562ed19c7d6bd4037586f87e33d77eb14accc0cbd9eafc6eb6dab819ed465d31cf16aed9c40f266981147d89d25248d4907850cf1f392ba8c6453c4cd54c6e9fdd247b5e2a31b305fbf13c76770b7467ef1bec4d031485136e92d43d5ff8a65b2c0b1544af17b39c6c90b08c6c4d3189d42c5b6a4761c56470585ec750872b26e31a2b74fbc0f979ccf004dc31056dc4402d6fa16fcf9e95c83ff0b2ac0bfc3e97a8dfbfcbcc372268aa7912588cfab7e9249a8b083b0494ec6cc4103c957f4e55e1eecfa6742abe9b6c40d60bb73dda455e6dd199619104dbae9e0bf5291557640eb667c16df3f02f066a31399bec76ce4d942697b501a679906522e164e5373920f871df1eb2d1f72ca04327ac2e851863593048335a7928ea40ac719430601b1099b49d8eb0886cfdfbbd9ae81637608ef325813c0508eb925ce84a1ed609c92999b6fbc5e3e3b5c60c892f568a7b9320cadf045c3e1b5fb6b4828f3208bc0dc3777094bd9ed2c2c614f5c5de05aa26487c26fce271bec2195bd77c25450cc9478b852de8f7c4348520e920fba19e5bf998bef667ce75c5245634163ac7d4b5f66e73c9f8ccc4072759a8dd80524427497070dc5789797026a258d3d06c3e79d85bc61b744ee0c8e5e388ecdd748adf3d06182096041bf77076a04f2871f053bf16e68b1d619519a27e20312e18efd05de6a34a88d22b8cd00b3a0de5b52e97b9dc1d738a3a814e431c7cd076f4af0b201fa88787098095f2e29ee70028599ca5a1f3118deb639b57852a134eaa0eca3b404d8a36e19d6febfd61d1b6adb3bf92c3825e08ba0fb248ad1a160f0e06077a1d152b02a5fac48ee762f56e2ee0a964bd474ad960b3a15834e7590ee35389ce8f515b902b54ac7adf023c230fd5c1d5224136234bf3d340a32d29c5f9d5851a16abbe5891bd0a71d1f6368f9b7fc2d657c2f0aa6dca67029acd408ba1b6f0a24471874f0c3b56dc65b8a183dc7f503d8e1f888ff3f50921b30fa6055a416bd542a227e0d9be3927ac340f180458a50ab101d91910d00cfc4ca8a5bcecb11ec36085b62ab229d50a542a2b2e6daf98b01cb16f82aa3bd606e263c7079d9f523145e559781f26ed125358124fc44991f9f0c51db246a5edd5c8ee5624db6eb70a773a54a292c61139637b5429a50f1c81a201bb7d2710a4da1c36fcbe2d7b0053b85b3760ae339f186b8f7ffc474826ffecfd33ded39c2764d10e0f24f447440395057aa552889de105a67c8a6eff6322822cdf0b199851a73879ea525a7064b5faa37d3c2b37853028ed4c00cec3ff1ed01270a23c468416fb014cc10a2ea08cb65c1f2ec5cc811b842a004948af7a6813d82f2621ce016bd12a96a72e02c7cc648b02fa4db60f65f83035eb112489f65a708b1ea40d435a11cd2fb0b75f513dc9a869a88ed5f4623162e26d91a2a88d372a7d83eeba512eb232ab7e7294f90921f809f8fb1b62795eb63433461677aef8605aa759e70cd19a403686daa3869812105c21ce3d1663761716c7152f2ecef10257b638ac69905a95aa6c19766c0325ed8a8da8b3e1af142a1cb1ecc435dd712ce671e1fd77bc943b0573ac526846a873843d5f698f0903b90e387d90ede5f6a6936609eee0230c18f52698393aa4700d62c1a888834f080a3098061a02273759ac374bde7f334a3ffd5b06d63e1c34fc14159d00d46b79f0707ba2b4925dd401357fe26625b503de38e49dd17d09b96e685a7bcd49e06d0e4da57cefd7ea0d9aae4eed21f6b39322f52fc1963ea0a119c81cdcae7e1550475cca307936a800ba52d673f6d78e3071ee84248245ecffbf798abe4496b6e754b588fdc2d18829a987fcee053c158805bb8f74b1ecba501f403366920eb805a9593ade7fae3899eb296cf2da3a620c1bd4027933f28f53a72c0adf0eb6bdbb85c3181cb12789b5946f34c97fbac413db32b9513ff67ac3caa40598cf0fcb14a68bc9bd3e4b590bc625cae34c3e57f759dde9a6349b64204b49252d1b27439f60429a35b5badda62b8a89d14d63a08505c85d13076dbb836eb95b6bebf6ebc2ca3c44a32dd62b1a67dae7b2c465a679881564c3e6b727624fa688087f482a5c7f69a7e301f40035987982f3cd75815a5861a816e0a4d28e8bd6d98573511fa1df22c4f2c0b50fb212bb056260c57a179d0866f9d006ed041fe917a3f4115cb831ba36339eea58c42ee69b58bfaf68e17dfbe48bc58f35132ba3d5b2fe6a3546bef0ccb3fea8462adc3ee541aaed1f85355a109a30bc78e00394b842e63d6bc5ee8966a521c12ab9d12a1ac4313c69f0660436ac15ba4882be8d6b502bf8197a480f78d0c9edeeda1d72fdeda4a0aa0b4a2d656c44d65d6968e8f308f9b0b46f0d20f219d4038c66770182d296ab81d949cd5b11a2b9dfca30b9323db3fc78caa1b7b52249e5dee769e09b58e3a78a26c73ee8960b737e9e9fa5395041cd685f88c092f5b0ccadcef6b6b076e8a3554351a601e01ea5640d985a220a761c7e8c8af067c21808db2c3ac321b805a79c5e9e3a289a31dde90cc628580537cc3e6b8719aa1a8b2ddbee3a9fcb7ec8aa153bf1155807b1a8a4c72d896168a2a01d762f2378d362b09dd0c17991f7a9b1fd573cedb163f29e4a5ff3f81b94bfc03e67e2008a89d1d9bd3233d907ae19756edcb373ade8ea0dc0ea335be95f5be823bda5ef02f97e9ee3f10abb7c708d41811e35d7842abc843e0d1b51d990fc5da55364850ce51b7d704993d4dace425cbcd044109a260b6456339382e090895466079c61e90d382c6f743a6583b1f8771054fd5b08f418c3a8a98b6f786a67aebb31b291fc27e2657f45c46a88868f99c5c13d7267c79014ecf8181ce3cb9e2c42b685ecdcb69bfb4c9097222b6f6e17a18354e8046f30d38b4ae5952e0caef069679be2dd56715cf750e7adda1d6bde46c780ecdc91d2b3902b95c2a74bc7f20695a499f959fcb1de3c40af7c2ede24fa75d8d8395978353e29a69bfe0448c852dc7900df711802505c1bf85a7c5939d8db7048f95b90bededc1b4b7cfbc0762e9f97e9a64cd343d2efd0ceb4a80ec3c9a1b9897ac788b4b10f95df6e7adac2873f0e028b82d303af1a4c0192837d1ce3dbae75203ca2935e73dd4b16c10bad21ab5aaab5bbe8361d275ead4612cdf344cd0cd20effc780ae2d01a5b6aeaa11f25863762bd1e2069ec61c895c1d0a12ba065f17fd40fd40cee72db87382364409d2e22f8b3cca1d7b64fa9bee797720058c83e0fe7e707bc57d49ca60de6ce6e2433a090a4d550fbaf52b81ed12b4391731a68479e9c9f0fb96f521fe1cebd43ece8713e18d5e7f8286e1453990ee1c36583ba67a17ff60be769663b9f34a5cb08565409b5161546178ecc75304ace527f017a29b114f010f168574fe924897a55ff51b6385896bac187ce6ca45a5d6b220b5eff157f4770aff78313756492c3af9c4315ddd772684738826d7172bd819c32cc0657e201d63a21268955243bc83c5db39fff1155fc5914de5fa30377a8ad51f0793a0c9a8205083470ca2faf1b0eabc0ecb8d9dab72b8e97d1543f02b2f2730e8a0e8552014b917f519587bb0661f8c6bfd18bd6e8961bc0786b5def3154de37d5697a021510ee7db2b77cedd27a2ee6ded36aadff000e3cd7c58567d3adf9e42fe2310feb94664a3eb55c06f6bc9c2a2ab5b4e4935bf017ea88eb5b0967b41efda71a24b789aa2c411d7bc31d3bb45175d15134bf15699c2d3280aecdf056e6aafcc25ed9e470e1bd402f4154dc2d3f4f80d6d4652f7c45f916a708e5f254cd2ad35391a9641da23329138ac6b56b9ae49ed09d2b44baef460157b44a112d2fe8ad512b64f2b0f872b20df7db592c40c327e81707a7e9b6de4ee8c1c98f40ed4948fb0f33ce1dccae0bba7651922bfc55367e39b97f01f37f01b65c4926a7436d554424fbb079857f8f005786a3e2abb6a73eb043a61baaa7997745e8b1494aca8a0ac1be267add2c99263009e6ff899383ecebe49afbc2eedf96a12ab3474fd6cb5b7590df2a5997b266a48d69e55c913e02aaec4d5cfc0c1f6677a76cae1c0e2a99b1d3062787400ded3be8378abcd2ca58f1db07335913e88f7c2be569c4396cd91d9c93b20faa1400eed2f190f78b704dbdfe2cac8fc2d883c0b47f3474cdec2fd68dd4819c37c7c3eae5de7382d5f0cb5bba0788713b420ae6e04a6fc33c6484ec8494baf68e7aa712cc907526d4feb2a732e3bf2628bd705066dcc35601d81809087fff39a002d86317b8d10725a1efb5c0cb8c8a60f86915986cf11b01d48dfee9a0f22568e3947a0bd579bd1144d7ac7c2432e6f6f23c81e3c97ff903a8b914ea74dc950fcbc53f823664e939ebeff71ac2f4ca703000deed5bd778b3902e7ee0fccf7c8d0e7ea1bfc6742408a0a612911f670badc6c529a700686f6b268003e68dccae9193ca6ce990336ded99f17257eec6aff2aded1e80c66f50164cdc6e02c974e61090c651f64acc38a7a41ac81d9ac089c53f7be49ccce5b0d9cc8029426476db352edf8a7d40995f2a82c0c3228dec6c151322dd42a9fd6139f01572e56433c98eb7152812a49be5949d9943f1ee20e8290f29750313771023975d9c9ba3d56c76580ed52c940c12e6d8bc8d2884b5f840470bce656c85fbda79338929ee7dcfa384832fcaf3f7d5a9e271a93394804826b0a7de9b38f5525a72603c9f2d1cb598f4ea07eb101a3310fbbfc0bcd42bbae3f88d8eced323be3234eb23b5289f92d63aa6526109483cbf31d9e7fdf2e04e7e336ab7d86709e1894cd591c31a94e68abe1e4bcd99bc2f16a9d6d3ba0238643818e9a32e22dafdf7e85bbf98d2cbf33918dde705804002e40338b0f90e8c53b5a741f1053d9aa303f319ab9737e4584c3bd4094e822986feec677c76af6072faaba686f72b6ca779c44493d95a052c69f24f1b04dd56c03b82e1f08a18cd57b20e23310d8c68c5426dbb25d7b3fdcafc39fdfc76a40b029071555bc938339844fa18c3445108d9ff16bf3a51ba10fdb01421f19cd8ef5bec95d4fd80a26fa901be6b636a3ac7344a3edef63dfe8b1ec2ddc3647f006fda511d19a3205e434573195550e4ae661c0b28f4c830bc0dcbbdcc6b95479fda495011eabbe"}) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') ioctl$BLKTRACESTOP(r3, 0x1275, 0x0) preadv(r4, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r4, 0x0, 0x0) getpeername$netlink(r4, &(0x7f0000001740), &(0x7f0000001780)=0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:03:08 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='e\x90t3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8c08fd81ce034127daea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c887addad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c1", 0x5d, 0x400}], 0x0, 0x0) 17:03:08 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x9) r1 = socket(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000034c0)={@local, @mcast2, @empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x206}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000640), &(0x7f0000000680)=0x8) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)=ANY=[@ANYRES16=r2, @ANYBLOB="00082dbd7000ffdbdf250b000000b000010024000200080004000500000008000400e500000008000100070000000800040002000000080003000100008008000300000000001c000200080003004f92000008000400ff0f0000080001001c000000100001007564703a73797a3100000000100001007564703a73797a31000000003c00020008000200648b1dd2080003001e000000080004001f00000008000300080000000800040001010000080001000200000008000400200000002400090008000200030000000800020000000100080002000000000008000100060000008c0004001400010062726f6164636173742d6c696e6b00001400010062726f6164636173742d6c696e6b000054000700080004000010000008000200010400000800030007000000080004000700000008000200ff01000008000100090000000800020001000000080001000a0000000800020003000000080004008f0000000c00010073797a30000000002c0007000c00040004000000000000000c0004000900000000000000080002004a9a00000800020000100000d40004001400010062726f6164636173742d6c696e6b00000c00010073797a30000000000c00070008000200000000001400010062726f6164636173742d6c696e6b00002400070008000100020000000800030008000000080004003f00000008000400050000000c00010073797a30000000002c0007000800020005000000080001001d00000008000300010000000800010011000000080003000500000014000700080004008000000008000300040000000c00010073797a30000000001400010062726f6164636173742d6c696e6b0000d4000400240007000800040006000000080001000b000000080003001c05000008000300090000000c00010073797a30000000000c00010073797a31000000002c000700080001000200000008000200a90000000800010017000000080001000f00000008000300018000005400070008000400000000000800030000040000080003000002000008000400080000000800040008000000080001001a00000008000300720c00000800020004000000080002000100000008000300ff0000001400010062726f6164636173742d6c696e6b0000b00001000800030000040000080003000200000008000300040000001c00020008000400fbffffff080003000100000008000200ff00000044000400200001000a004e24000000009635bfaa487f4c9defbd134edaf65ca804000000200002000a004e2300000ebf00000000000000000000000000000000050000003400020008000200ffff0000080004000800000008000300030000000800010020000000080004000400"], 0x2}}, 0xbd96b9f073d96152) sendmsg$TIPC_NL_BEARER_SET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)={0x164, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_BEARER={0x144, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1f}}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x3, @ipv4={[], [], @empty}, 0x401}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'teql0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @multicast2}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x116, @ipv4={[], [], @loopback}, 0x7}}}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}]}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}]}]}, 0x164}, 0x1, 0x0, 0x0, 0x40}, 0x40000000) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:03:08 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x9) r1 = socket(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000034c0)={@local, @mcast2, @empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x206}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000640), &(0x7f0000000680)=0x8) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)=ANY=[@ANYRES16=r2, @ANYBLOB="00082dbd7000ffdbdf250b000000b000010024000200080004000500000008000400e500000008000100070000000800040002000000080003000100008008000300000000001c000200080003004f92000008000400ff0f0000080001001c000000100001007564703a73797a3100000000100001007564703a73797a31000000003c00020008000200648b1dd2080003001e000000080004001f00000008000300080000000800040001010000080001000200000008000400200000002400090008000200030000000800020000000100080002000000000008000100060000008c0004001400010062726f6164636173742d6c696e6b00001400010062726f6164636173742d6c696e6b000054000700080004000010000008000200010400000800030007000000080004000700000008000200ff01000008000100090000000800020001000000080001000a0000000800020003000000080004008f0000000c00010073797a30000000002c0007000c00040004000000000000000c0004000900000000000000080002004a9a00000800020000100000d40004001400010062726f6164636173742d6c696e6b00000c00010073797a30000000000c00070008000200000000001400010062726f6164636173742d6c696e6b00002400070008000100020000000800030008000000080004003f00000008000400050000000c00010073797a30000000002c0007000800020005000000080001001d00000008000300010000000800010011000000080003000500000014000700080004008000000008000300040000000c00010073797a30000000001400010062726f6164636173742d6c696e6b0000d4000400240007000800040006000000080001000b000000080003001c05000008000300090000000c00010073797a30000000000c00010073797a31000000002c000700080001000200000008000200a90000000800010017000000080001000f00000008000300018000005400070008000400000000000800030000040000080003000002000008000400080000000800040008000000080001001a00000008000300720c00000800020004000000080002000100000008000300ff0000001400010062726f6164636173742d6c696e6b0000b00001000800030000040000080003000200000008000300040000001c00020008000400fbffffff080003000100000008000200ff00000044000400200001000a004e24000000009635bfaa487f4c9defbd134edaf65ca804000000200002000a004e2300000ebf00000000000000000000000000000000050000003400020008000200ffff0000080004000800000008000300030000000800010020000000080004000400"], 0x2}}, 0xbd96b9f073d96152) sendmsg$TIPC_NL_BEARER_SET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)={0x164, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_BEARER={0x144, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1f}}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x3, @ipv4={[], [], @empty}, 0x401}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'teql0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @multicast2}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x116, @ipv4={[], [], @loopback}, 0x7}}}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}]}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}]}]}, 0x164}, 0x1, 0x0, 0x0, 0x40}, 0x40000000) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:03:08 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 17:03:08 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f0000000280)=""/37) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 152.389589] binder: 5987:5990 got transaction with too large buffer [ 152.392293] binder: 5988:5994 got transaction with too large buffer [ 152.392329] binder: 5988:5994 transaction failed 29201/-22, size 88-24 line 3493 17:03:08 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a6273000000000000000000000000000000080000000000bca05e5b000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 152.392753] binder: undelivered TRANSACTION_ERROR: 29201 [ 152.406546] binder: 5983:5993 got transaction with too large buffer [ 152.406586] binder: 5983:5993 transaction failed 29201/-22, size 88-24 line 3493 17:03:08 executing program 1: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x2) ioctl$RTC_UIE_OFF(r0, 0x7004) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) [ 152.406891] binder: undelivered TRANSACTION_ERROR: 29201 [ 152.440155] binder: 6006:6007 got transaction with too large buffer 17:03:08 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x200000, 0x0) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f00000002c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 152.440193] binder: 6006:6007 transaction failed 29201/-22, size 88-24 line 3493 [ 152.440333] binder: undelivered TRANSACTION_ERROR: 29201 [ 152.461742] binder: 6006:6009 got transaction with too large buffer 17:03:08 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) setsockopt$inet_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000280)=@gcm_256={{0x303}, "5b0b6d04ad672592", "c30789956bbb13b04652d95808f358781d40b112b885e9149ddd27e494cc0c3c", "433f7a16", "58ff94c9e2dca7d4"}, 0x38) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 152.461784] binder: 6006:6009 transaction failed 29201/-22, size 88-24 line 3493 [ 152.462126] binder: undelivered TRANSACTION_ERROR: 29201 [ 152.536694] binder: 6016:6017 got transaction with invalid offset (24, min 24 max 88) or object. [ 152.536746] binder: 6016:6017 transaction failed 29201/-22, size 88-24 line 3379 [ 152.536914] binder: undelivered TRANSACTION_ERROR: 29201 [ 152.554330] binder: 6016:6019 got transaction with invalid offset (24, min 24 max 88) or object. [ 152.554376] binder: 6016:6019 transaction failed 29201/-22, size 88-24 line 3379 [ 152.554670] binder: undelivered TRANSACTION_ERROR: 29201 [ 152.582166] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 152.582175] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 152.609233] binder: 6026:6029 got transaction with too large buffer [ 152.609274] binder: 6026:6029 transaction failed 29201/-22, size 88-24 line 3493 [ 152.609620] binder: undelivered TRANSACTION_ERROR: 29201 [ 152.617558] binder: 6026:6030 got transaction with too large buffer [ 152.617602] binder: 6026:6030 transaction failed 29201/-22, size 88-24 line 3493 [ 152.617875] binder: undelivered TRANSACTION_ERROR: 29201 [ 152.668152] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 152.668162] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 152.680869] binder: 6033:6037 got transaction with too large buffer [ 152.680912] binder: 6033:6037 transaction failed 29201/-22, size 88-24 line 3493 [ 152.681269] binder: undelivered TRANSACTION_ERROR: 29201 [ 152.909973] binder: 5987:5990 transaction failed 29201/-22, size 88-24 line 3493 [ 152.926639] binder: undelivered TRANSACTION_ERROR: 29201 17:03:11 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:11 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) io_setup(0x11, &(0x7f0000000440)=0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) io_cancel(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0xffff, 0xffffffffffffffff, &(0x7f00000002c0)="1754cb92e84de3f37f0940872ef79105af0fd93ed9e03850d894f169fe5d6c40418aca0b444d7638ce0da831f284549de788487dbbbf79cb6511be54129f7ddd05066f2c2181a8024ea23be17ac47fee0084c2bd5b305dda539a13e47199df94c291bc60131297190812dff825c325b502939a4e9dfd3d1a9c0bbe10b340c92e7f0a9a258658735ddf879358b7430c984b075e8aff1367f6ab06ccacaa8af95b57c8b77aef70cb8694e555421e44369cdabdcabc7543819172b56865562796ae88f03da25d69", 0xc6, 0x91df, 0x0, 0x2, r2}, &(0x7f0000000400)) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:03:11 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) write$P9_RREADLINK(r0, &(0x7f0000000000)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) 17:03:11 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:11 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:11 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x8}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r4, &(0x7f0000000080), 0x1c) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) ioctl$EVIOCGUNIQ(r5, 0x80404508, &(0x7f00000000c0)=""/128) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r6 = socket$unix(0x1, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) fcntl$dupfd(r6, 0x0, 0xffffffffffffffff) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba001000030000000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000f89093ea170b197374b5912ed55f28cb8f9407147b62ec7359abe47b79c70adca3a3479ed87f51e2ea1fabb0b1b13f95fbc4abdbf343a39ae8aff21f9f0ca800f4da99358c5bbee8f61a8d83fce719c0b83e"], 0x28}}, 0x0) r9 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r9, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r9, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000001b80)={{{@in6=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000001c80)=0xe8) sendmsg$nl_route(r9, &(0x7f0000001d40)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000040}, 0xc, &(0x7f0000001d00)={&(0x7f0000001cc0)=@ipv6_deladdr={0x3c, 0x15, 0x20, 0x70bd28, 0x25dfdbfe, {0xa, 0x80, 0x7c5336152cfd69a8, 0x0, r10}, [@IFA_CACHEINFO={0x14, 0x6, {0x8, 0x69a, 0x400, 0x7}}, @IFA_FLAGS={0x8, 0x8, 0x212}, @IFA_FLAGS={0x8, 0x8, 0x200}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x4084) close(r7) [ 155.382976] binder: 6049:6052 got transaction with too large buffer [ 155.395705] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 155.395714] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 155.419907] binder: 6049:6052 transaction failed 29201/-22, size 88-24 line 3493 17:03:11 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x2000000000000054, 0x0, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x2f) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) [ 155.431565] binder: undelivered TRANSACTION_ERROR: 29201 [ 155.441653] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 155.449342] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:03:11 executing program 4: clone(0x1000000000011, &(0x7f0000000140), 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x401000004, &(0x7f0000000440)) r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x0, 0x400000000003) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x1c, 0x0, &(0x7f0000000240)=[@register_looper, @acquire={0x40046305, 0x3}, @clear_death={0x400c630f, 0x1}], 0x4c, 0x0, &(0x7f0000000300)="e7596a7d0b605ad045c9f67073c94bc3794e080308072996197ad11419e535ddb528cb755688b8cba467bb1281f0a610b7ed8484069c33247c3853f1deafd25c59a85fe1d0dfe73d46b3eb9f"}) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000200)=0x0) fcntl$setown(r0, 0x8, r3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x1405) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a62730000000000faffffff3900852a747000000000000000000000006ee600", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 155.862957] audit: type=1400 audit(1574442192.020:14): avc: denied { prog_load } for pid=6079 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 17:03:12 executing program 4: syz_open_dev$binderN(&(0x7f0000000340)='/dev/binder#\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000300)='./file0\x00', 0x80) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0xfffffffffffffeac, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$cgroup_int(r2, &(0x7f00000002c0)=0x8000, 0x12) 17:03:12 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000002c0)={{{@in=@empty, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@loopback}}, &(0x7f00000003c0)=0xe8) ioprio_get$uid(0x3, r2) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f0000000280)={0x7, 0x21, 0x1}, 0x7) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 155.876128] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 155.876137] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:03:12 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000200)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r4, 0x88, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r6, 0x88, 0x0, 0x0, 0x0) openat$cgroup_int(r4, &(0x7f00000000c0)='cgroup.max.descendants\x00', 0x2, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r7, 0x88, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR64=&(0x7f0000000480)=ANY=[@ANYPTR, @ANYPTR=&(0x7f0000000300)=ANY=[@ANYRESDEC=0x0, @ANYRES32=r4, @ANYBLOB="4ff450b773d013a8ce67232782895cb8d1f7d5b06ed7eae825450a0a23151af9246b4a131d9bf7fc0c841ba8942dee13b9d99c38219a80637626248d3742226e689637fed3647bbb6ae1979a9ae27008950e6c0ace3cff016b68a0068451675996cfe1b596e0eb68d7496196677722290ee71fb995025ff56654a5bf11b254cb710f8fa3926fc8c117e3a9352c6b47260275b1e34cae1311d0beeee6ab3c91d242a3e16be02aaddbfdc75fa208bfa4ddd2086da596d697fd0f2a8faecedb84a282ec26b014e0a8af679bf1f55b8a98e0af644cd8cf30ae5555ddf364b1", @ANYRES64=r5, @ANYRESOCT, @ANYPTR64], @ANYPTR64=&(0x7f0000000440)=ANY=[@ANYRESOCT=0x0, @ANYRESDEC=r6, @ANYRES64=r1, @ANYPTR64], @ANYRESDEC=r7], @ANYRES16=r3, @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000010000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r8, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r8, 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r8, 0x7706, &(0x7f0000000240)) [ 155.909986] binder: 6083:6085 got transaction with invalid offset (24, min 24 max 88) or object. [ 155.910025] binder: 6083:6085 transaction failed 29201/-22, size 88-24 line 3379 17:03:12 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 155.910389] binder: undelivered TRANSACTION_ERROR: 29201 [ 155.920564] binder: 6083:6089 got transaction with invalid offset (24, min 24 max 88) or object. [ 155.920606] binder: 6083:6089 transaction failed 29201/-22, size 88-24 line 3379 [ 155.920947] binder: undelivered TRANSACTION_ERROR: 29201 [ 155.968097] binder: 6091:6093 transaction failed 29189/-22, size 88--340 line 3138 [ 155.968585] binder: undelivered TRANSACTION_ERROR: 29189 [ 155.969499] binder: 6091:6093 transaction failed 29189/-22, size 88--340 line 3138 [ 155.970238] binder: undelivered TRANSACTION_ERROR: 29189 [ 156.015040] binder: 6096:6097 got transaction with too large buffer [ 156.015081] binder: 6096:6097 transaction failed 29201/-22, size 88-24 line 3493 [ 156.015318] binder: undelivered TRANSACTION_ERROR: 29201 [ 156.098755] binder: 6101:6102 got transaction with invalid offset (16, min 24 max 88) or object. [ 156.098794] binder: 6101:6102 transaction failed 29201/-22, size 88-24 line 3379 [ 156.116274] binder: undelivered TRANSACTION_ERROR: 29201 [ 156.123825] binder: 6101:6104 got transaction with invalid offset (16, min 24 max 88) or object. [ 156.123865] binder: 6101:6104 transaction failed 29201/-22, size 88-24 line 3379 [ 156.124551] binder: undelivered TRANSACTION_ERROR: 29201 17:03:14 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:14 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) r2 = accept$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @multicast1}, &(0x7f00000002c0)=0x10) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r3, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000340)='net/dev\x00') ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000380)) 17:03:14 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 17:03:14 executing program 2: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 17:03:14 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='\x80\x00\x10\x00\x10', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000340), 0x0, 0x0) r0 = getuid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r1) getgroups(0x1, &(0x7f0000000700)=[r1]) r2 = getgid() lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='system.posix_acl_access\x00', &(0x7f0000000100)={{}, {0x1, 0x1}, [{0x2, 0x2, r0}], {0x4, 0x1}, [{0x8, 0x1, r1}, {0x8, 0x4, r2}], {0x10, 0x1}, {0x20, 0x2}}, 0x3c, 0x1) 17:03:14 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 158.401559] binder: 6119:6126 got transaction with too large buffer [ 158.425870] binder: 6119:6126 transaction failed 29201/-22, size 88-24 line 3493 17:03:14 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[], @ANYPTR=&(0x7f00000001c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 158.456681] binder: undelivered TRANSACTION_ERROR: 29201 [ 158.462608] binder: BINDER_SET_CONTEXT_MGR already set [ 158.462619] binder: 6119:6134 ioctl 40046207 0 returned -16 17:03:14 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000000280)={0x4c0}, 0x8) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x20) getsockopt$EBT_SO_GET_INFO(r2, 0x0, 0x80, &(0x7f0000000340)={'broute\x00'}, &(0x7f00000003c0)=0x78) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r4, 0x88, 0x0, 0x0, 0x0) pipe(&(0x7f00000001c0)) fcntl$notify(r4, 0x402, 0x20) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) dup(r3) openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x24042, 0x0) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000004c0)='\x00\x00\x00\x00\x00\x00\x00q\x86\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0xc6, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="11634840000000000000000000000000002000000000000000000058000000000000001800000000000000478ba45b98771060dc8942d9f6aa02397c1aef3c37ac69ad23a7455f74c5f2add40692c2ab007a5b4b10b5fdef4b8a5f9764d25b67ac9dd9d9b8855f5bda5bdeb50b4edb6f930d01b5f26c6f6b24094027e758867ced440f41bfeab2dc58b2a1b28d82adab810800000000a2dc892cd8fc7d8972254173d2e733c200001733a02bcb3c", @ANYPTR=&(0x7f0000000600)=ANY=[@ANYBLOB="852a62730000000000000000000000000000020000000000852a74a66be538315ca270000000008a5a84f2317d5b3e06f4d8e4ac20fcb712632ac35735b73ad2f0ee689c42886d8bd09634b9da781677327d1ac111a1a74936c7d6222d46517da84005cbab00954bdc", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/147], @ANYBLOB="930000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000ecfffffffa10c41b00"], @ANYPTR=&(0x7f0000000400)=ANY=[@ANYBLOB="69a9550018000d00000000379ce3181a004000000000000062e8de4d78e9b61e5552c10a0449103d7b456cea8e72e27a69d0f4fbc401a0a6cbc48dec5d660000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)={0x164, r5, 0x800, 0x70bd29, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xf3f7}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x81}]}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_TUN_TYPE={0x8}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [], @loopback}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x3}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6f55}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x8, 0xd, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x70, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @multicast2}}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3a}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_WEIGHT={0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffff01}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6f}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xd40}]}]}, 0x164}, 0x1, 0x0, 0x0, 0x4000051}, 0x4008860) 17:03:14 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000140)=""/251) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) [ 158.468095] binder_alloc: 6119: binder_alloc_buf, no vma [ 158.468116] binder: 6119:6134 transaction failed 29189/-3, size 88-24 line 3284 [ 158.502826] binder: BINDER_SET_CONTEXT_MGR already set 17:03:14 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = add_key(0x0, &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="352940c5c8f212ea6fe693cc4723ec", 0xf, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000240)={r1}, 0x0, 0x0, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000280)={r1, 0x71, 0xfa}, &(0x7f00000002c0)={'enc=', 'raw', ' hash=', {'sha256-ssse3\x00'}}, &(0x7f0000000340)="ab16679d87543b93908646d403f5d3c0ff9abbbe45c068053f77a60a671846894e6de5454b5b9bd4d8d5acddb597fbf80686f5cdd9593d31a6a30f6a7f83021c5f35193bffa922f5107b8e203d0de378b3e18b437fe785fc9e6c14ed82eb12c3d9d79faf3bcbdcbf41cf2655d7c3b07764", &(0x7f00000003c0)="696a9be42e46ad9330ed7c0aa14aca4c9c5f648f3dbdd57696e864ee63bdcf06fc485c24083544536cf584451d261ac01b0895060d4fd162d89c8f1523253daf01a6f7a87cd02bd936487d0a137538d7ec99d9646c6639ac3bcf0ad1ab2e29dcf9134cbd583538be0da94a8cae1e4a8d041056fae01322224d5bfb7e22a424399b7ecbd41cfb66b51fa1d2128ca013b383769a2897cd4bb8c4076f394e47b6590ced8c9bfa582f05ffc3feea810de22913b40b7c695d17f9ff232b4ff458e7ab05ee1139abe09e427f9ea349caaddc980b507e63075a9a71a3f9ad6872f5160adb14537a21d11ab754383653a9e712e1a5c233e44052037bc203") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 158.502835] binder: 6138:6141 ioctl 40046207 0 returned -16 [ 158.503112] binder_alloc: 6119: binder_alloc_buf, no vma 17:03:14 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000e2b7f9000000000000000000000000000000000000852a646600", @ANYRES32, @ANYRESDEC], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB="000000008d000000"], 0x0, 0x0, 0x0}) [ 158.503131] binder: 6138:6141 transaction failed 29189/-3, size 88-24 line 3284 [ 158.512589] binder: BINDER_SET_CONTEXT_MGR already set 17:03:14 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) fcntl$addseals(r1, 0x409, 0x3fe364eb3b31ff6b) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 158.512600] binder: 6138:6144 ioctl 40046207 0 returned -16 [ 158.514838] binder_alloc: 6119: binder_alloc_buf, no vma [ 158.514867] binder: 6138:6144 transaction failed 29189/-3, size 88-24 line 3284 [ 158.582626] binder: BINDER_SET_CONTEXT_MGR already set [ 158.582636] binder: 6152:6156 ioctl 40046207 0 returned -16 [ 158.592571] binder_alloc: 6119: binder_alloc_buf, no vma [ 158.592590] binder: 6152:6156 transaction failed 29189/-3, size 5116089176692883456--2567033681757887349 line 3284 [ 158.592960] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 158.592968] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 158.627912] binder: BINDER_SET_CONTEXT_MGR already set [ 158.627923] binder: 6152:6161 ioctl 40046207 0 returned -16 [ 158.692299] binder: BINDER_SET_CONTEXT_MGR already set [ 158.692309] binder: 6164:6165 ioctl 40046207 0 returned -16 [ 158.694321] binder_alloc: 6119: binder_alloc_buf, no vma [ 158.694342] binder: 6164:6165 transaction failed 29189/-3, size 88-24 line 3284 [ 158.706750] binder: BINDER_SET_CONTEXT_MGR already set [ 158.706762] binder: 6164:6165 ioctl 40046207 0 returned -16 [ 158.746486] binder: BINDER_SET_CONTEXT_MGR already set [ 158.746496] binder: 6168:6169 ioctl 40046207 0 returned -16 [ 158.753374] binder_alloc: 6119: binder_alloc_buf, no vma [ 158.753396] binder: 6168:6169 transaction failed 29189/-3, size 88-24 line 3284 [ 158.763012] binder: BINDER_SET_CONTEXT_MGR already set [ 158.763022] binder: 6168:6170 ioctl 40046207 0 returned -16 [ 158.793184] binder: BINDER_SET_CONTEXT_MGR already set [ 158.793194] binder: 6172:6173 ioctl 40046207 0 returned -16 [ 158.797569] binder_alloc: 6119: binder_alloc_buf, no vma [ 158.797591] binder: 6172:6173 transaction failed 29189/-3, size 88-24 line 3284 [ 158.805784] binder: BINDER_SET_CONTEXT_MGR already set [ 158.805794] binder: 6172:6174 ioctl 40046207 0 returned -16 [ 159.043572] binder: undelivered TRANSACTION_ERROR: 29189 [ 159.049254] binder: undelivered TRANSACTION_ERROR: 29189 [ 159.055412] binder: undelivered TRANSACTION_ERROR: 29189 [ 159.061155] binder: undelivered TRANSACTION_ERROR: 29189 [ 159.066976] binder: undelivered TRANSACTION_ERROR: 29189 [ 159.072620] binder: undelivered TRANSACTION_ERROR: 29189 [ 159.078147] binder: undelivered TRANSACTION_ERROR: 29189 [ 159.090285] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 159.097936] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:03:17 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:17 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:03:17 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 17:03:17 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:17 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = socket$inet6(0xa, 0x80401, 0x7) sendto(r1, &(0x7f0000000280)="97d0981a3fe4bb5c6b4d569d17e79f2e571171217b5e1fe95af14abfda16bb8ea0294988bc0d3e085ea2a4a2bbcefe91296f87f5090b2f66e2a943b7fa6dce33d411e6641f18a9948bd736c865fb9e3b444b03efaa664534ff2d5118dd964b22496c431fbcca5fd85054d3844831df60f2301d8edbb7d36196f3bf7cc6986935305d8d4bb6d3a953249d3d711ac5267233103aa698b53d2d8e92f2cb7039db20e314ba5a567d42d61ce3f166b2dc1c8d6a0146fcf94a8c247c573291b0521656", 0xc0, 0x40000, &(0x7f0000000340)=@sco={0x1f, {0x1, 0xed, 0xf7, 0xc0, 0x20, 0x3}}, 0x80) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2ca, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:03:17 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000140)=""/131) sendfile(r0, r0, &(0x7f0000000000), 0x1ff) 17:03:17 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = socket$inet6(0xa, 0x80401, 0x7) sendto(r1, &(0x7f0000000280)="97d0981a3fe4bb5c6b4d569d17e79f2e571171217b5e1fe95af14abfda16bb8ea0294988bc0d3e085ea2a4a2bbcefe91296f87f5090b2f66e2a943b7fa6dce33d411e6641f18a9948bd736c865fb9e3b444b03efaa664534ff2d5118dd964b22496c431fbcca5fd85054d3844831df60f2301d8edbb7d36196f3bf7cc6986935305d8d4bb6d3a953249d3d711ac5267233103aa698b53d2d8e92f2cb7039db20e314ba5a567d42d61ce3f166b2dc1c8d6a0146fcf94a8c247c573291b0521656", 0xc0, 0x40000, &(0x7f0000000340)=@sco={0x1f, {0x1, 0xed, 0xf7, 0xc0, 0x20, 0x3}}, 0x80) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2ca, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 161.423519] binder: 6186:6198 got transaction with too large buffer [ 161.425851] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 161.425859] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:03:17 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x24, 0x0, &(0x7f0000000140)=[@request_death, @register_looper, @clear_death], 0x0, 0x20000000, 0x0}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000500)={'#! ', './file0', [{0x20, 'smackfstransmute'}, {0x20, '\\'}, {0x20, 'vboxnet0'}, {}, {0x20, 'user_id'}, {0x20, '\''}]}, 0x32) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) timer_create(0x0, &(0x7f0000000480)={0x0, 0x32, 0x1, @tid=0xffffffffffffffff}, &(0x7f00000007c0)=0x0) timer_settime(r1, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0xc020660b, 0x0) lstat(0x0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) prctl$PR_SET_UNALIGN(0x6, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r3) perf_event_open(&(0x7f0000000580)={0x0, 0x70, 0x6, 0x3, 0x6, 0x9, 0x0, 0x1, 0x2400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000540), 0xf2d8b275e8d6173b}, 0x0, 0x0, 0x9, 0x7, 0x7, 0x0, 0x62}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x2) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000680)={0x0, 0xffffffffffffffff, 0xfffffffffffffffe, 0x7, 0xfff, 0x4}) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) shutdown(0xffffffffffffffff, 0x1) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0xc) mount$bpf(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='bhf\x00', 0x2096800, &(0x7f00000003c0)={[{@mode={'\x00\x02\x00', 0x3d, 0x8000}}, {@mode={'mode', 0x3d, 0x2}}], [{@euid_lt={'euid<'}}, {@permit_directio='permit_directio'}, {@smackfsdef={'smackfsdef', 0x3d, 'group_id'}}, {@fowner_gt={'fowner>', r2}}, {@uid_lt={'uid<', r5}}, {@smackfstransmute={'smackfstransmute'}}]}) r6 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=@getaddr={0x14, 0x16, 0x200, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", ""]}, 0x7c}, 0x1, 0x0, 0x0, 0x8000}, 0xe000894) [ 161.427247] binder: 6192:6195 got transaction with too large buffer [ 161.427281] binder: 6192:6195 transaction failed 29201/-22, size 714-24 line 3493 [ 161.427664] binder: undelivered TRANSACTION_ERROR: 29201 [ 161.474180] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 161.474189] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 161.493562] binder: 6204:6207 got transaction with too large buffer 17:03:17 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/dev_mcast\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) io_submit(0x0, 0x0, &(0x7f0000000540)) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, &(0x7f0000000040)) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000500)=ANY=[@ANYBLOB="1800004c1f57c21e9ed34809cfed362e6ed1980824ebb21e4c77c6926be0561b4638c1494a3f5d52e70cce8e0d9680d2f61d0442dae69a90b39d8c9aa802a10bfd72c1e7bac849e44d00097cb758d180e03c27b8f87cb6021d2f310e443168054e2af50fa1ff172b0cef21991f680269bc4ca9f6a00d676c13496cecc005a0fa934a7ec3ae59b961835b57d8c9d79c1b88129440f99d33e3af4360f3623351057f04dbc7c8", @ANYRES16=r3], 0x2}}, 0x0) sendmsg$TIPC_NL_NODE_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)={0x80, r3, 0x10, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x3c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_ADDR={0x8}]}, @TIPC_NLA_BEARER={0x30, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @multicast2}}, {0x14, 0x2, @in={0x2, 0x4e20, @loopback}}}}]}]}, 0x80}}, 0x0) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000140), 0xc, &(0x7f00000001c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="c0000000", @ANYRES16=r3, @ANYBLOB="00000000000000000000160000004c0004000c005f8f241601001b0000001c0007000800828e7da1145b03c203000800000008000300010000001400010062726f6164636173742d6c696e6b000042340e4373797a3100000000240002000800010001000000080001000600000008000100ff0000000400040004000400380002000800010003000000080001003b000000040004000400040004000400080002000000000008000200090000000800010000020000ce643e798e35bc8d0b5aef43ceb93701000000fe4649e48ff7ecb775bf8fa5c82c93462fde083dd4acf2130978e03eb7dee45db9"], 0xc0}, 0x1, 0x0, 0x0, 0x80}, 0x40000) ioctl$TUNSETGROUP(r2, 0x400454ce, 0x0) r4 = syz_open_pts(r1, 0x4000000000000002) sendfile(r4, r0, 0x0, 0x6f0a77bd) r5 = syz_open_procfs(0x0, &(0x7f0000000200)='net/igmp\x00') ioctl$TIOCSERGETLSR(r5, 0x5459, &(0x7f00000000c0)) openat$ppp(0xffffffffffffff9c, 0x0, 0x400, 0x0) [ 161.493597] binder: 6204:6207 transaction failed 29201/-22, size 714-24 line 3493 [ 161.493887] binder: undelivered TRANSACTION_ERROR: 29201 [ 161.543070] binder: 6210:6214 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 161.543080] binder: 6210:6214 ERROR: BC_REGISTER_LOOPER called without request [ 161.543087] binder: 6210:6214 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 17:03:17 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = pkey_alloc(0x0, 0x3) pkey_mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x9, r1) pkey_mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000, r1) getsockopt$inet6_buf(r0, 0x88, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x7f, 0x8, 0x9, 0x7ff, 0x3ff, 0xa0bd}) 17:03:17 executing program 4: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x8000, 0x0) sendto$unix(r0, &(0x7f00000001c0)="6be9e9bbb2cdf6898798a4703034e9210d3ac0f572ba74e3d24bf4f64b9de9c5124a0f15f8431193392a1bc692c009a239fad83e315437e082d71057225f805ece574432ab61912fb58e47483879f166c931206a834d9f90a9e3118b8dfdd540468440295ffd46c6ac9b4807edc9520e7645ef1cd75e207c57639eb53b36560db2d0916d5dedd2740a5c36d64f775a604463d031b2622a225df815b96b0eeb34424d91e9ef2b099c02c39882", 0xac, 0x40020, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e22}, 0x6e) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) recvfrom(r2, &(0x7f00000004c0)=""/188, 0xbc, 0x40, &(0x7f0000000580)=@pppol2tpv3in6={0x18, 0x1, {0x0, r3, 0x0, 0x3, 0x4, 0x4, {0xa, 0x4e24, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8}}}, 0x80) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@request_death={0x400c630e, 0x5}], 0xfffffc4e, 0x0, 0x0}) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x7) timer_create(0x0, &(0x7f0000000300)={0x0, 0x17, 0x0, @thr={&(0x7f0000000340)="bcf4c19e8c14f2b8acf924f7e588aa37f8e8d8208b14b96642f894f8feda66c6fb58dceb404275c1491f72c6901ce58f9ed427547dbc21dacda44b956f74aa25d9a0e93ba2dd4c0ef344b78c35cad2a824c283adbb60ebef95f98bbaf2991eeb29bce579cc2d860989ffb1bc3c65b1ca04154891d0f07e07430c678fc9e5ee0a4238ab95dcc4d8f9f8e439ec7670628c68b65262806c210c9d66811f3f280709a2b308b82a6846c43d7ad30c0dbf2218", &(0x7f0000000400)="d09da8167e0db9d50914127d2219ee66648e4b979124deff59898051aecf27d03f776ca3e37dfc7e586b420e3ea423eda869b92b980c9afe0b3dbea43a3af11222ebf32190b92374cf83c8feecdf9d85d01c884ac6952c258a6f3fc9e2ed771c3b56f12569813c8971049cebd246e0a070c1e775ad5e985952fb0e5e2c82c5808181bb6c7dd0a531fb06b40780e60d9ed525bf2af81c32b9dc27bb88c42f7f6469ab996192f33d8a528b0dffcd2d0689"}}, &(0x7f00000002c0)=0x0) timer_settime(r6, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) timer_getoverrun(r6) timer_settime(r6, 0x0, &(0x7f0000000280), 0x0) [ 161.758581] binder: 6186:6198 transaction failed 29201/-22, size 88-24 line 3493 [ 161.787273] binder: undelivered TRANSACTION_ERROR: 29201 17:03:18 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 161.852698] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 161.863787] binder: 6229:6231 BC_REQUEST_DEATH_NOTIFICATION invalid ref 5 [ 161.863797] binder: 6229:6231 unknown command 0 [ 161.863804] binder: 6229:6231 ioctl c0306201 20000180 returned -22 [ 161.938933] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 162.010185] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 162.021447] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:03:20 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:20 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, @perf_bp={&(0x7f0000000180), 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xa, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) io_submit(0x0, 0x0, 0x0) write(r2, &(0x7f0000000100)="6ae8e82e42f8a61e", 0x8) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x0) r4 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r4, 0x800002, 0x0) ioctl$EXT4_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000001c0)) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYBLOB="000e6dc95336cbdcf4a41540dd8376d5e035ecb526317facb73644584a978bf8ba7dce77ca4479db5145be40dc0098688f727069fa08a335ef310eabdf0b624eae624438c2e8678853b21943efaff1a9269e99cbd7ef790f80b3357a58d4859c6ebab5f1b4296ef6694768f38716228df79c54bc233c5158d279e25d5fcd63115fdf47325bfde12df3fad26193fb950ed34953dfdbd2e65e5d43fd0f71d3e24923c191d8f131baafd8471c698acc15e3c38c6010573ccec0af557763c1bcf98fe3dc5d1fcdb837eb3f408a33eee257afbbd2d0823e800ffd53c1fffa48f57dab1964574354f1df67e7626b1813c733f6bab0dd78f13b8405c073b79dbdb3e897bf6f608199106272da648b60500944c853b8c29a22f461c9e7bd39a54b749775d14823f63c1dc0b37593750c7713721d75fe444c7522d2d4b0b0564ccacdcf4cf0a50e4171f86c788be448d66ee5d2e3364f8ed3ee0ea6fa12f6acf7f569aa0fc32376ad22046524dd9918ea5b4fb45296c3910e95b3e58906b81686e536f7ac9c687b86b594b94b7b9fcbf96fde99c168d000"], 0x2) fallocate(r4, 0x3, 0x0, 0x8020003) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000200)="e5"}], 0x1) lseek(r4, 0x0, 0x3) ioctl$TCGETX(0xffffffffffffffff, 0x5432, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='net/arp\x00') bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0xba, @remote, 0x120}, 0x1c) 17:03:20 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018010000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:03:20 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) write$P9_RATTACH(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x69, 0x2, {0x81, 0x4, 0x3}}, 0x14) 17:03:20 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x40000, 0x0) ioctl$RTC_VL_CLR(r0, 0x7014) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) 17:03:20 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 164.445577] binder: 6250:6253 got transaction with invalid offset (280, min 24 max 88) or object. [ 164.468249] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 164.468256] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 164.521551] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem 17:03:20 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0xfffffffffffffffe, 0x50, &(0x7f0000000000)=[{&(0x7f0000000200)="8d72d5734fae297110ab2c7f15fcf6c9967ff860b6b69718fba1a605202fc0c7b97ed2a6c5534a9c1519110ea1eb52a1fcd8740f4c5427c6e4e41786efffd65b3c8144fbb159d73c48602575e2a6ce9dbe971944b467abbc4ba813eef632e8bcb394213f8f64301c677ec47382542f2190cdfdbad860ea528bf7175d16911cdb024815852a8c799b3470e50c7794dd7ae41e5a42a267730ee3c68031a2ee8c2ea4fbb7487a4096e527f25fa25f5c528d11f655a057282470fa2a09b58afb29c74c28e689b05d4b758812a8fd9cefe03a85e5a42d477f70a576a0d5a0e1c6b16afbc988698aaa14b9fa9b14b4b7b8e45319cc8ebd77d8", 0x107, 0x7f}, {&(0x7f0000000440)="f660cd04480d941050d2ca00d980ce92d91ba52dda71081ba78eb7d27a3581a1922ada75e70e3d7cee3eff52f2cb1412c55c267e0cf2e5d45a3519cf12feea3c99bf6d2fd9e82e1b8a4300a8b002d95812b2abaf2f37ba6ce903657ca8bee570a9dca6f0d615d5632d9e3004311367e20be124de19af2dca5b8df9b6ba790c7eed4940341503eec4cc3a68838521f77e160567b6f741ea3dbf8e868910a98be70c4c0e87906d3583003c10745f6eb54ab042cf0f00000000000000", 0x0, 0x4}], 0x0, 0x0) 17:03:20 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, @perf_bp={&(0x7f0000000180), 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xa, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) io_submit(0x0, 0x0, 0x0) write(r2, &(0x7f0000000100)="6ae8e82e42f8a61e", 0x8) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x0) r4 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r4, 0x800002, 0x0) ioctl$EXT4_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000001c0)) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYBLOB="000e6dc95336cbdcf4a41540dd8376d5e035ecb526317facb73644584a978bf8ba7dce77ca4479db5145be40dc0098688f727069fa08a335ef310eabdf0b624eae624438c2e8678853b21943efaff1a9269e99cbd7ef790f80b3357a58d4859c6ebab5f1b4296ef6694768f38716228df79c54bc233c5158d279e25d5fcd63115fdf47325bfde12df3fad26193fb950ed34953dfdbd2e65e5d43fd0f71d3e24923c191d8f131baafd8471c698acc15e3c38c6010573ccec0af557763c1bcf98fe3dc5d1fcdb837eb3f408a33eee257afbbd2d0823e800ffd53c1fffa48f57dab1964574354f1df67e7626b1813c733f6bab0dd78f13b8405c073b79dbdb3e897bf6f608199106272da648b60500944c853b8c29a22f461c9e7bd39a54b749775d14823f63c1dc0b37593750c7713721d75fe444c7522d2d4b0b0564ccacdcf4cf0a50e4171f86c788be448d66ee5d2e3364f8ed3ee0ea6fa12f6acf7f569aa0fc32376ad22046524dd9918ea5b4fb45296c3910e95b3e58906b81686e536f7ac9c687b86b594b94b7b9fcbf96fde99c168d000"], 0x2) fallocate(r4, 0x3, 0x0, 0x8020003) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000200)="e5"}], 0x1) lseek(r4, 0x0, 0x3) ioctl$TCGETX(0xffffffffffffffff, 0x5432, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='net/arp\x00') bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0xba, @remote, 0x120}, 0x1c) [ 164.521560] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:03:20 executing program 1: r0 = inotify_init1(0x80000) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000000)={r1, 0x0, 0x7fff, 0x9c, 0xffffffff7fffffff}) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) [ 164.682445] binder: 6250:6253 transaction failed 29201/-22, size 88-24 line 3379 [ 164.724742] binder: undelivered TRANSACTION_ERROR: 29201 [ 164.741211] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem 17:03:20 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) r2 = inotify_init() fcntl$setflags(r2, 0x2, 0x2) r3 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x5617aa4c21cdb7e5) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r4, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r4, 0x0, 0x0) ioctl$EVIOCSREP(r4, 0x40084503, &(0x7f0000000300)=[0x4, 0x2]) sendfile(r1, r3, &(0x7f00000002c0)=0x94a, 0x2) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000000000f5ff07000000000000852a547000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 164.752474] binder: 6250:6287 got transaction with invalid offset (280, min 24 max 88) or object. 17:03:21 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, @perf_bp={&(0x7f0000000180), 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xa, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) io_submit(0x0, 0x0, 0x0) write(r2, &(0x7f0000000100)="6ae8e82e42f8a61e", 0x8) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x0) r4 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r4, 0x800002, 0x0) ioctl$EXT4_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000001c0)) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYBLOB="000e6dc95336cbdcf4a41540dd8376d5e035ecb526317facb73644584a978bf8ba7dce77ca4479db5145be40dc0098688f727069fa08a335ef310eabdf0b624eae624438c2e8678853b21943efaff1a9269e99cbd7ef790f80b3357a58d4859c6ebab5f1b4296ef6694768f38716228df79c54bc233c5158d279e25d5fcd63115fdf47325bfde12df3fad26193fb950ed34953dfdbd2e65e5d43fd0f71d3e24923c191d8f131baafd8471c698acc15e3c38c6010573ccec0af557763c1bcf98fe3dc5d1fcdb837eb3f408a33eee257afbbd2d0823e800ffd53c1fffa48f57dab1964574354f1df67e7626b1813c733f6bab0dd78f13b8405c073b79dbdb3e897bf6f608199106272da648b60500944c853b8c29a22f461c9e7bd39a54b749775d14823f63c1dc0b37593750c7713721d75fe444c7522d2d4b0b0564ccacdcf4cf0a50e4171f86c788be448d66ee5d2e3364f8ed3ee0ea6fa12f6acf7f569aa0fc32376ad22046524dd9918ea5b4fb45296c3910e95b3e58906b81686e536f7ac9c687b86b594b94b7b9fcbf96fde99c168d000"], 0x2) fallocate(r4, 0x3, 0x0, 0x8020003) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000200)="e5"}], 0x1) lseek(r4, 0x0, 0x3) ioctl$TCGETX(0xffffffffffffffff, 0x5432, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='net/arp\x00') bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0xba, @remote, 0x120}, 0x1c) [ 164.752517] binder: 6250:6287 transaction failed 29201/-22, size 88-24 line 3379 [ 164.752898] binder: undelivered TRANSACTION_ERROR: 29201 [ 164.944075] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:03:21 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x9) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000280)={0xffffffffffffffff}, 0x100800) ioctl$KDSETLED(r2, 0x4b32, 0x0) [ 165.035468] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 165.074603] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 165.079643] binder_alloc: 6306: binder_alloc_buf, no vma [ 165.079662] binder: 6306:6309 transaction failed 29189/-3, size 88-24 line 3284 [ 165.080233] binder: undelivered TRANSACTION_ERROR: 29189 [ 165.171289] binder_alloc: 6306: binder_alloc_buf, no vma [ 165.171312] binder: 6306:6314 transaction failed 29189/-3, size 88-24 line 3284 [ 165.171765] binder: undelivered TRANSACTION_ERROR: 29189 [ 167.055192] binder: 6551:6553 got transaction with too large buffer [ 167.061755] binder: 6551:6553 transaction failed 29201/-22, size 88-24 line 3493 [ 167.070957] binder: undelivered TRANSACTION_ERROR: 29201 17:03:23 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:23 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:23 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}) 17:03:23 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, @perf_bp={&(0x7f0000000180), 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xa, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) io_submit(0x0, 0x0, 0x0) write(r2, &(0x7f0000000100)="6ae8e82e42f8a61e", 0x8) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x0) r4 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r4, 0x800002, 0x0) ioctl$EXT4_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000001c0)) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYBLOB="000e6dc95336cbdcf4a41540dd8376d5e035ecb526317facb73644584a978bf8ba7dce77ca4479db5145be40dc0098688f727069fa08a335ef310eabdf0b624eae624438c2e8678853b21943efaff1a9269e99cbd7ef790f80b3357a58d4859c6ebab5f1b4296ef6694768f38716228df79c54bc233c5158d279e25d5fcd63115fdf47325bfde12df3fad26193fb950ed34953dfdbd2e65e5d43fd0f71d3e24923c191d8f131baafd8471c698acc15e3c38c6010573ccec0af557763c1bcf98fe3dc5d1fcdb837eb3f408a33eee257afbbd2d0823e800ffd53c1fffa48f57dab1964574354f1df67e7626b1813c733f6bab0dd78f13b8405c073b79dbdb3e897bf6f608199106272da648b60500944c853b8c29a22f461c9e7bd39a54b749775d14823f63c1dc0b37593750c7713721d75fe444c7522d2d4b0b0564ccacdcf4cf0a50e4171f86c788be448d66ee5d2e3364f8ed3ee0ea6fa12f6acf7f569aa0fc32376ad22046524dd9918ea5b4fb45296c3910e95b3e58906b81686e536f7ac9c687b86b594b94b7b9fcbf96fde99c168d000"], 0x2) fallocate(r4, 0x3, 0x0, 0x8020003) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000200)="e5"}], 0x1) lseek(r4, 0x0, 0x3) ioctl$TCGETX(0xffffffffffffffff, 0x5432, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='net/arp\x00') bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0xba, @remote, 0x120}, 0x1c) 17:03:23 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x234, 0x400}], 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000080)='msdos\x00', &(0x7f0000000140)='./file0\x00', 0x5, 0x5, &(0x7f00000004c0)=[{&(0x7f0000000180)="3214d5c948866f30d5924efc3b0fe6697a1df5b0a841d3a4e77ff472d752ef6637e702946f13b6f09592c98665e358c3e39622e581d74c90201dbdb073184de343ee8484395d07f7abe80dc1e383fa0b1a54421f5435444d5348", 0x5a, 0xfffffffffffffffb}, {&(0x7f0000000200)="b8787be4f56ba1d1c90aaaf1bcb2f06148c285789b575a7e97fe30e6f9abed2a5ceda3c05c9dd3093511db3a9a9c91c83176d01664d638ef8d7fda1ec48417d2b84a6bf747e85312f7fd5d25985fa76e089a02a37c997695b8e80eafe6942c6c32bdb1d13b0a96c6e662de2416c08c827827d8448aab009ef8f532b103afa72dc6e947570b2088ff780cc63a346748207fdfe473df58bca0a177166f6d482f4581c6668c98ac65b7c084d9b1d5dcbae0769dabb1b0103886167d12a41e8097f7581b05278f6fe13b8a70ae5a36c4fd65ac19587482bf441580aefcc8f06c152e1516ad63ae4332d503a179278353d3d235485a3df6d0", 0xf6, 0x2}, {&(0x7f0000000380)="8c30ee0cea48be85fc165a41a40788c996f8fa01c28d21207f9dcf57e0ad53d821391cd8f5a0dc593d984b80138d09f05f10978e1bf153bc4b6e8c61134e9e564518ffb091145585ae61f6479121f31db5e986f70bf214b85f6691d3cffef1a423ff38b4cdf416578226d39382eb7866f996a3e9bcaaaa5c92d75e38a91e5f486777b4a0525ec62808be9a8f268b2ffab6d92287797b433becf3bbf7bc2e4c25175438a82a90dc42ca1d41e7b56db76f52aa7c9ad29524d91690d5a138c7699be5b50722635a", 0xc6, 0x5}, {&(0x7f0000000300)="275a74372f1775b251e85d9294974b333589915604368b7636d9b7313987e5be7058e973b67b150205960c", 0x2b, 0x4}, {&(0x7f0000000480)="81b567a99b7ecfca6dcb62", 0xb, 0xfffffffffffffffa}], 0x40000, &(0x7f0000000540)={[{@dots='dots'}, {@fat=@check_relaxed='check=relaxed'}], [{@context={'context', 0x3d, 'user_u'}}]}) r0 = openat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0x8800, 0x24) write$uinput_user_dev(r0, &(0x7f00000005c0)={'syz1\x00', {0x5, 0xf21f, 0x6, 0x7fff}, 0x13, [0x4, 0xff, 0x17e0, 0xd0, 0x7b7bd33c, 0x100, 0x6b, 0x9, 0x0, 0x8, 0x7, 0x9, 0x7f, 0x2, 0x1000, 0x4, 0x6, 0xe2f, 0x0, 0x3e, 0x6, 0x2, 0x5, 0x0, 0x7a, 0x25, 0xae2, 0xa30, 0x8001, 0x7, 0x6, 0xb7f, 0x10000, 0x80, 0x200, 0xc09e, 0x7fffffff, 0x3, 0x401, 0x8, 0x4, 0x6, 0x1f, 0x7, 0xb734, 0x8001, 0x1, 0xfa5d, 0x7, 0x6, 0x1, 0x7, 0x10000, 0x6, 0x2, 0x7fffffff, 0x1, 0x6, 0xff, 0x4, 0x20, 0x8, 0x1, 0x7f], [0x3, 0xd9c7, 0x40, 0x5, 0x7, 0x401, 0x7ff, 0x7, 0x2, 0x7, 0x41a, 0x4, 0x401, 0x8000, 0x80000000, 0x2, 0x7ff, 0x7f, 0x3db6, 0x0, 0x5, 0x1, 0x2, 0x2, 0x81, 0xffffffe0, 0xd3c, 0xfe, 0x7fffffff, 0xc07, 0x1, 0x7fffffff, 0x5, 0x9, 0x0, 0xbd, 0x1, 0x5, 0x1020, 0x0, 0xb376, 0x2, 0x1000, 0xa7, 0x800, 0x3, 0x5e08, 0x1f66, 0x1, 0x3, 0x0, 0x9, 0x3, 0x401, 0x8, 0x8, 0x5, 0x7, 0x1, 0x80, 0x4, 0xff, 0x4, 0x67], [0x0, 0xfffffff9, 0x8, 0xfffffffe, 0x7, 0x10001, 0x800, 0x572a, 0xffff, 0x6, 0x8, 0x9, 0xff, 0x0, 0x80000001, 0x1, 0xfe, 0x6, 0x8, 0x77, 0x7c85, 0x7f, 0x3, 0x6, 0x800, 0x100, 0x400000, 0x1000, 0x2, 0x5, 0x3, 0x1, 0x7, 0x1, 0x0, 0x7, 0x1ff, 0x0, 0x6, 0xfffffffc, 0x8, 0x2, 0x8, 0x0, 0x2, 0xfffffff8, 0x6, 0x0, 0x541f, 0xfff, 0x8, 0x434, 0x3856, 0x1, 0x48e, 0xff, 0x2, 0x40, 0x81, 0x500000, 0x400, 0x20000, 0x80000001, 0x7], [0x6, 0xffffffff, 0x4, 0x5, 0x7, 0x4, 0x400, 0x9, 0x5, 0x5, 0x81, 0x73, 0x4, 0x7, 0x4, 0x7, 0x95d8, 0x4, 0x7fffffff, 0x1, 0x3, 0xee54, 0x2, 0x1, 0x0, 0x6, 0x7fff, 0x6, 0x401, 0x1, 0x3, 0x0, 0x7, 0x9, 0x74f4, 0x2, 0x2, 0x80000000, 0x6, 0x101, 0x5, 0x3, 0x80000000, 0x1, 0xfff, 0x0, 0x3, 0x1, 0x6, 0x8001, 0x4, 0x10001, 0x6a1f, 0x9, 0x3, 0x3f, 0x200, 0x7, 0x89b7, 0x8001, 0xb85, 0x27, 0x8, 0x1]}, 0x45c) 17:03:23 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) write$P9_RATTACH(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x69, 0x2, {0x81, 0x4, 0x3}}, 0x14) 17:03:23 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xff4f, 0x0, &(0x7f0000000000)=[@increfs], 0x196, 0x0, 0x0}) 17:03:23 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="00000015d992ef36d4365318000000000400004000000000060000010000994b0c2e7db7e73cfd2907"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 167.463871] binder: 6558:6568 got transaction with too large buffer [ 167.474440] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 167.474449] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:03:23 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r1, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x90202000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, r2, 0x0, 0x70bd29, 0x25dfdbfe, {{}, 0x0, 0xb, 0x0, {0xc, 0x14, 'syz1\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x40003000}, 0x40040800) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 167.481391] binder: 6573:6574 unknown command 0 [ 167.481399] binder: 6573:6574 ioctl c0306201 20000180 returned -22 [ 167.482415] binder: 6573:6575 unknown command 0 [ 167.482423] binder: 6573:6575 ioctl c0306201 20000180 returned -22 [ 167.521306] binder: 6577:6579 got transaction with invalid offset (3958544058539835392, min 0 max 88) or object. 17:03:23 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, @perf_bp={&(0x7f0000000180), 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xa, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) io_submit(0x0, 0x0, 0x0) write(r2, &(0x7f0000000100)="6ae8e82e42f8a61e", 0x8) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x0) r4 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r4, 0x800002, 0x0) ioctl$EXT4_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000001c0)) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYBLOB="000e6dc95336cbdcf4a41540dd8376d5e035ecb526317facb73644584a978bf8ba7dce77ca4479db5145be40dc0098688f727069fa08a335ef310eabdf0b624eae624438c2e8678853b21943efaff1a9269e99cbd7ef790f80b3357a58d4859c6ebab5f1b4296ef6694768f38716228df79c54bc233c5158d279e25d5fcd63115fdf47325bfde12df3fad26193fb950ed34953dfdbd2e65e5d43fd0f71d3e24923c191d8f131baafd8471c698acc15e3c38c6010573ccec0af557763c1bcf98fe3dc5d1fcdb837eb3f408a33eee257afbbd2d0823e800ffd53c1fffa48f57dab1964574354f1df67e7626b1813c733f6bab0dd78f13b8405c073b79dbdb3e897bf6f608199106272da648b60500944c853b8c29a22f461c9e7bd39a54b749775d14823f63c1dc0b37593750c7713721d75fe444c7522d2d4b0b0564ccacdcf4cf0a50e4171f86c788be448d66ee5d2e3364f8ed3ee0ea6fa12f6acf7f569aa0fc32376ad22046524dd9918ea5b4fb45296c3910e95b3e58906b81686e536f7ac9c687b86b594b94b7b9fcbf96fde99c168d000"], 0x2) fallocate(r4, 0x3, 0x0, 0x8020003) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000200)="e5"}], 0x1) lseek(r4, 0x0, 0x3) ioctl$TCGETX(0xffffffffffffffff, 0x5432, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='net/arp\x00') bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0xba, @remote, 0x120}, 0x1c) [ 167.521335] binder: 6577:6579 transaction failed 29201/-22, size 88-24 line 3379 17:03:23 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) [ 167.521574] binder: undelivered TRANSACTION_ERROR: 29201 [ 167.680800] binder: 6558:6568 transaction failed 29201/-22, size 88-24 line 3493 [ 167.685984] binder: 6593:6597 got transaction with too large buffer [ 167.686020] binder: 6593:6597 transaction failed 29201/-22, size 88-24 line 3493 [ 167.686239] binder: undelivered TRANSACTION_ERROR: 29201 17:03:23 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x806) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0, 0x4000010, r2, 0x37848000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 167.746371] binder: 6605:6606 got transaction with fd, -1, but target does not allow fds [ 167.746411] binder: 6605:6606 transaction failed 29201/-1, size 88-24 line 3427 [ 167.746621] binder: undelivered TRANSACTION_ERROR: 29201 [ 167.757955] binder: 6605:6607 got transaction with fd, -1, but target does not allow fds [ 167.757997] binder: 6605:6607 transaction failed 29201/-1, size 88-24 line 3427 [ 167.758658] binder: undelivered TRANSACTION_ERROR: 29201 [ 167.885715] binder: 6609:6613 got transaction with too large buffer [ 167.885751] binder: 6609:6613 transaction failed 29201/-22, size 88-24 line 3493 [ 167.886048] binder: undelivered TRANSACTION_ERROR: 29201 [ 167.896278] binder: 6609:6614 got transaction with too large buffer [ 167.896320] binder: 6609:6614 transaction failed 29201/-22, size 88-24 line 3493 [ 167.896673] binder: undelivered TRANSACTION_ERROR: 29201 [ 168.030496] binder: undelivered TRANSACTION_ERROR: 29201 17:03:26 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:26 executing program 5: r0 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) creat(&(0x7f0000000000)='./bus\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) ftruncate(r1, 0x8200) openat$ashmem(0xffffffffffffff9c, &(0x7f0000002800)='/dev/ashmem\x00', 0x48c880, 0x0) r2 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r2, &(0x7f0000000040), 0x0) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x294ad, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xdf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000008600)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0/file0\x00'}, 0x80, &(0x7f0000007380), 0x0, &(0x7f0000000600)}}], 0x2, 0x0) socketpair$unix(0x1, 0x80000000003, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, 0x0, 0x0) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) getresuid(&(0x7f0000004180), 0x0, 0x0) socket$inet(0x2, 0x4000000805, 0x0) 17:03:26 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) syz_open_dev$binderN(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) lsetxattr$security_evm(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='security.evm\x00', &(0x7f0000000400)=@v1={0x2, "3e6d18a9abd8403fbbe840ecfe37d1b55d590ba8"}, 0x15, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/187, 0xbb, 0x0, 0x33}, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}}], 0x0, 0x0, 0x0}) 17:03:26 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:26 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) write$P9_RATTACH(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x69, 0x2, {0x81, 0x4, 0x3}}, 0x14) 17:03:26 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) r7 = syz_open_procfs(0xffffffffffffffff, 0x0) r8 = syz_genetlink_get_family_id$SEG6(0x0) sendmsg$SEG6_CMD_SET_TUNSRC(r7, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r8, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x1f}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @broadcast}}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000140) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4001}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r8, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRET={0x10, 0x4, [0x2, 0x1, 0x10000]}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) renameat2(r0, &(0x7f0000000000)='./file0/file0\x00', r1, &(0x7f0000000140)='./file0\x00', 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000380)) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:03:26 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) write$P9_RATTACH(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x69, 0x2, {0x81, 0x4, 0x3}}, 0x14) 17:03:26 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 170.467360] binder: 6619:6629 got transaction with too large buffer [ 170.468460] binder: 6620:6627 got transaction with too large buffer [ 170.468499] binder: 6620:6627 transaction failed 29201/-22, size 88-24 line 3493 [ 170.468832] binder: undelivered TRANSACTION_ERROR: 29201 17:03:26 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 170.524086] binder: 6619:6629 transaction failed 29201/-22, size 104-24 line 3493 [ 170.532309] EXT4-fs (loop1): couldn't mount as ext3 due to feature incompatibilities 17:03:26 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:26 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 170.558863] binder: 6635:6644 got transaction with too large buffer 17:03:26 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 170.558916] binder: 6635:6644 transaction failed 29201/-22, size 88-24 line 3493 17:03:26 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000340), 0x108000, 0x0) [ 170.559625] binder: undelivered TRANSACTION_ERROR: 29201 [ 170.630597] binder: 6652:6660 got transaction with too large buffer 17:03:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) io_setup(0x0, 0x0) io_submit(0x0, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000007, 0x10, 0xffffffffffffffff, 0x0) syz_open_dev$rtc(0x0, 0x0, 0x0) munlock(&(0x7f0000704000/0x1000)=nil, 0x1000) [ 170.630636] binder: 6652:6660 transaction failed 29201/-22, size 88-24 line 3493 [ 170.630818] binder: undelivered TRANSACTION_ERROR: 29201 [ 170.639210] EXT4-fs (loop1): couldn't mount as ext3 due to feature incompatibilities [ 170.694335] binder: 6667:6670 got transaction with too large buffer [ 170.694377] binder: 6667:6670 transaction failed 29201/-22, size 88-24 line 3493 [ 170.694810] binder: undelivered TRANSACTION_ERROR: 29201 17:03:27 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 170.836479] binder: undelivered TRANSACTION_ERROR: 29201 [ 170.849994] binder: BINDER_SET_CONTEXT_MGR already set [ 170.850005] binder: 6619:6629 ioctl 40046207 0 returned -16 [ 170.850262] binder_alloc: 6619: binder_alloc_buf, no vma [ 170.850281] binder: 6619:6629 transaction failed 29189/-3, size 104-24 line 3284 [ 170.879347] binder: 6688:6690 got transaction with too large buffer [ 170.879389] binder: 6688:6690 transaction failed 29201/-22, size 88-24 line 3493 [ 170.927251] binder: undelivered TRANSACTION_ERROR: 29201 17:03:27 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:27 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup3(r1, r0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000340)={0x0, 0x2710}, 0x10) 17:03:27 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB="090000000100000062"], 0x0, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) getpeername$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000040)=0x1c) 17:03:27 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) renameat2(r0, &(0x7f0000000000)='./file0/file0\x00', r1, &(0x7f0000000140)='./file0\x00', 0x2) 17:03:27 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:27 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:27 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw6\x00') readv(0xffffffffffffffff, &(0x7f0000002340)=[{0x0}], 0x1) perf_event_open(0x0, 0x0, 0x0, r0, 0x0) open(0x0, 0x4040, 0x0) r1 = perf_event_open(&(0x7f0000000300)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r1) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x10000026f) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) socketpair$unix(0x1, 0x0, 0x0, 0x0) r4 = dup(0xffffffffffffffff) write$input_event(r4, 0x0, 0x0) [ 170.937542] binder: undelivered TRANSACTION_ERROR: 29189 [ 170.969899] binder_alloc: 6696: binder_alloc_buf size 4294967424 failed, no address space [ 170.971818] binder: 6697:6703 got transaction with too large buffer [ 170.971857] binder: 6697:6703 transaction failed 29201/-22, size 88-24 line 3493 [ 170.972258] binder: undelivered TRANSACTION_ERROR: 29201 [ 170.981660] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 170.981667] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 171.000397] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 171.000405] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 171.028380] binder: 6708:6714 got transaction with too large buffer [ 171.028421] binder: 6708:6714 transaction failed 29201/-22, size 88-24 line 3493 [ 171.028662] binder: undelivered TRANSACTION_ERROR: 29201 [ 171.133084] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) [ 171.142489] binder: 6696:6700 transaction failed 29201/-28, size 88-24 line 3284 [ 171.153051] binder: undelivered TRANSACTION_ERROR: 29201 [ 171.158781] binder: BINDER_SET_CONTEXT_MGR already set [ 171.158791] binder: 6696:6715 ioctl 40046207 0 returned -16 17:03:29 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:29 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x88, 0x0, 0x0, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000140), 0x4) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0xa2000, 0x0) socket$netlink(0x10, 0x3, 0xc) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) ioctl$UI_SET_SNDBIT(r1, 0x4004556a, 0x4) 17:03:29 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ion\x00', 0x14582, 0x0) dup(r1) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000058000000000000001800"/52, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:03:29 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:29 executing program 5: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f000018efdc)="1400000052001f0214f9f407000904000a000710", 0x14) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 17:03:29 executing program 5: r0 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) ftruncate(r1, 0x8200) openat$ashmem(0xffffffffffffff9c, &(0x7f0000002800)='/dev/ashmem\x00', 0x48c880, 0x0) r2 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r2, &(0x7f0000000040), 0x0) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x294ad, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xdf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000008600)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) socketpair$unix(0x1, 0x80000000003, 0x0, 0x0) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) getresuid(&(0x7f0000004180), 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) 17:03:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000280)={'ip6tnl0\x00', 0x7}) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000700000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 173.630357] binder: 6734:6737 got transaction with too large buffer [ 173.631389] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem 17:03:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ashmem\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffffffffffd40, 0x0, &(0x7f0000000580)=[@increfs_done, @dead_binder_done, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={@ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/129, 0x0, 0x0, 0x2b}, @fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x6, 0x1, 0x2c}}, &(0x7f0000000540)}, 0x1b3353f1c39708c5}, @register_looper], 0x0, 0x0, 0x0}) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r3, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r4 = accept$packet(r3, &(0x7f0000000280), &(0x7f00000002c0)=0x14) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xc) 17:03:29 executing program 1: openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x2, 0x0) getresuid(&(0x7f0000000300), &(0x7f0000000380), &(0x7f00000003c0)=0x0) syz_mount_image$msdos(&(0x7f0000000240)='msdos\x00', &(0x7f0000000280)='./file0\x00', 0x5, 0x0, &(0x7f00000002c0), 0x800008, &(0x7f0000000400)={[{@nodots='nodots'}], [{@euid_eq={'euid', 0x3d, r0}}]}) openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/context\x00', 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x400401, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000200)={r1, 0x28, &(0x7f00000001c0)}, 0x10) [ 173.631397] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 173.650722] binder_alloc: 6731: binder_alloc_buf size 103079215104 failed, no address space 17:03:29 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)) r0 = syz_open_procfs(0x0, &(0x7f0000000600)='\x00\xaeC\xae\xc4\x05\xa9\xbd~\xfb\x96\xf7\t\b\x00\x00@\xe54\x01\x01\x01\x00w\xa7\x04~\\\xd4Y\x04\xaf^\xc6\xf2\x98\"\xa0\xa1\x04\xaf\x81\x00ov=ie\xf3x\xfe[\x90\xe0\xaft\xafi\xd9\xb2\x96ef\x98XL\xe5\xb0\xc6\xac\xcb\x19\xf2\xba25v\xb2-\xc7g\tM\x04_R\x93\x1be\x8f\xacGxWc\xee[\xc0\xe6\xdc\xcc\x8dT[\x85\xb4\xa4@\t\xb3\x1f\b\x9c\xf9\x8d\x9d\x92YJ$\x89\xaa\xcfQ[?`\xf4\xfeg\xd6\xd9`Hpc\xdc@7N\xf4\xee\xfdQ\x1b\t\x00\x00\x00\xfcJ\x7fKC\xa1[\xe4\xc8f|\xe9\xef|\x1b\xf0d\xf0\x89\x1aM\x8b\xc3I&)\xc1\x8a\xc6\x11\x84&3\x02\x88\x97\xb7\xe3[E\x90\x95=\x8e7\x90\xa8,\x16~\x9c\xa1m\xf4F\xfb\x05\x82\x05\'1Q\xe5s\x8f\x13\xfe\xd3Zw\xf4e\xb9*\xcdgBY\xac\x83\xf8\xf9\xf0\xcc\"\xb4\xf4\xa7\'\x98\x1fg@\xbe|\xa72\xbf\vb\xc8y\x9b{\xfc?\x87\x9e\x16\'\'\xbe\xe6B\x9c\x01k\xe1\xa8\\\n\xcd.\xc14O\n\xd1\x14,\xc5\xa1\x1e\x9a\x03jUr\xca\xdb\x88C\x96\xd1\b+,\x8b\x8fTj\x80\'Q\x14\xa9\'L\x85c\x84P\xb1\xe6#\xba\x11+\xd9~\x13\xd44j\xed\x9b2\xc2\xdcT:\x9e\xa0\xe7\xb2\xf8\xf2\xd5\x96\xbe \xfci\xb9\xfa\x11\a\x15\xeb>rK\xaf\x1e\xcf\x1aI\xceM\x82v\xdd\xe4\xc4\xd1M8\xd9;\xb5\x14@K\x81\xcc\x02x\xc9]e\x96\xd57\be\xe5\x89\x9e\xefs\xe3U\xc7\xa1\xdf\x95\xe1\xf3\x0fM\x87\xb3\xd2)\v@w\x9f2\xbd\x8b!\xa2\xd4gv\xb5s\xf8\xc4\xdb\x87\x95dV\x9bc\xa3\a\x16\xba\xe9m/\x8a\x83\x9c\x84\xbes\xf6\xa4\xfb\xe09\xa6p\xcd\xd4*\xccF\xca\x1e\xacC!x\n!{\xc5oE\x00\xc2\xf6\x1f\xcf]\x891') clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$dupfd(r3, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="14cb365c0f05"], 0x6}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 17:03:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) lsetxattr$trusted_overlay_redirect(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file0\x00', 0x8, 0x0) [ 173.650730] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) [ 173.650751] binder: 6731:6739 transaction failed 29201/-28, size 103079215104-0 line 3284 [ 173.650891] binder: undelivered TRANSACTION_ERROR: 29201 [ 173.653643] binder_alloc: 6731: binder_alloc_buf size 103079215104 failed, no address space [ 173.653653] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) [ 173.653672] binder: 6731:6748 transaction failed 29201/-28, size 103079215104-0 line 3284 [ 173.653917] binder: undelivered TRANSACTION_ERROR: 29201 [ 173.681116] audit: type=1400 audit(1574442209.830:15): avc: denied { create } for pid=6729 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 173.691650] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 173.691659] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 173.699432] binder_alloc: 6752: binder_alloc_buf, no vma [ 173.699450] binder: 6752:6755 transaction failed 29189/-3, size 88-24 line 3284 [ 173.699876] binder: undelivered TRANSACTION_ERROR: 29189 [ 173.772904] FAT-fs (loop1): Unrecognized mount option "euid=00000000000000000000" or missing value [ 173.807630] binder: 6777:6779 got transaction with too large buffer [ 173.807671] binder: 6777:6779 transaction failed 29201/-22, size 88-24 line 3493 [ 173.807919] binder: undelivered TRANSACTION_ERROR: 29201 [ 173.808922] binder: 6777:6781 got transaction with too large buffer [ 173.809024] binder: 6777:6781 transaction failed 29201/-22, size 88-24 line 3493 [ 173.809311] binder: undelivered TRANSACTION_ERROR: 29201 [ 173.824997] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 173.825014] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 173.874735] FAT-fs (loop1): Unrecognized mount option "euid=00000000000000000000" or missing value [ 173.927863] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 173.927873] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 174.037347] binder: 6734:6737 transaction failed 29201/-22, size 88-24 line 3493 [ 174.047816] binder: undelivered TRANSACTION_ERROR: 29201 17:03:32 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:32 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='d\xe5r#\x00\x00\x00\x00\x00\b\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:03:32 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:32 executing program 1: openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/user\x00', 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) 17:03:32 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:32 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 176.641960] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 176.665699] binder: 6799:6807 got transaction with too large buffer 17:03:32 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 176.665739] binder: 6799:6807 transaction failed 29201/-22, size 88-24 line 3493 [ 176.666140] binder: undelivered TRANSACTION_ERROR: 29201 [ 176.704103] binder: 6815:6816 got transaction with too large buffer [ 176.704141] binder: 6815:6816 transaction failed 29201/-22, size 88-24 line 3493 17:03:32 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_procfs(0xffffffffffffffff, 0x0) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000400)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2200032}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x14, r3, 0x100, 0x70bd26, 0x25dfdbfe, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x810}, 0x4c014) sendmsg$NET_DM_CMD_START(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0xa0000004}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r3, 0x4, 0x70bd28, 0x25dfdbff, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x800) sendmsg$NET_DM_CMD_START(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, r3, 0x10, 0x70bd26, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x2000}, 0x40040000) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:03:32 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:32 executing program 5: [ 176.704384] binder: undelivered TRANSACTION_ERROR: 29201 [ 176.751950] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 176.761783] binder: 6819:6820 got transaction with too large buffer 17:03:32 executing program 5: 17:03:33 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 176.761821] binder: 6819:6820 transaction failed 29201/-22, size 88-24 line 3493 [ 176.762822] binder: undelivered TRANSACTION_ERROR: 29201 [ 176.804853] binder: 6822:6823 got transaction with too large buffer [ 176.804892] binder: 6822:6823 transaction failed 29201/-22, size 88-24 line 3493 [ 176.805124] binder: undelivered TRANSACTION_ERROR: 29201 [ 176.824622] audit: type=1400 audit(1574442212.980:16): avc: denied { ioctl } for pid=6822 comm="syz-executor.4" path="socket:[15635]" dev="sockfs" ino=15635 ioctlcmd=0x6201 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 176.825544] binder: 6827:6830 got transaction with too large buffer [ 176.825587] binder: 6827:6830 transaction failed 29201/-22, size 88-24 line 3493 [ 176.825727] binder: undelivered TRANSACTION_ERROR: 29201 [ 176.876356] binder: 6835:6839 got transaction with too large buffer [ 176.876397] binder: 6835:6839 transaction failed 29201/-22, size 88-24 line 3493 [ 176.876547] binder: undelivered TRANSACTION_ERROR: 29201 [ 176.914531] binder: 6835:6840 got transaction with too large buffer [ 176.914573] binder: 6835:6840 transaction failed 29201/-22, size 88-24 line 3493 [ 176.915004] binder: undelivered TRANSACTION_ERROR: 29201 17:03:35 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:35 executing program 5: 17:03:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:35 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:35 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='/dev/binder#\x00', r2}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xfffffffffffffd37, 0x0, &(0x7f0000000500)=[@decrefs={0x40046307, 0x1}, @dead_binder_done, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/229, 0x0, 0x2, 0x29}, @fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r3}}, &(0x7f00000004c0)}, 0x1020}, @acquire_done, @request_death={0x400c630e, 0x2}, @exit_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x1}, @request_death={0x400c630e, 0x3}], 0x0, 0x0, 0x0}) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='westwood\x00', 0x9) write$P9_RSETATTR(r2, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0x7) 17:03:35 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000340), 0x0, 0x0) 17:03:35 executing program 5: 17:03:35 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x54, 0x0, &(0x7f0000000100)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/48, 0x30, 0x1, 0x15}, @flat=@weak_handle={0x77682a85, 0x200, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x40}}}, @request_death], 0x0, 0x0, 0x0}) 17:03:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:35 executing program 5: [ 179.676344] EXT4-fs (loop1): VFS: Can't find ext4 filesystem 17:03:35 executing program 5: 17:03:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 179.736094] binder: 6865:6870 got reply transaction with no transaction stack [ 179.746589] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 179.784846] binder: 6865:6870 transaction failed 29201/-71, size 88-24 line 3046 [ 179.811709] binder: undelivered TRANSACTION_ERROR: 29201 [ 179.827215] binder: 6865:6883 got reply transaction with no transaction stack [ 179.835269] binder: 6865:6883 transaction failed 29201/-71, size 88-24 line 3046 [ 179.845727] binder: undelivered TRANSACTION_ERROR: 29201 17:03:38 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) io_setup(0xfffffffd, &(0x7f0000000240)) 17:03:38 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0xaaaaaaaaaaaac31, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) 17:03:38 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:38 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x1400) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r4, 0x88, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r6, 0x88, 0x0, 0x0, 0x0) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r7, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r7, 0x0, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(r7, 0x5411, &(0x7f0000000000)) r8 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r8, 0x88, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5b, 0x0, &(0x7f0000000440)=ANY=[@ANYRES16=r0, @ANYRES16=r8, @ANYRESOCT, @ANYRES64=r0, @ANYPTR=&(0x7f0000000500)=ANY=[@ANYRES32=r4, @ANYRESOCT=r6, @ANYRES16, @ANYRES32=r5], @ANYRES64, @ANYRES32=r6, @ANYRES32=r4], 0x3ba, 0x0, 0x0}) 17:03:38 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:38 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:38 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xff) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0800b5055e0bcfe87b2071") getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) 17:03:38 executing program 5: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getpid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x4) 17:03:38 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x15) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xd03) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@fda={0x66646185, 0x7, 0x1, 0x26}, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x20, 0x48}}}], 0x0, 0x0, 0x0}) [ 182.693173] binder: 6892:6895 transaction failed 29189/-22, size 88-24 line 3138 [ 182.706468] binder: 6893:6897 unknown command 786435 17:03:38 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 182.706483] binder: 6893:6897 ioctl c0306201 20000180 returned -22 [ 182.764519] binder: undelivered TRANSACTION_ERROR: 29189 [ 182.776990] binder_alloc: 6912: binder_alloc_buf, no vma 17:03:38 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 182.797797] binder: 6912:6914 transaction failed 29189/-3, size 96-24 line 3284 [ 182.798610] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem 17:03:39 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f0000000140)="25bca274769e620aa734fa0095e0612687ecfd125c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df6d675fee2ec922140833e08aa9243a7b57711e9d5b5aaa494780963bac60db266dd263d662f7e687ea501fcea197a08312182611a04d4a6abd29cbce0ed16d45e4bb24c929aa75ef0b02ab28e37961a5008d88a4dd3c4cc00a4eb44dcf4b1f94f03c14cd2fff3aada0", 0xc6, 0x401}], 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r1) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000480)='/dev/uinput\x00', 0x1004, 0x0) ioctl$UI_BEGIN_FF_ERASE(r3, 0xc00c55ca, &(0x7f00000004c0)={0x0, 0xfffffffd, 0xfffff801}) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) fstat(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0}, &(0x7f0000000300)=0xc) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='fuse\x00', 0x4000, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=r1, @ANYBLOB=',gvoup_id=', @ANYRESDEC=r4, @ANYBLOB=',blksize=0x0000000000000800,blMsize00000000c00,max_read=0x0000000100000001,pcr=00000000000000\x0000038,fowner=\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=r5, @ANYBLOB=',\x00']) 17:03:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 182.798619] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 182.817434] binder: 6920:6921 transaction failed 29189/-22, size 88-24 line 3138 [ 182.817657] binder: undelivered TRANSACTION_ERROR: 29189 17:03:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 182.880780] binder: 6922:6925 transaction failed 29189/-22, size 88-24 line 3138 [ 182.881055] binder: undelivered TRANSACTION_ERROR: 29189 [ 182.912305] EXT4-fs (loop1): VFS: Can't find ext4 filesystem 17:03:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:39 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0xfbaef51dba1c1af5, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000280)={r0, &(0x7f0000000180)="42d0f1b3793fb65f8a2b9901de18499e7c1c4e3ef71fe31cda11ba6afc8615bfca098713faab21cfcec8e337c0444fcc1fef6a799ec0cb32f669bde0f2492bc94859510fb37aa40d6b4604eb7a975cd5540749f6c5c233de3de5e892143fa3d7ec1d96c1fab377eb8b8d1c384d781d3070ab3c086c0de11ca849a1695a393059152e302ec8e345f64241e197cf6e82ec0a9c080bdc4da438a7dd03c66926e827ec08287727", &(0x7f0000000240)=""/59, 0x4}, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) setsockopt$packet_int(r2, 0x107, 0x7, &(0x7f0000000300)=0xf1f0, 0x4) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r3, &(0x7f0000000100)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r6, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f00000002c0)={@ipv4={[], [], @rand_addr=0xc6980000}, 0x7b, r6}) [ 182.940780] binder_alloc: 6930: binder_alloc_buf, no vma [ 182.940799] binder: 6930:6933 transaction failed 29189/-3, size 88-24 line 3284 [ 182.941046] binder: undelivered TRANSACTION_ERROR: 29189 [ 182.949431] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 182.986988] binder_alloc: 6938: binder_alloc_buf, no vma [ 182.987007] binder: 6938:6939 transaction failed 29189/-3, size 88-24 line 3284 [ 182.987247] binder: undelivered TRANSACTION_ERROR: 29189 [ 183.044850] binder_alloc: 6944: binder_alloc_buf, no vma [ 183.044869] binder: 6944:6946 transaction failed 29189/-3, size 88-24 line 3284 [ 183.045145] binder: undelivered TRANSACTION_ERROR: 29189 [ 183.072529] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 183.072538] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 183.093682] audit: type=1400 audit(1574442219.240:17): avc: denied { write } for pid=6945 comm="syz-executor.1" name="net" dev="proc" ino=15858 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=dir permissive=1 [ 183.094068] audit: type=1400 audit(1574442219.250:18): avc: denied { add_name } for pid=6945 comm="syz-executor.1" name="pfkey" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=dir permissive=1 [ 183.096330] audit: type=1400 audit(1574442219.250:19): avc: denied { create } for pid=6945 comm="syz-executor.1" name="pfkey" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:insmod_t:s0 tclass=file permissive=1 [ 183.238223] binder: undelivered TRANSACTION_ERROR: 29189 [ 183.244596] binder_alloc: 6912: binder_alloc_buf, no vma [ 183.250158] binder: 6912:6956 transaction failed 29189/-3, size 96-24 line 3284 [ 183.258042] binder: undelivered TRANSACTION_ERROR: 29189 [ 183.334179] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 183.341870] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:03:41 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:41 executing program 2: mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:41 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:41 executing program 5: add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)="05", 0x1, 0xfffffffffffffffb) 17:03:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) getsockopt$inet_tcp_buf(r2, 0x6, 0x1a, &(0x7f0000000380)=""/76, &(0x7f0000000140)=0x4c) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/status\x00', 0x0, 0x0) renameat(r1, &(0x7f00000002c0)='./file0\x00', r3, &(0x7f0000000340)='./file0\x00') ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r6, 0x40086607, &(0x7f00000000c0)=0xfffffffffffff271) getsockopt$inet6_buf(r6, 0x88, 0x0, 0x0, 0x0) r7 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x48, 0x0, &(0x7f0000000500)=ANY=[@ANYRESOCT, @ANYRESOCT=r6, @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYRESHEX=r3], 0x0, 0x0, 0x0}) r8 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r8, 0x88, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r10) getgroups(0x1, &(0x7f0000000700)=[r10]) fchown(r8, r9, r10) 17:03:41 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='\x05\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0xfffffffffffffe6d, 0xfff}], 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r1) setxattr$system_posix_acl(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000180)={{}, {0x1, 0x4}, [{0x2, 0x8, r0}], {0x4, 0xd}, [{0x8, 0x4, r1}], {0x10, 0x1}, {0x20, 0x71d7df8b1bc2fac8}}, 0x34, 0x0) 17:03:41 executing program 5: r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0) fcntl$setlease(r0, 0x400, 0x0) 17:03:41 executing program 2: mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 185.720146] binder: 6968:6971 unknown command 926363952 [ 185.732964] binder: 6968:6971 ioctl c0306201 20000180 returned -22 17:03:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000000000000000000000d25ab8eb2f31046136e89b206102358f0000626b3e1fc2803f3623d4609184383b867892c6a19559e2", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:03:41 executing program 2: mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:42 executing program 2: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 185.807959] binder_alloc: 6989: binder_alloc_buf, no vma [ 185.832858] binder: 6992:6997 got transaction with invalid offset (24, min 24 max 88) or object. [ 185.832898] binder: 6992:6997 transaction failed 29201/-22, size 88-24 line 3379 [ 185.833295] binder: undelivered TRANSACTION_ERROR: 29201 [ 185.905659] binder: 6989:6991 transaction failed 29189/-3, size 88-24 line 3284 [ 185.920646] binder: undelivered TRANSACTION_ERROR: 29189 17:03:44 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:44 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) ioctl$TIOCMGET(r2, 0x5415, &(0x7f0000000280)) 17:03:44 executing program 2: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) getsockopt$inet_tcp_buf(r2, 0x6, 0x1a, &(0x7f0000000380)=""/76, &(0x7f0000000140)=0x4c) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/status\x00', 0x0, 0x0) renameat(r1, &(0x7f00000002c0)='./file0\x00', r3, &(0x7f0000000340)='./file0\x00') ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r6, 0x40086607, &(0x7f00000000c0)=0xfffffffffffff271) getsockopt$inet6_buf(r6, 0x88, 0x0, 0x0, 0x0) r7 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x48, 0x0, &(0x7f0000000500)=ANY=[@ANYRESOCT, @ANYRESOCT=r6, @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYRESHEX=r3], 0x0, 0x0, 0x0}) r8 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r8, 0x88, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r10) getgroups(0x1, &(0x7f0000000700)=[r10]) fchown(r8, r9, r10) 17:03:44 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:44 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0xffff, 0xfffff82b]) 17:03:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:44 executing program 2: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 188.744270] binder: 7018:7026 got transaction with too large buffer [ 188.754704] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 188.754712] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:03:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:44 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 188.758627] binder: 7016:7024 unknown command 926363952 [ 188.758635] binder: 7016:7024 ioctl c0306201 20000180 returned -22 17:03:45 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0xb9f, &(0x7f0000000000)=[{&(0x7f00000004c0)="a2842de124714825ad8cac40691345a7c541a7602d3431d833d1853b377668b8807596f3943f37f887be905d4c290f43d9bfb521e4273b0aab3745f2493ffa4b007d0f7388bf5732c19de9f8effc22bb1c323377fec0d3f8cd1728893e8360bd14c3fa9a5572568daace333cc29004795f7ae1226002e0473993aa8a83c0997c00e14e7d6fd4bde92b573f9aae78f2314f0484bfe2d33640a32d5ef0388c1f1c0c8685744523d2286f4d55fcdb4ffd7613c31735cef3fd707277cbd48af857511676d2927271a379f36a8d0e84b75587a9716775927879ade98ae89869cda7c085786a7359503751628db14910744047df355e13aa69d4638efb4ab261e72afebcae0203598f7ab3ac69e31b01b44b1984212234fa1937be05b35d001cdd2a26f2000000000000000000000000000000000000000000000000000053d9b48738b4f9246a2bb32898c24677160c842a11", 0x150, 0x404}, {&(0x7f0000000240)="492352fa381983d82a316caebf84c40ddc189bc09359d848347ac2a4bacb721c4f26339e40a4b62658069f295f88b48564d3398fac5addf88b48b9e9428030830d8c2915b8b764d9b61f39830d7f76eea94075b3eaaaf8ac803a35b2c38ac201b73baeb6509c98eb69cc1a16ccf57c20daa6e0de1766deef047164d9d3e5a3337c82c7cb1ca85bb58e9fecb7c25ec01f872d18138e210ccfe1e93b163c8ee78efbf1c73371340f86cfdc8a99a3f3f4a71be87cc3ce2dc81ff022a13c0bc53077b58a83df30e3499d23fc2cf65734e1cba6a2b2f44c509b71fe0547d58c2069b76a7e34e1d470363063fdb73fcaa6693871", 0xf1, 0xfff}], 0x0, 0x0) 17:03:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 188.804709] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 188.804719] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 188.806906] binder: 7035:7039 got transaction with too large buffer [ 188.806948] binder: 7035:7039 transaction failed 29201/-22, size 88-24 line 3493 [ 188.807394] binder: undelivered TRANSACTION_ERROR: 29201 [ 188.867915] binder: 7042:7050 got transaction with too large buffer [ 188.867953] binder: 7042:7050 transaction failed 29201/-22, size 88-24 line 3493 [ 188.868249] binder: undelivered TRANSACTION_ERROR: 29201 [ 188.878048] binder_alloc: 7048: binder_alloc_buf, no vma [ 188.878069] binder: 7048:7052 transaction failed 29189/-3, size 88-24 line 3284 [ 188.878330] binder: undelivered TRANSACTION_ERROR: 29189 [ 188.910114] binder: 7053:7057 got transaction with too large buffer [ 188.910157] binder: 7053:7057 transaction failed 29201/-22, size 88-24 line 3493 [ 188.910516] binder: undelivered TRANSACTION_ERROR: 29201 [ 189.021370] binder: 7018:7026 transaction failed 29201/-22, size 88-24 line 3493 [ 189.031305] binder: undelivered TRANSACTION_ERROR: 29201 [ 189.036939] binder: BINDER_SET_CONTEXT_MGR already set [ 189.036949] binder: 7018:7037 ioctl 40046207 0 returned -16 17:03:47 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:47 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:47 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:47 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:47 executing program 1: r0 = add_key(&(0x7f0000000080)='syzkaller\x00', &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000280)="0cf6170dda7545c257c74b1479c27f3c0de4b2beab09e80c01baeada618ebc2404601e694abc86baaf17232414df76937a6134a46dba0d19729e1f9f79244ef6fc8152171544a9ca3c43fb18c703e36153310e99b5f36b0e02a3a8f793", 0x5d, 0xfffffffffffffffa) r1 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/user\x00', 0x2, 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000380)={0xc0a9063, 0x86c8, 0xc142af02aa1f8eaf, 0x7, 0x3, [{0x2, 0x3, 0x0, 0x0, 0x0, 0x623f80bb653a4ba4}, {0x0, 0x4, 0x1000000000000000, 0x0, 0x0, 0x60c}, {0x2, 0x7, 0x1648309e, 0x0, 0x0, 0xc02}]}) keyctl$unlink(0x9, r0, 0xfffffffffffffffb) syz_mount_image$ext4(&(0x7f0000000040)='\xe2\x00\b\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) listxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)=""/161, 0xa1) 17:03:47 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000780)='/selinux/enforce\x00', 0x10000, 0x0) write$P9_RLINK(r2, &(0x7f00000007c0)={0x7, 0x47, 0x1}, 0x7) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000740)='/dev/ppp\x00', 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r3, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r4, 0x88, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r6, 0x88, 0x0, 0x0, 0x0) ppoll(&(0x7f0000000100)=[{r4, 0x40}, {r5, 0x400}, {r3, 0x1000}, {r6, 0x310}], 0x4, &(0x7f0000000140)={0x77359400}, &(0x7f0000000200)={0x50000000000000}, 0x8) r7 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r7, 0x88, 0x0, 0x0, 0x0) fcntl$getownex(r7, 0x10, &(0x7f0000000240)) write$FUSE_OPEN(r3, &(0x7f00000000c0)={0x20, 0x0, 0x5, {0x0, 0x15}}, 0x20) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0xe) r8 = syz_open_dev$binderN(0x0, 0x0, 0x0) r9 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x80000) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000300)=@security={'security\x00', 0xe, 0x4, 0x3d0, 0x0, 0x128, 0x128, 0x128, 0x220, 0x338, 0x338, 0x338, 0x338, 0x338, 0x4, &(0x7f00000002c0), {[{{@ip={@multicast1, @multicast1, 0x1fffffe00, 0x0, 'bond0\x00', 'veth0_to_team\x00', {}, {0x7f}, 0x73, 0x2, 0x159135134b3d4063}, 0x0, 0xc8, 0x128, 0x0, {}, [@common=@inet=@ipcomp={0x30, 'ipcomp\x00', 0x0, {0x4d4, 0x4d5, 0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3ff, [0x62c, 0x4, 0x8, 0xffffffff, 0x80, 0xfffffffb], 0x37, 0x81}, {0x101, [0x3, 0x0, 0x3, 0x9, 0x2, 0x9], 0x3}}}}, {{@uncond, 0x0, 0x98, 0xf8}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x6, [0x7fffffff, 0x3ff, 0x5, 0x1, 0x1, 0xffff], 0x8, 0xa6}, {0x6, [0x3, 0x1000, 0xe6b2, 0x2, 0xab, 0xffffffd9], 0x56, 0xfe}}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x24}, @loopback, 0xffffff00, 0x0, 'team_slave_0\x00', 'vcan0\x00', {}, {}, 0x62, 0x3, 0x2}, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x800, 0x4, 0x1}}, @common=@icmp={0x28, 'icmp\x00', 0x0, {0xf, 0x1, 0x9}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0xff}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x430) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r10 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r10, 0x88, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000005800"/52, @ANYPTR=&(0x7f0000000900)=ANY=[@ANYPTR64=&(0x7f0000000c80)=ANY=[@ANYRES16=0x0, @ANYRES64=r0, @ANYBLOB="8b1b872acb3f37e3eb4efb432bfa339f4bb64f36f01d0fe220bccf86a178c691b28921fd2b1ee9706777e3b30104882c4a657f1bb99ce480a36a297f3b6bdd6d1a4153f7d530bb14690eccca2bce6cdc7724fe232544daab11934d2befa83af127431da8de889ba7bf7ae4ca669781eaa53e71c0b70e8b36a9b9a86790dad0f58e9fe89407d743c04f84044ece9f4dd3ce0f2335168063846399e854dbf6699faf30034f9cb9acd7c27a9e034ec9a48f4d01fca20c277495519c512e3a025809f1512cc4babd63a7fcce7622f9850e43bc20", @ANYRES64, @ANYRESDEC=r0, @ANYPTR, @ANYPTR64=&(0x7f0000000a40)=ANY=[@ANYRES64, @ANYBLOB="2a81d4a669f7e5ad64ba34bec73c47500f4d0194e1ea2e9ade4b0c382d64eee0cd067994a719effdb5b573a764572a1ead5bd4ff74101b7534a41270ac30bc2391de9814a75a437a67f64470f9e3ece8ee5c31572b9300281689caf7704e03f112e785c336086f1d3ab3d12a1947e8a1b5a804e233d50e09205fc909d997f9b7e3f5327ada78c9e7edf4e4b0a539d4521d9e17a731a25a", @ANYPTR, @ANYRESDEC, @ANYRES64=r1, @ANYRESDEC, @ANYRES16], @ANYRESOCT, @ANYRESHEX=0x0, @ANYRES32=r10], @ANYPTR=&(0x7f0000000840)=ANY=[@ANYBLOB='\x00'/177], @ANYBLOB="000000000000000002000000000000001500000000000000852a747000000000", @ANYPTR=&(0x7f0000000980)=ANY=[], @ANYBLOB="a100000000000000fdffffffffffffff0000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:03:47 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 191.760317] binder: 7072:7074 got transaction with too large buffer [ 191.769736] binder: release 7073:7076 transaction 448 out, still active [ 191.769741] binder: undelivered TRANSACTION_COMPLETE 17:03:48 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:48 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000280)={0x0, r1, 0x4, 0x2, 0xa00000000, 0xffffffffffffffc1}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000400)={0x1, &(0x7f00000003c0)=[{0x200, 0x20, 0x80, 0x800}]}, 0x10) setsockopt$inet6_tcp_buf(r1, 0x6, 0x1f, &(0x7f0000000580)="0c71d6f6f70967cf74b1915e78fa6cf2d69aaf0a47519f246b7541172b6c90ced2e5a31da7c8f521f255fbb87278840fe8adb542962ec32d0ff3cdf69898e80f9b40f65bce9dfb6daeeb07c887a3daf4deee3d959349a9549977671a936c28d3574c514d51831ff9686bbfa684546c1e60236a8f55ce6ca2bd16ca1f521c016241c21072be7913f48e194d659c43a827404d300c95b38781e057f1c37f07f433fd3a5d6083627f0d8eb9fe64f02af6c12759e2f0f9d7611538dfe8cd9bcaf95c98dbdcecd21774c787ffb998d03b2fd6af4592563ca129622a0303ed36d4358b84cd8d6704c8fe6f555240ff64c92d89e5f611a2c61c6ac59f7f", 0xfa) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r4, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r4, 0x0, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x54, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="076304400000000012634840020000000000000000000000000000000000000036626605000000000000000050000000000000001800000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB="852a68730a02000000000000000000000000000000000000852a646600000000", @ANYRES32=r5, @ANYBLOB="0000000000000000000000008561646600000000030000000000000000000000000000003200000000000000"], @ANYPTR=&(0x7f00000004c0)=ANY=[@ANYBLOB='\x00'/14], @ANYBLOB="6004000000000000"], 0x43, 0x0, &(0x7f0000000300)="8ddf32654c183ca800ef9ddd482f77d72f4d63d49d55c14a12cdbe72bfb3ac4083682396751db588278edd5e63567f33c27403b5efb78ae67366000000000000000000"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 191.776088] binder_alloc: 7075: binder_alloc_buf, no vma [ 191.776108] binder: 7075:7081 transaction failed 29189/-3, size 88-24 line 3284 [ 191.776380] binder: undelivered TRANSACTION_ERROR: 29189 17:03:48 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:48 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x9) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) ftruncate(r1, 0x40) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/enforce\x00', 0x0, 0x0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f00000002c0)=""/122) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="852a62730000000002000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000220002000000000000000000852a646600000000ea4a010100007c7426070ebaa467555d4347e52d5c1ce5d80e8dbbfebf28a44ddc1570e685527f79f7dba475f2abace3416b34e28e9f02162bfe79a64585863a48932ea33b170a17cbc05c861459ac5bd19aebffe2d36131a05c98a0ff45ba64", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:03:48 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000000140)={{0xa, 0x4e23, 0x3, @rand_addr="c24a77fc7ac0b13bf40b8a56040a6424", 0x5}, {0xa, 0x4e20, 0xd5c, @mcast2, 0x8}, 0x5, [0x7fffffff, 0x401, 0x400, 0x1, 0x0, 0x5d4a5504, 0x7]}, 0x5c) [ 191.806348] binder: send failed reply for transaction 448, target dead [ 191.828919] binder_alloc: 7089: binder_alloc_buf, no vma [ 191.828939] binder: 7089:7091 transaction failed 29189/-3, size 88-24 line 3284 [ 191.829273] binder: undelivered TRANSACTION_ERROR: 29189 [ 191.869294] binder: 7098:7100 transaction failed 29189/-22, size 88-24 line 3138 [ 191.869421] binder: undelivered TRANSACTION_ERROR: 29189 [ 191.885751] binder: 7103:7104 ioctl c028660f 20000280 returned -22 [ 191.887015] binder: 7103:7104 got transaction with too large buffer [ 191.887049] binder: 7103:7104 transaction failed 29201/-22, size 88-24 line 3493 [ 191.887336] binder: undelivered TRANSACTION_ERROR: 29201 [ 191.888143] binder: 7103:7105 ioctl c028660f 20000280 returned -22 [ 191.934323] binder: 7107:7109 transaction failed 29189/-22, size 88-24 line 3138 [ 191.934636] binder: undelivered TRANSACTION_ERROR: 29189 [ 191.949087] binder_alloc: 7111: binder_alloc_buf, no vma [ 191.949104] binder: 7111:7113 transaction failed 29189/-3, size 88-24 line 3284 [ 191.949319] binder: undelivered TRANSACTION_ERROR: 29189 [ 191.951770] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 191.951777] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 191.981178] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 191.981190] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 192.105662] binder: 7072:7074 transaction failed 29201/-22, size 88-24 line 3493 [ 192.121757] binder: undelivered TRANSACTION_ERROR: 29201 17:03:50 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:50 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000140)='cpu.stat\x00', 0x0, 0x0) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000300)='tunl0\x00') r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000080)={0x0, 0xffffffffffffff7c, &(0x7f00000bfff0)={&(0x7f0000006440)=ANY=[@ANYBLOB="b800000019000100000000005b000000ff010000000000000000000000000001e000000100000000800000000000000000000000000000000a0001000000002e", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000fbbccf810000000000000000fd85d16e79bad40ac3794899000000000000000000000000000000d94bfeadbfce0d4ed6f71b242b42000000ea0000000000000000000000000000000000000500000000000000000000000000000000000000e6010000000100000000000000"], 0xb8}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x1000000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0x80fe) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x8) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$KDDISABIO(0xffffffffffffffff, 0x4b37) syz_open_dev$binderN(0x0, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r5, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r5, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x6bc, 0x0, &(0x7f0000000340)=[@acquire_done, @exit_looper, @release={0x40046306, 0x1}, @increfs={0x40046304, 0x1}], 0xfffffffffffffd2a, 0x0, 0x0}) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r5, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={0xec, r6, 0x204, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1000}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xebda}, @IPVS_DEST_ATTR_TUN_TYPE={0x8, 0xd, 0x1}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xc}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x32de}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x7e}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xb0}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x13, 0x6}}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x804}, 0x4010) 17:03:50 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:50 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0xfe24, 0x400}], 0x0, 0x0) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$char_usb(r0, &(0x7f0000000240)="c8d85cd5d46c186ed9af084b0768346ad091ebe2c6985b480073a94a5b7211afafc8a8f758444072e0b99f6233fa4786b0414fa24c30f69dbb67e0834fc402aea57ce25c648fce5fb8f4dd4b5b7880d0b250f5f8a67f4e09544757d39a37e8909e7c29834beb0eb302f2d0303ed25636d602f7d86224ab8427e1ac84ed60ee30153cba7e5a6b177bb159faf98b689438317227b7018e33e1f3641b3db94d7aa10e73b3cadf6183e95aa319d089226b1a07fd4b3899caad0d9ff16c718347e32d99b88733000ffed02ae780e19299cff5cfc0897ba5f23adcf816bfce887a50eb53bc46a39ec5b9ab9103cb922846f25e8b", 0xf1) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000000)) syz_extract_tcp_res(&(0x7f0000000140), 0xd, 0xef81) syslog(0x9, &(0x7f0000000380)=""/4096, 0x1000) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$FUSE_WRITE(r2, &(0x7f0000001380)={0x18, 0xfffffffffffffff5, 0x3, {0x101}}, 0x18) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f0000000180)) 17:03:50 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:50 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 194.788415] binder: 7129:7135 transaction failed 29189/-22, size 88-24 line 3138 [ 194.805836] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem 17:03:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 194.805846] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 194.807599] binder: 7136:7142 got transaction with too large buffer 17:03:51 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) ioctl$PPPIOCSCOMPRESS(r0, 0x4010744d) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x2, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x440, 0x0) 17:03:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x9f823436c2e4c1eb) dup3(r0, r0, 0xc1d04d033bc9adeb) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000280)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000000)={@empty, 0x0, 0x2, 0x0, 0x3, 0x4f, 0x1000}, 0x20) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x40000, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r3, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000100)={0x2c, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x2, 'sh\x00', 0x9, 0x80, 0x62}, 0x2c) ioctl$TIOCGRS485(r2, 0x542e, &(0x7f00000000c0)) socket$inet_udp(0x2, 0x2, 0x0) 17:03:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 194.807638] binder: 7136:7142 transaction failed 29201/-22, size 88-24 line 3493 [ 194.807804] binder: undelivered TRANSACTION_ERROR: 29201 17:03:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 194.845072] audit: type=1400 audit(1574442231.000:20): avc: denied { syslog } for pid=7134 comm="syz-executor.1" capability=34 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability2 permissive=1 [ 194.848205] EXT4-fs (loop1): Unrecognized mount option "<º~Zk{±Yúù‹h”81r'·Ž3áód=¹Mz¡s³ÊßaƒéZ£Љ"kýK8™Ê­ ŸñlqƒGã-" or missing value [ 194.848226] EXT4-fs (loop1): failed to parse options in superblock: <º~Zk{±Yúù‹h”81r'·Ž3áód=¹Mz¡s³ÊßaƒéZ£Љ"kýK8™Ê­ ŸñlqƒGã- [ 194.848239] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 194.848246] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 194.858096] binder: 7146:7150 got transaction with too large buffer [ 194.858233] binder: 7146:7150 transaction failed 29201/-22, size 88-24 line 3493 [ 194.858386] binder: undelivered TRANSACTION_ERROR: 29201 [ 194.976185] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 194.976194] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 195.052491] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 195.052501] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 195.117445] binder: undelivered TRANSACTION_ERROR: 29189 17:03:53 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:53 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:03:53 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:53 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:53 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) keyctl$restrict_keyring(0x1d, 0xfffffffffffffffb, &(0x7f0000000000)='rxrpc\x00', &(0x7f0000000140)='\x00') 17:03:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:53 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:53 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000280), 0x0, 0x0, 0x0}) 17:03:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 197.800181] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem 17:03:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r3, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) write$FUSE_NOTIFY_POLL(r3, &(0x7f0000000000)={0x18, 0x1, 0x0, {0xffffffffffff8000}}, 0xffffffcb) r4 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r4, 0x88, 0x0, 0x0, 0x0) ioctl$FITRIM(r4, 0xc0185879, &(0x7f0000000280)={0x80000000, 0x6, 0x9}) 17:03:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 197.801764] binder: 7190:7191 transaction failed 29189/-22, size 88-24 line 3138 [ 197.802082] binder: undelivered TRANSACTION_ERROR: 29189 [ 197.820256] binder: 7193:7196 got transaction with too large buffer [ 197.820296] binder: 7193:7196 transaction failed 29201/-22, size 88-24 line 3493 [ 197.820458] binder: undelivered TRANSACTION_ERROR: 29201 [ 197.828066] binder: 7202:7204 transaction failed 29189/-22, size 88-24 line 3138 [ 197.828205] binder: undelivered TRANSACTION_ERROR: 29189 [ 197.844740] binder: 7207:7209 unknown command 0 [ 197.844748] binder: 7207:7209 ioctl c0306201 20000180 returned -22 [ 197.845857] binder: 7207:7210 unknown command 0 [ 197.845865] binder: 7207:7210 ioctl c0306201 20000180 returned -22 [ 197.885414] binder: 7211:7212 transaction failed 29189/-22, size 88-24 line 3138 [ 197.885731] binder: undelivered TRANSACTION_ERROR: 29189 [ 197.905509] binder: 7217:7219 got transaction with too large buffer [ 197.905548] binder: 7217:7219 transaction failed 29201/-22, size 88-24 line 3493 [ 197.905871] binder: undelivered TRANSACTION_ERROR: 29201 [ 197.929192] binder_alloc: 7221: binder_alloc_buf, no vma [ 197.929210] binder: 7221:7223 transaction failed 29189/-3, size 88-24 line 3284 [ 197.929533] binder: undelivered TRANSACTION_ERROR: 29189 [ 198.040951] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 198.086270] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 198.094518] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:03:56 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:56 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rtc0\x00', 0x10000, 0x0) writev(r1, &(0x7f00000008c0)=[{&(0x7f0000000300)="6c602ec14bbff3f38bdfae2d248c28fbdc57011e4fb56f6405d51a18e78151304730293f23617f0ea9d6fede997e7f4d69a54166499e235e3a7bc3bf53722fa762e6076a996a5f1cc5066a5004f91fbac9754e8e418398f6a5831cefd8ad80adff4d84fa98d3e8a8f25a30b224c34c9b49fc317d990c77d06b39e4c9ed242336029c2d8f671c5bb6ac64ada66ba45564c6df9801d4", 0x95}, {&(0x7f00000003c0)="7fc80d5ed05b7191f5e981d1142f5a176503e6c3f649422fcd59f2f63087d798c28b22b29db895834fadd2d7db1839ff18bf694bcb98e550c6fc18b26b42ed0398f572490854b15bc85ec739c21799b0641c0d0983a9c69b7e9a098e31d9499a2519b07dfd41ea4bab82bde49ea60874a643d92de07019cd5486228fdbaa6e56c549f26e933a7ff608216eeceee685ab9e4ffa", 0x93}, {&(0x7f0000000480)="c6317a23d5ff2c3a20e594a56a7245d2c1f0beeff8f10f2c578a8f6dbfcd1f341a272f17a5787ae22a69ce5ac7244e51fa64c585accbe2ff2a9df0094c4a92e06e0525bb1c82ac35d1165d310a4a805d", 0x50}, {&(0x7f0000000500)="3e1e996453f125d86d46c108a7793e874ad436664d979ca19b2297259dd032d2d112a18d8ebafdfa4daaa735bf764978d2dee80eb4df5b153166053ed54e7dfaeaba32adf6012dfa01d33c3cae9c582faabcd261f62e1a0f3c992178a69cb45688585fc5e572dd724001e04375cbb16790f3a7a5001808518c", 0x79}, {&(0x7f0000000580)="8b948d9f591735b4f7a0ec5a88d8b90be5a6ecf501eae8810996f81d922bfaba648cd57adb5fa4871e4adae918f0373647285b6f5902292ca8a62da76af3ddd295a7dad3c610f8285a9a419f19f5c4a63f84d59cf0bc163fc9bd7cfa2ff67a2477ca87885dd8f1376ed5b6487d88ebb0774cd6bbc6a3fc81526330730a2134cbe410b6354ffb3fe42b447aed5c0fa4c8ffab8cd2baa4673787b12ba09b2d9934374fdb248eb46da1c6695c", 0xab}, {&(0x7f0000000640)="2690455799a8205f532426846081163c8354b56c7697fdcc77bcf75dd1b546e38bc88a71987a2c68533f25c66c66decac1615fe59ef55c3923efbcadda7fbce204c6ce0b6294ef892c6c0679f2a5809fd23cb507c09ae86108d600187e0c374f781cedbb61e7924f48bc8c8f62787c3a7572a069f699c7d9c500ba08aeb786def6939fb452d1938dcae77521e2cf5c61f88be8a3f1ba3693c440c6580b49b474768798302675dd5441d271f4bf5a5097f206918a305859d55abd473d63bfd35dd7ea3e441e0daaedb49ba6c59bff3beb1b26306d55f829b391e206fd027f6d36df8591168ad90b4e277905", 0xeb}, {&(0x7f0000000740)="57ce547689ef697bcbacb4938f12409860694dce4e5e7ef3ca072f4fcb2f38b7", 0x20}, {&(0x7f0000000780)="788ba91d1e54ec42534fc47569ce60cf63c3ba9131b38078ac8d0dba02bf9064e9ebb7ead698c6cca6304a9fdaaca0d369da9e6de9c993a07086", 0x3a}, {&(0x7f00000007c0)="a15408a29601de34a69017bb2704733f4f27d491b2fe809279d16fbcb55b2eb0723d8e4e6b6bb64ca1c5fd3ebdb989644cb876240ef999a0559a3abc2fd518eb51a8569d2f530bdb2af253b059529422d13ca56e57990a81aede38c559cfaa97cc881f021b26d07f8d120939735e4e48330aa3d8ac7d", 0x76}, {&(0x7f0000000840)="42566353405af6eace173b7713bef96d4e74d2e581aeb3f07222634e8cddaefa52e0398833a56d734b09752d6cea50ea0376811346b0f3151b7593fb5f8b5a38e1ec7d", 0x43}], 0xa) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x800) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) ioctl$FS_IOC_GETVERSION(r3, 0x80087601, &(0x7f0000000280)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:03:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:56 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:56 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:56 executing program 1: syz_mount_image$ext4(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) 17:03:57 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:57 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) syz_mount_image$msdos(&(0x7f00000002c0)='msdos\x00', &(0x7f0000000300)='./file0\x00', 0x3, 0x5, &(0x7f0000000740)=[{&(0x7f0000000340)="904746222cf34649d4a65466d872b421b63bc1c0e1e7f22af6a160f7b343fdc2420441ef10ad1f9645be85f646742eb55b44e507307b4b09c2a5b9504d90ac01571b5a50210df9a1d8db883d230d276c3fff8405", 0x54, 0x423}, {&(0x7f00000003c0)="3b639aa5a844e9da65856a4d9ce8acfb660320b35f354cbb31942a0b4f96034d20fea1c3552c1afacabc4373299fea3afbe341927663c4e1b25d5fe383d1d6b8ddb05d6aedf628ac59ad78f13bda0ae514d37f0991b6fc1a9a7af94c89162f2022f10a389dbf419877d4a9700fcf760111aee389a954dac5296fed7e61e8db571e0af18bb1cfc8f443c171612a2c7a4199a0e686ded45ac8a95e7232fb6a802fcac90c71ccb7", 0xa6, 0x80000001}, {&(0x7f0000000480)="165e60681b76bab0edc38387d6e0f257624eba494e53aea3368e7efa9f673b2783cfe260fc80903a5f115b1133b2298d539b514839c83080a417a10ffd5c12449419e0e0188c6bbe501a39e810da19f0b2cc0b85827e7e38667e96e8b841484a84114eebfc663393c27f1a2f3c10f49c73c46db2d99b0c5437520cb8970c74f678a8b4d7fb5c51923642e657d0220b8bba2c3801ae848bdac31edec24c45e733da93ffb02d8389da2cdf6842ac52fb7b62562040dd416454092f98e89ada2ce7494411d6c1", 0xc5}, {&(0x7f0000000580)="8f446a085698740c31b33acfb89bd841baf011bc0e3e31806352640368105718f617b56c54f1199103823729e444cca87d886a2c3f601f751635ade6ec4d4bf90fb8ced1b2c7003d422e192ac6c9c729fc9876a84eece3465e1ef2359beba2572295ecbefa20873475f8c5feb8efb958b6c92c3351bf19d86ace7a8ae496f7fae2fce5e8aa27273bb85e059aefdf3c76b38ca5d38347464260652a91753849aff58c474754532deb76e0b358c4d8b4335768ca2920b198", 0xb7}, {&(0x7f0000000640)="5904a27affcf324b7e5f8cd81ac2df0e4518b3276c3886b4dd25e581af3a3b38818d6e3e2da458716d633fb149b6df95fef6e26576d4a0128e20859e59a33831dd790747e6d52beee5ce7a00bb20cdfba2c9404d4ae90fd7d11365982f9c1fa91773cec219782b28a80fac127b5a4b3123dc2c88ec5d82d08d1e1cb22230cee2d79daa5c3777fddeb7afad82905c5c1a6f11c97cb43c70551708588817442bb00554b78199d99db30f5261b4a6fc15ced1632e8ca480fe5b8f3da12471ebea24d8e594f540c38cd1a7cb7254799edd8cbff95a4551c59de1eca6228821c5bf2fce15da601dd19af5", 0xe8, 0x80000000}], 0x200000, &(0x7f00000007c0)={[{@nodots='nodots'}, {@nodots='nodots'}, {@fat=@check_relaxed='check=relaxed'}, {@nodots='nodots'}, {@dots='dots'}, {@dots='dots'}, {@dots='dots'}, {@dots='dots'}], [{@permit_directio='permit_directio'}, {@hash='hash'}, {@smackfsroot={'smackfsroot', 0x3d, 'team_slave_0\x00'}}]}) ioctl$sock_ifreq(r1, 0x8930, &(0x7f0000000280)={'team_slave_0\x00', @ifru_addrs=@tipc=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x4, 0x1}}}) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 200.827431] binder_alloc: 7234: binder_alloc_buf, no vma [ 200.836631] binder: 7238:7246 got transaction with too large buffer 17:03:57 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 200.836667] binder: 7238:7246 transaction failed 29201/-22, size 88-24 line 3493 [ 200.836834] binder: undelivered TRANSACTION_ERROR: 29201 17:03:57 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:57 executing program 1: syz_mount_image$ext4(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) [ 200.837053] binder: 7236:7245 got transaction with too large buffer [ 200.837084] binder: 7236:7245 transaction failed 29201/-22, size 88-24 line 3493 [ 200.837241] binder: undelivered TRANSACTION_ERROR: 29201 [ 200.887365] binder: 7256:7258 got transaction with too large buffer 17:03:57 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(0xffffffffffffffff, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 200.887403] binder: 7256:7258 transaction failed 29201/-22, size 88-24 line 3493 [ 200.887572] binder: undelivered TRANSACTION_ERROR: 29201 [ 200.890587] FAT-fs (loop4): Unrecognized mount option "permit_directio" or missing value [ 200.934622] binder: 7268:7270 got transaction with too large buffer [ 200.934662] binder: 7268:7270 transaction failed 29201/-22, size 88-24 line 3493 [ 200.934909] binder: undelivered TRANSACTION_ERROR: 29201 [ 200.954191] FAT-fs (loop4): Unrecognized mount option "permit_directio" or missing value [ 200.988404] binder: 7277:7280 got transaction with too large buffer [ 200.988442] binder: 7277:7280 transaction failed 29201/-22, size 88-24 line 3493 [ 200.988605] binder: undelivered TRANSACTION_ERROR: 29201 [ 201.040107] binder: 7287:7291 got transaction with too large buffer [ 201.040153] binder: 7287:7291 transaction failed 29201/-22, size 88-24 line 3493 [ 201.040315] binder: undelivered TRANSACTION_ERROR: 29201 [ 201.147951] binder: 7234:7243 transaction failed 29189/-3, size 88-24 line 3284 [ 201.158756] binder: undelivered TRANSACTION_ERROR: 29189 17:03:59 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:03:59 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) sched_setscheduler(0xffffffffffffffff, 0x1, &(0x7f0000000040)=0x1ff) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x7) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) getsockopt$sock_buf(r3, 0x1, 0x3d, &(0x7f00000000c0)=""/160, &(0x7f0000000000)=0xffffffffffffffbb) r4 = syz_open_procfs(r2, &(0x7f00000001c0)='net/igmp\x00') preadv(r4, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r4, 0x0, 0x0) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0xffffffffffffffff) lsetxattr$trusted_overlay_opaque(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='trusted.overlay.opaque\x00', &(0x7f0000000280)='y\x00', 0x2, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0x0, 0x0, 0x0) tee(r1, r5, 0x68ffae9f, 0x2) r6 = syz_open_dev$binderN(0x0, 0x0, 0x2) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r7, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r7, 0x0, 0x0) r8 = syz_genetlink_get_family_id$fou(&(0x7f0000000300)='fou\x00') sendmsg$FOU_CMD_DEL(r7, &(0x7f0000000540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1800}, 0xc, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="00022bbd7000fbdbdf250200a0c1080003005f00000008000a004e22000004000500080002000a000000080008007f0000011a5fc6fe9c962feb9b3f1018361688d75b46a2e8853b0ddcab8cf923d6748947dcc089e28b28e40ac4d69c5a8939493b2e8505b1fdf3357b269ed534d90f0b2f88e28cad0aba41c87a4372c93479dcbec36e582f352918b357a1d68540be6f3f71df12f3bb6c7b736faad6f5a0eb2077cd0ef2"], 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x145) r9 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r9, 0x88, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0xcc, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="11634840010000000000000000000000e71dbe7745dc9734c80a430000008e000000000700000000a00d3c5c132c569ce458c3b58301c0bfef5c7f283de2a857fb7cd07c222c4767e1ea3f0aab78369af267c38174f51de7da37e453ef44ed989385bf931dd6ed682af838bf561a310d0c98b0e5916295d61ab47cf863d82fc79148c64dccedacf3412c1df6869b298cf787db08c14dd08e6ce3d800"/180, @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYPTR64=&(0x7f0000000380)=ANY=[@ANYRESOCT=r9, @ANYRES64=0x0, @ANYRES16], @ANYRESDEC=r0, @ANYRESOCT=r0], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB="0000000000000091"], 0x0, 0x0, 0x0}) 17:03:59 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(0xffffffffffffffff, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:03:59 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:03:59 executing program 1: r0 = add_key(0x0, &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="352940c5c8f212ea6fe693cc4723ec", 0xf, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000240)={r0}, 0x0, 0x0, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000000)=@encrypted_new={'new ', 'ecryptfs', 0x20, 'trusted:', '-Nmd5sum', 0x20, 0x25c2}, 0x33, r0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) 17:03:59 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:00 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(0xffffffffffffffff, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 203.839780] binder_alloc: 7303: binder_alloc_buf, no vma [ 203.853449] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem 17:04:00 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@empty, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@empty}}, &(0x7f00000003c0)=0xe8) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) fstat(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r4) r5 = getegid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r6) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r7) getgroups(0x1, &(0x7f0000000700)=[r7]) getgroups(0x4, &(0x7f0000000480)=[r6, 0xee00, 0x0, r7]) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000004c0)={0x0, 0x0, 0x0}, &(0x7f0000000500)=0xc) fsetxattr$system_posix_acl(r0, &(0x7f0000000280)='system.posix_acl_access\x00', &(0x7f0000000540)={{}, {0x1, 0x6}, [{0x2, 0x1, r1}, {0x2, 0x4, r3}], {0x4, 0x1}, [{0x8, 0x46de334402fcd7ed, r4}, {0x8, 0x1, r5}, {0x8, 0x4, r8}, {0x8, 0x1, r9}], {}, {0x20, 0x7}}, 0x54, 0x0) r10 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:04:00 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) setxattr$trusted_overlay_nlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='trusted.overlay.nlink\x00', &(0x7f0000000180)={'U+', 0x2}, 0x28, 0x6) [ 203.853457] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 203.853466] binder: 7305:7313 got transaction with too large buffer 17:04:00 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/null\x00', 0x200000, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001340)={0x14, 0x0, &(0x7f0000000300)=[@increfs_done={0x40106308, 0x1}], 0x1000, 0x0, &(0x7f0000000340)="643c088e6ee36410e525c8cf46c6b224b5d7c7df58b453f8bb1f481925e5fefb45ff1ab7872ad5af8d93a876d0e7716f3b23c3065aec48992d5433de5d859ecdd5773da5a141606949bccdd067f92b4ef7f33cc4677eb8775e4f30b5633eb576923dcc98f42041dc392982cb1035850b37216f9a51204afedc8055ce31863aea9301bc31b2d8befe6c4542d77d5a999dd13f12b612f3b4d03228804086a75f9322294a9120e7573418900dabb9be32ad2cc00d37277a48ddcf5ebeaa0885e7a0216d7e82f55ab3709e43ce95dd368bbb5e0e4df3c7ccb527fbb17c666a2b926e7d4deb57803a7fc92e35ddb29520041ffdbe7a9abe7894891fb3780682d8cb6b7147a84f6961651d022503d3975a4a3be1ffd43aa0da435631341434dc4b76c7265032eea09f32dba9acc87f01fd8f618509f171b5d3c8e07a6772d99e18dae955409da88f557ee9f79ee9dc763d8e298ba8be4e8fce13a12a43d26579483333788cfd67e6d51e34e9bc4785b81cf15fbc23395f0917565cfef6acdd30c32928a76bdc61d5b58b89463ff59259e0b7d6073630cc1bd7b06a8ad64c3d6f67a1c9f1c95ea618e31dbd68fc7fb3f66a73b76c18e5c51d18445e577d22049dcb77fef29fa2d5344a97dd3519a60328abd5894e8bc5b3acf4748d1b9c590cf8f9bf3342617e9324506602a0ab2fa67fbf101530076dd86d66402de2b318a468ecc3a5a162eede50dcdf842a9d2c2bbd41fe493a0257102e81ac1ace5a3a15686a42e2d9a3b472e3a7f0a9b25c1623cfdd5b2bc4b58c9dcdf08f172a487d17e1f90ce18bc5406c5b7f0be5c0fc96bd241aee29ae167ebc9e43794d37da2e96976d06f36594372c32f4dff8c7f313192c2b6ce90a3f6b561c39cdda5431d66d6bb718365fd6dbc089dfc6e3f0a66c7cc5a133654b6b71374e1d4eb8de7a1e5318f8ad8d4d45dbd20e7c40f92657a7b3379bb598bc2e8ec624d05a7c0c99b1e2f2ace105f538b1d9e55ef47d88da48333a22d7ae1f613af3f57e49735e8be7d78a6295698b0bbc778b6bf2e0d35d73d7679296907255189187d921992b21ebb64dde53333e7a998ebfc59b59bef05fd2629a9aef66af99165898baafe3e84835b0a5e220b7b9854c6ae1f24a5d9cef184bf325a1f127977c3e99ceec5b2fc2814e624bd979af0c0dd84cbabd4c07fb1238e61909a00560fee5f0092a9939021896ef855f705666e81d04617b723aadc6f0e1a9e7f33aced707754a102ddc28f064a2f2923a3d2d0cf54e1577861db1d86afa189e405148909452c0414b63800b959f8a89a6e813018ccd074657c7569490a72139350b936ba0211d6b3df8bd20fb6bce2d25ba96749b43044338541e6affe30c9d292f98baf13cbbf37334b878f7634a7e1afcc30fa981088fb2531d40b742389d9fbbd7d84f3bd57cb71f9ae23e085b885ad1fb3074a4968995aad5e120c096bf4b243fb6a60323f2d6e1f5fc9dda998c8e0884ce60ef75efc889ec70e0852e31ac7c6c3140de6f0de6b7a9e8110b2668036fbbbbcda59c6f978bd542405f777be0e7887a73187a9c7165ab64fffb8bbb6c8fe3b0dbc57433c7c565c0599539bf62c8669469c91f2fd6ad50163133c4838ba7acb27ef81ffd6d43fff7cdc0ceb748c6dbfbfc84653fc0043493d277dca36380bea40f9f37803ee221a42584c938a024a5b244051a3e21865dee02969a87cd6c38c65f7f1ae55f5111e94b6854d96d9010b2ae691d59750fc18921171a6b7404f0229ab71fab9ae0b17d1a2bc996e98c33122df73ae60ad0a6363865cf86e27b8ee5549034fbd45ed3d27ef3a118b7e9982000ce20a323478cc78e01c68cf8fdfe24159b80accd1f142f1f7588b9eec8fb7a4ca962d47aaf6177d276eeba3c68f3f79c33bf436a5a8f107ba89b99bd1b004295ee3ec790824123219392b6f57a75473f0f71398dd1370eff99ebf16a06a53c489574571c10fa15653cb5f078e714d1765b147cccc6c59c0a57d5b6ab2224eb4c4de47b2c30c44e591899476754d4b347b742b147bb176d79eb817da9c37fa39419c9d0ba40fab794aae3398e060cc3b6a5818d79cf4c4ed0ac7d8dc19c443f3caa9047c18741768c3efb8e179a9d0500c3e0a47626e72c8439b55abcbd9584745af96b0e1beb461da4b46f7efd8dc0df343d91ae606537dd599e059276e72e0772fb72f3917fcf3d4c21c6d24d5e3364051159f741b18bab9b9ff0bb91b7ef60d08ff4e085970c936af3a3b6b2d8a4fc5539152798ef19b90b138e761341423372af7663053dcd18d630f66bb94c75e62b78d471656462e4b753deda35301c4a6302471a82ced5e8982579faefd4052bbe843de10980db9b946d616ce51955b0e668fb3475afd6a731bfd82666def190e8bc7b06017305add0937a2fefcf48cbc254b416f21f166805a6ed0c8c735a69094c91961f01544ccd6a4601f59b768dd5d5573bcae57d82953008356d4fc3375ca7fe8bc17e0e375af54355f2959a8a6502a0a8abb9b9a361dc19da7a61a423acdb374d2fc011cae6dd559424afd1c6fa735f170c4f68cd78e06c72ca3d46ae21585bc3057bcb3792258e57e2ff0c9c825e8668b9cbd2a2c60614f4abb351a7807c29d59202b2375c00dd2feac4059c363c43e6cece287e8891f60a04f995d2686d84d536d7bbc1baefe7e003d94c4307ce9b1bfe2df264aa444cdbd85a46b7cb0fcf662fb2ed4a71521442f66a21af8e92ffed438053518a4fa9ca60ddb6896f29d355c3852a7e43ca7df427a873dfcfb04dfd47249499408789f4a4360e573cfbe1854e011eaf54f711f4b1c8bcf0de6169a29135669002bde32e16c612d2a152a11d0066efd4574bdb2b5a589b111bd7d42e500fd727d0a25c9829a5dd51cc174a5bc01833a424de85dc591ef6bded7d957848e754bbae206c5ca1e766774888ec2e645a1f154b06a209b70a79f13e6819e3047c070933213c28f4e8ffd07d26d4ad4fe5500b5820c3d1892f28aca0ec8a45c1d92056eccb7fdbbcaba43adac8eaa44c05ab811d8e246df2330008ceda611654051407e280c1343e373e525561c6ddcd89d98e039affdd93c8bb1646c0f054fe3b45573e1409c61b9a6776e8a3ba97dc5c395f6519c5bd0ba3102838e58cd892919e01af3a3536409c8f9f58a322b262a9084ced1e61be25c08171598416645323eab7d5cdf101c8b7f47a741b4272226cd1fbfd642ac8486c76f83a9d8717ccd70d21932f71420a4be984cd97ddd6a156bda8bb4ad14c6772709fa5812e3c7bd681384b12eb1250b487ff0a7f13b5799d342225f52261f718743c4d9fc3b613e1ddb445543b10587a41d5983cf4db6113b362ff76762fbe8f7265d31dcf7f670888b2e871fb3e332e53d587d83aba05d2a406344160a38a8e719ead39e0f6f3b4d323628901eeaa39e122602a9d67911f3da62d70d8a4334bd4c0b0dcc97fa89f2c9f94178fab91e56f3c9270958257b172a1581c44f38b20379db32b89886605dbc2f15c24cab6a1767996bcbbc2af4d5259f0961a39108ddf966df3bf20e0550db3903afa3a196b784c8028eb4516416d5c0aea10e76cea66820d740885f376bd5b4aa72e8aa6fff5e5220df24b9df75651eb112398ea7e2bb8341b9525fb36effd2f443f768276c9ad9b87067c3e9a85d52f5c069cdb0da465617421a4eae02e36e00824382709ea168feebdc41d03b634ff20809668f38c5dac6c6b44ea393b83045c0fa0d49be03f7c1d798f989aadad916e4e555d2aec41521d5083a15a8e5327a09d028af105b9269967445112c91f2a0592b8f9232a208a7a0da2e3992970c76a99cd8c331b51e684891964f9ab84c058e919dbba9110281db6575b77075e6dd7f7009f2f5b11669dcfd68e1186f95115c916fdb7aa4453f7d30fc8c45534dab2cb58704edf35f833d08caab9e3114e90188d03d481bf0d707cea805b99ab7113b12c82d3614e26c70be5e22cd6237510643a2db6272ecbaee685dc3cf8058b214864357a1d835b56cef7cf0482dd1b9103643703e72232b1eb5a9f29515ba3205ecf53d0871981a3e64411bcdb2b9a0ad16ca59d0224b316068a9b2b24496471638ae1527859f58a430d9aa7e2f6ced6a87612443b85c0aa5af4661ad3f8bf7c819e0ae42af7c166d2ca20d67cb3484901941aff2d5359ea507b262ec60f736515eb333bf9c25c7f556eb696fb29e73e99575cff98ef6eb604f121ecab94f5bb961d482e8f19e963d7bb29ff7e3ba0ce7a828e10ce084b4694c38a6235e9835204744fded90b6ff15e642f066b83a5b257ffa3440e8f11c1b3792bd6597829de3ba97272101430a3f3d39bf3fdf1c7b5073c4cba71147ab05071eabeefc77f99da1bdca330beeb867196d32e95e99ca55b58f115118b771a76ae4cddb7131715cc1cd0b050684b1ef7029c0d855b45b408cab9b953958d8a29d9bbce1826d2c994776b9a832432a662a381f17c105b880a4d080d0aac758aaf3e438aa4123b0e4d2becdcf2d70cc727998eecef0255c5185cabae4a8b6be20bbdaa4e0c5dbc6c81299e0416bd4116ae6e7edc63c630f3fc7edfbf99a52fc8c340a8f11a0085f6df6df33d3e140de7469d8cce993c024411f3473470e23639e67916b752a5dc3dd0057394caf5a2b38be6d554815fee150afd9779fe64857c9442fd597633ed3e80e432bf95f5149bda1772d75b19d013f7166404833931e6fa4e4ba3526ac9bfb6a66ba8cbd7b24986de8371b740dc49b0d7d287e883b6be963a5a28636f9b68fdcba7d04a09bf47a721682fee06a32fa3cff1526f5ed9c709775e35b9f76ff6e08b9d1a08795c996f0c0691f28d363704c22e93c94fd2192b3edf7af70732a3ec3fc82691660343827f42c567c0a33f73842fd4fe2588f821c7c2e0479323b3946c2c33c8cc2e52271c79867aa7678ed926c6a029c9d448a14999a326c738937dddd057198e3072d55de88be8e9d62e6df1b22fc2ffbf68dcacb75fc759b883e21bd8712c31490804064f936b9beeddd2ea05a1e723dff22eb1149c63f4c504013d38913c5be3dbeb4ad9f9825e718796dce3caaf04ac198cfc041e6b51d567303f45f31d6c9c09a2244ec9dff239434145b739b0171d460c1140b95b3a92e1bdffb5ac9257751423c640c5ab0822f367a110b6605bca72c1d2f8c1a818e4dfd9164101669f01cc9ba56b5b2781ac76322d450e2f822aac0b5acaf65871271052e1665e51b4d644affe6d756394ad8dfcde54d9b208817af1ce5cf9d87fd66f5b4334803d4a437ffbbdd4473c8c472b7e4e267fc85656582ce2eb92ac4d70fc0544c14ac45c6f36eb223b16b4814f42e086ebdb048e19e0b118e78d9d23f724595acda506cfc6e6016a98a7621c1ed1e08eca23fc971454c6ae555cf02807700671ee1b5e293a8d61ad8d786393e8c182e0fcd2376c24a71b943cf4f9085450f4891921dfbcecf2b618cb9e5a6d95e65b7774b5d653a68283b8dca16ebb300949b5da812e52caa82ce265c2194a509dde5579b41117d40957211fb7f89947a2d79961a6ab74f6a58a33a953da782bdcf53d1ac53b9886fc1be648bdc6f040621c9ed511e5e1ccb08a8fcc813635bbd7e725684fe207736c7e0927d1e5fffdab59a3af9fe27250289b59fe4b007cae793f4d96a4de16124cf759f38e3eab8328b71b682ef925efc6653374dd1fe28475be34d88a9997759b75cb9d331ee7253c82a9ad7d4107d19b5ff3de4f4d41626aa8882eccca8ec8e7aec34ae03b85d0b23d"}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) ioctl$sock_SIOCOUTQ(r3, 0x5411, &(0x7f0000000280)) r4 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r4, 0x88, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001480)=ANY=[@ANYRES32, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYRESHEX], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYRESHEX=r4], @ANYPTR=&(0x7f0000001380)=ANY=[@ANYBLOB="2d010000180000000000e5fffcffffffffffffffa7b8dc209e24c89e6e7892f713f1780233e8a0e61f5caa89d24c483c5c9903f34e56c2a50e45f85a417fc9b7df4e51da17e6b510f4f2bf54301aa1156a20dd7fba6410aa588e83a18e5215a5b0df5b1c3b313731d7a1282069b028b0ff3482a8d3d885280328d9c2cb4827bbc91678d79dd2faa7581c9632bfcfd3da07f2644d695a0ffaade511fb931ba663e45b888f804efd44dfe2adf163b51b10eb21b655fc2a98b123d1fb202f29cc4f47f3d75625932a3f6fdc2499e24000c8cb74211ad7826086c381"], @ANYBLOB="0000800000000000"], 0x0, 0x0, 0x0}) 17:04:00 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r3 = dup3(r2, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:00 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r3 = dup3(r2, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 203.853502] binder: 7305:7313 transaction failed 29201/-22, size 88-24 line 3493 [ 203.853675] binder: undelivered TRANSACTION_ERROR: 29201 [ 203.926343] binder: 7324:7326 got transaction with too large buffer [ 203.926381] binder: 7324:7326 transaction failed 29201/-22, size 88-24 line 3493 [ 203.926603] binder: undelivered TRANSACTION_ERROR: 29201 [ 203.930413] binder: 7321:7323 got transaction with too large buffer [ 203.930455] binder: 7321:7323 transaction failed 29201/-22, size 88-24 line 3493 [ 203.930990] binder: undelivered TRANSACTION_ERROR: 29201 [ 203.936040] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 203.936050] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 203.980193] binder_alloc: 7334: binder_alloc_buf size 8388720 failed, no address space [ 203.980200] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) [ 203.980217] binder: 7334:7338 transaction failed 29201/-28, size 88-24 line 3284 [ 203.980387] binder: undelivered TRANSACTION_ERROR: 29201 [ 203.983467] binder: 7336:7337 got transaction with too large buffer [ 203.983504] binder: 7336:7337 transaction failed 29201/-22, size 88-24 line 3493 [ 203.983674] binder: undelivered TRANSACTION_ERROR: 29201 [ 203.990794] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 203.990802] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 204.032655] binder: 7344:7346 got transaction with too large buffer [ 204.032732] binder: 7344:7346 transaction failed 29201/-22, size 88-24 line 3493 [ 204.033076] binder: undelivered TRANSACTION_ERROR: 29201 [ 204.182838] binder: 7303:7308 transaction failed 29189/-3, size 88-24 line 3284 [ 204.193435] binder: undelivered TRANSACTION_ERROR: 29189 17:04:03 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r1}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:03 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) pkey_alloc(0x0, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYBLOB="ffc630de51f19aaaa34891f188db16235b2c1c1581b6f39ceea71fd722821a2420224d0dbfeb95a2d2b964a5d6d12a1359b13592b91788a9f93b5689fc49edb0d207c71fc229028761f34be63f02c4c365", @ANYBLOB="940000000000000000000000000000000000000000000000852a646640000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:04:03 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x200, 0xaaaaaaaaaaaae1e, &(0x7f0000000400)=[{&(0x7f00000000c0)="2aa051746296e011914c3d1df60e4ce954b30b0e1950ee207c26d9f3e0feb2a2027d43e7804e8c4241534327a2e5110e5bce547e00e7786a17b23419d2c4821a784b20b39274a4ff527f752197a3f7d4f502d63ea17c966b82e822dd36b890934f7ab2b94f3c57cce7c184cd7a5b310b4ee6e2f4d6177c299773e59d62b1711332eb8250f9e2e1a6f0ef587ee55ec21d5f3bf76ec75cbd6205bcda47866bcaff3c64d7a7f07b731661f9253e93e1a18b4848c4c49532de16395db15239552af191a3543d4ef95245d0cc455424a66013b49dc8844ead2061b271e112de4097050f4fcfc7cdd0af", 0xe7, 0x6}, {&(0x7f00000001c0)="5bdc612984dd3d67693b07cfb3dc2e944632428c791ff5f62ed542fddaa4cebbcf283aebbec61d722490e560eb7f541aec79b984088c9295eb0d0c1156a3e73304c222f95f", 0x21, 0x1}, {&(0x7f0000000000), 0x0, 0x7fffffff}, {&(0x7f0000000240)="bcf33a8d218a81e081dbef59897985335d62228e7c8504f847f9c499c0a55ff5d2a00deaee4eba2c986613ae21ed0e", 0x7, 0x8}, {&(0x7f0000000280)="e3b02fe5a9174988b1fbec3b73d0fe91c5e8197b0936ae9def2c7c2b8238c7ea1ead850b97a913415a9ac57513c45ebba5317eb27a8082b03f20454c9de67f4e2b00174d5c3933a7315fa171595320070e4307e59e456f51ea1323a52c55adce9ca5b19992884bfecdd549a3290b0fe398e3a3d66cfcfbf0a8101736aadd6d4869526bc28ff4aab4d7cfb1302d38", 0x8e, 0x101}, {&(0x7f0000000340)="dbf0d663fe937655041e80f794f4fbea7e66b3cfbd8c9d23870fd1bead8e1e7e4e91a816dd68954c3b27f66b1ed75d130ab53df23cb4853ba8b9c22b863388205e8f9967cff38ff63586cd01d56dd7842acaf996f443341fc8c221ee5645aeed73b06d0f228e2d671527ad0c9618b6b09e30f665d0c210e58cd10b5215f7b87318dc2ffcd3b4dee7b0c5debbdefe23aff9bea2bff0d0818a46603f4529026c9f1618983b420b7f4746dd836736430dcffd63f97081a369ce", 0x132, 0x7f}], 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x88, 0x0, 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) prctl$PR_SET_FP_MODE(0x2d, 0x3) sched_getattr(r1, &(0x7f00000004c0)={0x30}, 0x30, 0xed13f7e5bf942b95) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='nJt/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000500)='/proc/self/net/pfkey\x00', 0x2f2d5e5c7f453aef, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000540)={0x6, 0xb, 0x1, r3}) 17:04:03 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r3 = dup3(r2, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:03 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:03 executing program 5: mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:03 executing program 5: mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 206.853374] binder: 7355:7358 got transaction with too large buffer [ 206.870921] binder: 7353:7364 got transaction with too large buffer 17:04:03 executing program 5: mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 206.870966] binder: 7353:7364 transaction failed 29201/-22, size 88-24 line 3493 [ 206.871119] binder: undelivered TRANSACTION_ERROR: 29201 17:04:03 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:03 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:03 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 206.952637] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 206.979790] binder: 7355:7358 transaction failed 29201/-22, size 88-24 line 3493 17:04:03 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 207.013651] binder: undelivered TRANSACTION_ERROR: 29201 [ 207.082823] binder: 7391:7394 got transaction with too large buffer [ 207.091802] binder: 7391:7394 transaction failed 29201/-22, size 88-24 line 3493 [ 207.101372] binder: undelivered TRANSACTION_ERROR: 29201 17:04:06 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r1}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:06 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:06 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000001580)='/dev/null\x00', 0x400000, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x80000001) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x480440, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001080)={&(0x7f0000001000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x4, [@var={0x6, 0x0, 0x0, 0xe, 0x2, 0x1}]}, {0x0, [0x0, 0x30]}}, &(0x7f0000001040)=""/13, 0x2c, 0xd}, 0x20) ioctl$TIOCSLCKTRMIOS(r2, 0x5457, &(0x7f0000001540)) r5 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r6 = creat(&(0x7f0000000300)='./file0\x00', 0x0) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000200)={0x0, r6}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000013c0)={r5, 0xc0, &(0x7f0000001300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000011c0)=0x101, 0x0, 0x0, 0x0, &(0x7f0000001200)={0x7, 0x5}, 0x0, 0x0, &(0x7f0000001240)={0x1, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000012c0)=0xffffffffffffaabb}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001440)={r4, 0x10, &(0x7f0000001400)={&(0x7f00000010c0)=""/255, 0xff, r7}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000013c0)={0xffffffffffffffff, 0x10, &(0x7f0000001380)={&(0x7f0000000380)=""/4096, 0x1000, r7}}, 0x10) r9 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r9, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r9, 0x0, 0x0) ioctl$LOOP_GET_STATUS(r9, 0x4c03, &(0x7f0000001480)) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001440)={r3, 0x10, &(0x7f0000001400)={&(0x7f00000002c0)=""/152, 0x98, r8}}, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f00000015c0)=ANY=[@ANYBLOB="852a627b000000000000000000008afe0d41000000000000852a7470000000006285d9a22fb93e59c3470cd43c71eb1cb360608120fb1db04507e5c88568e956ee071750f7405bb6b04346938cd0e19c13f2140962c4960b728e476eea762ad0afb76fc51aa726a315ee21f72ca5e9893b548470f2d070099d377bb02481fb8675a907a5b576a6fca4d649375111c155ee5f521a", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:04:06 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x10000000000003ce, 0x400000000000) ioctl$TIOCGETD(r0, 0x5424, &(0x7f0000000080)) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000140)={0x8, &(0x7f0000000000)=[{0xd18, 0x5, 0xc4, 0x4}, {0x9, 0x81, 0x81, 0x9}, {0x5, 0x0, 0x5, 0x80000001}, {0x3, 0x7, 0x1f, 0x10001}, {0x3, 0x7c, 0x0, 0x6}, {0xf2, 0x0, 0x32, 0x6}, {0xa46, 0x40, 0x40, 0x401}, {0x1f, 0x6, 0x1, 0x4}]}) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) getsockopt$packet_int(r1, 0x107, 0xe, &(0x7f0000000200), &(0x7f0000000240)=0x4) 17:04:06 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:06 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:06 executing program 4: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r1) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r2) getgroups(0x1, &(0x7f0000000700)=[r2]) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='fuse\x00', 0xb1, &(0x7f0000000340)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x18000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1600}}, {@max_read={'max_read', 0x3d, 0x87}}], [{@fscontext={'fscontext', 0x3d, 'unconfined_u'}}]}}) r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) openat$full(0xffffffffffffff9c, &(0x7f0000000440)='/dev/full\x00', 0x751f58a5f4830713, 0x0) 17:04:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 209.886552] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 209.887659] binder: 7400:7401 ioctl 5457 20001540 returned -22 [ 209.890910] binder_alloc: 7400: binder_alloc_buf, no vma 17:04:06 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:06 executing program 4: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/status\x00', 0x0, 0x0) r1 = accept4$inet(r0, &(0x7f0000000300)={0x2, 0x0, @multicast2}, &(0x7f0000000340)=0x12f, 0x80400) r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) write$FUSE_POLL(0xffffffffffffffff, &(0x7f0000000280)={0x18, 0x0, 0x2, {0x3}}, 0x18) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r4) setuid(r4) ptrace$setregset(0x4205, 0xffffffffffffffff, 0x2, &(0x7f0000000440)={&(0x7f00000003c0)="e1c20001a99241cd1404943fcb3314338f23e48345286e1e3a2bfed1c1a9bf740ba674bff289ded7079634acea5736a08913dabb893bda2e6be4f1ac2fc0b24ae187a2f5405a4b91d944702e497082e1b25fc076371b6cf20f29545524937d23f89b305087627e37a6dd2d45c883d84d1dcca4a188", 0x75}) r5 = syz_open_dev$binderN(&(0x7f0000000380)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_THREAD_EXIT(r5, 0x40046208, 0x0) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000010000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRESHEX=r1, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYRESHEX=r2], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYPTR=&(0x7f0000000480)=ANY=[@ANYPTR64, @ANYRES64=r3]], 0x0, 0x0, 0x0}) [ 209.890929] binder: 7400:7401 transaction failed 29189/-3, size 88-24 line 3284 [ 209.891174] binder: undelivered TRANSACTION_ERROR: 29189 [ 209.893588] binder_alloc: 7398: binder_alloc_buf, no vma [ 209.893604] binder: 7398:7411 transaction failed 29189/-3, size 88-24 line 3284 [ 209.893806] binder: undelivered TRANSACTION_ERROR: 29189 [ 209.899110] binder: 7405:7408 got transaction with too large buffer [ 209.899151] binder: 7405:7408 transaction failed 29201/-22, size 88-24 line 3493 [ 209.899319] binder: undelivered TRANSACTION_ERROR: 29201 [ 209.949726] binder_alloc: 7415: binder_alloc_buf, no vma [ 209.949744] binder: 7415:7422 transaction failed 29189/-3, size 88-24 line 3284 [ 209.950091] binder: undelivered TRANSACTION_ERROR: 29189 [ 209.963872] binder: 7419:7423 got transaction with too large buffer [ 209.963913] binder: 7419:7423 transaction failed 29201/-22, size 88-24 line 3493 [ 209.964345] binder: undelivered TRANSACTION_ERROR: 29201 [ 209.977507] binder: 7420:7425 got transaction with too large buffer [ 209.977547] binder: 7420:7425 transaction failed 29201/-22, size 88-24 line 3493 [ 209.977737] binder: undelivered TRANSACTION_ERROR: 29201 [ 209.987256] binder_alloc: 7428: binder_alloc_buf, no vma [ 209.987277] binder: 7428:7430 transaction failed 29189/-3, size 88-24 line 3284 [ 209.998773] binder: undelivered TRANSACTION_ERROR: 29189 [ 210.040317] binder_alloc: 7433: binder_alloc_buf size 536872176 failed, no address space [ 210.040324] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) [ 210.040341] binder: 7433:7436 transaction failed 29201/-28, size 88-24 line 3284 [ 210.040498] binder: undelivered TRANSACTION_ERROR: 29201 [ 210.045614] binder: 7434:7437 got transaction with too large buffer [ 210.045653] binder: 7434:7437 transaction failed 29201/-22, size 88-24 line 3493 [ 210.045819] binder: undelivered TRANSACTION_ERROR: 29201 [ 210.219097] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 210.275126] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 210.289382] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:09 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r1}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:09 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:09 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) setsockopt$inet_buf(r1, 0x0, 0x9, &(0x7f00000000c0)="14cbcab019f750f7938fb3a0e0362e4307b3b274cc1fde974e221230689ef744aa3b4c919de8f4352b4a85ae32dfc4b2e1d3f75ddf1d54952ee74dfb6c2b1fee014bcbfaa2f2aaf6842d2c1a54656ada090d3b0d478446f46429886b7755a60e2dc97f3f9c1c3be433e08dbde654e8b9556ff41e5daaed3937262d0711abb2f02d1c5d4cf627b27018", 0x89) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) geteuid() ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r4, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r4, 0x0, 0x0) ioctl$PPPIOCSFLAGS1(r3, 0x40047459, &(0x7f0000000300)=0x800) ioctl$TCSETAF(r4, 0x5408, &(0x7f00000002c0)={0x8001, 0x916, 0x0, 0x0, 0x94, 0x2, 0x59, 0x2, 0x8001, 0x8a}) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) connect$inet(r3, &(0x7f0000000280)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f0000000400)=0x8001) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="0000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cdca61c01a5bbf000000000000000000000000000000000000000000000000000000000000000000000000000000000000000022042bf20edada15d4fdb2b577bc0228000000000000000000000000110000000092431d768c6dd0e96186f0018ed73d9da0706a"], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:04:09 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0xffffffffffffffff, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) 17:04:09 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:09 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r4, 0x88, 0x0, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r5, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r5, 0x0, 0x0) r6 = openat$cgroup_subtree(r5, &(0x7f0000000280)='cgroup.subtree_control\x00', 0x2, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000002c0)={0x4, 0x80000000, 0x5, 0x0, 0x0, [{r2, 0x0, 0x80}, {r3, 0x0, 0x80}, {r4, 0x0, 0x2}, {r6, 0x0, 0xf1}, {r0, 0x0, 0xc}]}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) setsockopt$inet6_buf(r2, 0x29, 0x1b, &(0x7f0000000380)="7d19aab5b470dbe473d5477cb60910e410a54371d4", 0x15) [ 212.896771] binder: 7447:7453 transaction failed 29189/-22, size 88-24 line 3138 [ 212.901775] binder: 7449:7452 got transaction with too large buffer 17:04:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:09 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000000)=0x3dc2e766bf1c63c1, 0x4) [ 212.901811] binder: 7449:7452 transaction failed 29201/-22, size 88-24 line 3493 [ 212.902227] binder: undelivered TRANSACTION_ERROR: 29201 17:04:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:09 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="9400000000000000000000000000000000000000000000006466000000004883a85e3ae04f478037ed0db6597047a35a3b5a52e271cdf6e25398f01527c7639a837e46af98e601cc1f49f151918d07bec83760afddcb094b727b0ac9765546f3691a8f5e0bbaaf1027d0ff50fd5c1875724bad837c005e4f1eabb26a429d9d7996f38f37cdab4cccbb9207662ddc69ad83a89b32a3c556733e79e9247a06830f126fb125e6aa846e67447d7f5adb4293c42c8577fc0780695091", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 212.906462] binder: 7451:7455 got transaction with too large buffer [ 212.906500] binder: 7451:7455 transaction failed 29201/-22, size 88-24 line 3493 [ 212.906747] binder: undelivered TRANSACTION_ERROR: 29201 [ 212.916424] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 212.916495] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 212.949472] binder: 7465:7466 got transaction with too large buffer [ 212.949508] binder: 7465:7466 transaction failed 29201/-22, size 88-24 line 3493 [ 212.949660] binder: undelivered TRANSACTION_ERROR: 29201 [ 212.970254] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 212.970262] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 212.980276] binder: 7468:7470 got transaction with too large buffer [ 212.980313] binder: 7468:7470 transaction failed 29201/-22, size 88-24 line 3493 [ 212.985089] binder: undelivered TRANSACTION_ERROR: 29201 [ 213.039371] binder: 7482:7485 got transaction with too large buffer [ 213.039408] binder: 7482:7485 transaction failed 29201/-22, size 88-24 line 3493 [ 213.039615] binder: undelivered TRANSACTION_ERROR: 29201 [ 213.040577] binder: 7482:7488 got transaction with too large buffer [ 213.040610] binder: 7482:7488 transaction failed 29201/-22, size 88-24 line 3493 [ 213.040893] binder: undelivered TRANSACTION_ERROR: 29201 [ 213.042619] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 213.042627] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 213.107489] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 213.107498] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 213.273593] binder: undelivered TRANSACTION_ERROR: 29189 17:04:12 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:12 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r4) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r6, 0x88, 0x0, 0x0, 0x0) pipe2(&(0x7f0000001d40)={0xffffffffffffffff}, 0x80000) r8 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r8, 0x88, 0x0, 0x0, 0x0) r9 = getpgrp(0xffffffffffffffff) r10 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r10, 0x88, 0x0, 0x0, 0x0) fstat(r10, &(0x7f0000001d80)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r12) getgroups(0x1, &(0x7f0000000700)=[r12]) r13 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r13, 0x88, 0x0, 0x0, 0x0) r14 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r14, 0x88, 0x0, 0x0, 0x0) r15 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r15, 0x88, 0x0, 0x0, 0x0) r16 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r16, 0x88, 0x0, 0x0, 0x0) r17 = syz_open_dev$binderN(&(0x7f0000001e00)='/dev/binder#\x00', 0x0, 0x2) r18 = socket$nl_netfilter(0x10, 0x3, 0xc) r19 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r19, 0x88, 0x0, 0x0, 0x0) r20 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r20, 0x88, 0x0, 0x0, 0x0) r21 = open(&(0x7f0000001e40)='./file0\x00', 0x0, 0x30) r22 = socket$inet6(0xa, 0x2, 0x3) r23 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000001e80)='/selinux/relabel\x00', 0x2, 0x0) r24 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r24, 0x88, 0x0, 0x0, 0x0) r25 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r25, 0x88, 0x0, 0x0, 0x0) lstat(&(0x7f0000001ec0)='./file0\x00', &(0x7f0000001f00)={0x0, 0x0, 0x0, 0x0, 0x0}) r27 = getegid() r28 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000003780)={0xffffffffffffffff, 0x8000, 0x10}, 0xc) r29 = openat(0xffffffffffffff9c, &(0x7f00000037c0)='./file0\x00', 0x2ab180, 0x4) r30 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000003800)='/dev/vga_arbiter\x00', 0x442, 0x0) r31 = openat$uhid(0xffffffffffffff9c, &(0x7f0000003840)='/dev/uhid\x00', 0x802, 0x0) r32 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r32, 0x88, 0x0, 0x0, 0x0) r33 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r33, 0x88, 0x0, 0x0, 0x0) r34 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r34, 0x88, 0x0, 0x0, 0x0) r35 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000004a40)='/selinux/access\x00', 0x2, 0x0) r36 = gettid() ptrace$setopts(0x4206, r36, 0x0, 0x0) tkill(r36, 0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r37) r38 = getgid() sendmmsg$unix(r2, &(0x7f0000004b00)=[{&(0x7f0000000440)=@file={0x3, './file0\x00'}, 0x6e, &(0x7f0000001740)=[{&(0x7f00000004c0)="e2aafbc4c5bff3a95588c39623b14c61c4bd310c70c1cb8f967c73283b1249d98af81d09ed3f53f0b7063d69e750d70bfe8eaf2d0f7c657c7191d8a62c97ede9f25d3feec998e4b7f054643c744da8b916b06ea77462cb0d5667841623f22f8f8965d5d86ad75e4b6a33a04479a83bedeef9a194d759034b8605253b8c055c1ab1f44c35463855511a24271d4e89493ae7ff76275d4772aeee38af879797ff7e93647904f937b1185f3a39cc4694054bd4d5166084a3badde7d81fa65067a11e50ba5aa6c9bb6bcc00b2b6d7ba6d569395d8f788e35e45f86213087d8919c600213502922ad367ab5d8216148a43d0e6b1f7c11f00a64d041924d02606d86c0e2df5b9b3f629c7e1d48def59946fc48e57e2faf920dd3566f5020c409682006a0d772874a90e3a628325b441d487df056c915e4be557edd7995239e02e3dc41685e8b32a34928c77eb23b6be51b006542e70dc99c90c2ca8e376cc6043f5b7f94a198f344f9f5a8351c02d459b3f8e0d3131975318e211d977278e08445b110e309d889173b3407bbc7a5e1accb7b13808e6f5c11a03432b3d502be6015f5e3d6ad56bd511a2a850c3d43650dfdc11d47a167106fc93ab8d18c473dc51b6b2f5128afb757075d7b69954eb62e2754277b731504ff7aaa28b8b33634640ceecc23ce4386da46273c5eb30a7941f34d1fe5d9d1abc2a987cec744ee438458e9beff2029755339b1c51e553c9c5cdc3f1d284920e2c9a1acb3fb75c01dc793af8e62c6f7eb5e3dce6f68c00be2e23430b455878da9741d1ed76c8ffc9f6459befe475f905fcda2239b1f8e28d0802caeeae05c18996feac4c8b0738fd7672b838e8fe2934a159bdb68131a70df01190567cb77c26fff61b2ef000c5e96957e51918054f3a85926cd3c8e0b49076581b66109de0cb980ed92fb20c95218ab1baa0a49548d5bf59feba3480a28d9f34a91974edd87ddf37ddb0ffb848ea5a430f6b9a3a4fefdbdd5bdf16c0b909ec858da3a0efb41fd2cf73c05dbbbf9077673e90f36c036797884cfbbdb0b251b1d08908d4c1b20c95b4171162fd9bb73e2b1fb36563d7a213f3dbb0db26ad1a2acc4bd96fc509621cf9ee79042904fa1a2d6fe1418dde39d7e805e6ccf16e34bc49cfce8dbf24f7611429d54909957d4848ea442c7b5a0b056aa87c4bf9df1354391681a1db361906a2282652d5c80893e06ed81ba3bf757fc0c68e2118f79291e5374790caf922547f8f23ab833de8a37212fb63f3dff0d00e307db116b407bef136ea85aa639b20dc7f436c1a1995bfb31d32ebf8500bff2b9a501ad5c254723bb70ece1472e19fcc85a79eaa4c02d194eba2638e7d0dcc7f916001c0e58d869ad11c9dcbd1a307beef35573d4fc14d48979bd43e774693860fef7dd81ad95c2e187699da61c4829acc77390edb9952112ec773a92d881d385d67d43634eb971b3df32d7bd4dd9fa79f69c89f9a8a6ce07f41ecfac17ed392d0a413591466dc8f70e69973dd2e30828b91710055b4748b36920a72f7919cc487efc179b12a9c7d19e8a2c99516359de795f199dd1759e2d40574a3738c4ca1bf790ba69f8ed556d2415caeb1ec0f9a8c05467e1ad30bccdd1d74ff48ae06316585b0ab426c0ce77d5753dbce7631a1fca746b0dfab4c59e11b5f7faf60754215303b4fa8219789a2cb37ad81e709ac78255853d239c62b749f0df848133b5c8206d946b83c1462ea675adfb47d03e7ae8261c7a94fe46bb3ea21ec0657357391b7150ccdc51a69aea739b50910546cb5c2fb12faa58a16cfbc0ce1af211e815400f8db9b7acdfc2ba3b54c260dbffae85c1f1c218f2ea687d82d7d6ab0bbfa87b52981a88710f9832030a019934e47522e5fd2e98cce1b1f64529cdb74b77d7e484124510685fe940a54bd7e8d45b3d5e9ed5c31f056bb307e4c796ca90a114dc3bc9fb407e4a4bb44cb7d0690853a1bc3a210a0b9bb443813ce3be889d4158058f7b4b2d61ddb9a6bdd98f6aac23006ae8f46288ab4f62ca9d2aee7d3e1da1e47a025c433e462da82f79698b5039e68680603573c020662be6ff72301a7cf3b993e4fe5641ffe73046a061a9c93cb802d8a162e5cae265d4e5b39d0858b3464609816ce67401b55399485882633b5b7fdd22fa18c79379b9a9f89c0093befbcd098be666de042259ed17ec34eeda329f2ab44de6d0eb99f8e32325af38d515bea1c05a9a729ffc224a4ff20726eaa2fdef27943f5cfa794585fa8e6ac195d36d0067aab46bbe792b83eb4615d0e83f4b7561cbea418b4c607b481459bc6a21baa202147c80b93af5dfa20570b51a97a1562562920e864e5a73e8cfcda2255df2e1cb6777d492c2bd187ac69190c60a7f2594c692761546da5ded52a926e4a1fc7284071c507cedfcf7368c41c70c96f0fe17e3d1e16b9684f266b23e557c217740fa5922d93d448bf6d21e3339b33d581175922f130fd1be803b2b521cef95131d9cd823a432c7eb12a29b0022687dbaa1178c11bc02137b5b843e5fd6849e5f24c7b5139161b03d2482170cab5b31514246bf72d9855e133971992feab70aa02386380f2cff921f96ee7af5eda3bd3bdb1c5548e12dde9e311aa5656e5ff6245eac03e5d5e7e4fcd0d68b83b18cf2032e3001f365d8ba49e9aedd57fde6284ed93f2978ca143587b53db8f0596aeff3bc641b0766f926bddda65d01306d85ea4970bdd3a196b84164758204a2175833f010643459869907d6e622021968aa8e817aa53ee26f55ec1635c62704643340c245930c781374d2b48e011cf2dbd8c2bae968622c2d1fe34cd2dfba8207286b985af5f4e72cbe817fa55abb8481c8ccd35ca2f3fcccb69f981f95c7851d4a8e0780258373170d6515f11fc91dc45cf7cd0d6aca67d9ba42e4c50f9e89bd1b2ecf6a4b7534079da73c96c23189af04d54640acf172c0c594b3ab2b625ca2b9e351867c02f192d487c323f6c3b923f9b6cd37f2d95aa68167e6899d08a0b9cfc34748c4db895fa19ee57cd71f42bd59fb8f04a6d00788329751c5d3bc32207553031715fa64540d28aaeaecf1c56f1991b4070e8da7631b70fdcfbd73ebd36b7511ddb01ade2aec4e3be2e0439a858468ab9ad4dfe2c2a22ce31cfbf2fa48b42ff05d54f6ca2ecfd1343a9f8281361ed552e6b223b5a3195484ba0eb6278a8d3ef82d8b66e86a8783dc0ca071efdffa1a270fc2ca97a9d9d6fc3646eb718f00ee51a9ef19193397047ceab8ccbc3709cd020e9c85f05103f4ab9242e6d5a4c55b1fb0ef4c260e6eacb996f3650abb346c19188d24a2889384794ad9fbe4b6f7165ad86fbff1447f45cfeefd3841e1b5d77029ba2045c97de73a5e24193c36eeaade5959aeeb7e11ecec24e9739d3f18f49afc5c664d398cc6210c89727a840eac423e87806555ab6c08eae5ce634cd098e93b2642f9f663a41715d0ca9572aaf4be195fffbb76015c9ba3351bd3d1f7ba2125c39602b317cd14c766a1d08c88a298bd8e3aa89d1c8bcbb074f9e922878d5f29c62f0b0fb6851efd2ae8ed7129cb496dee291cec60e6fad1cb3f13bd74c6bfb6013d0da0abec095e0142994813ea3a9b342c5120a1b0cd2e4850541c1d826906d8d1787f2fbd4a3301bd20ef87cc02a51b04997533c882acbf35c2ae77804478130b6945e1ab8f8951856c3316ccb71f1d6441610a0339d4065e8dad83da72fddc6c7ca7d4076565b682459c7fbd5795ad2d37432e83e84a2741ed992eaba83923c18895b0f6b1fbb37330a86dd86ee661907ddae0c96ce33e03218f5944ecef2ffa413aea6f17345d32612d20322f554e27d5ce8e36d80de999ee9f39683cb0e2ba964cdde7e628abd5c593a54ef2e5f14ce5a4420d49fbe6b95f2a8807a74f9d85c2eb346e519f7cb72a6e758a9475242a731828516ffbeef0480702edd257fb958c385d6eb6a845a7127f2296a46fd0df57e9eee7cef991abd81da0cf750f6b16fef35d84cdb92132a9083c1ddfcdfda300484063f7d9c592e33fc4daa2c4d8d0b7b2d9b8829152e6c04fed6faddfef0b65f0d9bdb8200b4165564d4ddc89e9a51e2b38063980bf77dd8e9bd5746216f5a013bc40e21e3262b95f5981cbe42bad8e4b47ca263b30fcf6b2e44e5c877559cff7427a9da550ce2e651476f0ec0b1419015f5a0436df22ca18a5b42d5c9f213ec080ba4e046c9f241704a05bd98583e153b5b884fc2725c0dd3a17c1866fce28a829ca1ccfac4914de98404b5f5c3e86727a6309c37e613d5dd6ca363ec002eb6e474d59375deff3fb076ec5cac81e20e6bc4f7740b68472e2fbc0f73247b70b8d84e901fbc419791a2943bc67f5d3827fb703bf359b723860b0398cf34a13b40b8f194542b30a5530959b37a5ed08a2b6cd6f6122c2a3041d0b1e3890ede5bd2899c49a4dc0669445169d15bf0cecac11dce31bc9629489793077d910b63ad5bfdbf53481d11393eb00f4dc4d339f64dfd10683f3db5352312b6c26e6f8b522c213da66d570f39b6e3328b67f92ee9fb1a2c1f3ff3accf13531cb860e505c752304892e1a955cd04df318b1f9b91bc912d7e6200486b23b93c45c460906ccc70fe7ae02ac4e04beff78e240f557e863e9aedbc5c042dcf172b6f726bcefca09673be74647c69fe096a2b3b96629014dd5dd5e71a679bf1d242d26b403e2addcbf1d844d60daa513ac5b2871e9ecddf3e9756b11bdc189bd1e592c39bdb4eb87d47cf0ff95eeeaacc06867791a890cfee879d0b8c1f9dd68dacb2a006bd06010cb182d5b40130aba16fadd6634267a2e1a87507cefe4e2e5c6ebbafce68e64d69b09abdcbd654aa22a48a5873437a52e2344a9be55b48a1bdff8e0b2d9f043d7b543c8d05986ce93271bde210fb7b067fc7a966bc9bc413388dde0f8a57af8df797f5ae20f4090134e731e556fa36e87ad394e09ed8262db6c23678ac8ef693f8563ca04526740019525904061b685181eda0dd9339944b7933dd579c64f17efb6544c81169e614205e9a7e331c108cb68c1402e257a90b8864ac000588767d1ce801b62de459dd611c489004987d3f19267a28074869b724db42cbed1a805761da3823acdf6e668456ea48b85ec3b5e024786b46df72c48738aae96492d747b4625c30816b1fdc8603980f4d879f156cd0a8f7e11c485fdb5d7e20fbdeb3207a303994c41096dfd1f1a9822f2ca10d48d9eb8d1782fadab6263c5a8c147ebb0ad4c99fc615019baa17b3096afd292faa514a4fb930c9adbae35446f1ef574d901c114d43c3050864a15e3900582270aac5c8b245493ca0953c65c2f0b9a792e63a26dcfeaf1265dec610fb4be585439108be7bddfb5b9813cf15c774926e9472be930e35a3734a2facbf4550ca4eec98288584bbbe38fa673c17fa6339e362bdff1ff5ab3724adeabaefcc9c974507aa9b4b02ff9907131aa7e0a9207065ed3d9307a5ede79358afb30051206ca1bef24f969527d9ae8591f3c85517b4ff5a299f99dde8b0dd7b2eb374414cf5a6b4a4894977971d5cf11f596fd94e77656a0645157e048b6e83258ee49cbfc8bdf1b8d1e25471dcab68c564b4445d7de51f5417e8e4ec052cc6e13c9dce031de36c42a8e055be64ec8e475db8b9c670ff36e02d26fe50eadb6a1c67bab889589139f50624df4c91f1627620512da2e6a68b20448293889af45f452094d8056a0c8ac630d60b384751d0646cd23d9a50230098ce96c41449e58d09d0b225c3ef99ed5c1b254faaf9b6acd80ebc499dff5745838ed7a578", 0x1000}, {&(0x7f00000014c0)="e299226ef59a215e3652e0beced264db6f20329c5b922a3d5ee63b90287499206573ace6c589c1e7dadd719adf81330c8c8d0a9cb612ea9c243618a8fe0eeecfe42c71fc712741b6e73da27b3491bb66e0dbb379c9c372c39da640775bf1fabe0e68e97372cbb67e91816d1cc6", 0x6d}, {&(0x7f0000001540)="5f675ad2b73f201fcbf0f58e34df4330beafac6ca32132c643cd832fc45fc9b4fe8b260161db6497cf9ed861c1de407392e06d054166856c078924081b994ab7c79a88b5963d790c692e9ae8efe271c25320a2815944f3ee650cd29a158274aa85817b20ed8425175e8fcf9d2139e3fce718763c3bc37fcd51e21d50f4ddf69f715e17a4141a3d290a6e696912af021b4e3647", 0x93}, {&(0x7f0000001600)="70020a4c401defb56554a9475b12289d2c07995c2ede6ee03742a27f1b7e81e0d6bb461c62198c840cacf07a3b2178331d34a56eeca63d53cc63b94bd25a6604ff83c4a9bad4663709560cfc27d535558affb506334eb3593fa520d0a850100eca1c5ee8a8401063051466ee1209e4d8b8f41298275a045ac7f34660b97a3e58fe126f62861d68e365d5248604c321a37c5c65ddaa6cdfa2dbf86773cd72f7078f08211915707e1ed060cd01babb7ca6d18cb11c0828938a1d6f45ac37477e", 0xbf}, {&(0x7f0000000340)="dd4c830cc59b3df0bf9f424855e723507a3dd1f08e010ec72bda9fd23cad3af960fa", 0x22}, {&(0x7f00000016c0)="3bcf4713072c16a0fda65332302e4db5fb0411793c9f64eaa3484b91478ddfc9b7e314aa743d20617c3427f23770686726c0b19caf74bdb6cea4e06e8adde176637212167da2a0fe1011217a50cbbe96a0f4ffa4717694705abe4a83119b4f329925a4ebef2e6a1c6f56b4c05195", 0x6e}], 0x6, &(0x7f00000017c0)=[@cred={{0x1c, 0x1, 0x2, {r3, r4, 0xee00}}}], 0x20, 0xc096}, {&(0x7f0000001800)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001cc0)=[{&(0x7f0000001880)="044c8cfa254581ca2c36cd4455d9fb9e1a6a5eaf4db0389bd229ed8d2cb604db30fa5fbd4f66a2adbe6fd1a8a58bd93e6440e3834e16b5a720e9a08cd3663428043e2bf7ddcb5cbab86fcee4a59ee48c79876e8322ba6cef2f87f252e90c4b9d046f77e16c8b732702e39c599d00d3c626c5521f94de", 0x76}, {&(0x7f0000001900)="288805088b24df4149413904e66fd0c978b1431c10b0b265b1cd7ebbf0aa110699405f80a6", 0x25}, {&(0x7f0000001940)="99482d85f202191f7896ecd7fdc81fed4ee4ac1da409bccaa8e18f42d3571d893f718d9bcc31ecbb66fab8211c17e4cfea2eef17ab4e7ec58c9b9a334bb8eb5ac772cd7f8a59f937b3618cc0d1841d0fa4e241702a6fd0775d2e8945db4e31fb0d1c61cd902d36d6f6c39800071e309298eab68cacde91f8d450b9cbd9b8b783e97e34a33f3bee886b599fc86ad62777170bfa508bb33e9884b328a46d52829eae34eb327fc6754cf84bf8b3ee0623f476cbf7c5fa8a22da8cb8c36fb8cc3f4824bf6f3b3117f19bf532dd0db128b8042274b525046f3265af33879f6363b60d7a36aefc0d1da4c3ff9669", 0xeb}, {&(0x7f0000001a40)="b905bce4de784a599805786aa987492f3bf93cfb2217dbfe5660d51b5fad5b67155dcfeba29f23a779f0243c9bc0cdb43ddfbc0dcc903a8d431a43ba4f2e21c35499dc8768d720f8dab607052cb3afb05b1ed6073ef41ba759d8584a430e57c47eaddb5aa2b051cdafe2d03fb0413076bcf1f287bf6867401ae7837b09b29115689305b66dfc7c234127fad6687e6553a1b48c9564cb4f167b30783c077ee5e8b3197413e8484791b0", 0xa9}, {&(0x7f0000001b00)="6a44037ef66b478bdb19f661da6f4816cd74167f4eae0f6ab0e29bbbc023246677eb36650a708071f13d47c4b758a8d10e9c6a57e7a9a6d40c1f74cdea1b89825f93118d59b363e0c31bc7b22ea23757d91379a1c8f7f0fe85c4b2b43e8e648b6acf167badf830b3c1aad4041207d35c0f476cd6a9c368c01edc84ca2ddd5328056cf9f96c85d5b1582d134aaa5d8d7dda9c9394da0231dba1aa105fb36c", 0x9e}, {&(0x7f0000001bc0)="db5300059ddb158b4e47f0c253674a213c6461150ceb54c22e9f2caef319b8cae9af7faf18f508e094b36bed2878bc17ae0950630bd59fa56471230bc3c913bddd09ae9ea7049252392d69dea821b2f8859649228ce37cac0f1acddb07cc136f5236d1437a8b429273a240c863163f5e3cc9208d9a4e88fb0589c6d9389dd25ba9c3487a5cca71384010d291b7e6bd677e0967f7a25a37fe9d1cd9bd8ca9629de85522dad128db774c5b62565674284ac96a390470bf5d314fce054ab25560fc4666", 0xc2}], 0x6, &(0x7f0000001f80)=[@rights={{0x14, 0x1, 0x1, [r5]}}, @rights={{0x1c, 0x1, 0x1, [r6, r7, r8]}}, @cred={{0x1c, 0x1, 0x2, {r9, r11, r12}}}, @rights={{0x2c, 0x1, 0x1, [r13, r1, r0, r14, r15, r16, r0]}}, @rights={{0x1c, 0x1, 0x1, [r17, r18, r19]}}, @rights={{0x14, 0x1, 0x1, [r20]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, r21, r22, r23, r24]}}, @rights={{0x14, 0x1, 0x1, [r25]}}, @rights={{0x10}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r26, r27}}}], 0x130, 0x200c084}, {&(0x7f00000020c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000003440)=[{&(0x7f0000002140)="a3d693d8b5ed840abce2941e66046107776954a8d920f6f3394c9e6f189a7d92858b9b479db145daac68842131115ae6e1f170785276b88558d681f71cf539a8922ff2bf835b51a55530d7cfd735cd54132f54cde03dac36fcc33248073421f2344c6006afa214bd7b4ca65336279a941e719a612726e36895e7f88e46acb6420bc8eec02dec7d23446c77246cb7056034428d197c7fd63b233f1db87611be7d52fc7edfd79986a7f705c50de26d4278972c75cb59bfbe43c3eda12963520c7866488de5ffe127d6e3ecbeb5345b15bb78997a11642d0809d5de52aeb2b6ae4357ead367b5e95cbfea", 0xe9}, {&(0x7f0000002240)}, {&(0x7f0000002280)="e461e31346d99fbf6f1916f5051c778bbadeaa7eb3a6a1db811ef51d347adbe832d8b3fc9249dfaa10e6368a3da119b27b391e8a1aa38e27b740a5dea970a2ab794341c0054a0692c16152c895ef07a595a9620a5132e7360d8b52e0f8f7e91a424f15c5aa7b0470c9d8afd8caac36fc77b00d5f97f274ce0866d098607e38a9f4a0b8a2602ec290742669c0e0a9d091242e06eaf437ac96f33f122b0cf2dd52b26203405736d80de68b8758389b1fcebb9dc616406b5f6f8017a9621331b59eff989c630dff869471bd01e0bb8e330047d97ab00a691d054235bf44f67eeadfb07bb3b787a5df6466b2a8f86b85807ffc6af3f9d126ee8e2e897afed84e670d6ac507f951f6b9b4db40ad786a7e2918bc3e753388281e8ce5df8044b3e0ad3f0a692673763984f42a7b9b460526dcec5533c85697b84588b4792caf22262bf5b1c2e7469986a6729e4e957a2c205e5ee1f6bd3b511878199bd4fb42c65e0b2997f1bd70d01afab31d6010bb5b426fd3be18e2ee7a98000e2dab6ccd3ecf0e3d74e105b538b7e9670855043fb1fafbcb2e803cff3f11749c3cdcaa8bf2f203b772169f7e3c6af031efc9c00948012c86e5e154c3c4b2887e63176357306d6874e2eaf193f67e17956c444af16a4853a8d24cf8a212b0144310be635416e328c81eb873dbd8314c869b2a2d4d8aa3342dea786973e5742303a8d329cc64238ae1b43ff80d7650fd2ab26da63274e90ce45f6643e7d1eb7d61abe006bb5bd8c0a1afe9b3418d48e66250d280aaa705ec26a552f70b7257605ad7173a517b603b9865eeaedabac5c14f5d92ccdb62d9d46e4c9b954efc82e3655cfd0895478a9342c0c40a0414f0d7e832b1ca005e3de9c5084270701672f67bd1137e4435362aa2ac71157438594210f56335aa6f58818a77936c2059c7dfa0a7ad34adb054a5740e6f40424a46a335fe8fa5407bf9979960d520f1b124a0fdbd41aab800321b6ed5faa7ff3fc923515613ef2d04666adf25f04a88866a4c20fc3cddaa6fa2f148498bef58d1d441886a7a7e44fde7744df624a2671384c840c5ad553a4068f5e78fedb9c0aabe82098f302c616784f2467e7a553978d6c07d425bd0ba642a880c7dfcc950e6577fee1eacc0c2498ed8087a2a99beaaab4e29970f17772892e49ca1590a7eb152bbc70c800fa6d6fce0370359e87f01a953f0d8d890a429c9e63e345495e745b637bea50a76731370a24f8036f8932c337cbcc7b3f67de10b7cf32f2eb5e6a99a6721f66d59836b122380d575c7ac2d7ee2f789211357d09a4d334c5ed905a6ff3a7def3c2860ce0eb3866bccab915bc35f3f0af9d16b9e87232f8b1d46f10babd7be5ecefd05fb7005d986b8e921973fd850fcc3e02efc12a4dec12aa6823f6fd25475007c8ea46b6e20c8858b2f6a46717d6514057136019ee76395a3dfd203b6b80986b69e3b6cefdac9e4b17e73323ce521f2885ccfd0f8d4306f0e4bb78f6b2dc18c4d3b02b7d25a59759fdc01fa9b8fad8101d7a57256f6c1ed0671f0f731e953c55ca11a5dbfce150acceff2d456649b364c74c960dd9476fc665ed0fed4065d7f0a058e36ae46a5773b66d3c217e39facc6d14bd4125138347785db1395cc8f485d9e82cd322245263a283e0af53f3830bed5e3a6ab896e834f8271efcd3f8956fd7531a50999cee2add6888965977bf8d170ea6151734b76d0c08232ab92f1d4fa2fa9874d2b71fb8e5c630226a9d1dc12333c2612b24b9c2d217bda4fcdb4326d50867e9c1b722d4aff4a1e107902a9ae2de24ae07c9009c8d6750e7c6f0d0a54816acd9affbc84875403720173fab43fb7d057dac4d570e3f048968392f811208cc33ab01dc57bf894b604af67699f37bddef3001be649ce71b0428305092cc5febf1abf4d1b64551af6b937f696a9ff9d090f444fbccfcb76ad74dee595c798b4f8bba65c0fcc35de34907b16612e396f3016432b426fc821be52b13690606e0f6023dc8c7cd1f32230293d2ddca6bf8631666ad37b4fa5eb7bf9d101bf48d695d1c4deaee35602502cc5dfa5171afa263f17e43ded64caf28cc0480aa2f16be5e18db0d2a94309fcf3ffef7345e752db3b267b7c5a27e138f7cb231d172a5f7e4560a6e72713485a9f5dd1d9efc88a3dead4b1e97a4b33f1ff859b00b62a0a7c3b95d14c483b9b2399d54d8668de76f3088efc251d037592ffdb306041f7b93a28d631617dbe927a2f21e78055d93f1d9f671971486bfe370488592568e62ddb284c14c8a1717839b721c0e91a0f9dfbff5e0123e3be44271eac71417c4d473b09f8e90e336d4e3fa9e95affd71d246884f190d7cc1e17ed6ea0bd3da3af693b2702719ca1e14bc91c59e25fb791371381b71a9e7a8343e41a611391f23948d9e4f13580de483f97c0d25e6c370cbca0f6af5855aa49b5d34e00cb3d24221f885dee5d89b428cb9db5a4a4e7b768c3b7b9f3dfe90621c8e51089cb7fbba386d5a96d49c1a394501f42ec0a5b4ed5004324f0ea146a7796ba496c9d5a2fec3dbbe3f36d80cb2722bc7b641c17f8889bf5de8c091cc218fb1d5645673f5b620e207a55ba6d20ab5fd9952685013c542af6603b897cfdaae00d547fee9cb3c329c69b3c838b9f936a485614025bcf1613102508c8a4d26a48ed473390cdf36f9008c8995dbea76a12479a20206bf5bb051892e4bdbe7e165d97d62d7c5310f7aae7a2350e5553c4b3cef11e0827dcda6c472f271e57e67052fb0c9f5eec8b7d90f72d41053602cf9d399d5158a93af2d652e82940f150aabeec0c9fb7f334d0c0b45c9d0b6821e028ea63ca172d6b5e914f9fa01aa0f97c4a89f067da3447257724db967f5bbbfa43f80f4eb6a8267a29b73c1441c4114880cb1914eecaa3256bd107039fcd6b6dc7c27f2912b4742a137dd3c7305be5961aaf7cc36fbe09646d7c828f5eb35fcc15ef1c45b8ad26ad3e4a46f5d2149502e457a4b8439c2c9cd270560623b08f4604806b2659dd643d01139a4d25fdd7d2856acef215b986da934fa6f75511df6d8de1c395b9f9ac6a629996c5bf7ac11cfd1223cb806263aff62deec3463b7d10918db8bdaed22c5014494fbca657c151fbb7564a43700e0ab6949343efc0c95ea9091dcc8878fb28798f552f64e9f446f7bce50e93d4f7822de04bd237735f9fe968d6669e8f11583845a6ed75d88638cd968b2108badcd499b852103dbb81444666e2d2c692c67f38f9dbf534f9defede5d5a22dfa9e16e530ea871941f0c50df419d778126d660c5618160584a16214015c24b6637d794b3706b3051e583b033cf5321ab2626cd1b266f617865d428b12679e8c57350ad83e7b78fb775a9e5222644af1492722de0f760401b8e2725004eed088088caa2f9e40708cef125fa8f00ceea090d4121cf71dcb013172adb8ae4272ad4155cbb8adcee5033df2621f69338a9cdbdb68da55768774043e55d1ee60da65a61955617b085d24846ea2b9a52cc59a61387221bdc9d5ce7c12a124cf03dae9a7ce78c304229b2ed0c53078e91dc06798890fc9bbfc40990b58abc36bf9553b9af87bb3fda7ab543c89c3a07bfb49349e595481cc8df7068232cd440520640be51105676663be02b37c97c387bafb2cb1a9bb7c03b37e962e5c9cb3dece0556bb5f6971522fe8cc9792a3f0ba4e0d978d19568e4521186d14b61ce3923372e55f24b9ef1f6bdeebd33601821c0742f90ebed7a64bffbf854c8bd2ab13b3b327ab8b7ddfee8fa000e87fbefe88077ffbdf5b3dd1fccac3763b3873fa90bc43da91272af9e52003b6373e340cba72adfd7fbc39a05d1d2c064c8e20b789b4b7c45fa5989fdfc5d8b28cf8aeade8a0c6684be9f976ab1feabd01f186f956844e1132ded1a71c1d3f26dc72fb8f40f85f7a747e74925c607e82dae295119b25d5c68dd38872a89830b440ec61b4aee7d4325e6009c058e97210c041998f15e0af80357ef4bdcaf0ccf303282d5de5e1f8eb9ba7a89e5cc95a0c9207dc1381e8a4387c39cc9970b0d6e5cc184b23314527fe57c0d2edcbb0f746450b2f8d596c6e89455a62f2136624f425390a8341cf6fdc11b728498ccecf1e89b323e767be253d9725940880d30901860189d6b4fb3bc5950187d3f8049524a24a83c04aacbde37948a664e8bfdfe1ce764bb0ffd2d6f63d0df8dd60db379a1389b94664490ef5327a84681bc6189360ead0432bd4a600eb7273a815e3d791a50f58a39cb928def4f61987b71b9cc9cf619a77064524def544fbc8b4e71e60998a3ba9c1b3a5a0c0302712614173ac854d01fe4525b2a191e6adede9301c34e296ce4025895d7a5bb3c174c8a61df67f62fb3eabeb7b00b8a7a0b287a0cf4915b44cec51c0cba0ba047abcb0f7e83ac1d280c53142403cc18bf37895c149e24e77eba71c9670b2f6c384d095670523c018ab9b78a2a0fcd2a9dc2f700a7cb726e27d0fb3b5cb54fd171e9ebd3ad1828b2186bba262eae6d75291a7cbff69375e22c55894ca41e724fe72d9f3e0d12cc7564b4e1e58444afccfd6eb86011ce497eb59edf462c8262af6ed18493fc70ac0150bc54db7421da41a20d057db5b652f4385f406df0c518c69526227b5e4b00153fde0ab1ca5082a22c806428a91d802435c3b334a2fc606204ed0e8c89d559edd86f61c6fb1155cf9e0743f9d47b03aa5f49ba30cea12473a868da3c1f2993d9134a6e0ebe19964452a7c94a3531ff8066c51b2ea0caddf8a5ecccfb6c7abbc01338de4b13b401f2ea6c72d3f7ac32d66f41beb0718ce0049fe9c10c6758adea02c9a9ef0d8df22f083ddca0777c5655997c17c1822d67bd767a7204d0d8fdf443062f1bca166fc95b57b580747739a67350894469b5710a3ec1258a2e5355fa94606adccb8a9b807ec4e9aeb271627e6d394aa8cd199956fb1ea51baf5321d927eabad543ed9ed533079d7184e50cdf40c738372e4e9333812a1a360dce176a92a4aef32a49163143d4a66bcea970a9524488d68f02e50c097b0c6126c604e4df45c0e0a406cc40f0dafbc2052b0df5813eb3f2b54e39fe161fc4a5830a8ab0ae91060591dd594cae29c718b5397a89634c15019bae69f7ddce188317d2271928d62a6e7c901f2db5313a3ee276125f7aaf5318a61fb803641081890dc00102f554931ada8bab4be27d7cc3d0b68219ce05213ec6b3482e4755c73d80de738609833acf728db8e2c89ef47ef8613341c309223bd5d5b6b67427663403209561b2c665ad4835cd3042c81e3a29523ad4b50629d1e8faf6d3cd871a5901ee73ec3825c474b89a433718f31f4de621c149aa2225178b93bf10be1edb4b89ad97244afaed66e59cc3bd4efeea11c983b043c01bf053129c98fe5fe212b37e9a1ed45d34290d1b3fcee27bc1db1d306f45b982bf8bec6307b53b11746ef733b22c5eb1d61a28138f8fdc0b1c9d795bd5ffc210effff6cbaaa3ee72d0a52663b64eb9676efde0521e51967842f6c2a097f65ddcdb0bcc6adcf2241ac4bdc4143c64eacedc754e2afbef560aa70a5505106a614bb08562bbffff54b4bdb99bec638f96643d13e0585cf79bd5109ffd6f805fda4c24b2db9a50865ece959961f8b4224679a15435f0d6c8a023e6fa5ee135f704a27176d63a29396c1a04d48693d63d3d9e5ef5375eda2afe11aa2892d657440c6850e747a21f58b9b18af7ef25e3160550d93def2dfa5c1b67739f4fc3c2530b75d33e571b56a6027f738819641f7e45a32af8bbddad1d16c24891c425e0198b", 0x1000}, {&(0x7f0000003280)="f626b495ca0120dd8a7152496ca43d94cfda01dce942afe5f3dd40926c25e90e4876a6c311062652ab4872409167bee2293fe1dbe6c3193c73cfd45fa1fdf0458de2372b5a1184a41c88a57cd6a39dbcafd2371ce3ff1686c3ef2131e52982ce2a9d64f90676ce4d8d608fc119f352b6163f144cad7d7bd56fd466ecf3e3793faf8ec154d569ee94b7cf979987b176922f6bba7d3b8f08d47cd80b139df6cdb9fa55a8da2cb1a46f081ee238ed59368c5162e5741cea97c7a53d16ef0c42c09dbceaa7087153d9e7a9714ade4d90a3205ad55b012057a609f0515925", 0xdc}, {&(0x7f0000003380)="1513c5e4b1d142cea8a370582306d1da81868ce987e9ca9daeb16b9ef3334bcdfce0b6d481eb9edca293b398cc51b1d31d94916aebaebd206ec3ac339bf38fc9541f629a129a081efa6fa07465dc661350f3e539631110f1381c2ef8b500ad5712f5c6d8df3bc9d5ccba0deda8bdd526fe60", 0x72}, {&(0x7f0000003400)="a61ceda2d48cce5eff952f8a20b788722d576d0dba761c80e3bc", 0x1a}], 0x6, 0x0, 0x0, 0x10000000}, {&(0x7f00000034c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000003740)=[{&(0x7f0000003540)="382623205462e15a91cddf57cc1760b0354fc6f57663bc43fd0b5ede98ff4ccde8b83cf6e27a6b1ce3f645fee5d4bcfa75198943849ede994751613929d9a332b408cdac534956a0f519e242de82f3d65629d0242a72437ebbaa5bb9d0b5f10802a474a09f7b63a805ea8d84d5b73c2d89d9675dc67848b1bbafc655a1ed9f244287a9dc929241045abae0d29295c66e79ebf7a535a2991ac0b4e9239d38b51093", 0xa1}, {&(0x7f0000003600)="eccdcdb9821abfb57a0ea76dbd32f47fdab0a56a6b498c3ce285980a9c3bad3d592ba513efa2e3efa1845b9af29a2679b765b21d2414617b", 0x38}, {&(0x7f0000003640)="771326d63b033d2aff64229371b5dc3d60ebfa0888a5ccca8c20887d3e462c74be901ba3f1b990eb1c88629cc8c6d8ba95710c86c51d44a76e3dc9f9396950bb7d39dacb9c98131f6c16342841ddae8610bc0ae92220644896b947f04b74b421495b04dba236d654f4d85c9d0eb7a4ae13071bf5c08fcd89052fb76db7accd16aba6eec357d5a10572ea75289748d8896de10db811966c345efeaec4b9367a27454c6b1154b6fd049a13a124e23f38b444615877b51e5230fdef02c352266b7c6fe0c3c94536d8c3f3ef1bb60a7b4442a561edcd9d465ee2e07e66cc90f849b64bde1656fb51b4312cf755d0750780334a763b2fe189262785", 0xf9}], 0x3, &(0x7f0000003880)=[@rights={{0x20, 0x1, 0x1, [r28, r1, r0, r29]}}, @rights={{0x2c, 0x1, 0x1, [r30, r0, r31, r32, r33, r1, r34]}}], 0x50, 0x1}, {&(0x7f0000003900)=@file={0x2, './file0\x00'}, 0x6e, &(0x7f0000004a00)=[{&(0x7f0000003980)="768b90120977dc8abe71a3e67c72505b711c1e148c98263933d1cfd53a9797eb0beedea80957ac33460bd36505ca56f42aec426460a780e8e72b8fece44cec23e16251fbce7d4bb780e90c2909c4b6d70ab1cf05f4e0d46f62dfee23abef3ab9873715e14c287edcb51541e9", 0x6c}, {&(0x7f0000003a00)="819218085750e4cc442d62972d4865f75e95b846307559be5875d6cc5a3e5aa65d94e6f868ebc96c5c1f25cf344036a386b60d415e704e568e398487ae8e9baded3d869a5ba6634dbdc5aa22c481ae4e2ff46a0a42d03d062b52902922763d6dcb9cb5393b7071fcf2ebd5aad03f1cc542b95c735341a17586931f5906bc991537a6282c9e61307027f5562b546e8bef1bb173190eb98e08dac7b7adb59605f2e0b00ece7301c9380a0b3f8e0234ec5ab2b416c763d38b404a75a3f9f71b5227e6329940b3729554758007c61e6890bba5070c24cfb8e08906925c399041f9564f74fe7cbeb03f23f3382f35b4cd20800aac0b692af7c5cfdc81b8a5e04ead8cf693bc451eff34c1cf8efec2b8dd4a6c9a0ab6190c1d81420dd878c39ccd6c1884cea5e11cb98058e39820930ff73099c771f19bfbd56cc610b14fd462fe83c126f15ac7e7762dc0a3537650807e7cd9720b3d952e58874d80170bab1c4d5379a1a836ef4ae81fa171973659fdda33f40910ee9a5b2361123657f37240f624661911d3b6fec89fd8ecaebab7dbe416b72a9a923ab774026b42882ab89f23667288f5d036aca80ad91196ea0c3d0153911a966d11c10fb9e08e24cc756bc81594a0fd991f4b3a84457dd339c1ba7107d92e93ec243d10889255f1b64debba2663822f21d6c59d539ce5764f6f615c0866cddb041186358dcae165db16b2261e7cf126cb1ff5c31dff02ae518ddf78e69898e472654e76ac6808db6263c883333e96864c1a7ab49e6929396765a8e8ba8ffae620a1b0990437d8cca5499cd4ad07a37941f78fdba9db28ef9f727f51393c495d073b1310f50975b8955fcae553fe6c8a1395e51225cc7ae2ae39f48244b10e5aee6764a3a678164863919858819189f00857852590be315c2628b37799aa1d265232274c1e2e1171356946769204f4b134eee11bc1c031ecaaef3a4e719666f3ff1306e9ae362ca2c00d837b6f1e2dcfd0a981320cabcb63cf9cb4878d584dfd71ed60edaf0bd89c2d407e53863f7f57bf8a856e81af88ab1c0abb76a94114f649309054a62d639c240405674fe816dbaa7812506e97d520f4dd4b9e80d13008ee2ff281046875a6a749a932a0ccca322426d7e4cb21e910a180cc583ed946a2ab1cd25b3da5fb8572f7a6a23f0903f863de51efbdf86f08025a17bd55b8b4aee26bee55ab865ce09480c12dde2fd005a3263b48d2c598737b4e3d1451ed0922a420b3665432a4f2a64a07609ac980b43c0b21e4fc8a1136db7389c8f148027a8c042cf2eba06f803089273638c09c77ed3aa9540dc28187c1b6e8c350040f32466347696841d73c98c73d8dc7133f9de34afc268a1fcd62fcbee8b76f792f1c6a2bcce3444202bed50f93d8eea66921b36fb500c59cb993540925950ab1d9129277fe88dac438b264bc2d22e83237e52cf5d89b2db8c44ea9610659f9697f84ed6b87cb30fcbba2965fa5603321cec927396977c6813cae6761bab10bce60b65662375f7720129f5d8c3bf2bbc109687970ba25f8231b4bf5d454ae080de5080aea14deba9e5d4b1eb481353946de7fcdd82f0b54ae34ad6e74f9a7c57614426af19de8b0daa0fad743d17053e874553c1fd451cf7e6c0c584f33c1f094b0a055eca4261cd457b780774836d095c243711be0d6cd148f0ff3b0db6072811ea3b3004a9e5e837a16e78b9c3bc1bd8f23c72c756c35e32485768d49823fd56d2d0447eea39ea16731f494166948f8693773f0515da2769f29e689862c830bcdbc53dabcd42ed60eeffd9b80b799ff620e007392c0490bb0e2a29e0a9fb84f2637f833de87d15a5a855c2ddc767826394f2d6e9e9477fc608a3f4be733b9801e3fb7872619829f1e69efe6b440f08a262041dcd1b90fffcb2faa1903e434d0b7529909c560535cc03f50fb3ca3971fe98f801d3a82758fbf512969530106694ecdaec0593374ca55dcf717a699748fa8396942d6680999ea427ba49b104a9a8a1f720f7a12f6cb04df04fef173cbf48d137ea6db611e8cdc591197359def8443a5af5f708c5c2af42490b4ddb9904287c1c9ef481c64f7f6f66524a0ed28cadf34437a92ca9fdad6cbd07deee44bc089aa39262cea2db0d843a57d5d07b24b73f63ba0e23cfd11f6d0b30dbfbfec1f83bbf6fc2fca96b05dcfa5e55ed0bba931a87147dcfb02204849aadf2cd1b2f7ec0981f55968a69fbc564344e44cefa743a37bfa52e3d77aba369ad224d6da22a1d2af6d88ebb63c327273147bbff1ca9cb8973f64ac7d47b230ebd73bec176cb5e44772a5f21818aa6aa15754350c17a3d6fa08e96b7f303255b1cec98623d5337606183820b4b079bd3db1c8b168d446ff9ca0a24d881c3848ceb69757d15303048f2c3572361117fab358adfa80b0fd98fe928495007cd7fa0e92cc6ee4ce03117ddf6bc53a91d86398895ca330a485f2b366d7f9f704f1ce3a3695f4d59c201c5318cc62480be62e1a043fde78fb60de96dd4c49be856758baedb42d9c758fe4111c76b0518d21e9808e6e32410ac236bb419b8e4d11c6455b4120208d4bcdf9d5e6b412df27a6bfd6f3616ca62025f1507098f70a0ed0b1eb59ae2d4559deb794cd57f45976a3a1bf21ffa7e1a7dff5ad6c41b6c1c42c2f0ef3cb15be54d89c2c2900adb72e2a54cef576f43b3da3ae1725f9774c739d07977dcdcc5c4666d144989d6067dfbb71a1980283074215eafe2d31babfd21a68a3f2f2b93b8ff487db6d59b24c544be361d29bcc2789a69c0d548d88cff65168f5effc451969407eb53915fa25c0cd00646294d3d8339bb2d2d612df8f906dcf7a3e23d033d9deef3589cfe092e1466d72d647df8f60bc932bcd2ac22e4cebeb2d0c780bd3060fdf85723f6ad59bdf79efef8ba3b1e01a3f4482a8d3da46b1b19e5e48fe74c9cc8c26045e008543082c6afb2f49eb6d7f117468b153edb5f3773cc5d7ac2c30ca5e177d5ac6a7e251762f49616178b84f1a57770954054f4656af7ee1ecc66562d6f2dd36d8661f93d1156cc487bff0fd4ae4092503ce0077d433fbc729ec274725a3708e9f1609c9e04b7ccabd739fe9e2cb967c74da22155643c56edca6a914c4588619e7f7f2458d7c1fb2e483d8478bc74019d6faff8437ba9cbeb338dc6ded0eb347a5a17961f2bf4a25085cbd3f3a879ea4942b58167fcf2ee9b8a80ba9a1ca0af7c790084dab8043f08ca579d87a8fd7d657fccb2915240a2d183392644cbf614060d445479e43db06f8bcd09e0d710a0840e6ac96ed0bbc5e6f71b5f2971eb048e364b2a94a3bfa0178a3fabb7ff3fdfd550577124262fff005e60b89d22940caf95fd3e40d7b7ca350a88d0f613c63c6194b0f3a0c63e376fed6089d6136ce275be22739c7e51eb022f7899b1e188e6b83ea2d65ef13358d52d28cead231981c042a74bf4ec895676e49111897953b6898aee7bbb53afaa90f1652577eaf228bd5ea7ec4d477436c5084859ec131993ddbab23225380483571385b7574b5c7eed1052453532c3191faf1db8b8413072a94193e80f8708d17814fc38f84d324fe0c74e6c9b717d1b1f0fabdf6a7cffbc5b699aa71f09e73fd2c1b9900b4e7e98923ac48ae8be8c0d654a1da2e72a14dea0f5726ae3c8e3f202062fc4e534687042e01b4adfa50a08f36a20c68c46e3190d873d28124895ecb345281e9f008c2de90374be48518aadf7f65a29eb5a05403f9464abf1119f3877656b76c94d37cce9cb52a882afcee8728dff047e2e3dea101a193d8d7252d1c25ebc315c123768ef0c7f259cfea437e78bf529d5e3ae2ec09ba1eecfc139f41949e13703015ef020f7b005deafe9b5c22c8656caef5b977912531d57453582f32b5e75b919f6772a3fb3ff537c045d0f46135a65a7ddbcbbcd17df9874ef45b7d2238012ef5a2a7409ee21ecc743a4a8a2138a65a1b5098d92f893d0d7c86ad579a0e824e2ee8e3bca9de38ed0f505780046325c7f401bf8322307f6928a7730e310fc73c25e8f38b89b8186d87b3487ddda237d5f2eb1b2f8618337c29395837414cae32cf65f820e0c07e026879ea71ae2afc79c8df1adb5c6161098f46c31311caee5e16e0b4d73f8de902ed20ec4347f4c5dd9edcbdb4484b1894e65a5ef9ded28866922cc106b44ade13d227a5c020a74209bf21cc9368da35bccedb4864844924c79e05db4bdd9e2b6778b7f0ea21ad74ad93dc094d1fb50dc1cd759a322a65c6a37d1c1559b85ef8ba92037b26bb5105731f0aeb5cd1602e096c4d97a2814b07d7f29adff63191cbc11cb662a48f3bcf966a5d3b5628599859c71d4a60dd78b7567da6258257f35eb450e9d632dc39d0b3e86bc48fe0cb32b93644c18fdc7ad7db8fe2d2c5a87683ac9bb9a164eabc94db444f7d0cc90ab189fa9e3597406d270bf9f0f88f164fcf4b4eda2a52f538f37e2e941c91cb52b01c7665a5060aaedee3625203c6230bec49c9669b65ed403c8fac01f00cfdedca77420d404e4095480b64a30abe69f6466834769000054696f797220434d9366f67719e5cf7420a984bcb9db104df4d5f4e66ae5aae0723ffc51ba2fe22959cb0455bff2e46a18d4248296178be78a7e009b0559d79237248aa811f1eb6ed90361ee7af2967ead11328eaadfbb24e2b2f194cebc657f51faa42b9dfa39a141d8ddf615e4b01b8ff6be5866c6db657854396f5234013c64a27ac0ff4384bb42c68b10d7f1b8b1938ca6f1a5a0fbfced602f3fe063923c582d455b65b9fa442a2fdd2a0f636c49cebeb897deb901befe8d725c4442957d0e7c7425b92ca2719535c4cd1fc32c561778722671151c5700340c06dcde5a9693076d3e422d625f6a37514f13d75cd74b47d62789f8c79c5165b512b8b8b1ef1776b3af780d390d69d7370a28caed24cb478665c8f43e5f55739d7e05c0f0b223e83602ae5780e654156ef9429c16c78f58116a6d0793eaf7f9f9d664743753b666be124e616c00a903bc7640e4e7c4bacd9dad64325d301cba409468d6f490e2cdad249b641638c83e7fef495504aa01ae64947952a80384085069751486caf2dacffc18fba8c6c6447110b8f566b798ceda5c9244df0aaace7fab589a6d7dd1eacea7a06b6e01ffddf6f4095a9ba6fcd5ac7ef9651d1350d631989039bc6ff6c8256e6b942b87587419e430fa506d0883d44e98115211b7708ad35a82e0ffe322a6f8d2ba03291a3bc76052e5dc223410b06b6b7e77e9c7a4f10ce93a15f8a0890c1b2f6ab5584769f55f06123cc8b1882652bef10e9e0a6e9c14acddfa30b4032a6fa79210e37a574af3c86631ab90122e5b22eab9c19528b1f55308eaeacb5852e1796dc772b7af6e2aba696830b8372d0842fa580b751f9703ef50e54c2e2a371fdda78ff0a703316a8a385b253a678a66ffbbb20b0ecd24eac4f43576d9fdf01eb46b7c01de986e106c598e9faf175d661394e32334c6ef766a9097adec1376ec4e8db3b80e0cacea9def090a9f047969875b8050b4f162c5b07ec9ed9190f13a6933066efc3edc577d40453c56b5108c2536f993eb91e37c284226b50f7344c3921ccc94e8328162c51344748c9a245c99cea6f089396ba7d3e522344f897c261555b2920994df00705573e4b75910ead43129a3e5b9c639a19b8f4b3535bdef7f517293d3df3bbbd7d93401a926299b84c3f92127766e17d2230cd4a30d507078853a23f8f677c5dcafd03632917fdcda310a18d86cc226d36c488fb76bd6a5057c07c1e2ac19cfcecc85b083b", 0x1000}], 0x2, &(0x7f0000004a80)=[@rights={{0x1c, 0x1, 0x1, [r0, r0, r35]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r36, r37, r38}}}], 0x58, 0x4000}], 0x5, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="ec3606bee311d4f430ee6c5ee94561de"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r39 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x600c0010}, 0xc, &(0x7f00000003c0)={&(0x7f0000000400)={0x38, r39, 0x20, 0x70bd29, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7ff}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) 17:04:12 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x7}], 0x0, 0x0) 17:04:12 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:12 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:12 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a62730000000000000000000001010000000000ffffffff2a747000000000281f95663dc5d15be30f5c3e0120d68473b1f0d09e3630ae", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:04:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 215.920456] binder: 7501:7504 transaction failed 29189/-22, size 88-24 line 3138 [ 215.925032] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 215.941092] binder: undelivered TRANSACTION_ERROR: 29189 17:04:12 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 215.966070] binder: 7517:7519 got transaction with invalid offset (24, min 24 max 88) or object. 17:04:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 17:04:12 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 215.978534] binder: 7518:7520 ioctl c0306201 0 returned -14 [ 215.979854] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 216.005093] binder: 7517:7519 transaction failed 29201/-22, size 88-24 line 3379 [ 216.022346] binder: 7525:7526 transaction failed 29189/-22, size 88-24 line 3138 17:04:12 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 216.022501] binder: undelivered TRANSACTION_ERROR: 29189 [ 216.063377] binder: 7529:7530 ioctl c0306201 0 returned -14 [ 216.079464] binder: undelivered TRANSACTION_ERROR: 29201 [ 216.097388] binder: 7517:7537 got transaction with invalid offset (24, min 24 max 88) or object. [ 216.117235] binder: 7517:7537 transaction failed 29201/-22, size 88-24 line 3379 [ 216.126343] binder: undelivered TRANSACTION_ERROR: 29201 17:04:15 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 17:04:15 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r1) fstat(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket(0x1, 0xbb7602de3664fb1c, 0x7d) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000a40)={0x0, 0x0}, &(0x7f0000000a80)=0xffffffffffffff6f) setreuid(0x0, r4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r5) socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000980)={0x0, 0x0}, &(0x7f00000009c0)=0xffc5) setreuid(0x0, r6) r7 = socket$inet6(0xa, 0x22501871752654e4, 0x0) getsockopt$inet6_buf(r7, 0x88, 0x0, 0x0, 0x0) fstat(r7, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000380)={{{@in=@loopback, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f0000000300)=0xe8) r10 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r10, 0x88, 0x0, 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x5) setreuid(0x0, r11) r12 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r12, 0x88, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r12, 0x29, 0x23, &(0x7f0000000480)={{{@in=@empty, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@initdev}}, &(0x7f0000000580)=0xe8) getresgid(&(0x7f00000005c0)=0x0, &(0x7f0000000600)=0x0, &(0x7f0000000640)) lstat(&(0x7f0000000680)='./file1\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r17 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r17, 0x88, 0x0, 0x0, 0x0) getsockopt$sock_cred(r17, 0x1, 0x11, &(0x7f0000000740)={0x0, 0x0, 0x0}, &(0x7f0000000780)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r19) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r20) getgroups(0x1, &(0x7f0000000700)=[r20]) stat(&(0x7f00000007c0)='./file0\x00', &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r22 = getgid() r23 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r23, 0x88, 0x0, 0x0, 0x0) setxattr$system_posix_acl(&(0x7f0000000000)='./file1\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000d00)=ANY=[@ANYBLOB="02000000010000000000000002000400", @ANYRES32=r0, @ANYBLOB="02000100", @ANYRES32=r1, @ANYBLOB="020000005d42cd5c53067b49fd98954059deaf58389da72c59", @ANYRES32=r2, @ANYBLOB="02000600", @ANYRES32=r4, @ANYBLOB="02000100", @ANYRES32=r5, @ANYBLOB="02000300", @ANYRES32=r6, @ANYBLOB="02000100", @ANYRES32=r8, @ANYBLOB="02000100", @ANYRES32=r9, @ANYBLOB="02000000", @ANYRES32=r11, @ANYBLOB="02000100", @ANYRES32=r13, @ANYBLOB="040004000000000008000700", @ANYRES32=r15, @ANYBLOB="08000100", @ANYRES32=r16, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=r18, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=r19, @ANYBLOB="08000400", @ANYRES32=r20, @ANYBLOB="08000500", @ANYRES32=r21, @ANYPTR=&(0x7f0000000bc0)=ANY=[@ANYRESOCT, @ANYRESOCT=r14, @ANYBLOB="addfd610a12684605162cddfe35bcda6d235640617474414912b1d7c6149ac3b8b8a4a31387fec4afc07e605a4fcb3795f142ba6c097c293329030f3ff874dd4e86ff01a9661b10c04bb91f9068a03a573dea45080d497dc331ca73f1b52b8305fa1389fa6da7277accf92238d4aec112efcc881a4ff151992", @ANYRESOCT=r23, @ANYRESOCT=r6, @ANYPTR64=&(0x7f0000000880)=ANY=[], @ANYRESDEC, @ANYRES64, @ANYRES64, @ANYRESHEX=0x0], @ANYRES32=r22, @ANYBLOB="10000700000000002000"], 0x23, 0x2) 17:04:15 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:15 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/148, 0x94, 0x0, 0x26}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:04:15 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:15 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 17:04:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 218.915024] binder: 7543:7545 ioctl c0306201 0 returned -14 [ 218.943941] binder: 7544:7552 got transaction with too large buffer 17:04:15 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 17:04:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 218.966517] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 218.974731] binder: 7555:7557 ioctl c0306201 0 returned -14 [ 218.993668] binder: 7544:7552 transaction failed 29201/-22, size 88-24 line 3493 [ 219.003109] binder: undelivered TRANSACTION_ERROR: 29201 [ 219.009339] binder: 7544:7566 got transaction with too large buffer 17:04:15 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 17:04:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 219.035233] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 219.044962] binder: 7568:7574 ioctl c0306201 0 returned -14 [ 219.051467] audit: type=1400 audit(1574442255.200:21): avc: denied { getopt } for pid=7546 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 219.075317] binder: 7579:7581 ioctl c0306201 0 returned -14 [ 219.130592] binder: 7544:7566 transaction failed 29201/-22, size 88-24 line 3493 [ 219.147953] binder: undelivered TRANSACTION_ERROR: 29201 17:04:18 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:18 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17:04:18 executing program 1: openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x800, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e061536bea7f41879604122687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3", 0x1a9, 0x400}], 0x0, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x880a}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r1, 0x20, 0x70bd26, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x8000) 17:04:18 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 17:04:18 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='\x00\x00\x00\x00\x00\b\x00', 0x0, 0x1006) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:04:18 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:18 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17:04:18 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0xffff, 0x8}, @window={0x3, 0x35, 0x6}, @mss={0x2, 0x80000000}, @sack_perm], 0x4) tkill(r2, 0x7) prctl$PR_GET_KEEPCAPS(0x7) ptrace$setsig(0x4203, r2, 0x7f, &(0x7f0000000300)={0x19, 0x4, 0x16}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:04:18 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) [ 221.954632] EXT4-fs (loop1): VFS: Can't find ext4 filesystem 17:04:18 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000280)={0x1}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x1}, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/33, 0x21, 0x0, 0x21}}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:04:18 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17:04:18 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) [ 222.062597] binder: 7622:7629 got transaction with too large buffer [ 222.084746] binder: 7622:7629 transaction failed 29201/-22, size 104-24 line 3493 [ 222.095133] binder: undelivered TRANSACTION_ERROR: 29201 17:04:21 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:21 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) bind(r0, &(0x7f00000001c0)=@tipc=@name={0x1e, 0x2, 0x3, {{0x40, 0x3}, 0x2}}, 0x80) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000180)='TRUE', 0x4, 0x1) 17:04:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 17:04:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000001c0)}}], 0x0, 0x0, 0x0}) 17:04:21 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000600)='./file0\x00', 0x2000, 0x171) symlinkat(&(0x7f00000005c0)='./file0\x00', r1, &(0x7f0000000640)='./file0\x00') r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00 \x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r4, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r4, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_PORTS(r4, &(0x7f0000000540)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80008}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x4, 0x70bd29, 0x25dfdbfb}, 0x1c}, 0x1, 0x0, 0x0, 0x6602858598791a6a}, 0x8) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r3) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000002c0)=0xc) getresgid(&(0x7f0000000300), &(0x7f0000000340)=0x0, &(0x7f0000000580)) stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgroups(0x5, &(0x7f0000000480)=[r3, r5, r6, 0xee00, r7]) 17:04:21 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 17:04:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000001c0)}}], 0x0, 0x0, 0x0}) [ 224.954278] binder_alloc: 7639: binder_alloc_buf size 2097264 failed, no address space [ 224.961063] binder: 7644:7649 got transaction with invalid offset (0, min 0 max 0) or object. [ 224.961089] binder: 7644:7649 transaction failed 29201/-22, size 0-24 line 3379 [ 224.961239] binder: undelivered TRANSACTION_ERROR: 29201 17:04:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 17:04:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000001c0)}}], 0x0, 0x0, 0x0}) [ 224.973955] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 224.973963] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:21 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x88, 0x0, 0x0, 0x0) mount(&(0x7f0000000040)=ANY=[], &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='virtiofs\x00', 0x0, &(0x7f0000000140)='ext4\x00') syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x4, &(0x7f0000001300)=[{&(0x7f0000000180)="6a60290a49638e27ce5786f4442ceb26811517b9f840ef9d4c00136915ea81ffb6fde1676825546fc62080ad1f3fbb5ef985e39a3288b191f5c2", 0x3a}, {&(0x7f00000001c0)="6e78b44d2364f7878f425c333f1d4538a22626153ce00da999d70cb7b2dc5ee000f6946d10bfc54cfabef4b0d7424c58a7f898f3d38c3e965e3e0a1ac754bed0de58a1f7a87803f7d57f1edc2e4109b431e0cbbfc83d8249740fce43d31a22bc919adafa47d1ed906a7ef2ce70f1f8ad38afc2a97868371a339940d4fe6094f1a9f6b650434c6486aa8d8b09f7a39bf598b0aa6e74ee6b00f85f0605bae043535332ceace18ec6b8928636186ad274b5c0fa53639ecfea0c8aa354a0137a299bef81ea87a826f8d353583d7083121f80dd99edd702f2b7c3c2517c35f8708290e0c3fe0f63f5f66b0c5f9f1ed423ac43ac41663b8d076d9049b5c81789106cac13dcbab74122b452e0e9fa16682884b5f56ed048193909adeda75926a14d5f793a1c8282f4a1e60bc5108a5403d9f3dca1e4787796c84c643d585b3289ec287e89212882f8b08f73fb33d9b26ab152034d53cd9782b2752893b1412226811d22b3e3806bf23ceb3454d58ef48a3ba2117ff71621707112758c785ac5d943120872cbb48eb982dee3cb0d007267dadc6ba5c63be66b20ae696572629224064c29ee5b178a507050b119831ce1f2d0fd6533aa46212fcf3afac6dc7605b9395296fa079c34a8a2e8acedfa6e08737d769a4c777ddda48bd9ed5d5454fb5bc2c1cf78ddb41e26fb04ce2a7e739cffba649a27a2d5708524e89affda59ef06eb33b308a85d9c53a4d2807be90fba58f85fe4ee251d8b6ea4317d7aa5a17cd0a393e4df00b734d741086034e2ec8511c8ce7590f414c37291eee71e2e2675d60290f0bd094c9dcb068e6ce5ea779aeee8e6ad612353b13489a55283051a50f35e1fc17b01a0f0fb7a39046befe480406bbac048d9f9bd4c00e6840b608d40d0e91ca308136526e135be0d3380283107269cb9010abf871af8183d22d527c8c625aabac346bde35e6e1883e8834e91d42ebb7e09ba1adfc7d2bac4c0e8c6f0fb148c8eff0da48ef21c5fa578b8abe6f6b1e78a46bcb1149cdfbc1c452dcf6c69076f209102c7c0290912847ae85d4b9ff6b75a80224c290d92fbfc2d31832d7d420db7ccf54fb6fe4bdd7a2036f2c4c17aa0f4ae5c0bfc6c3db05d23cf89223481944e66d8acc6b2677884d5b716248ef023707dccd7ba278e04cab1b017e5f69458af398e0377b969fdfa46be4dfa9882453c312444daa53897d721ad0201ab5a94fa8a1cdb94d3e9dc863b7d1c83797714152f4c4ab929042826abc41686ce9fe5f4dccb5ced5e320cab9496b59019c4c5bd87808bfbef2d9afb658fb2b21e2fa525da298db837aa6c1370fc8891791929f70e90de4096d397ab352aa67512f1506e628a250d1cb2070e9a4edc502c9e260c85162f15ff0592eb1dd37d852a09b95a56fa4a6a967bc3872946a03747457314e7cde833e1d87277f7dd7b8252eb1fa5b597ac9c9a5d43147f4a1376fd7aa8406213167e863946a356963cabfe13119bfb4a90b49f54ea9d5791d7fca0ab1ce0c6e4b551518c54d5d82ab371e750bf9b4d32eafeb52b5c2f48244c169f5a2e7f520fff889ca103fdd5a0ad53e5cc364ee48fc0987e78b812c130675afa0a3f831fa8a84a390466572cddfaec260c5cf315e68121fa31655c08974a274e9d1575e9f08fce7e4c1a2bd9bb0b8b93a9b483c6d41d56027d9980e6dd2aa09a05dd07492edac142ddfcef198b4d7cf098daa4f9ae80d9bacfd8029b19abe6e1ccb199485b47710e0236126e278fad3a48422e20eb3c104bbd12c66c450484acc6c3ba6515816562afb8e55d510e675df200365aa4b146a2fa5c5bfb456e4fb00d6a295fcf77736f542204fd463a0e8b8a08a84e07a1089be6debf5b027d335de59d5757ac5e2d945b712fcb27fe41040fcbade38ea4df5a6310cfbd367552689eaa3fbe9a5bf890b1278a60cc51c959ac12fb75a1c5fdd4791b2333c7646ece86c0e4aaf08c2cd52fd5dbe14b539cdb8e59a55ccc6e5ab1b1883c0f420189dc4a7cdac0eda1a8affffb160d207d40bca64d4f04ec6748377c4760e927b5a40ed9e5e6a70bafc28e9955bb2de8ded5fb2fff682325c3adab1e64386d350ec6f304ae0af14367aadee3f684c7b19f7986c6c18d64a448a6a41aadcba924b8a871ff06caafabe72c3de5b978551ef823b451ec9ee4f2ceb90fcfc229e2e6e2878086ea0ec738e5471a39a69185a2bb8140017cccb485dd93257662bd53d99766adb1968dbe7d1ca00e2dd1fb92d887a73c1640f451a217f4a857e39b756c5f46867723b27bcbc186b8ccdb07ac38b8c73e88445fd76a36f556d4c6a7d473424f4301ec750e8c204b371b1c72b970736282df22bc2e3ba52b81c0cd2d6db948f347f86f1f89121ec0e605866166c3b4e9d99ce6ca0cabeb56d30c2e443a59361c9bea269f5e037503e93a7a1c00967a9b714427ca7668a32e3b47ab17ec9542d9df3ab21f11cb6ffdb211769015672235d350f8c3f1726462db443fff1c11d9ed169c3caa7ef373c7f3be468786b5af4c522682cd9fcc01e9aad7669f557fbf9328915836cdbeb410960cbedcb42f62d3205b2be3bc4812a016f33c41aa30889c4ef29ac427fcf7eb965c89d1e5e287d1aeefe0b779fb8d675e20f33e41975d336e00d1a509d3087aa3613d41ec84d3bc3886ae7e572c1263801427d74d1b8769d5a9b1a42e4fdea64978d9c3ed0f82cdda4ba93b7daf95bb3115db777437a3d148203779688c683987f2f098546cfa4c0313a652ad2ef17824f6d44498dc161c8883dca46468a37c07fb978f118c2390c8aee69c4124014a7c045eade4650548223228d2ba0295795d10238d633f311e6738e00feb7f2520ae3b4e85d317f0ff7f4f2ab8b0921b1462d75a4c1f9952959463eb4197e63cab433a1f2fae3c59bd25370c2ad84e8f9082ff9393873455bbc227fa7b5b916c5f2efb452b11c3f655d8ce651d2724f2f1830c7704f24aa90f631080ff6970a29b06432732f59d8bf8d0b5ba8f626027cb4d1798495c3aba12845b9fb597d78d1849668b2027ce0b5343229475b73d732d9d26a6ad79089cc86a5175662a0ce3041cac352c9c8475307f71d967b89a50a3e903116e50fbdfe0e78814891c808110916a8d6504b3b281c427c6211e6fb5aa45fffe817d51a454a4cde2b40f9b5df951cda26b0353dc6791b524f429617038669977181e58c7882845ee570d602e16392a3d9047ab337916d6586a2109400c26359cb5488801ca9b651a37649ce9ef21911c94a656b5ee80bb024a450dea25e6bd5720c629d8cb024d0282927c7ccad72d177f28ca0d34f675470b47ca8e1e71a58b5b9333f8c9a6d19157908b87cd35c30b9315cc38c0ab9fbbfef2dd37955a4ccbaee8a5eadd1f5382595c6349d1a3b3b6edc91ccde3a4dc916c744ce824250742404f89a22baf6e0550bdcadd8a21da6851dd02a4ebba04169d6221f77960a67e1b0f245524205f2853624602afc4dd415305ad2e4de1b92d1e5c25fb2572ceac79ead870eb0772a51e4d31d336be6cd74c9c05ba7afd56711103ee41a7722a90907a8621b6b33af0a1a4bf1da14e4110eb4fc1290fa85fbe57e47599b50929c392fd41f8378dbd29059813826403fb7935915ea5894d780a7f9f0718f0ebb8202d21cae67d9c6658446e4658672a456b3c85cc71fbfd2a20bd8527f6dadbfaba7abf5ae8746dd684328b6deb3c59c02a5f7384327818d08a42e9aba0e9a490102b2c6861cd2397e053e42f897bd0797c7aeb41630f152b7d5ba8ebf3ccd136473e221ed78f0b9e58ecfde0ac171f6a33540345df7bfa158b2d75afbb619798de5b9b871107fb3a047f0d04bcfebd88d974b99a1d26d9daee8ab38a1150c75c269e8dc0bfb2a9806fc5f6ea3d448cfdeed348f52bb30d9be85d5bc05e715d641a505438cd25cc73bc9c1de6f25e54a7572d14f0b6a0278da2a83cf56206a55faf61e72ea11198bde8dbd866862a20978fc846b0c2bc5e53de47754dbdc764017cf68636b34956302c1a1afd0069be8e242481fd317733c05a81a5de7fbe00a15d8a944c549940ec822d1db33e2f04188b0125f3d3ff4bc540a53ccb791271f67572e7744ecede3308eeded29bc17ac024b681e256e18826e12560ce546f39279943a3c30d655d17ae10d724b6cbf9e8b670082f53ce0552a9a0b78bfe1ebcabc5c688fc0e854c8c6c1bb9fc7df124a32cf427d347bca7b639f75c449a174b8837c119a3783c795c344aeefd5bb5047d4af0bb5aa4638f3aede311de0e624ccf3d3e5ceb21db2213eca527394b804bc5b5f752f924882ae2101fbd15605304d2c266516a15d7ff50e004ee3ea426e4e7b3b50e157c82cac5db4500d38bf9f9cc1179a0b79bca2e04722b7948837b343b4d18fc41b0b1a0c8412f085ca472944f1e9faaa2b4e5b22362ff40c280cdff118dad4bbd5cfdf9ff4466a3b6684759c8ab88431d2a60bd75cbd9b8bf307c0deb2b07d18cfd9b46e9b2a8f5f7c3867a9bee46816860f347e06a506cb9357fb5a5631f0f14bf0b907dd43338cdfe91c5b46376caf1a4c1a58a85350da3c858dee60a384aba742756d6ce56c759e5218134ce595c88a06b5487091d26e6bf6a91c70222037cb38d67f7b7dc36e2c92deb4bbb6c0f93eaaf02e727ebc4bef52dcc802341843b661cf1ad406155e29be2182920517f63011fc32e621d237a141ddbdd467b016f91eeb1eedb948f008e6b830b864075cec826033a8bd12f3d1718f7e89f596fcc6aa8651761ceecd8b9e0e04e8ca251c9667c245d645f16fabaf81aeb7c338f6143dc7254cc9ef5a3c8262daf7274dbedcff4bbe1da1ccc2ae189dee991f13806da89b49bbc40267686957e8ae2b13d84d653cc7303cda5f66181149ebf6f44b3df93b4a2620f2eeb773621122ff86b64aefff712abf2e776fd03aa51b688699df1f086e530c10186b53a4e5359f2ad9889535b5ec4ad28621b5fe2a6eb4f3bb36a299135ad6aec7a55f9922b0aa5e610e210a516078e00ecadc315a2bbc49c6261f001ab87df77c3dcb1d89246ab3e93c1b2a85dc9f95dd2d4bf85451d4725c620a8d5fc25bf61bd915fa6139f601f79ab0b4be639c991eab592e9cdfb419b19325760f01e9cb03da064e73527fc4591a88cbb51bc8807385805a69646df9b7652905f347c2175764dbfcbdd51ce9ea438432c5359bbdc99caac0de064818a58709aba9627dbef5823db55f06331a8d3d0098d26c73589aaf1bbd1cca3def2ee35771b0ea20c2a4a69f5d0323d6a12f89892b716a2a3d2afb97747aebf7ab6c862a7fe3c794ea850be57cc55dafaa694feae6552bfe9813103c326795a2a7eaa34cf3c0d06baa5ece895fad0ec6cb79ca7b10afc85192322fa0b9ef64a1abaa51c728d7949405cff7d7378791885b54123067a86e195823f1bba98e3cb9166b3ba178977b4915342f455f4539e7ad0c6317430df1a4ba521282326a835a2ddd206120202c26fab5a17a1dea53a0ad485c9353f88dbe25ba56b6ce40b76ab38abad993afcb2126ba21a702ec6e8c5439c9515bec152a09b8993299d1159523d2f93ea3107e7e8bc6b054db89321da50527e73d44568561907711ac3f549d2fe137c3620eff4b40e438bd20a5e6ef5a8586b5ad47f6eb906e54384e04d66cdcc55d40be684b597469bd5e627b9239b6885bd1d89d95845798ad99d405d461200811eb34a2293e65f08c7814d082b98ae55fd014240dbacb0066dfc34ba403020972f5b546c0cb4059b581b1dcdeeb67f69a41484396c31", 0x1000, 0x4}, {&(0x7f00000011c0)="8223", 0x2, 0x6}, {&(0x7f0000001380)="1c387a6a0ef1d5782aef0616754d24ddf36ea2d7fce0a3da2e3aefc3aadd4907c6fb1aba4e314e1bb3bfe2ac280a91c35b591e2d439a69d76c3576cae1c76852a6375743ff2bb7b43ef95e55f604f510e43f629fb54c0e0d8c63456b12e380b45d2de93a3c3c7278cce93aded16ad078d371feef1bb3d4bcf482aadf63f2e21993b96c5950eaf18f63a6a03887dd77fcec66483169503d0a6bfae9ca8f51a1e32f54a40e61321c04720598005e3f3f92311148e2c78b3aadf3d81f78b4b0b5489e9c652e8da38eefe6d18aabda11581c9051c3984ef0e71e86e4cc190fe54c05f71929e772f60fde63be13a0cadd48a47ee111a350fe88148174b1cf7d9e29a817225597fcab93c9131ffba0e3691b54225fbf42237c08c9c9db049ca8e94d5b76d5ec", 0x123}], 0x0, 0x0) 17:04:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000001c0)}}], 0x0, 0x0, 0x0}) [ 225.020429] binder: 7656:7662 got transaction with invalid offset (0, min 0 max 0) or object. [ 225.020562] binder: 7656:7662 transaction failed 29201/-22, size 0-24 line 3379 [ 225.020723] binder: undelivered TRANSACTION_ERROR: 29201 [ 225.023525] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 225.023533] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 225.110448] binder: 7669:7671 got transaction with invalid offset (0, min 0 max 0) or object. [ 225.110476] binder: 7669:7671 transaction failed 29201/-22, size 0-24 line 3379 [ 225.110831] binder: undelivered TRANSACTION_ERROR: 29201 [ 225.121592] binder: 7674:7678 got transaction with invalid offset (0, min 0 max 0) or object. [ 225.121617] binder: 7674:7678 transaction failed 29201/-22, size 0-24 line 3379 [ 225.122124] binder: undelivered TRANSACTION_ERROR: 29201 [ 225.127235] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 225.221836] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) [ 225.231375] binder: 7639:7643 transaction failed 29201/-28, size 88-24 line 3284 [ 225.242044] binder: undelivered TRANSACTION_ERROR: 29201 [ 225.247793] binder: BINDER_SET_CONTEXT_MGR already set [ 225.253486] binder: 7639:7657 ioctl 40046207 0 returned -16 17:04:24 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:24 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000001c0)}}], 0x0, 0x0, 0x0}) 17:04:24 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x400000, 0x1, &(0x7f0000000000)=[{&(0x7f0000000380)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764dfc25dea92c1f2f026cbbc1e67f911e8ccaa954852d99556f354c7ded3bdd8754a2d2f25d6855010e272df4f4bd3fb3de193d97cd3eb12dc9556bda942bdb7ea683fd53ebfff265064c6962a3b10", 0xaa, 0x6}], 0x0, 0x0) fsetxattr$trusted_overlay_redirect(0xffffffffffffffff, &(0x7f00000000c0)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x3) r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x88, 0x0, 0x0, 0x0) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$bpf(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='bpf\x00', 0x80000, &(0x7f0000000240)={[{@mode={'mode', 0x3d, 0x1f}}, {@mode={'mode', 0x3d, 0x5}}, {@mode={'mode', 0x3d, 0xfffffffffffffff9}}, {@mode={'mode', 0x3d, 0x400}}, {@mode={'mode', 0x3d, 0x2}}, {@mode={'mode'}}], [{@euid_gt={'euid>', r1}}, {@fsmagic={'fsmagic', 0x3d, 0x428f}}, {@subj_type={'subj_type', 0x3d, 'ext3\x00'}}]}) 17:04:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a66a9a763e0587100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000065d26200"/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 227.955732] binder: 7693:7695 got transaction with invalid offset (0, min 0 max 0) or object. [ 227.970570] binder: release 7691:7697 transaction 683 out, still active [ 227.970575] binder: unexpected work type, 4, not freed [ 227.970578] binder: undelivered TRANSACTION_COMPLETE 17:04:24 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:24 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x1c, &(0x7f0000001880)={@mcast1, 0x0}, &(0x7f00000018c0)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000001900)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, r3}, 0x14) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, 0x0}) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0xef, 0x0, 0x0) setsockopt$SO_TIMESTAMP(r5, 0x1, 0x3f, &(0x7f0000000040), 0x4) 17:04:24 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 227.971200] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 227.977833] binder: 7696:7703 got transaction with too large buffer [ 227.977946] binder: send failed reply for transaction 683, target dead 17:04:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0xd0, 0x0, &(0x7f0000000580)=[@dead_binder_done, @acquire={0x40046305, 0x1}, @clear_death={0x400c630f, 0x3}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x13, 0x0, 0x0, 0x58, 0x18, &(0x7f00000002c0)={@flat=@handle={0x73682a85, 0x15}, @ptr={0x70742a85, 0x1, &(0x7f0000000280)=""/32, 0x20, 0x1, 0x5}, @flat=@weak_binder={0x77622a85, 0x1000, 0x2}}, &(0x7f0000000340)={0x0, 0x18, 0x40}}}, @enter_looper, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f00000004c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/62, 0x3e, 0x0, 0x8}, @ptr={0x70742a85, 0x1, &(0x7f00000003c0)=""/207, 0xcf, 0x2, 0x24}, @flat=@binder={0x73622a85, 0x1000, 0x3}}, &(0x7f0000000540)={0x0, 0x28, 0x50}}}, @request_death={0x400c630e, 0x2}], 0x45, 0x0, &(0x7f0000000680)="68d4574928d6506d5497b8be24e76f4b9cf8eb8c23baa9396da4deb2425dd2553f171abfe92f810964ce14b4a95dd4ac708c0ecb667ee47ded329ea885dc480f8f864ee459"}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$PIO_SCRNMAP(r1, 0x4b41, &(0x7f0000000740)="60ee829f8df634eb2c46c855a6f55564dbdbee8b34883e6ea7") r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:04:24 executing program 1: syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) [ 227.986319] binder: 7696:7703 transaction failed 29201/-22, size 88-24 line 3493 [ 227.986513] binder: undelivered TRANSACTION_ERROR: 29201 17:04:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0xffffff78}, @fd}, &(0x7f0000000280)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) [ 227.990111] binder: 7696:7706 got transaction with too large buffer [ 227.990154] binder: 7696:7706 transaction failed 29201/-22, size 88-24 line 3493 [ 227.990429] binder: undelivered TRANSACTION_ERROR: 29201 [ 228.023812] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 228.039808] binder: release 7712:7715 transaction 695 out, still active [ 228.039813] binder: unexpected work type, 4, not freed [ 228.039816] binder: undelivered TRANSACTION_COMPLETE [ 228.051161] binder: send failed reply for transaction 695, target dead [ 228.107305] binder: 7723:7727 got transaction with too large buffer [ 228.107344] binder: 7723:7727 transaction failed 29201/-22, size 88-24 line 3493 [ 228.107555] binder: undelivered TRANSACTION_ERROR: 29201 [ 228.110873] binder: release 7724:7725 transaction 706 out, still active [ 228.110878] binder: unexpected work type, 4, not freed [ 228.110880] binder: undelivered TRANSACTION_COMPLETE [ 228.121451] binder: send failed reply for transaction 706, target dead [ 228.155046] binder: 7734:7737 got transaction with too large buffer [ 228.155088] binder: 7734:7737 transaction failed 29201/-22, size 88-24 line 3493 [ 228.155239] binder: undelivered TRANSACTION_ERROR: 29201 [ 228.165879] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 228.165887] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 228.169444] binder: 7734:7739 got transaction with too large buffer [ 228.169487] binder: 7734:7739 transaction failed 29201/-22, size 88-24 line 3493 [ 228.169747] binder: undelivered TRANSACTION_ERROR: 29201 [ 228.324444] binder: 7693:7695 transaction failed 29201/-22, size 0-24 line 3379 [ 228.335076] binder: undelivered TRANSACTION_ERROR: 29201 17:04:27 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:27 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:27 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000140)={0x2, &(0x7f0000000000)=[{0x5, 0x20, 0xbe, 0x1}, {0x3ff, 0x1, 0x6, 0x8}]}) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) write$P9_RREADLINK(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="9d00a14c929171ea0700106c6530000000000000000000"], 0x10) 17:04:27 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vga_arbiter\x00', 0x80, 0x0) r3 = socket(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(r3, 0x890c, &(0x7f00000034c0)={@local, @mcast2, @empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x206}) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') getsockopt$SO_COOKIE(r3, 0x1, 0x39, &(0x7f0000000640), &(0x7f0000000680)=0x8) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)=ANY=[@ANYRES16=r4, @ANYBLOB="00082dbd7000ffdbdf250b000000b000010024000200080004000500000008000400e500000008000100070000000800040002000000080003000100008008000300000000001c000200080003004f92000008000400ff0f0000080001001c000000100001007564703a73797a3100000000100001007564703a73797a31000000003c00020008000200648b1dd2080003001e000000080004001f00000008000300080000000800040001010000080001000200000008000400200000002400090008000200030000000800020000000100080002000000000008000100060000008c0004001400010062726f6164636173742d6c696e6b00001400010062726f6164636173742d6c696e6b000054000700080004000010000008000200010400000800030007000000080004000700000008000200ff01000008000100090000000800020001000000080001000a0000000800020003000000080004008f0000000c00010073797a30000000002c0007000c00040004000000000000000c0004000900000000000000080002004a9a00000800020000100000d40004001400010062726f6164636173742d6c696e6b00000c00010073797a30000000000c00070008000200000000001400010062726f6164636173742d6c696e6b00002400070008000100020000000800030008000000080004003f00000008000400050000000c00010073797a30000000002c0007000800020005000000080001001d00000008000300010000000800010011000000080003000500000014000700080004008000000008000300040000000c00010073797a30000000001400010062726f6164636173742d6c696e6b0000d4000400240007000800040006000000080001000b000000080003001c05000008000300090000000c00010073797a30000000000c00010073797a31000000002c000700080001000200000008000200a90000000800010017000000080001000f00000008000300018000005400070008000400000000000800030000040000080003000002000008000400080000000800040008000000080001001a00000008000300720c00000800020004000000080002000100000008000300ff0000001400010062726f6164636173742d6c696e6b0000b00001000800030000040000080003000200000008000300040000001c00020008000400fbffffff080003000100000008000200ff00000044000400200001000a004e24000000009635bfaa487f4c9defbd134edaf65ca804000000200002000a004e2300000ebf00000000000000000000000000000000050000003400020008000200ffff0000080004000800000008000300030000000800010020000000080004000400"], 0x2}}, 0xbd96b9f073d96152) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x98, r4, 0x400, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8000}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x30, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x400}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8000}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}]}, @TIPC_NLA_LINK={0x1c, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:04:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000001c0)}}], 0x0, 0x0, 0x0}) [ 230.980772] binder: 7747:7752 got transaction with too large buffer [ 230.987890] binder: 7748:7751 got transaction with invalid offset (0, min 0 max 0) or object. [ 230.987917] binder: 7748:7751 transaction failed 29201/-22, size 0-24 line 3379 [ 230.988135] binder: undelivered TRANSACTION_ERROR: 29201 17:04:27 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:27 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000280)=0xb) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) fcntl$dupfd(r2, 0x0, r0) [ 230.997682] binder: 7745:7749 got transaction with too large buffer [ 230.997718] binder: 7745:7749 transaction failed 29201/-22, size 88-24 line 3493 [ 230.997921] binder: undelivered TRANSACTION_ERROR: 29201 17:04:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:27 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r3, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x5) getsockopt$inet6_buf(r4, 0x88, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000001100"/52, @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="8561646600000000000000000000000001000000000000001300000000000000852a646600000000", @ANYRES32=r4, @ANYBLOB="000000000000000000000000852a747001000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB='\x00'/62], @ANYBLOB="000000000000000001000000000000003000000000000000"], @ANYPTR=&(0x7f0000000400)=ANY=[@ANYBLOB='\x00'/24], @ANYBLOB="03630840", @ANYRES64=r1, @ANYBLOB="0d63000010630840000000000000000011634840030000000000000000000000000000000000000017ed083c0000000000000000a6fcffffffffffff0000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="adc726fad87e852a747001000900", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB='\x00'/34], @ANYBLOB="00000000000000000100000000000000200000000000000085616466000000000400000000000000010000000000000034000000000000008561646600000000090000000000000001000000000000001800000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000002cf5c88ced99191790b29c3447ae9c89e42465958657543f3da57fdd6c8954c2c5791362084df44d4937b4d6d1e34aa1e3b10f5b9bd6af4b401c1ce231a6297ae988a1ed07d760f4185a4a6b91373bc2c3cece95228cfbf77480649432c27dd604f9a0d64b9ac5a1c3d971cec79d9f599d3d0e11883d845bd8f9a29e53bd33a2712185638cc1608d6c909566e97a2d1289a4bc57db71e9f73782f5bf45230faea5f647ac62a5e73406497b41882fea"], @ANYBLOB="40300000000000000d63000009631040000000000000000000000000000000000e630c4000"/48], 0x0, 0x0, 0x0}) [ 230.999591] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem 17:04:27 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x8000000, 0x1, &(0x7f0000000340)=[{&(0x7f0000000140)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000007c0)={{{@in6, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@initdev}}, &(0x7f0000000300)=0xe8) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000000c0)='./file0\x00', 0x3, 0x7, &(0x7f0000000700)=[{&(0x7f00000001c0)="e2ac2ed39c900905544ca11320c3704ec9d3c979c3d7ad41ee05246198a788e7e899b9bf195645401724723d954257d4f4b9e20781f632c561d03236e3732a1e61dac4d2ba54c816cdfdb2fea74e0cab3469258fb2c879fc1a156751c10af7b18c6be98ad14d34428c28dc418498e6c51ee3c338f3ec79584031e12b33ddf0f881af9c9fcb90aba881832a3122c36e5999620a3b22d89f4d18d71b8e87594e2efd7af1a330ce18893bed5aa1e0e37baebced6e2955b529bda9522195e2f1b5e330e19ce2be1da4e048af901155a72217d5d9061f1533a3bd17d04b576402a01e07bebe9d2bd641076beace3f", 0xec, 0x6}, {&(0x7f0000000100)="abef4c06e8c64bb7471a2a7ec91fdbe2442cebc54879567c4fa9da3298b5a4a483e34045c8f8b8597a6f33f6", 0x2c, 0x5}, {&(0x7f0000000380)="5dfd42982568f4c74c9ec96ca21524b360251a243ebba8d2f0fcb171868f6478f0d01dabc92298b43d44b5f128ced2453a7dc40502299e080a8ce0f6b04da1b2b77a25934fad5a4d827e0e592f997ee4b9720ebff5425faf21a45bd3f2ed2a0d4d7163f00ed47d97ecc418c98c09a1de4d576b323b8303f8db46548d77ce976d49323b6f24140c53aaa092d6fd44290e5d0421f2dc98838996817f3b585ab440ee73d03ecd027834746bfe713d6433cd7da4b9852372df1439a22328dd1873f04834423c8b220d2b400e408d720b100c94c2b43e6abb", 0xd6, 0x7}, {&(0x7f0000000480)="2108a8cba9bd6811546a4b9dc3b340ab939d74e50e8a5d81b966fb7c7e2a47168e8b4cb61103bcdd526072910a655deadcabd47b330c1b2bb615f035d622a5387dd034e47d2e2c271f0a31291bde910a92450288e2e6d5c4f5ba87a020f0e4c4c45edc4b8ec9661823ed0f57d35fa96f73244ff3a57f4af5e755e3346a17c81948f0c424d19780fc8b85b684165d3dda74e35dd3af419627f147a7b54d9edc9c475e69f51a551e31e3d10fa410b0791d299610696348a3c1e51f0304360c7b60ce925d51", 0xc4, 0x80000000}, {&(0x7f0000000580)="6443744b472d992ea5b26900e0682df51b9b1108f5df75fe28e3b746364e6ed2052e64fff0123d600b5ecb127b5b593d893130a2da2996cfaf0ee04b9ff84990e03ded1ad6316674fcdefef446202fcda54f226ab042552dbd1a6ed6608912515731662cc22e09cde24e144155019198c824fa16b2ecdce71dda5a0e4dcb7d92ed4e5127cad61cabc9e673414989fb49f6c0d5367d0a4b013863256dd0ec1f56c59567a705a4a5444723e08756e303f1c67155f3", 0xb4, 0x7fffffff}, {&(0x7f0000000640)="a181fed7badd3dfb51e93ef6d53ca55d75b33688e4cd3fedd42df05a0ab8bfa685eb6b3ec7ab6f8c98e7b9205847cfecdb9b840660c6bedc4e8a8ff797511b32a18113903b15dfb24bd05fa922409310530ea98857309f59959ffc1fb486e697cc2c45bfa8a4b2e64237e1306466ba3e1195c2607cfdfb6c3a4579d02f72d76526fcec1386765ab1372db7c28ca764d43679c8cb3898a15bc4a536b3c9e07628ba8c2e3fe3b455372de60eb2e18d", 0xae, 0x8}, {&(0x7f00000002c0)="49da1c0a624c0a6d71226d950fd1263a2f0b2346ae90258896d8a821be4d55b26f59d09580da14da3bde8ce74dae89a25372ab62", 0x34, 0x7}], 0x20da80e, &(0x7f00000008c0)={[{@numtail='nonumtail=0'}, {@numtail='nonumtail=0'}, {@shortname_mixed='shortname=mixed'}, {@numtail='nonumtail=0'}, {@rodir='rodir'}, {@uni_xlateno='uni_xlate=0'}, {@shortname_lower='shortname=lower'}, {@shortname_win95='shortname=win95'}, {@uni_xlate='uni_xlate=1'}, {@shortname_mixed='shortname=mixed'}], [{@context={'context', 0x3d, 'system_u'}}, {@subj_user={'subj_user'}}, {@uid_eq={'uid', 0x3d, r0}}, {@audit='audit'}, {@fsmagic={'fsmagic', 0x3d, 0x5a6b}}, {@seclabel='seclabel'}]}) 17:04:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, 0x0}}], 0x0, 0x0, 0x0}) [ 230.999600] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 231.051703] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 231.051711] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 231.064394] binder: 7767:7772 got transaction with too large buffer [ 231.064429] binder: 7767:7772 transaction failed 29201/-22, size 88-24 line 3493 [ 231.064897] binder: undelivered TRANSACTION_ERROR: 29201 [ 231.069522] binder: release 7769:7773 transaction 734 out, still active [ 231.069526] binder: unexpected work type, 4, not freed [ 231.069529] binder: undelivered TRANSACTION_COMPLETE [ 231.072975] binder: send failed reply for transaction 734, target dead [ 231.115472] binder: release 7777:7782 transaction 738 out, still active [ 231.115476] binder: unexpected work type, 4, not freed [ 231.115479] binder: undelivered TRANSACTION_COMPLETE [ 231.123146] binder: send failed reply for transaction 738, target dead [ 231.146416] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 231.162561] binder: release 7788:7791 transaction 744 out, still active [ 231.162565] binder: undelivered TRANSACTION_COMPLETE [ 231.165693] binder: send failed reply for transaction 744, target dead [ 231.292319] binder: 7747:7752 transaction failed 29201/-22, size 88-24 line 3493 [ 231.303115] binder: undelivered TRANSACTION_ERROR: 29201 17:04:30 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000280)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:04:30 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, 0x0}}], 0x0, 0x0, 0x0}) 17:04:30 executing program 1: nanosleep(&(0x7f0000000180)={0x77359400}, &(0x7f00000001c0)) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0x44000, 0x0) r3 = signalfd4(r2, &(0x7f0000000240)={0x41}, 0x8, 0x80000) fcntl$setflags(r3, 0x2, 0x1) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f0000000140)={0x3f, 0xe, 0x200, 0xfea, "08b802214b00000000000016000000000000000000fbffffffffffffff00"}) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) write$evdev(r0, &(0x7f0000000280)=[{{}, 0x1b, 0x6}], 0x18) 17:04:30 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, 0x0}}], 0x0, 0x0, 0x0}) [ 233.987955] binder: release 7805:7807 transaction 746 out, still active [ 233.996872] binder: undelivered TRANSACTION_COMPLETE [ 233.997526] binder: 7803:7810 got transaction with too large buffer [ 233.997560] binder: 7803:7810 transaction failed 29201/-22, size 88-24 line 3493 17:04:30 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:30 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, 0x0}}], 0x0, 0x0, 0x0}) 17:04:30 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, 0x0}}], 0x0, 0x0, 0x0}) 17:04:30 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) write$P9_RCLUNK(r0, &(0x7f0000000280)={0x7, 0x79, 0x1}, 0x7) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:04:30 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, 0x0}}], 0x0, 0x0, 0x0}) [ 233.999676] binder: BINDER_SET_CONTEXT_MGR already set [ 233.999684] binder: 7803:7810 ioctl 40046207 0 returned -16 [ 234.049939] binder: release 7804:7806 transaction 752 out, still active [ 234.065100] binder: undelivered TRANSACTION_COMPLETE 17:04:30 executing program 5: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 17:04:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) [ 234.067908] binder: BINDER_SET_CONTEXT_MGR already set [ 234.067916] binder: 7821:7824 ioctl 40046207 0 returned -16 [ 234.068865] binder_alloc: 7804: binder_alloc_buf, no vma [ 234.068883] binder: 7821:7824 transaction failed 29189/-3, size 88-0 line 3284 [ 234.072056] binder: BINDER_SET_CONTEXT_MGR already set [ 234.072064] binder: 7819:7825 ioctl 40046207 0 returned -16 [ 234.072307] binder_alloc: 7805: binder_alloc_buf, no vma [ 234.072325] binder: 7819:7825 transaction failed 29189/-3, size 88-0 line 3284 [ 234.075424] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 234.075433] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 234.090860] binder: BINDER_SET_CONTEXT_MGR already set [ 234.090868] binder: 7820:7828 ioctl 40046207 0 returned -16 [ 234.091090] binder_alloc: 7803: binder_alloc_buf, no vma [ 234.091105] binder: 7820:7828 transaction failed 29189/-3, size 88-24 line 3284 [ 234.103082] binder: BINDER_SET_CONTEXT_MGR already set [ 234.103091] binder: 7820:7833 ioctl 40046207 0 returned -16 [ 234.103309] binder_alloc: 7803: binder_alloc_buf, no vma [ 234.103327] binder: 7820:7833 transaction failed 29189/-3, size 88-24 line 3284 [ 234.128934] binder: BINDER_SET_CONTEXT_MGR already set [ 234.128942] binder: 7834:7839 ioctl 40046207 0 returned -16 [ 234.129864] binder_alloc: 7804: binder_alloc_buf, no vma [ 234.129883] binder: 7834:7839 transaction failed 29189/-3, size 88-0 line 3284 [ 234.135821] binder: 7835:7841 got transaction to invalid handle [ 234.135829] binder: 7835:7841 transaction failed 29201/-22, size 0-0 line 3138 [ 234.141388] binder: BINDER_SET_CONTEXT_MGR already set [ 234.141397] binder: 7837:7840 ioctl 40046207 0 returned -16 [ 234.143807] binder: 7835:7843 got transaction to invalid handle [ 234.143815] binder: 7835:7843 transaction failed 29201/-22, size 0-0 line 3138 [ 234.151689] binder: BINDER_SET_CONTEXT_MGR already set [ 234.151699] binder: 7837:7845 ioctl 40046207 0 returned -16 [ 234.344826] binder: undelivered TRANSACTION_ERROR: 29201 [ 234.350394] binder: undelivered TRANSACTION_ERROR: 29201 [ 234.355940] binder: undelivered TRANSACTION_ERROR: 29189 [ 234.361479] binder: undelivered TRANSACTION_ERROR: 29189 [ 234.366990] binder: undelivered TRANSACTION_ERROR: 29189 [ 234.372555] binder: undelivered TRANSACTION_ERROR: 29189 [ 234.378080] binder: undelivered TRANSACTION_ERROR: 29189 [ 234.383659] binder: send failed reply for transaction 752, target dead [ 234.390410] binder: undelivered TRANSACTION_ERROR: 29201 [ 234.396062] binder: send failed reply for transaction 746, target dead 17:04:33 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:33 executing program 2: 17:04:33 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r0, 0x5429, 0x0) 17:04:33 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="8561646600000000010000000000000001000000000000003f000200000000008561646600000000070000000000000002000000000000001000000000000000852a646600000000", @ANYRES32, @ANYBLOB="00000000008000000000c53f"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="b0ffffffffffffff18000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:04:33 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0xfffffe89, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) futimesat(r0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={{0x0, 0x2710}}) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000380)=@filter={'filter\x00', 0xe, 0x4, 0x490, 0x0, 0x140, 0x278, 0x0, 0x278, 0x3c0, 0x3c0, 0x3c0, 0x3c0, 0x3c0, 0x4, &(0x7f0000000000), {[{{@ipv6={@rand_addr="0b34d11a06415f0fdd043c73638e5017", @initdev={0xfe, 0x88, [], 0x1, 0x0}, [0xffffff00, 0xffffffff, 0x0, 0xff], [0xffff00, 0x7fff80, 0xffffff00, 0xff000000], 'team0\x00', 'bond_slave_0\x00', {}, {0xff}, 0x32, 0x7, 0xd, 0x10}, 0x0, 0x118, 0x140, 0x0, {}, [@common=@hl={0x28, 'hl\x00', 0x0, {0x1a73f66e89d7e2dd, 0x1}}, @common=@hl={0x28, 'hl\x00', 0x0, {0x1, 0x9}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@uncond, 0x0, 0xf0, 0x138, 0x0, {}, [@common=@ipv6header={0x28, 'ipv6header\x00', 0x0, {0x20, 0x10, 0x1}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x9, 'syz0\x00', 0x9}}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, [], 0x26}, [0xffffffff, 0xffffff00, 0xffffff00, 0xffffff00], [0xffffffff, 0xffffff00, 0xffffffff, 0xeb1d598515f6ed8f], 'syz_tun\x00', 'ip6gretap0\x00', {0x1fe}, {0xff}, 0x6, 0x4, 0x4, 0x10}, 0x0, 0x120, 0x148, 0x0, {}, [@common=@inet=@tcp={0x30, 'tcp\x00', 0x0, {0x4e20, 0x4e20, 0x4e24, 0x4e23, 0x22, 0x87, 0x40, 0x5}}, @common=@ipv6header={0x28, 'ipv6header\x00', 0x0, {0x40, 0x10}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4f0) [ 237.021244] binder: 7855:7861 got transaction with invalid offset (-80, min 0 max 88) or object. [ 237.044028] binder: 7855:7861 transaction failed 29201/-22, size 88-24 line 3379 [ 237.062411] binder: undelivered TRANSACTION_ERROR: 29201 17:04:33 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:33 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000600)='\x00\xaeC\xae\xc4\x05\xa9\xbd~\xfb\x96\xf7\t\b\x00\x00@\xe54\x01\x01\x01\x00w\xa7\x04~\\\xd4Y\x04\xaf^\xc6\xf2\x98\"\xa0\xa1\x04\xaf\x81\x00ov=ie\xf3x\xfe[\x90\xe0\xaft\xafi\xd9\xb2\x96ef\x98XL\xe5\xb0\xc6\xac\xcb\x19\xf2\xba25v\xb2-\xc7g\tM\x04_R\x93\x1be\x8f\xacGxWc\xee[\xc0\xe6\xdc\xcc\x8dT[\x85\xb4\xa4@\t\xb3\x1f\b\x9c\xf9\x8d\x9d\x92YJ$\x89\xaa\xcfQ[?`\xf4\xfeg\xd6\xd9`Hpc\xdc@7N\xf4\xee\xfdQ\x1b\t\x00\x00\x00\xfcJ\x7fKC\xa1[\xe4\xc8f|\xe9\xef|\x1b\xf0d\xf0\x89\x1aM\x8b\xc3I&)\xc1\x8a\xc6\x11\x84&3\x02\x88\x97\xb7\xe3[E\x90\x95=\x8e7\x90\xa8,\x16~\x9c\xa1m\xf4F\xfb\x05\x82\x05\'1Q\xe5s\x8f\x13\xfe\xd3Zw\xf4e\xb9*\xcdgBY\xac\x83\xf8\xf9\xf0\xcc\"\xb4\xf4\xa7\'\x98\x1fg@\xbe|\xa72\xbf\vb\xc8y\x9b{\xfc?\x87\x9e\x16\'\'\xbe\xe6B\x9c\x01k\xe1\xa8\\\n\xcd.\xc14O\n\xd1\x14,\xc5\xa1\x1e\x9a\x03jUr\xca\xdb\x88C\x96\xd1\b+,\x8b\x8fTj\x80\'Q\x14\xa9\'L\x85c\x84P\xb1\xe6#\xba\x11+\xd9~\x13\xd44j\xed\x9b2\xc2\xdcT:\x9e\xa0\xe7\xb2\xf8\xf2\xd5\x96\xbe \xfci\xb9\xfa\x11\a\x15\xeb>rK\xaf\x1e\xcf\x1aI\xceM\x82v\xdd\xe4\xc4\xd1M8\xd9;\xb5\x14@K\x81\xcc\x02x\xc9]e\x96\xd57\be\xe5\x89\x9e\xefs\xe3U\xc7\xa1\xdf\x95\xe1\xf3\x0fM\x87\xb3\xd2)\v@w\x9f2\xbd\x8b!\xa2\xd4gv\xb5s\xf8\xc4\xdb\x87\x95dV\x9bc\xa3\a\x16\xba\xe9m/\x8a\x83\x9c\x84\xbes\xf6\xa4\xfb\xe09\xa6p\xcd\xd4*\xccF\xca\x1e\xacC!x\n!{\xc5oE\x00\xc2\xf6\x1f\xcf]\x891') clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$dupfd(r3, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="14cb365c0f05"], 0x6}}, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1b) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) 17:04:33 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000200)='net/tcp6\x00') preadv(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=""/169, 0xa9}], 0x1, 0x1f3) [ 237.072857] binder: 7855:7867 got transaction with invalid offset (-80, min 0 max 88) or object. [ 237.091505] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. [ 237.116575] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 237.127861] binder: 7855:7867 transaction failed 29201/-22, size 88-24 line 3379 [ 237.136235] binder: undelivered TRANSACTION_ERROR: 29201 17:04:33 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) [ 237.309198] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 237.316866] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 237.367420] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 237.378336] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:33 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0xaaaaaaaaaaaab03, &(0x7f0000000340), 0x40001, 0x0) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/attr/current\x00', 0x2, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) write$UHID_CREATE2(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800020004000000000000800900000007000000f85b21c557d4df63b0d3e45a201cb7b982fdf038354db7f1ce46d1ee420e2b443024aeef7d05486ae2daa29a0efd8fc7f109f79392ac864c78a5fbd764b5149c4f98a3038520a9e8"], 0x130) 17:04:33 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') lseek(r0, 0x5, 0x1) preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0xc4804) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000140)={0x0, {0x2, 0x4e20, @multicast1}, {0x2, 0x4e22, @multicast1}, {0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)='veth0_to_bridge\x00', 0x8000, 0x1f, 0x4}) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000080)={0x3, 0x800, 0x7e, &(0x7f0000000000)="2362c65a4798f1cb98b45071cc466d1e3a44650b1f50debeefafeaab439e4f5cfc558beb307ff387bbddacd1eeb7c41b363f9e63b20388b4ce7b88d5c91b2e93b468ccb5f5704c9d4f0dd93a096833b427832b3c08ad34b1880c5f08ecec90baa03a01931d760a2cb3586a566a298b1e7ce4fe97604f1cdb252c22047431"}) 17:04:33 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340), 0x289e894, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r1, &(0x7f0000000100)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r4, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') recvfrom$unix(r5, &(0x7f0000000380)=""/170, 0xaa, 0x100, &(0x7f0000000440)=@file={0x0, './file0\x00'}, 0x6e) preadv(r5, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r5, 0x0, 0x0) faccessat(r5, &(0x7f00000004c0)='./file0\x00', 0x40, 0x1f00) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x80}, [@jmp={0x5, 0x1, 0x2, 0x0, 0xb, 0xfffffffffffffffe}]}, &(0x7f00000000c0)='GPL\x00', 0x40, 0xe9, &(0x7f0000000100)=""/233, 0x41100, 0x4, [], r4, 0x1, r5, 0x8, &(0x7f0000000200)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x10, 0x908, 0xae3a}, 0x10}, 0x70) r7 = eventfd2(0x2, 0x801) splice(r6, &(0x7f0000000300)=0x200, r7, &(0x7f0000000340)=0x6, 0x100000000, 0x8) [ 237.891719] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. 17:04:36 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:36 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0xc, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r4}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4, 0x0, &(0x7f0000000280)=[@clear_death={0x400c630f, 0x3}, @free_buffer={0x40086303, r4}], 0xfffffffffffffd73, 0x0, 0x0}) 17:04:36 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='batadv0\x00', 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet(r0, &(0x7f0000593000)={0x2, 0x0, @multicast1}, 0x10) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r4, 0x0, 0x0, &(0x7f0000000040)={@multicast1, @local, @multicast1}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x18, 0x0, 0x0) 17:04:36 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280)='/dev/zero\x00', 0x80, 0x0) ioctl$TCGETX(r1, 0x5432, &(0x7f00000002c0)) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000180)={{0x0, 0x1, 0x6, 0x2, 0x8001}, 0x4, 0x0, 0x9}) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) rt_sigprocmask(0x0, &(0x7f0000000000)={0x8}, &(0x7f0000000140), 0x8) r2 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$describe(0x6, r2, &(0x7f0000000380)=""/4096, 0x1000) 17:04:36 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3f, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = getpid() tkill(r1, 0x9) close(0xffffffffffffffff) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='sit0\x00', 0x1cb) sendmmsg$inet(r0, &(0x7f0000003980)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000940)="9867bf94d689a90f8cb437accb9a6ce2fc4c7240451785757e07a463f7f10098f68c9dfd0aa7e421de797557bbea26f905112400fbc577bc16f473b1e2c361cb1cdaee71e6de5d4afa64cba9242d660aadc9007620d810c07982e2673839b453ee2fecda7244ebbc2db203453bcaa0ec2f78d9f43d32c703253248a1d5aad48f17a38e9128a57073f2154a610989fbd694453d102d622b2b7401840e21656d1f9e437190f2af1321fe92a3e4934374169fe2ec097e1e9b11fca192bf5463796ed1867c646861565a58706456825a12116721a9413ad277d74ee146a5ac3dcf2aea5fa68af427ed2d4a3bc0d36b45a14dfe8bb93dd56d8286c0699d186f827dd7e44b4ebd19d0f857976db647213128da81adb8bec1b3d2b957bd9a2c85cd1963a70bb6fe3412edf84fd8edddfb1960fcf126b073d8038ef0b246d8d4625c7ddc7382f77840cd60d0f1223be8e6a0f6d0731f2abbc5a04e43c5481efe147ed04c344cca0ac31612436ac2d6d0e7b1eb2f780e3a6ddbb7c30a253803454d31187b0d7adde6a71b3759f85d9b23861830cfabf0ad6454799ac8618b57e749f64e8aa7cef28c921e69f0fb624ba44d113b8e9c10118f279758e8f109751cef039bf76e91cc268884793dc11b4190d8b1ca507b876db5284cfc0069b08235f54a8a68309b5ad32bdd", 0x1e6}], 0x1}}, {{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f00000003c0)="9aa86ef6b1cf0ae9f8b469e4e0bfb39c64b545e2dc38c85f05e4f51446a3f3b4f532f8fb25761335f4210debf8ff3bbb6ff4d4184f79479cdc43ea209636d68c04931484099595424145b42fd8a740", 0x129}, {&(0x7f00000005c0)="7884064bac9b4d5daeca371ec89019e42ac702ce53fe7112f0e1a68afb7dbd2aa0dfffd36167903abb26c295913f5a9656c2b3546e6dba0712db614e74cdf159cf515787b0c497a1e9042b4a284649f68f38246e509789df9925143789956df68e1aa655790d79a701d30f55575e69cf5e4a2051d5f4ca571e43ab6683937cfd1500e0fccebdd99b9e23bbaa614b67dc8f35a059cf4bbacd1a136cf0d1a77b3f5b7820f7e0a73e975d09f3ab59c93b889a9593c685472d62299c5bbefe14920b3860a6c5f0097c9c99fc2755d5537f50bec301774ac40098a44a78bf11c43a7296615d7bd06ba5597890450b11a3dd18350febc6", 0x7e}, {&(0x7f00000004c0)="22e9965e6561c1ebab1e08acf6c2e07e0119207579f43f5082314df188d16d04ea761d4db5f6addc67a24398fa26ea6b275a1213ce650c1c03ab4e98be9515394a9279c1ee1b5e58be3d6178b188815ab356ebc83e498e2eed4af502cb60b453875430dd00ac84c3256a122f9caf1ef859d1bb60fd1e2a8c3d69ad44611b", 0x7e}, {&(0x7f0000000540)}, {&(0x7f0000001040)="0e6ad62eb503aa142a14eb070dc1e01a7b4e347eac76233a4ed88680e4c0d72601f79263e2ea09128601eb8214c578af8f76e9d84beb4c25854c5a4206f9e961daf44f17c52f69882058a4b11d5e8be8ff0b0f5020a8497235ec8861648da3714344d9ef76be4f9028ffcf3e3d59c08b0898c28e8aed1dce12a41d68a5c328127b005c2d4549d169bef22fb0f9183a75d4b4fb6959a2cfd7b7e0bb95e8e5fae0281658f496650d86b9e8d652faffbcc04169ebdfd462c7b9ac2f1a0c791253114f8ad400f11bfac7df5b7159246b28af987a20f16d4247f60df4c9c60fe22f9209031382a6725141af66ae1102518c4ea590c669eded6ce0829a2031e83b78465c7adb542d1c6981a6c8ac5417e32fdf824dc46c8477b7ff8398cff31ae9232e8f493f8d4efdcdabeb136f276ae8eb214e474089f21a0e78631d8bcb1b39d9af3925e3df676591a29f92c50143d9093eb9385d1e751050ba5d1423fbcf6109f26b93880c6620884640f3c5230087494dd38facb67eab5fa96074b99c5951c5b15cb01302ea020d15afbae2b5c6afb6d36c443be4c8dbdc97ef061f91da9573f874e94707a1b94894c7c05c572ee40c4fb57c96a9b2596785d17ee86ff644777cd206a45d7636bf428a17d5748409585e23f267ec360007c11975d99442bbca8d115965cb0f75ee3db9ee73cae03057a987485495b4f463da121c6b9887209f4144536c2d0b318666066d05488bfa4e47ab6997de007bb52816bc02f7e690a51dfae1a682aae5ef688704f3824a05b161781d772dd84300980c9f67f67c9ac5ecced30b66f30549aa278116e49dd79ad7cd63b1204814a9f3bdb8ee836f8dcb17a89067132220257bcf491c31bdb07c8540a01234828a5bd61ec674a9e4d7ae4a4566f28ea088bee5aa4cf7cd61d100552745885eed3728936109fce8aeaf1190c8bb5c01143263fcf093b83def667d7304833a68afea2b7e815022c1e4d15650938f6b0c6802ea8f84a0bc26c9b7d0801495942e4a9304d2e6a8807a37ad1cd35e7f20ad36076ac6b34826d2ad7c319e420dc2bf6edf4da61e74835bb0da1080bfdf3deafbc27a1cc2e96f669744e0e0ab30324190d2eb329621797f5ade0c9dd1806988fafb439483881526620f403d981ad213c5f1dcfd5d51cb02657998bb658ba01d9f2984afffbab1694808e96b7c943cf8545fe5cc4548b2fe20151ef651a9b8df3db29650bc6a0c06669e6c4d656cfcec8ada1fa8139e3c361ae0df0bcf802e6031503547ea8deede92d0f8fd9286efe5a9af012103351713073b81397a0b24efc37fdac825270b3fc1b8edcac926dad21164edc111148e889ff959e9068c90a08938306c71467322482d1f2ae03f45eab8c7ac4a043e3d15778e682c3027977f3158a8b38cc95d472aed8088189a64e988139f59cdd3d900682075a5888a146478b67315667acbb140bd2ac6fc5589ef4462474c9aaa5866ab0fc0b3e64f8da8775015764a6b95fe88b33c3090396da08901bc5c0a5c1c58e22d9d5296fee6e289b32f95ecd01bac32bc221f03ba215412020497cc6b533989e7492dbee9c2472adbc6ec394b903df96f5cca5fe887b85af3daac0cbe61f3970bbc672f0befa7d27a42a7ac0621863ccb42572946ad06a432e942e651846a7858bcc7d09dede2eaf35929a31a1ab4eba1124f9d2c2c6d046d72988014aa7acd8dd0965a3039fdf237dfbc0a2e454c381c7f9a8a19c0132ae40f4f32e5f058f9f7776490d3cee57277ad5696fb0c9fe778e49071b98685b75aeb0abd88b10cf63b7d4944749c781beb0f90ec8511c866e6937928c2f2c44fa434f465893baf83960dbe556762f1f22ff2cced57d0221d7b8fd4497b7ed83c7b22fb1ecbe6ccaba5879bafb0e6a3a8f3c76fa4312fc9d513cce05f59bd54c1d6594d0a6f2ccc87433de2ff40a41c168d1fc6803bd1eb7d6ac8f55ef12a5219150e5d0eb3caeb1c050d2e4ac97181b39d885d3422e5c402d7495481011fb498ae78a0f878098600d586a7e2c9644c3029e1e9fd98bbcd7261c3395c0c964142d0c09f7156183ac9099763f8550c6a209abd2e028d1b11193adb3503571dc4d712dff35b47655f2d17274e1ab879f263602bf9dd21c48228f2f409ea7fb878957499b18cae0e13da68b15f9b96a94a0491221132c9c873c4e406476f1f47aedd08ac21a47b0eb1c2c0cf9a05b8627bfc8010a63bd9ab84dda2c0edfe9a511bb99e79f60a2a6c47b086a7c0fce1fab031e52faec57c1210b92c2d9f3614996fb6474c94437d3297ea4ab8546a74be350b35ebc0c7d5216d89b10939388830e97f5dd9ba70d9a17cfa3d1eae45eb9aa1a32e8b58c9a3b1539e58359d67b869fa836ffa92ba517ac7f1a029df5368e4a868c744647114243c4323f48a61031d764f34c0ad5451d144b4bc8f82221e54c01d09bdfaea029411aa26d4f74c7f0d665dfa47c9ed6380b21dd5a10a41f2feef3f1ab98cfa7ccea12b6f6f5195c7bf1e244ca3124b618b3cdbe4bac5a6d762a36cee9d3ccba662f9b4edb74f8cc804aeb77629a326dd439600957a6077a91d39e5bdc5b74fe9c846cd415a59b4c6cb8d600ccf438b2c31a47b540751c1cd80c49267f510f217c953bf951619798266b10b1cf0ed377688094c37757214d28cb45ac6d8391a5446997d7ec3e1165c380dda3f2a50490385a503976f5ea19b7a22187229c61141fbbef78a126729c4c4d61dc52aaa23af6f5df825f4e54d4e5b12ed4adf9ec4ea1b4fdabd80893910bca67ec2144ed49ee0ab7f8005f4cb062033036efa41e8253c4eaf7cb2ed734c716dd62b67cbadb4eeb017b7541fc0bd01c104e5587bebd228838a662a230b60a7969eb7bab1050403ce77b117511af914ef470635a0aa062ffe9e9e1d16d23d19a5742c8d0f92e4e12c034c51afa49832244874a52b3041ef5dd0dbca7eb7956df44cc5b020feb449f55ef58f74122eb92fed8b05ad644faf5997705ef2d1794515382b1981bf002aa4bc71f4b1b023cc6a422e2e22b600ea4ded527ee5915b816abd07e87cb5280608594d19c99979d8358eeae5662af5886248c4856df8f3b634c1926934f17e89ac449f4a0e482475f5bc4d74ef2636c0298926c52af9e7bd12593adf221cf68106999212eafdf746c7dc6a82dc24f50b695d88ba3e7cfbef9f91dd286b1a8aa2378bcd2bf7d90eee149c6284306f5f088c084c54bcd72ab78430fe7813cd669a1923b4467e8bf0090f5ee31b2cc6294046f16c3c79553870642407b38af17c4be4bb2d21403426fd37af3226781226f68b53d7449d2fb2fe8f1f8f3e928fb0f30c3372e50c70b584ac0f0552ab9dcc567465cd46243cd14cde7c909e500ff08c8a3e513605c9341db204d668e52722fadf9173c1807ab4d184e16cd15400fa96ebe268b3f68eae95672782bf38667d6fd34ab3a6cd90650738415e2d71925b9a04b74f16463a78b7499bb6a35b4bbbd249415bb8c491afd68011ac3bac66af3f0d60ff98d9fd869c18d93274fa77638fff845d7328473605200706bbcce0a99a0f00cce65bd9f71e0712bba43aad16499ac19d3555bc9de40cd9c70ca8e0debc00b2fc32a20b333ca5cf109d3cfde9b575d7a43d7f8e489688d17232f0caa6d4c0c6f7600780756c74d31f489cb02ecafa616d1b958da694d36217fdd42d00d70d43a8f7045b31730374770b2a65b7347e735e96f16d174c2364cab757afa09bcd257d1f611e51c093e4b23149573eee2a295c680842e3d992df92e5fbc9094ffd2ce2236618acd819f986970295ef5867c6ade66a8bfca3e12cd8a3bdecaf73cdc8d927b8fb4a95f5c4470b91c141b531751541e7c0808ef075b537625c765f8ebb360d68e75d1919af40cff2ac51fc2d5fdfe42a357ef15920c1ae29237d6ce84c9d270da21f6b930aed6de5c1680be2d3863adf4e8f2bdf9a7bf095b836c38d390cac7e793193a15a4eb733dea008452778272c89c94696e0af32b9327fef4f08e98e3a77d41072f2544e56e5d51031488035dc026f15fd51fb8b6326526556c88c64f5a37cba3036e6476c33358ddf5a9765cf2f13b5a402ec8ad99000d15832b9dc22e17627aa0680f67d80f0e68d3962f774998fb5e59b983c22c5a222a9584a9c9d2e401a89c4060af821c095a2d570805319173bf7a9371927b389fb8bdaacb9572010a8b3e67e83408a4323d89b0ffe64894828118662971a814ecbf383ab1b0b1bdd3392c6dd9a5f845656f1027cb7871db8e1fb858194cfed433cde9512d673d9cae518dbdff915a69251b69bf36bb873a958adf1385fff405c6cc232eacc755806d9c7963dd73b518a7f05e9f2d03d2d4fb2a44d95fa1de21dae6945bf5224b325e120c855a9aa1dc17e73ad7b12d6707cf51879ad212f0080e411fe2fdc0ed4217727b9f636387a6fed27f4fee12193888894f8438f274bef363fdc8d3970026cb984b49f2888c24675a9fc6f396a6b78fef81d3870c12455b1ad849a6977ea05038804e335ec50909d831774df2943c2147da0c2da37f8f8cdd84acc75db848c1bb06fb5617fdee7086fe9709e266f6d330d7d9ed533e026114956ba701db54adb0dc3b7acef587079f54febb35deef5701225acd86469d35382d325e2cf33f6d2da821d842abe45aa038b7c7d616f7cab12f07e9ce6c419601990c3ab6702099e1cf4fcca2141f58de2d873d18cf6e6f74e7cce9f33b2b0183a3bf65bb89a476962e41c88a66ede4a0d482aea87a3a47f01e2777ecc2889aaca11d589b5f6dc0fff05e692e3970c62b897390e2b9eff0112a3a98bee6e3dfd2633a07d5b522629e3e2af766dc853355db803b9c33949029a34e7595b07b1957d938baab03f7beaf04d6c8f55963587fa2eba776ce6000355848f475b3fb6e6660f7c6983a5fdf34a64e82f0e6c85d8286fb09ba4ee39311d9dfa8ef280b03f3a28c593809d96183a8d741c5624c7b34bab4d2f0aad6b3076a500da71917b1ad23fec88e29d097e34182fa4fa24fe7628f25478fbe76fee7b129c4437b3bad084af45d49e721830929174bf272ae8f2fb298f2835af2a1a257f8c174c6f0de8118df37fec6a2979bd2b172d248908a21ab7f27d78707c42eee379ec75eaabbde0201f9dc35188bd5ae0db8c255f793f46bd7d8dfd5f4e89003865e6d23f04cf94a263af673177c7974f7ae5dd79ed43e61904ddaaab04cb7779dccd598b76bd7a1d0a286de91b69cbefdd91761c862542f9a5611b2c3493649e6e9b8fd57a4786290ac94b8d5e28bd4bbac8c2cb2cddda64f19dfd0b2e91eb8df30f7afda3c5b5b5a9209e11a8bee5bcc6825038f5593ca96130fef89c8f3572fd3541acd57538e515c41910b0f4345adaec2b022efe31461f16cba5b1861ef7f3679df3f2d7c0f56830fc8803205d30741c231fbb29baf54e6c430ca525ad3067a8a04d3b3148b59aacdd808a38dedc2b7b6fbce90238fc41516de1da3b9e6a037b97f8dd8a76409ac2b16e4257c40b67a3aaba94ae495d9e800d40fd9badd97dc2513fbf93cf0969e48f06fd6a7efd028628c8cde6a70873f0a54d28c54365efad978e92287edd74bc78f21467af9401833b37d68406a50791cb11681c4b436eaabaffc7513618835a57f73b34994a3052329b3833dfc03835674b8f70cb66d7a936ffc953117be14cef233412749b0460d8ce33007db96f6d5ae71442f3cc15218a01cd73edc754116f7ae38ddca20252cc7733d0a3f35c81ab1a130678c4a2362ce1e8950eadb0a2bc", 0x1000}], 0x5}}], 0x2, 0x4000000) [ 240.019080] binder: BINDER_SET_CONTEXT_MGR already set [ 240.029183] binder: 7929:7930 ioctl 40046207 0 returned -16 [ 240.041037] binder: 7929:7930 BC_FREE_BUFFER u0000000020ffc000 no match [ 240.046435] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem 17:04:36 executing program 5: 17:04:36 executing program 2: 17:04:36 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 240.046444] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 240.075648] binder: 7929:7930 BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 240.089088] binder: 7929:7930 ioctl c0306201 20000180 returned -14 17:04:36 executing program 5: 17:04:36 executing program 5: 17:04:36 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:36 executing program 2: [ 240.119781] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 240.119790] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 240.227424] binder: BINDER_SET_CONTEXT_MGR already set [ 240.239543] binder: 7929:7968 ioctl 40046207 0 returned -16 [ 240.256803] binder: 7929:7968 BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 240.258466] binder: 7929:7930 BC_FREE_BUFFER u0000000020ffc000 no match [ 240.271009] binder: 7929:7968 ioctl c0306201 20000180 returned -14 17:04:39 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:39 executing program 5: 17:04:39 executing program 2: 17:04:39 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:39 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$BLKBSZGET(0xffffffffffffffff, 0x80081270, &(0x7f0000000240)) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vga_arbiter\x00', 0x800, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) preadv(r2, &(0x7f00000007c0)=[{&(0x7f0000000380)=""/215, 0xd7}, {&(0x7f0000000280)=""/114, 0x72}, {&(0x7f0000000480)=""/131, 0x83}, {&(0x7f0000000540)=""/99, 0x63}, {&(0x7f00000005c0)=""/201, 0xc9}, {&(0x7f00000006c0)=""/235, 0xeb}], 0x6, 0x100000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r3, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000840)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000880)={{{@in=@initdev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, &(0x7f0000000980)=0xe8) r6 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r6, 0x88, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r6, 0x29, 0x22, &(0x7f0000002e80)={{{@in=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in6=@local}}, &(0x7f0000002f80)=0xe8) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r8, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r8, 0x0, 0x0) accept4$packet(r8, &(0x7f0000002fc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000003000)=0x14, 0x80000) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$packet(0x11, 0x3, 0x300) r12 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r11, &(0x7f0000000100)={0x11, 0x0, r13, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r14, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) r15 = socket$nl_route(0x10, 0x3, 0x0) r16 = socket$packet(0x11, 0x3, 0x300) r17 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r17, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r16, &(0x7f0000000100)={0x11, 0x0, r18, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r16, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r15, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r19, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000003040)={@initdev, @broadcast, 0x0}, &(0x7f0000003080)=0xc) r21 = socket$nl_route(0x10, 0x3, 0x0) r22 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r22, &(0x7f0000000100)={0x11, 0x0, r23, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r22, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r21, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r24, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) r25 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r25, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r25, 0x0, 0x0) getsockname$packet(r25, &(0x7f00000030c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000003100)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000003140)={{{@in6=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@loopback}}, &(0x7f0000003240)=0xe8) r28 = socket$nl_route(0x10, 0x3, 0x0) r29 = socket$packet(0x11, 0x3, 0x300) r30 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r30, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r29, &(0x7f0000000100)={0x11, 0x0, r31, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r29, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r28, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r32, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000003280)={{{@in=@initdev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@mcast1}}, &(0x7f0000003380)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000033c0)={{{@in6=@mcast1, @in6=@ipv4={[], [], @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}}}, &(0x7f00000034c0)=0xe8) r35 = socket$nl_route(0x10, 0x3, 0x0) r36 = socket$packet(0x11, 0x3, 0x300) r37 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r37, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r36, &(0x7f0000000100)={0x11, 0x0, r38, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r36, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r35, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r39, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000003500)={'team0\x00', 0x0}) r41 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r41, 0x88, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r41, 0x29, 0x23, &(0x7f0000003540)={{{@in6=@ipv4={[], [], @dev}, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@empty}}, &(0x7f0000003640)=0xe8) r43 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r43, 0x88, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r43, 0x29, 0x22, &(0x7f0000003680)={{{@in=@multicast2, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000003780)=0xe8) r45 = socket$nl_route(0x10, 0x3, 0x0) r46 = socket$packet(0x11, 0x3, 0x300) r47 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r47, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r46, &(0x7f0000000100)={0x11, 0x0, r48, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r46, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r45, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r49, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000003880)={'team0\x00', r49}) r51 = socket$nl_route(0x10, 0x3, 0x0) r52 = socket$packet(0x11, 0x3, 0x300) r53 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r53, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r52, &(0x7f0000000100)={0x11, 0x0, r54, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r52, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r51, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r55, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) r56 = socket$nl_route(0x10, 0x3, 0x0) r57 = socket$packet(0x11, 0x3, 0x300) r58 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r58, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r57, &(0x7f0000000100)={0x11, 0x0, r59, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r57, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r56, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r60, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) r61 = socket$nl_route(0x10, 0x3, 0x0) r62 = socket$packet(0x11, 0x3, 0x300) r63 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r63, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r62, &(0x7f0000000100)={0x11, 0x0, r64, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r62, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r61, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r65, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000003940)={0x0, @local, @initdev}, &(0x7f0000003980)=0xc) r67 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r67, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r67, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r67, 0x0, 0x10, &(0x7f00000039c0)={{{@in=@initdev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f0000003ac0)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000003c00)={{{@in6=@dev, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast1}}, &(0x7f0000003d00)=0xe8) sendmsg$TEAM_CMD_OPTIONS_GET(r3, &(0x7f0000004800)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8708c42dc0cabcd8}, 0xc, &(0x7f00000047c0)={&(0x7f0000003d40)={0xa78, r4, 0x200, 0x70bd27, 0x25dfdbfc, {}, [{{0x8, 0x1, r5}, {0x3c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r7}, {0x168, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x60f5fd53}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r14}, {0x160, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r19}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1bbc3b2e}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x100, 0x9, 0x1, 0x1}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r20}}, {0x8}}}]}}, {{0x8, 0x1, r24}, {0x240, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x269b}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r26}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xaa}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r27}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xfffffff8}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r32}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x401}}, {0x8}}}]}}, {{0x8, 0x1, r33}, {0x230, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r34}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r39}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r40}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x14, 0x4, [{0x3, 0x1, 0x0, 0x6}, {0x1, 0x20, 0x1, 0x401}]}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffc01}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r42}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r44}}}]}}, {{0x8}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xfff}}}]}}, {{0x8, 0x1, r50}, {0x1b8, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r55}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0xff}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x8f}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r60}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r65}}}]}}, {{0x8, 0x1, r66}, {0xbc, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r68}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r69}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8}}}]}}]}, 0xa78}, 0x1, 0x0, 0x0, 0x20040820}, 0x80) write$P9_RREMOVE(r2, &(0x7f0000000200)={0x7, 0x7b, 0x1}, 0x7) getsockname(r0, &(0x7f0000000140)=@vsock={0x28, 0x0, 0x0, @hyper}, &(0x7f0000000000)=0x80) 17:04:39 executing program 5: 17:04:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) keyctl$chown(0x4, r2, r4, 0x0) open(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:04:39 executing program 2: 17:04:39 executing program 5: 17:04:39 executing program 2: 17:04:39 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:39 executing program 5: [ 243.067678] binder: 7980:7983 got transaction with too large buffer 17:04:39 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='batadv0\x00', 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet(r0, &(0x7f0000593000)={0x2, 0x0, @multicast1}, 0x10) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r4, 0x0, 0x27, &(0x7f0000000040)={@multicast1, @local, @multicast1}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x31, 0x0, 0x0) 17:04:39 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:39 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xff) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0800b5055e0bcfe87b2071") r1 = socket$inet_udplite(0x2, 0x2, 0x88) sendmmsg$inet(r1, 0x0, 0x0, 0x0) [ 243.076740] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 243.076749] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 243.196798] binder: 7980:7983 transaction failed 29201/-22, size 88-24 line 3493 [ 243.215060] binder: undelivered TRANSACTION_ERROR: 29201 [ 243.813332] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 243.821325] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:42 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:42 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 17:04:42 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f00000004c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) truncate(&(0x7f00000000c0)='./bus\x00', 0x1000) r2 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x0) lseek(r1, 0x0, 0x2) sendfile(r1, r2, 0x0, 0x4000000000020009) openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000040)) read(0xffffffffffffffff, 0x0, 0x0) sendfile(r3, r4, 0x0, 0x80001d00c0d0) 17:04:42 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x4000) 17:04:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f0000000280)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r4, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r4, 0x0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f00000002c0)={0x90, r5, 0x0, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xf70}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80}, @IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, [@IPVS_SVC_ATTR_AF={0x8}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x101}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0xa}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4430dd83}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}]}, 0x90}, 0x1, 0x0, 0x0, 0x120d0}, 0x4000000) sendmsg$IPVS_CMD_DEL_DAEMON(r4, &(0x7f0000000500)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x114, r5, 0x400, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000000}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xf9}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xf006}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x757}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7fff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}]}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_TUN_TYPE={0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6d}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@loopback}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="72a69cad692bed98ec9c992b3aef239d"}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x48002}, 0x63941825711661d) r6 = fcntl$dupfd(r2, 0x5f0acf3de343463c, r3) getegid() setsockopt$inet6_MCAST_JOIN_GROUP(r6, 0x29, 0x2a, &(0x7f00000002c0)={0xd9e, {{0xa, 0x4e24, 0x2, @empty, 0x10001}}}, 0x88) 17:04:42 executing program 1: mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x1f) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000000)) 17:04:42 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) [ 246.064362] binder: 8062:8069 got transaction with too large buffer [ 246.071593] binder: 8062:8069 transaction failed 29201/-22, size 88-24 line 3493 [ 246.085117] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem 17:04:42 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) [ 246.085129] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:42 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:42 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x800, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x3ff}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='wchan\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r2 = dup3(0xffffffffffffffff, r1, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f00000002c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)={0x30, r3, 0x300, 0x70bd2b, 0x25dfdbff, {{}, 0x0, 0x410c, 0x0, {0x14, 0x14, 'broadcast-link\x00'}}, ["", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x10001) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x2c, r3, 0x300, 0x70bd2a, 0x25dfdbff, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @udp='udp:syz1\x00'}}, ["", "", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x2000) 17:04:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xd19) r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='attr/keycreate\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000300)={{{@in=@dev, @in=@local}}, {{@in=@empty}, 0x0, @in=@local}}, &(0x7f0000000400)=0xe8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r5, &(0x7f0000000100)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r8, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000440)={'vxcan1\x00', r8}) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000480)={@local, r9}, 0x14) r10 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="001d0000000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$PPPIOCSMRU1(0xffffffffffffffff, 0x40047452, &(0x7f0000000280)=0x575e9d07) [ 246.154702] binder: undelivered TRANSACTION_ERROR: 29201 [ 246.160694] binder: BINDER_SET_CONTEXT_MGR already set [ 246.160704] binder: 8062:8082 ioctl 40046207 0 returned -16 17:04:42 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 246.263206] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 246.323064] binder_alloc: 8101: binder_alloc_buf, no vma [ 246.328729] binder: 8101:8103 transaction failed 29189/-3, size 88-24 line 3284 [ 246.341768] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 246.403604] binder: undelivered TRANSACTION_ERROR: 29189 17:04:45 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:45 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) sendmmsg$inet(r0, &(0x7f0000004b80)=[{{&(0x7f0000003a00)={0x2, 0x4e23, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000001c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev, @multicast2}}}], 0x20}}], 0x1, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) 17:04:45 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:45 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f0000000140)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f00000001c0)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r1) r2 = getegid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r3) lsetxattr$system_posix_acl(&(0x7f0000000000)='./file1\x00', &(0x7f00000000c0)='system.posix_acl_default\x00', &(0x7f0000000200)={{}, {0x1, 0x6}, [{0x2, 0x5, r0}], {0x4, 0x4}, [{0x8, 0x4, r1}, {0x8, 0x5cf9d36f145cdb9a, r2}, {0x8, 0x4, r3}], {0x10, 0x7}}, 0x44, 0x0) 17:04:45 executing program 4: r0 = add_key(0x0, &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="352940c5c8f212ea6fe693cc4723ec", 0xf, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000240)={r0}, 0x0, 0x0, 0x0) keyctl$restrict_keyring(0x1d, r0, &(0x7f0000000300)='big_key\x00', &(0x7f0000000340)='/selinux/checkreqprot\x00') r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x8000, 0x0) ioctl$RTC_WKALM_RD(r3, 0x80287010, &(0x7f00000002c0)) 17:04:45 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0xd19) r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='attr/keycreate\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000300)={{{@in=@dev, @in=@local}}, {{@in=@empty}, 0x0, @in=@local}}, &(0x7f0000000400)=0xe8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r5, &(0x7f0000000100)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r8, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000440)={'vxcan1\x00', r8}) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000480)={@local, r9}, 0x14) r10 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="001d0000000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$PPPIOCSMRU1(0xffffffffffffffff, 0x40047452, &(0x7f0000000280)=0x575e9d07) 17:04:45 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:45 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 249.085714] binder: 8137:8142 got transaction with too large buffer [ 249.099081] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem 17:04:45 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x4060010, 0xffffffffffffffff, 0x8e018000) lseek(r1, 0x4, 0x2) ioctl$RTC_WKALM_RD(r0, 0x80287010, &(0x7f0000000000)) [ 249.099089] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 249.135453] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 249.135462] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 249.199449] binder: 8137:8142 transaction failed 29201/-22, size 88-24 line 3493 [ 249.218844] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 249.218852] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x3) r3 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x101) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x40, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x2}, @free_buffer={0x40086303, r1}, @free_buffer={0x40086303, r3}, @clear_death, @clear_death={0x400c630f, 0x2}], 0x29, 0x0, &(0x7f00000002c0)="9d1acab31d645d124e2d7d3dda8677f1a76e5243675942ca2a995e5d16a688d58c5a026718daacf53e"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/148], @ANYBLOB="940000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB="000000ff0000000000000000000000004000000000000000b09af66dc17f224ea74ef1d174b48fe0ed40418a35b84ec884a357a15d37edb0334fe75aed2dce"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:04:45 executing program 1: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x7) sched_rr_get_interval(r0, &(0x7f0000000000)) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) [ 249.220942] binder_alloc: 8135: binder_alloc_buf, no vma [ 249.220964] binder: 8135:8139 transaction failed 29189/-3, size 88-24 line 3284 [ 249.279130] binder: undelivered TRANSACTION_ERROR: 29201 [ 249.281155] binder_alloc: 8137: binder_alloc_buf, no vma 17:04:45 executing program 2: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 249.281174] binder: 8137:8154 transaction failed 29189/-3, size 88-24 line 3284 [ 249.281203] binder: BINDER_SET_CONTEXT_MGR already set [ 249.281209] binder: 8137:8142 ioctl 40046207 0 returned -16 [ 249.319849] binder: BINDER_SET_CONTEXT_MGR already set [ 249.319856] binder: 8176:8178 ioctl 40046207 0 returned -16 [ 249.324313] binder: 8176:8178 DecRefs 0 refcount change on invalid ref 2 ret -22 [ 249.324325] binder: 8176:8178 BC_FREE_BUFFER u0000000020ffa000 no match [ 249.324331] binder: 8176:8178 BC_FREE_BUFFER u0000000000000000 no match [ 249.324339] binder: 8176:8178 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 249.324348] binder: 8176:8178 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 249.325766] binder_alloc: 8137: binder_alloc_buf, no vma [ 249.325787] binder: 8176:8178 transaction failed 29189/-3, size 88-24 line 3284 [ 249.335472] binder: BINDER_SET_CONTEXT_MGR already set [ 249.335482] binder: 8176:8184 ioctl 40046207 0 returned -16 [ 249.335925] binder: 8176:8178 DecRefs 0 refcount change on invalid ref 2 ret -22 [ 249.335936] binder: 8176:8178 BC_FREE_BUFFER u0000000020ffa000 no match [ 249.335942] binder: 8176:8178 BC_FREE_BUFFER u0000000000000000 no match [ 249.335949] binder: 8176:8178 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 249.335958] binder: 8176:8178 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 249.336020] binder_alloc: 8137: binder_alloc_buf, no vma [ 249.336041] binder: 8176:8184 transaction failed 29189/-3, size 88-24 line 3284 [ 249.655486] binder: undelivered TRANSACTION_ERROR: 29189 [ 249.668156] binder: undelivered TRANSACTION_ERROR: 29189 [ 249.680861] binder: undelivered TRANSACTION_ERROR: 29189 [ 249.694564] binder: undelivered TRANSACTION_ERROR: 29189 17:04:47 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:47 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x88, 0x0, 0x0, 0x0) accept(r0, &(0x7f0000000140)=@l2, &(0x7f0000000000)=0x80) 17:04:47 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:47 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 251.089578] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 251.104066] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:47 executing program 2: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:47 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000280)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r0, &(0x7f00000000c0)="44176fef5c19cb3f291f93fa7293ca0352d1f50239832db8107bb2ff6028e385", &(0x7f0000000200)="1fd9dfd324825615de2bacbb8736023288ffc100becf46a48985876b8d4df66167faa2c278ec9623f19f952d354998728695e840a9b266525d585f29b3d7c8238f54eab95bc0dd778a139e99c85032183195a151ed7499a5c0941849bc"}, 0x20) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x4, &(0x7f0000000180)=[{&(0x7f0000000380)="71617b9bf9a014395ea50eccbbecd371a1ee008d2bdbbc8aead2abd0df75bc70340a8535c962a0a8fde9c847085351420be60ea6886424983f901486d87dafaa3cedb225e13a30d3780bae45186af529fc584623beacc4669d324a9eefcd515a7d3697954ffd68a24da9724d7450417dafae5512f18800e250cfa41e7f703169ceaef1716019045c3b9d9814f24e097969dbdaff6c5dddfed0d770804ba289e2fa4b38192933dd9d1a277a1760632fee758f1d96eb2fc01f234b398d51b23055cf1ddcda1d59fc9931ff1f167f8b42bf8ae20862a60c2e0986ad9c58da7b452883c82f2ddea05fe70772920994ba5837a53b6b6de8d439f639f36dfa58bc5cc05b9cf2c340111737f4e9128e5dee6071e1a84f0c9942716fd5e069a34be03a0cc96ad1aa2f6849837597278f7f25df79ea3571fb64ecb315adb0cdcfd5798c338bdecaa7fbd6c29afbe0cbb55c74461c99efcd2822ec6c5af5e76db651e9d68a19310881c1e0f30d4176a91abd0870452d9e3ab368e2d0566d13324c30fc537258812beb3c882885885f5fff24769e19247c40dcc374445e2cbac67986744aa1f4915734e620aba23da15b9118ac8bf5ffa884a4ad8abff4adf81488e446854f6d2352f174822701f88ed77720ff91c40ecf16ce20bb0a329c87aac383e69877aa19e1fee2ea2d2f05bd2df00e6f6ae33443fb8cb5823c9abace86ccb73e9753e7a227ffee9fe2d198acb9abbce35516529262eede3ebe813de624fb2a7e662b33682b1a629883025570cf902067187874bdd744e8e03f7dd1116224c847c1cb86704f6159dadb0b419ed3c760b25f8def2cdc1a59743407bf301cabc03353b87d158bc7c83626ca0004b328a2245a77791abf345d7d6adee0ec47898f7a79a450b3d40416098bce3f355b3a9f823f5f596727b450602167169ce6387dd420db06d7a22117f448bd69db00dfe47c9d46f93ab416e0ab8749d5883f4b5f6907092b973dd3a1152c0d9d1f4588d926c335fdc335437a746478d19cac56e851686072ff4076e8241745cf349c9d118d5f015384194d5bbfe8fd07753e79929752642e6c5c25c0921f56c235e6e730e72c0de30438132fafbf051cd13a0a5ded3924342e6d8048dad8ef805cfda4866d3df10e3ccbd22690a209aff1c9a90b65909c40a4eab6e548c746ef641bf6de217f6606f1dd383692d114ffae982c84bc72ba29e2ef1c2b70ab28f1d2bf7a9921a53461cd2124093aa5fbab6aa8fe09dd3024e24ac4ee9ca600e075087cc6ae6ef363d9c1ae38f1c91f387e0d0530b32cb5cb3d230f238a12fa1d48e15242acc4f0b9cbd4ffc40e834f3da4d79151c8ba06b77801bc76f6d4b8c8bf7ea2fd54cfaf35a7664ba6b6726c9a21d06c76852d991cb629ae71cca2faedd8309bd1cd876b8cddb3dc04ea2c83440095ae22115b2e5493aab8ff6e0662269e620756261d8d520cb2110aaf7f86cc4ed6bdca2db5369a3035f6ad9556b0b794f4495a09efb148f44afd8d3b520d74772a1f808a1fe4e70aef3aadbc53c0a7c7dde1d7197549c4df3c31a03821e282147631d235767466092ef1ccd819646ac0b85a540fd9d3c54d8cd1ce5beaf1e80f16cee9f8004cd99c8ce783bc8d3cfb6c7afac8662155a5e1ba8fadcedb23d2f2d82d450e6f3979d329230713ccd460d651d465e313b9a5f71a3d6897be1aba4d648c1376ff7d6ecf579cc8fb354e504257003476233180d1373519f361b298b507073177cd73ffe87b6b61af4140abd07c0a0cf8c48cf283deddffd2ed09108abe6819a6ed6271647fd4f4f932eaed1f0075929fafa1288f48c099aaf65037aedeae66c02d26b9e94a86b320dc8d24ec945f97f1f1ea345d66797021facf8153414b31ac7150244835c0e5b15398dca913c7300eea21376c233d966da551c71d0557746f6bda78313c61f1325877a4b7fa5d61ba6284586b4142207b971f803cfbc2b84249fe07f4ba0d19a933da72450cba555636f25b15685e0e145e96ecec3524052ef6bd964acc7074f5962213370dce0b668dd6406bb1625a9ae4e1d40f6e7d582155cee387e63769d943e70c8c0cdf26341b34de3bf07ba502a130f9baea560911a74714ca9625d2bff44227a131ceb69f6b304dc096b45c2ace7abfb8d5adbe38ae8fca1592016812cc0a51f2dc0115de97a72e466344e37748708ec4b1523d4ca6671a294bbeb76d62bf10b550db02366f63ce2034f03c258c76aef4580ae4c58a0da05d0cd745131ce7a7b2ef1318b817fe2dd72439ab12359798725736d98c3c3fb4e22423ac9ccfcbf02a255c7d91fdbde62b42461071b925c67b75c58b17f0fcb58e62efd7772c4fb3748555cba7f392f351f147486bb6a8529d648d45743a1dfc4b50151b62d5065ecace0d3d7b78bb9dd37b6ca895d719368968e00482dbf4df6f5c7d3a73fe4ea28c69c38d32f51b1b6f58b59353cb2cf7225af6d72681f5d16b237438323f9c9d74b4b3bc2a674c29ce5943f4aee3c634ffce76dc26d9e40477e49ec729ff2e50118c3a90d1f15386e552fb99272c8658b67eef77155b057685e22c3f18c698b3e6c4e5c9607e2639515f65b1181ffb7417bd8152d0a96e4b4a8b969f7d6637462aff6403a9517d917e3b0baa331c2c71661b09b9061b8963acac1933defc22b699e7ead6892e64cefda3becda2ed0779ced88b1dabb8b7a731b1f566ecfede115adb0db77c0124591b07d210d247aea3f4c0b7023df718da2812d7f99c0393516665959b2f9572892088e683c0b49c236421427ca856f0ecd9356c9f000d7cd031e7ca9a6606335f21b17df9d2927f8b9d4e2205d730fc0fd67c725ec62e3d7103dcaf4c0d18dc0a39c9318997c92c89d398bae2b3e8fd96f63ece398bd1f7fd42cedadd6afc1a4fb5d93e39ac0ad33ebf8ee55ce69fd4da6d1dbcd5dd0e39136595a523934a39406701882fe149c0539e3dcdf670a892f0cf773225a65b479da6e57321bd01f72fe1ffe8c16ef725f01bd7bd9cb1381c922480a31d773d6d1f4d6731e750ae4acfc6f190907c4e8be767ec25367cf0488e1abb5a2b3061fdbcc9aadbc28c0e87d7dc21ee1bf363acd36965c0d24289a28265f34de52dbaee619207d86f1a3c25efff62bde92f339c06a99d3e21d86e4954ae433483538ba4c748c19ed47a663d1b2f2046dd5925d4f846f772e18b62bcc1c11089f4252245f410f31acaf969244d011ec5de156f80dad6912223872b15275b4fe5945e9e28f658e0d5365b6e86d11263e76311a408806623d25cb85edc89ac3313b138fbac5fa7831c175101bb443322b00fa009055b6d5b6dcca4881ba463dc39bb6e7de7340752faf85ebdd1604a136ce1086c90466b1dc29afba2056e1380c611c09d48367d56688f8d04bf02e51f1aca4afe96249d3cde46425524d0b2f330a857150272ac4cb585b5a2299aee7f6d734b2cd5147a4bfdab6bfa59d16372c16c812aa9d6d2ce686924bf1b20be719d80025a2c557c9cc0df8ba39fd19b18959be652e936ee9373c74f3d3d46f76c11d6705a04739fd4de4a8d310d6ecd248633db37372fd353aeefe2b0bcd7c994215b3cd3c53ab4c8f558c111434c60d81861e2a8c0e63f6b2c52b8fab536b041d2a548fbc18c189a5d7e8c4b5a5f067e02e8718d75396830bd3963ecbdfe3a2a2ce644b7864aaec989f4484d1192c1a581773ddd7b09381da87be48193556e9565d1849b06baccc134ade15c53c79f184cf8b2ff6ad21545fa2c9716f2bb4751b9731b94db08c562b24e2f62df2d1fa1f4f7d98311fbb9436072917c968cd13a2212f21768a0b07a43252e4793f91221a413ce92c97cfaee6dbbac632a3bd04b332f64a61bc5ae906a1aa141523fa1628e14be707979bcad83118dd57366c32ba912ea7239512313caefb897cc5702529842386d17ce1d7b966a581408ea8fbb407a96870aa0959325f079843322ca167a4e152b3458428d381094e70143af1dc247947eae69837e8c05c0024e647ae5c42631edc20a4db76fd7e4ca67897f4c5c5c0e4685bb30db11499b1fae7f0ec31f52088aac963dc993835e6c9b12b0868396e6beb8519a5a402fa7faa9eea4542ac46fac925e9aa2f78f1c672d652a877c5e9dba80d0f5e7a1b38a739f9fee5a03f16ec8f4838ce2790450eba61250cfb19501dfdf7f57270f04faac21fa680bf5918fda4b6ff2aa72a2e2ffa8dd0c7e02ad805ed93499bc88695db2d13dbb975cf4cdacdd981c1620f81e6143385fbb2dd912549417b69bf4c666b2a52559f3d40027ece5e59ed8997f91e131bad76fc5e46f0d8291191b270265b1e56b5d5127c1a5405edd6ffdfc49b094a5f19368967ca84280b1f4036cc3b334b99d5b45b9a9997eb59dfdf646db42fe4946d18bbc3580356062df2b01fc08f23835ae068037944575580edfcaf3f958f77714301f5b26cdc4605f33215594a2b9fbebc8e8663fa7a4f8bcc7adf9295d30592f77f972bf3139aaf9f72084db76c734e42d6fedeb13f3e900b320059f4871dac91b4148a9f412a24d15d6c152617d67b8d147ef727ce9189cffa2f4868e01908fcedc7a2c96941831275854fe36c748f55977b4acea31ee7a94e81f7f506d188f750a7788a9b5a2facf654f5afe8e63d954b3065c24504d5a170d8542fd3f77607b05c7188f8d955fe2fec7c624da43dc7b839477388a7c8087d6d3658fedb6b691808b68c0060d6dd9189e8a02d44753227d55ec21bb3c5f7714fa99279a7cc90457a31cd2d0d8b0c7e6fe730e564b996acef4a297047ede7696591011ddc8f0ef8016bf9ee60aec34cf43782c7bc28e8e7f35865b2507ee9743b53d96e56819ae107de4ee11287649cd6efc78c1aa3ef49d2a60823c866169ce054e4300478140897d3371ce24c411fcbc254dc7809ee86d49d2558b506be198342eee742eee3c682dae2ace8473dd2e49ee2f7ca6e4ba924c27bef52fba29b774bc2c9cf2cf71b7146f2dba27d61c4772931eef5c73936779407c2d418474d3b53b0111de328be9b5e63ca3a774691c083263f7a782560c95a164ff8040d284e1c76f02e7c2de2803f3506d243808f0348537cda94d13854e38465822238dd236ffce3a330380fb8fa9803872d8543d7bad3f4df4709d057e9002b86eb0494677e0a5c92dbb5e4e3d0225291e990579fc0bf67c3a1918b125571e7c5508e87d7fd71d1e0f2a250b2777060c190a5b5af7e9f63340add257a9fc9a8b0e1fbd250f6c45bf9236fa291d60c0e41bb26366d7f78678af4e01781dc3a9cadd038e05f6151cc5dbb0bd44931697b6ea838d372dd7e7ea5ff7d6a2a8d552228b4b20d758a61f89ab1ddd2c527d6069ef26dbad92eb846081203e5fa3276316bbdaf721e7ba05f8b977b4db116d521f7a575b352616b969c9b07a7b5c31cf5440a6175da29634f387755fd0392b367c30a7982783178eb7f7413a93d5ed243fe7b820286f84f3505c1e588a0ef8eee853f288dd2d358e311488b68758b4face938ae6da8078ecb6ad6f75651d0e1e971851af110d9cbae9a5a93ef3c5758ca1a9a56fd8df8cf9ac33cb9aa419e65d2be92f20860882ab657131a77af74933436c911e55f41e8472fc450576747ccc723cd605bb991ec29058fd04eeccb5643fc39248bd77e8d44e689ecf1837bca9b3b611d3d17d2391de536a2ff3caef3c9ea581c64274c4bc4f030d07548796e67b99d4188ed3d168cac7a0bb088dd4b9e7cb58f5e0fcd5ebcbe1c1a9bc9315f687dbccd7b44634828596", 0x1000, 0x40}, {&(0x7f0000001380)="f09064148ae7570619a729870053c71dd5604cd113dad84108acf7f8216537595e0de3afb4818768f94e0203a84b16030092bc8d744fc4f086d1cb8b25306dc7c53d192e466d64a0726b6d9457a143fca6ee0ce36f9339037c0b07810d9ed8ead590d87c9ea2ac84d242e616e3b0d9b295a45e1659a2fa4751e8dd603e804e77015786d6bcdf68f22d37247882a61cc0ce9902336c78e29a4a840776353b23861c7d9b3ee7ef4cb74b41f1f1de82d8c80b45c96d650f68814ff56f5538ffbc9e8f53a99b41a0097975576ad1fb55a800dcbe2c6af7fdfdd665b1502122f49a57fa28fa1891fb00c2cad8694db9d5992ebeccd8824d9b1ae33ac7803cdfd38b69d2ceca63fa5d3654e67914451de42618931d674bfeeadf2ea9c17c7caa8b9fe7f42e076b5abef8b66e5a295861108b1206f0f8680f36a1c5c89d76651a63260e25e74dc1862dc778cb973f1eab9f87c9fdec54d2970f1ede1bce9d3ce897475a5a488540d7f70999d4b6373dfe3d46711158a8663496e4e617a7300a56ca68f9db04285266b6c153d15fe0cb499172d7552e8c1507d1681e7985eb1e471530029a4f12efea19e858006792260e4d8cd2972a1956288c988aaa10b77d93882848a1ead1c21a99da022569dbcd81222edc2597d55500b3d2b0f36da19d1567e7c756d0dcb0ddf443034dda2e1c935ecb9f129346bda9e9f804b1978ecd8d7c67e2eb35b5acd1b63ae9fb71842af095e55e3b4ff15b424ec76647b16851e4c266ed5b08e1249b02f8e682305763f74360b875c8ff6f36225fb3befb2ee33f2c6881f202c6e433f1f74b825bb26dedf530fdc36c1bcf471dd0ac7779fe39c136fb77596100debaef16378645559d8fb0b51dbba71a981baf381145ccae58a23597a47ef5085ce8bbffdd351aabd8566cce688c97929da12aa648249dea05fbb75838156f5cd2826b71da8ae61a43c08b12d6f1a7338282231d646307e9a0c4e63761626fa7b8f9d4106bcd91279a2d6c3bbded00002b6515e02bea02c91a4dcf9a3034ac6d923568a5ffe818e623443128b56159044829bf8f8d8755506357b7e4e71caed12dadf5a14345a2896d5066447227b5a31abc3a378ade6ac7bd29ac3474b1e5eb33fb4bc73dbeb28264a68dc342ab8872d92199d85e98d3527958929a5ae070e1906a36e5298c2749e7b9d85a274eca85137f4dd5311302979141785f02cc8dcf162d7e71b6258cbf1c1de84f8f95c1acffc9991ebff803c1ff292e98aa4bc21374571365a66b6f240f682e479e95765d18928981c77aab80c53c7c7bf44fda5919ca68a372df64bb95a5838056246941f4e2a1498da9282303db08e66d1e77e80a798cbcf11b9a44e7de0a5849ba0bd6db4eddbb2812fd9c7d65966616c2155267e22668b28bcbce13acc0a7f05ec0c174639d871f85d3362d397434c2057348ee6211188ff51a7b5fb1e3897b123605faba46804c54fd201cf578afe55df977beb3963c5df3b93749e05889590c873aece7cdfcbbaa5f5098cb8d541913883950cd649c2638c7efe6d82331aded272d8a7a623a97c11af5d66421bb465d037757cab937d0a3972c872626d79a52bee81264f5e4b9678edda3df83d6aa9777e64801c180a0f05066b94389e60d724b324997b7c624a29a53633bd0af3aa05b5b91098ad504222d196dbb6c7a3e606ba9a0369a151aebde9d7ccca0fbdab72448fbe4f9d8cfd3ffc6b2b39025a114390f03bab29d02bdc9f3e61c75afd63fc268be974dbbf042bed6f2ea33fff3ae55b2f491886e8d4f75d1caca05f8bc5fbb9344e0d57712069f16f6b94b4a256a38f5ca1180767b96debb3f45e945ecebb9effececbb14ddd7b974d8930369ce55d24dcd393c22660bdd385187b88bd0579196f558dcde4d3908394caf443b57217d1620f5df2247b892a479dbc0b4e5cbf55db801ba6803a4a87463ca893e3fb011d33910243153b6b5556345b9b89803df2e45d2c32a36beaf28330a2c58233095007e1da20187342cabe4bdee4c77e53dc9c7f7de1524ceb820c3c96f8fd05266fdadfdfbce806b9be5ae61a6e46cb3082d71ea8513aa6aafabb641b2f919c6424119502b8d0d294feefe14b3a706427ae671620590971e2d85b146413444d9cdafb481815369cc283126e65284fcd076e7d5c35fa4ef10a0b764d4a5b1d26a1b076e52a63213a29a2f1fe9fb8699c52436f56ce729116dbc6994a9d3200f7c1953edc89f3c44b79f9fce3f047f8b238c406033b454df22ed07f45c06be77ec7ee7d0cdcac52b709bebc08feb64829ba05347327ece83ef6e8db2b26381d8561b90f210167fa7d5a667cbeec8ef0dc73bfd1cacd5f37ce73b435aebdb4a710ba2ad9b259e7dd02bb83be1184bbd90a6c5a1e6c7d0058df6329a2e17d8cd1eeacde56ffba14a26c42c2e62df8dd55017c7e3a9416af607f3341e580beb5c105b442e6cc0362b9c9834ed93e3ac6c70882ac25d315a3a921394e4279c759adbc9670451edd45fba3c445142cc49fb4a0a82ee4851d1c3763b5303f7ee9a388ba77a7a5187250e62c8f87d817492512426e9c946fbdfa362000db56822440cca2ac55fd21f4d0305a09c2e30ffa7472c25f802c8c977a3682216be330e3e3f54e642c568f72c894c3c3f89a843d7dcba2120cce5284efb2f1ce007708532321811e8517b4eaa383c7f9362ec5711223d6745f87dad24f457615a7f0adf488744e015092648cf4bff5a2f8cdb0377bba20292a7f667f3dba6d85504db2553a2ef0dcce697b5fa17be20aabc65eedcce89043875f72a53b4eecf488ff8fc1dbd9561eb0103cd82beaccd48a75401c4735fff799a013ffa6cea4bb077e7b04bcf9d1598a8dfff32d17ecebf79a215d8ed8019833f0c2ff3092e725d182ab24c2a4db10830dc3420523f0210f1759ed2f6fb93d4ec64e6aadf691274aebf447dbc17666803197288ecdcb1ff0bda2bd95a5f450146c1e7afd42123365d747223ec10e9d5ac944a1cd16f90633da495832b1fcbde2888c8ac0ba9fce3a46e5df5ba36c5288f1f9b6a529db94c0ff16c1bdc073c48edce5277bba5e8d9381ccf7710ae56bb23b11ce969abe70118be0f5ed3aac130854cea9d9e7eec6223d8e1c1ef9820fa6375b12d1f5c42c42594b699e63e8f51042916847e072cae6d6ed960a514a4952a860daa0b9a8537147eb1db2b84c15ef7ade9b10fa5e810a3933f5c357f029d04bf9fadca88a2779190337ddc7662b78f70a004c0d7b158dd917ae2e7d84dfef33aad7a29dd4a90cfe7a887ac320594a172473a38557320790d50eaf3524fb231bc9b123767adf008926ba0ee343228b54473bd1af0619616984fb6a513c6596334a6376a0065848919be6d7df6a3c82e0e661d831cb2a45b2c3ede1ec28a463fafbdc70ed4926a751900af29d1209e7f8aff3ecc62ab7ea4223578e606cc9c1b0d0b657d6c42070a27b4069346965973fd38b0418bc2954426ec3ea3b9fd86a98c6963e9dabe761a77b0be7c00c8edef9bb4bc4c3c4c5a34aac6f8a1f826e0cc52c35eb0fdaa8f9ab4800bae1c5a9d12d7ab01f17ce50431f3b749200ba9ca85407d35b069d564fbb70aeb0e4811aa837ca37b44a2eda742b6f3d65cda43495f456ac7c2f1826dbecc6e396bfc00b3f62d8e6258e915ca99bbf5661d0e2d16a86f04f5e705ae1a847ad1d44ae2cbd9b361a6f7fc731825d7c8de3b4df3dcdb08b487552bd9bfeb383c613d36be96f5559327af65dc6d7daf4b65d8bb2efed4a4622ec84c953db419ea0f35d9a2a776ab265a8d3011494129b986bcc6803923b7f203ec0b7e51a748c00b8fc82b18135e02bcef8690a29f7b8c5b90278d2c32edce0a1a2fe1ff0049d9aa075e7f98161f6228750dd6be52e4787d6ae5313947fd7b06174a05785c4ba0c6a2ffde3104af2eca7ef4a9c6e29c5a3b90a9f4d78e5e3fc114ade87e0db241429ae3e14c3f076fde1ba49ccbf94ddd78fa832f4285104499c2d79767133c0940ea14ec3b576265c9e8deef9fefdc882d135e10913b49f3c799fcde202a394b9710eaee6d14c4821014abcf1641adb3d707534d7fc089531f71809efaa9c61b36bab1a0ab6c4ba8b9482cdd328d7cb31f591584bd9a30030d517ca07d2d6557c3021ac0c39056eb9c671dcfb5a6c17ad4f2881954d923363881e4ee1151d3956a74f0f8b8ee682baf2edc7d14783f9886a0a38e748b48044a16fffc252bb939f9c996db554a3153db9d26e2864a2c78b7b8d9d8c5c7c5cd393759a031236be517974c05dfb8d2fca9c289f5742c8e8119acb9cc6a5c11ba8437eb36a0d10a4060ded7304e4b8b96f012a0707db224ae8ff654e177e5bb70d3c7e65312d6710e8be50b4c0d2220d4f0e60f23e1abce02f1e2d23bcd07aa25b48ad6896f2a945c83cb2fa8ada412f505c906e1e2621df084b72c94b8f26541b7d07e71340208b89ed55f74e7f33d3cde64247e364d60b9f19394f4f9faa1b6707c39af4ae149eaec8b451648b3b7be65663a827b06e96abde00037d76c0f6be1836ccbda4a21934f1fd543e3184ada3e3504fd03f91ab1c0b868ddd3b1a2ef70cb089c584ca4a0c5cd6f3a83ca1e7fa3afe35d79c4671f02a4e885a009ac601c2822549690343bbe815b714f60ee104a795892e15aecf2a1de27753987aad6d8b540db9cccfc8a00e1c7c1dfc85ece9a1ad88dd62c6d55e0985bf3633c1995a11ff49f70c79bceb5de65ecf78757e3e5d19ea4a5f74eee69712634940a9d26fc4afb87703d4c84a5f1c113407c2674a4b924ad6c0b84dffd2dcff7370be3d409b3a174efa4a3609b78a878c3b052435d6c6d3a7a71df71a311f491f9f837d70fb5fb8b817246a194067fc04c6c607b9f5f6bd99f177976fe3a9be65182b78f5852446abcb442708ba8de7d5c9bfe2f709d42731d87fdf8aaa26d45146c7b6a4bbed3ffa6da04516c8259143a1f6a5c379da83b19c50fc409eb422cd4b3cd2bc11040608aef2c3a111d65bc2606f548c739e7e7fb681b193e369ab05a72a726a22f5769f4b4f0476792d6e06391a35a05b5225543dc55733aa4604c5d17cca8d59a16fdb99f56572f7763b14da48ff522c7f27ae9ad4043879fb72bb4cd54911b4f71dfd811ec6675b586f5fd66f746f976306fa3febe66215fce3b6f5226babc8fffc57e664be5aec46e1e42c292d3f6aa242f2704432356e05a105e7f31260b43cf8010eb706b66ae6e01c42add28cd0ed9ed374f75489476323cc7f69224f675d8cb0433740d421de3498a6477bd485f4426ccdab4d737a83d876fb1ddb5ffef0e868516309cce0a174548519959ce602d0a3d0783f5e4f177530edbd5ead8714ce32c63bfec5f5ef19ad08c7232820ba2cb676449ea2a21554d283562d6dc33f5c2321cfb6a39038a7dd8a54cd55ba72c6b530f76b0ffd060aa92068114250e417aa1f88d2b4099eef4166b877048c8f790c220ae690c180d13bafa14ac2d551c991b2dd8fec4e310f69c92edaf0a73d2633ab5048e44ad2ab08da84ddffc3a41cd2ca088cf47f9219e03ce10c0c5851dd5e1dbcc3c7e0ac7d14a5c5843e3eb4994e6b2d30901ccdd51a7b6632707a9e865776fc9e9ec9ce2f21c6141c963b8864a1a83c41b4a658972a8ee6b36de1b1334d69903613b02052a556e488160f9c423cb603b404fe010f147c1f53b126d1988f86487d3bec2ac114d7038a90fc9fbae8c83b9280c54b1c3bf7f47653a345adc0aa5eaae26eb35431d880bca94c6665f7fb9e4c582f89ea", 0x1000, 0x8000}, {&(0x7f0000000000)="a2015a60c9658aeea541f98842fa6c3356750d34358e49aca0c62c8b1cd396b4fa1bc870692c6b3b7e39758809929727fee6acf8", 0x34, 0x5}, {&(0x7f0000000140)="bd6154d17f1263707355fa37b6933c99fce51ddd7282afc7c112b8d8e5220f243852e8f95a98213b363b8358eb", 0x2d, 0x106000000101}], 0x0, 0x0) rt_sigpending(&(0x7f00000002c0), 0x215) [ 251.175432] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 251.186490] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 251.275028] EXT4-fs (loop1): VFS: Can't find ext4 filesystem 17:04:48 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:48 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:48 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000140)=@nat={'nat\x00', 0x19, 0x2, 0x34c, [0x20000380, 0x0, 0x0, 0x200003b0, 0x20000566], 0x0, &(0x7f0000000000), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{0x5, 0x45, 0x8914, 'bcsf0\x00', 'bridge_slave_1\x00', 'vlan0\x00', 'veth1_to_bridge\x00', @link_local, [0xff, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0x101, 0x0, 0x0, 0x1fe, 0xff, 0xff], 0xde, 0x14e, 0x186, [@stp={'stp\x00', 0x48, {{0x0, {0x7, 0xfffd, 0x8, @remote, [0x101], 0x4, 0x0, 0x0, 0x7, @remote, [0x0, 0x0, 0x88be2bd9e4443516, 0xff, 0xff, 0x1fe], 0x4e23, 0x4e24, 0x8, 0xf012, 0x2, 0x1, 0x6, 0x6, 0x5, 0x5}, 0x2, 0xc0}}}], [@snat={'snat\x00', 0x10, {{@local, 0xfffffffffffffffc}}}, @arpreply={'arpreply\x00', 0x10, {{@dev={[], 0x28}, 0xfffffffffffffffe}}}], @arpreply={'arpreply\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0x115b94e749fae21a, 0x1, [{0x5, 0x18, 0x22f0, 'veth1_to_bond\x00', '\x00', 'hsr0\x00', 'bridge_slave_1\x00', @local, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @empty, [0x0, 0x4e56f1b89671fdcf, 0xff, 0xff, 0x0, 0xff], 0xb6, 0xb6, 0x106, [@limit={'limit\x00', 0x20, {{0x2, 0xffff, 0xfffffffffffffffc, 0x1, 0x7, 0x28b}}}], [], @common=@log={'log\x00', 0x28, {{0x80, "6c228891edb70eb41e1ef4c6b5639029d1a8d0b13fa49dffb530d87c596c", 0xa71a968e2ba4adcf}}}}]}]}, 0x3c4) [ 252.170074] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 252.191619] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:48 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f0000000280)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r4, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r4, 0x0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f00000002c0)={0x90, r5, 0x0, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xf70}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80}, @IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, [@IPVS_SVC_ATTR_AF={0x8}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x101}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0xa}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4430dd83}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}]}, 0x90}, 0x1, 0x0, 0x0, 0x120d0}, 0x4000000) sendmsg$IPVS_CMD_DEL_DAEMON(r4, &(0x7f0000000500)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x114, r5, 0x400, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000000}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xf9}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xf006}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x757}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7fff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}]}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_TUN_TYPE={0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6d}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@loopback}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="72a69cad692bed98ec9c992b3aef239d"}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x48002}, 0x63941825711661d) r6 = fcntl$dupfd(r2, 0x5f0acf3de343463c, r3) getegid() setsockopt$inet6_MCAST_JOIN_GROUP(r6, 0x29, 0x2a, &(0x7f00000002c0)={0xd9e, {{0xa, 0x4e24, 0x2, @empty, 0x10001}}}, 0x88) [ 252.274256] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 252.299460] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:48 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 252.312999] binder: 8241:8243 got transaction with too large buffer [ 252.313038] binder: 8241:8243 transaction failed 29201/-22, size 88-24 line 3493 17:04:48 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 252.341574] binder: undelivered TRANSACTION_ERROR: 29201 17:04:49 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:49 executing program 1: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000000)=0x401, 0x4) r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x88, 0x0, 0x0, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x200000) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000001600)) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) recvmsg(r2, &(0x7f0000000500)={&(0x7f0000000200)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000280)=""/159, 0x9f}, {&(0x7f0000000380)=""/163, 0xa3}, {&(0x7f0000000440)=""/23, 0x17}], 0x3, &(0x7f0000000640)=""/34, 0xfffffffffffffd90}, 0x2000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r4) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000540)={{{@in6=@remote, @in=@local, 0x4e20, 0x8, 0x4e21, 0x0, 0xa, 0x3d9980886ac02913, 0xa0, 0x2b, r3, r4}, {0x8001, 0x80, 0xffffffff80000001, 0x2f00, 0x1e, 0x3f, 0x6, 0x100}, {0x9de, 0xffffffffffffffff, 0x1f, 0x2}, 0xffffffff, 0x0, 0x0, 0x1, 0x2, 0x1}, {{@in6=@remote, 0x4d6, 0xbc6574989e9b8908}, 0x2, @in=@broadcast, 0x3501, 0x4, 0x0, 0x40, 0x9, 0xffffca95, 0x1ff}}, 0xe8) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r5, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r6, 0x88, 0x0, 0x0, 0x0) r7 = accept$inet6(r6, &(0x7f00000004c0)={0xa, 0x0, 0x0, @local}, &(0x7f0000000680)=0x1c) ioctl$sock_inet_SIOCGIFADDR(r7, 0x8915, &(0x7f00000006c0)={'erspan0\x00', {0x2, 0x4e21, @loopback}}) r8 = openat$cgroup_ro(r5, &(0x7f0000000140)='memory.events\x00', 0x0, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r8, 0x40086607, &(0x7f0000000180)=0x2) r9 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r9, 0x88, 0x0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000001580)={0x0, 0x0}) recvmmsg(r9, &(0x7f0000001440)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000700)=""/15, 0xf}, {&(0x7f0000000740)=""/102, 0x66}, {&(0x7f00000007c0)=""/123, 0x7b}], 0x3, &(0x7f0000000880)=""/158, 0x9e}, 0x6}, {{&(0x7f0000000940)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, 0x80, &(0x7f0000000b40)=[{&(0x7f00000009c0)=""/112, 0x70}, {&(0x7f0000000a40)=""/195, 0xc3}], 0x2, &(0x7f0000000b80)=""/24, 0x18}, 0x6}, {{0x0, 0x0, &(0x7f0000000fc0)=[{&(0x7f0000000bc0)=""/227, 0xe3}, {&(0x7f0000000cc0)=""/227, 0xe3}, {&(0x7f0000000dc0)=""/2, 0x2}, {&(0x7f0000000e00)=""/48, 0x30}, {&(0x7f0000000e40)=""/17, 0x11}, {&(0x7f0000000e80)=""/83, 0x53}, {&(0x7f0000000f00)=""/11, 0xb}, {&(0x7f0000000f40)=""/120, 0x78}], 0x8}, 0xfffffffc}, {{&(0x7f0000001040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, 0x80, &(0x7f0000001180)=[{&(0x7f00000010c0)=""/160, 0xa0}], 0x1, &(0x7f00000011c0)=""/59, 0x3b}, 0x21}, {{&(0x7f0000001200)=@isdn, 0x80, &(0x7f0000001380)=[{&(0x7f0000001280)=""/207, 0xcf}], 0x1, &(0x7f00000013c0)=""/94, 0x5e}}], 0x5, 0x1, &(0x7f00000015c0)={r10, r11+30000000}) ioctl$EXT4_IOC_MIGRATE(r8, 0x6609) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) 17:04:49 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:49 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 253.337239] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 253.353339] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) keyctl$chown(0x4, r2, r4, 0x0) open(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:04:49 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 253.615245] binder: 8280:8282 got transaction with too large buffer [ 253.631372] binder: 8280:8282 transaction failed 29201/-22, size 88-24 line 3493 [ 253.657466] binder: undelivered TRANSACTION_ERROR: 29201 17:04:51 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:51 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:51 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000340), 0x2066000, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) read(0xffffffffffffffff, &(0x7f0000000180)=""/208, 0xd0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000)='TIPCv2\x00') r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) ioctl$LOOP_CLR_FD(r1, 0x4c01) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000280)=0x37) write$cgroup_type(r0, &(0x7f0000000140)='threaded\x00', 0x9) 17:04:51 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:51 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:51 executing program 2: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 255.160422] binder: release 8293:8295 transaction 795 out, still active [ 255.172179] binder: unexpected work type, 4, not freed [ 255.192658] binder: undelivered TRANSACTION_COMPLETE 17:04:51 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 255.207393] binder: send failed reply for transaction 795, target dead 17:04:51 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) getuid() 17:04:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0xffff, 0x8}, @window={0x3, 0x35, 0x6}, @mss={0x2, 0x80000000}, @sack_perm], 0x4) tkill(r2, 0x7) prctl$PR_GET_KEEPCAPS(0x7) ptrace$setsig(0x4203, r2, 0x7f, &(0x7f0000000300)={0x19, 0x4, 0x16}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:04:51 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 255.312873] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 255.335416] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 255.404936] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 255.417164] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:51 executing program 1: 17:04:54 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:54 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:54 executing program 1: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='fuse\x00', 0x2001020, &(0x7f0000000180)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r0}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x37b8}}, {@max_read={'max_read', 0x3d, 0x4}}, {@max_read={'max_read', 0x3d, 0x7}}, {@max_read={'max_read', 0x3d, 0x8}}, {@allow_other='allow_other'}, {@allow_other='allow_other'}, {@default_permissions='default_permissions'}], [{@rootcontext={'rootcontext', 0x3d, 'user_u'}}]}}) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) write$P9_RRENAME(0xffffffffffffffff, &(0x7f0000000300)={0x7, 0x15, 0x1}, 0x7) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) ioctl$TCGETS2(r1, 0x802c542a, &(0x7f00000002c0)) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) 17:04:54 executing program 2: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:54 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:54 executing program 3: r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 258.205368] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 258.233306] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:54 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 258.309799] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 258.337354] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:54 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x611704}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xd0, r1, 0x31a, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x58, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x67}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x12}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x2f}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6a}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@remote}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vlan0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xb5}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xa, 0x8}}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x40}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}]}, 0xd0}, 0x1, 0x0, 0x0, 0x40}, 0x40004) 17:04:54 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:54 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 258.519272] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 258.551799] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 258.623945] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 258.637100] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:54 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x181200, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x2002, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000180)) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000140)) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x4, 0x0, &(0x7f0000000280), 0x818, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r3, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) ioctl$BLKZEROOUT(r3, 0x127f, &(0x7f0000000200)={0x2, 0x7}) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r4, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r4, 0x0, 0x0) ioctl$TIOCLINUX3(r4, 0x541c, &(0x7f00000000c0)) 17:04:54 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 258.763605] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 258.831847] EXT4-fs (loop1): VFS: Can't find ext4 filesystem 17:04:57 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)) 17:04:57 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:57 executing program 3: r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:57 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:04:57 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:04:57 executing program 2: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:57 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 261.223850] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 261.245117] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:57 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:57 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x1, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0xff}], 0x808, 0x0) chmod(&(0x7f0000000000)='./file0\x00', 0x51) io_setup(0x1, &(0x7f0000000140)) [ 261.316918] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 261.340339] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:04:57 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:57 executing program 4: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 261.508004] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 261.575843] EXT4-fs (loop1): VFS: Can't find ext4 filesystem 17:04:57 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/igmp\x00\xa6\'`\xe3U\x03/\x1b\xe9HD\f\xb5\xa4\x9eT\x18\v\xc0/1t\xb4]\xf0<\xc6& \xc7a\xdd\xffwX\xc8\'\x86s\xed\xd7\xd3\aj\xca\xb7\x14\xd5r\x9b\xadw 0xffffffffffffffff}) r3 = dup3(r2, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 261.752124] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 261.788710] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 261.864110] binder: 8485:8486 got transaction with too large buffer [ 261.881090] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 261.881098] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 261.933019] binder: 8485:8486 transaction failed 29201/-22, size 88-24 line 3493 [ 261.968348] binder: undelivered TRANSACTION_ERROR: 29201 17:04:59 executing program 3: r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:04:59 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) renameat2(r0, &(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000180)='./file0\x00', 0x4) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) [ 263.401250] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 263.408996] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:05:00 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:00 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@empty, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@empty}}, &(0x7f00000003c0)=0xe8) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) fstat(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r4) r5 = getegid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r6) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r7) getgroups(0x1, &(0x7f0000000700)=[r7]) getgroups(0x4, &(0x7f0000000480)=[r6, 0xee00, 0x0, r7]) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000004c0)={0x0, 0x0, 0x0}, &(0x7f0000000500)=0xc) fsetxattr$system_posix_acl(r0, &(0x7f0000000280)='system.posix_acl_access\x00', &(0x7f0000000540)={{}, {0x1, 0x6}, [{0x2, 0x1, r1}, {0x2, 0x4, r3}], {0x4, 0x1}, [{0x8, 0x46de334402fcd7ed, r4}, {0x8, 0x1, r5}, {0x8, 0x4, r8}, {0x8, 0x1, r9}], {}, {0x20, 0x7}}, 0x54, 0x0) r10 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@flat, @ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/148, 0x94}, @fd}, &(0x7f00000001c0)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 17:05:00 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:00 executing program 1: r0 = accept(0xffffffffffffffff, &(0x7f0000000140)=@nl=@unspec, &(0x7f0000000000)=0x80) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r2 = dup3(0xffffffffffffffff, r1, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f00000002c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)={0x30, r3, 0x300, 0x70bd2b, 0x25dfdbff, {{}, 0x0, 0x410c, 0x0, {0x2, 0x14, 'broadcast-link\x00'}}, ["", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x4010001) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1004}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r3, 0x4, 0x70bd26, 0x25dfdbfe, {{}, 0x0, 0x4102, 0x0, {0x18, 0x13, @l2={'ib', 0x3a, 'veth0_to_bond\x00'}}}, [""]}, 0x34}, 0x1, 0x0, 0x0, 0x20000010}, 0x4040) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0xc25, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x2, 0x0) sendmmsg(r1, &(0x7f0000001a00)=[{{&(0x7f0000000380)=@nl=@proc={0x10, 0x0, 0x25dfdbfd, 0x6000}, 0x80, &(0x7f0000001900)=[{&(0x7f0000000400)="fb07859457f46d146095f13a6769229efb37cdde52c1f80444c6a2c9b4ee788ee0295ad1fbe494aeb3bd77892dad7c8e7e9fd61348e511d69b3150c7712ec008fc216010ae6534d0869105668cfb", 0x4e}, {&(0x7f0000000480)="b1887a2a698cbf638e7ffdd5d97b9227b96b36bcd843c819999657a86b3dcb52742dfe99a5d820ca125f3992d35b99fc51d7b4227d9d5885fb5e9999c36fcee1f56e102fee79b79cc30e25414b0e6583baaf957d6b644f7fc6127ba3b0ee7370233e419fcdc102412b478f77af4bccb0532bfc832f006e5ed4d0f1a744053e07135c15681d047ee273ac793ca3dc51140696624c21d7e241b3a68c6573eb710b01ac3b69fd0c257371ad17be8aeedc8e16b149e2761ea83c8aee375679cd872dfb3ff6e01abbea3fb0d1b5d8d2933c6b2bd5f24f808a0238fdc9390bde6b9a33dfe27b27eefb887fa93eb23be104b017b918f88e505e6c1504c77954db97c3b326871df4ac8fa3516a2ccf9d343db2b0c16928d64965854eaccc2ed0efb77cce8756ae32ec80b09f97fadce66ed9a1c15f1826482b5b15aba48252e5d6c7f1081c59b40305af3c0ab72716a8d0104304f667c448be7502cd28c171234a9e57ccf5fa69f6ed0d0f21faa5de46e5c10ea563937a0ce830962fb1ef55239147023d36ebfffabd59c3440048191dfcb682ae563cf93353541b37889eaba7bd90836309657dae91ef4d3d70d2c86fa31053a16b18cb640eb90f25cc5b21708ca3ebb3e28ab0a9ccc5dd04fdd412177837af71d315566ed4419f8575d75e94a91534a739868af0f711ef2a0591578eb17c53b3d1081d041d3aa2951e8c7e93ceff4165177aa862792995e2012b347a8b2992ca38badf1161c1ef3842a59339bfd339e97ea0bbe9ce4daa4cf175811c497e97a628595192c79b336d1721278a63fc57409873610c5901f747fc6bf380a6dfc412682c081937d635cd0f1eb312ad3df8f48c70922dd57dd8904d25964a9edcc511382cb74239b527a8b8514d4983b01382d3612d20e408faa98feb81287e2a445415ea0e7c9715dfbfa39ae2dc8cca97771c666ce7ac0bf0df45addff6b623133e129fe2e812e06e134feb75785d178176dfadb7982510fb3a6d5cd3d1bc59533ededf0ee0a93a23b2d5ef7c561db73fc2cde87e747252241231ee130170fb293a3e9bd3abc8da52a2d092f6cb7a2387545f0c721a1143ad1442364b0982aa8d5817605d1e8022651fd13981ae4812578e092f9af9cd4c009f0af77e66cdfc3e64be71f03c74d186a7152a816088e3b17689a381408e4f1addacc95c088f131411599002b16ac517fc0e76c0ce186992ea9a8520b5a8da28a0fadfbbe8505fedba5db446dc935acc855d7bf586011baa4d67e65ea3c3e955bea29438bc222472739bfaaa587cfab49f2ce1d157f0703260adc9ee142bd41f96e7ba42b2eccfce8edfe0af2b5dafd818a1b7d129950df009397c95cff6220168b92d325a3a6cbce40a5ab99fc8bc3fad2ac27f6418be968a2addd9cb3a6d7e23faee0d780d9f6595ffc71bd1c88e8aacb1dd96d192f35e329fbc49649b1617c27598029adbcec4f36c2a7180d420697a6f64a6d8ac6d5d6fe2c70929e45e2663f4e351f9e6f7842aa3609d6f3b6dd17677688c287b01a478eb4862e74d63fb8c386db932dcdb96837fa6a89e7a30e4396a2b5d2a08d1782b8b01f27bdaffa8192743f04bf8aa34cba47997827698136a458d197bbc89486c5b199e152a3da7bdfadf983e0498c1d3a6b979253ef7576cdfca1f9bb879650ae6fc0603597441b00b20627737b4829b8db6e325ea60a22fb59accefefe5c45aff710e84a93640253e37016f065b1e2835f0bfcf851dcbb9ba0777b60b4dee9046377b9ea8c366ce98abebfe8e5c12ac75385971e0192c22bddcca9a43a51682fb6caec8ddb86dd05a91d34cf5a63171d282a55c44092967aeea105fb15d45a4a024c39790cf5bd6d64335623100ac3b4ef0a7b3630711fb53713a6eb125ba511322d510c25f8003658a6afc23a53ce213bef42ac2a006cb1f2f383455642ff690f1c1b9e22744276fb534dfd59529908ce920739d401f7952a8f2395e50383dfa3f7264cf76381d62c4f4e677fbee07dd4b5512e6b1e4bde87c3f2122b50f4a7727f9077459d404363bd3aeaecd8abe9ae8ae70c971705026cbee7ae0c99f1c21ae6b8c0012019c0f70831c4fdda0220f464da2df75bb9ea134be028bb0a8850f949482b9dadc6e4ef2c399da7dc08a8af090f8995c6292b06903dc6ec1bdc076634d854500b013dc008fb7691134f563ab970c77b5d10e872bbb6959e5af6aee67519b7f4672e394e1444bcb6e414ffe5ac48b53cf7c859955a84e21c88ad71927bce221e22b0be960e9470d17bbba182ff49d9e4c0c31e0fb5bfcef81d8dc9e5d228f40d9637b6321c914021a589c21017195d94ba2b48c158de14d32050b57961204d2c3a4135da3a2d931e27bdc9e98aeadd1a0edaf86eeec6fe71b73d9503f33a376e13d1d2aa2ae1cfcb9398ef11fc6733858923e2f9466db7f27f816bf8d63896f728a98941717e72414944396b831e124147d462a28eb40a69849fb3bae5b77df8633b67d3a73c29a4c844e3f89b9d37a1047bc386e8d7c134088a68790f4ea6cdb0d6eb212e13a91f15c4b76598937e6e73065aea8ef7f9c2e6c3367712f4042b8db0f46899bc1c4780ee55bad36d7b94a002cea0c975098bafe88877af96c4fba9e1430845336ab3474ff1072999cfb4e04e9e8b3fa2dec2499b627c7f8d1560c1d66c2b44851a221f3aa5e43ba67996a40126574817b7147bef8c0e4980264342278f8c178bfe1fa6e54fcff4a760be3bff784971153feec348efe73a9700c51a45239f0eb0f1523fe8797446af5447cac5d4c62d604802cafc980b2d9a89b7d8001f363733b71a9b785ffdf0100ca8eecdc40875075375d528f82081d00585c32e00a1e0f633b949f274791c14228c4431b32bc5b9578a996fb7538902e2c4e147ef80c1d3c499efe238e3500be5bdd2c3439a18cc104300e7dfae2e58a4ae7833fd632c53f5c3c507b79b4130eb6fe567d43048b26726cfe1e79f030efb295b84f1eada672ce59458878177293c9b24d4e7e3461c2f868f4ea635df8de9dac62e0e9786a643e2019fd62bed47087271aa5927d1da236528ce112b0df39ad0b4dd5f3aabf4de9b396bd538470ecd1e0babbcea01099876bd1877cb8e26b5937efa8586edf1f6bb9a64dbef31047bd1883844e95eddb91edff9ce5bad4abcfa7f70f7f1676d81ed8c8d1caf147b2f43d320c178144c16e76b50f1b12e3d3c46ea24980e2608258b23af02831b5efa1450bb8cef78ef77faf6eef667b35372466e16dbee1d9584fb138881b3cabc987bf8c44125ee79d6441b5bdb0f2bf7030e575c14b5189b1d69974a4362bc3099ec72ead68c2736bd7a6388b2ad52cf394e9b4d3b8b7c62672f6ba3da733c3aa00f951f1bdac29b9b25600cc196d01df6ed62000615f6ef2b354b46b44ec95dec5cd111189d9f70792aa54816f91ff17286237612e2d3ee11a4538e88e48879884ad3737e18afa5708e83b1e374df0c0a670f5ea4022d6bbcdfb6be2fa1555ddba5e21d85c529bcb430570cd15b6c46753da7f453896e790fc84985ee09f216e1510b95d830191e81fddd188b562f3abe716b52ace8f4026bcdccab10f6689efb7836527e091365e6e8d413963d1a1c241459745a9ba06a31b7d360534d17179b3d0c42ed094e65a84fe7ab83af4e5474607c080a8869958461cc7b59db1f389ff1cc2b6489cc6c00f2928f7ac532b1b66d0a738cc7725ae0076cd7f1deb1755b8d805e790144d3fd009f230763861f0f8157849fddae97258b07a8e01192b5cbc9b0b5aa2ed217223c1d2ae4d2977dfc5490ce8434e185344e326cd36839fb5157ee07b65ba54b04d1963b1d8bf383a2e3dfd56e587fcc9b14d71b435a9e0ba72f3bf741ea2e4cf24c2e6ce3ff3f3f28a1c3f0b50c6b7daec5d02d28ce9264b8f6e8011c256381ee38965aa0ec0d9cf7963e5ad07434e7b9bb69a250c264ec58ca1d284cade28c7918d64466af1d1e227a62bbd96bfb0a11814daff2c74195edbc4cae6db979598911b1a1bc0097c4021abe04345476c04334ccf45aa81a7d9847813d702ed4708cffb2ce2c88085b7f7a2654299a81f1f73491951286242cd607289762f5a6ea55d6e6634fa52223bbc9a46c3c86a6c9cf008920d6c2101e8af855a8aa8e5784db40d6e2a81c08a5b42325c57ab2b9ff80b976508d9113315a7f3f774aab6baeffa7c6f50a36276349eca5298322ce0c7a708570be49c693934802eba030e41af1fb1198a2137884f9193f320d48d949723d92e2abbd5d1b9c09b2dc8e447ce4a8541de71648b004eaec6cfae3f003753631b71f4f396595d7db19bc737029b5664d7d4d273fde6f536828c13a6a09af5c3fd705f5cc0cf8c41487e8810318bf4a789e2f0b6f0dc6d395b09037cc227921c2979fbbbe1779250db086444d72f8ce205d585a89e2d8ff03aa2e166421303e599ad3b4851703c3b5cc946d4cf078dadb5827d22c9258312f8b8323036fe892294749b066bcbd60c80c91657aec4f09a6bc1cc01526948ef6f060210423ebe697bc30bdc744a8a7804e8a4f472ecae21348e125b052d9ae64f2cc3ecd065ba66c8fc8c3cbab82f0da3b1e3ac7f6bb0d19939cd43458c624facca2c95ec81996099401ba44d9445ea9ced950ef500b758f5877c5432b49602cc847117fd9a122dab0f14f4044016cd8e41356993b1856dc7cc4ab32cd0889b7a08804e34cb4ca4d58b0a7c54b759e9f5f7abb58a70beb8a9ccaf524fb359a88054ce4ec70c7851a95c6fd9dc3c6bdbb96ccb59b5e00a1b82d388bb95b1f1f5368810a79353cb437c2ae2acf764ba31c3be6cc08f0aa5914ae0182d1a3497e3671a5f06847120a287b4aef23c280047ddde93c9c5ce8fa43cb034a482aced81edc40e5dc4b3f73d6ab06b4da92bedc0034708ef584a0db9955e8b8c622b412cde47814d13925ff73b85b6749ed38d0c6fc55c1e5a75c328cdfcf7de5ef674c953677a4d181b5cb963a6a6ef452e3be8a93672120d3935a7cec4c1dc2ea9d67747f399c1adee0c4fbdfe618d87485b8afa412e28d1ed958f9cfcb2776b39dfe020267461495a588ec4d2b1e61d650408ca350b8e90e4ebfdbd5fad4104a349ecdd16cb394a219397e6d48784240873f5d64838151d1191b92f1bc0fada2bea31ab68accc910944258d76c71e15f32ea290fdc01343eab7a3174e9ee092ec9a3dbdd6650d5a84cea201a93cd8fda675e062ef2b91927918a985786a9fcea9615b50e05b56f157ebb81e386b161c14fdc88a5108e58d5195fc13f058097b381c2763e4ae4b025c2fa766d1a7dcfc9f679ef5251b5154a03f1479b8a8809922e586c4a2f6921ce497579d680262aa3503f49269bf291209b6c87a2fa8f8588d1dabefab47b550cca3b16ad9a13526b921db5febe70bad5c0f41ddcf5a67ba222eaab6bd2dfe8e8b535d8c28386d2f9a46839204d3f4cdfa2bf1c89116f77280b4b0d3f6caf70f2a44853ed903fad54a8ee5da7224c139017a891f6228b939bb0b4079485f36b0303e3dc9440fc43bf0f97973e0d13f7d17760bf2d72af3ef9d8ea8ab104cf5df8f8e8c2e22caf298ecd59034698cef7d193d786eb1fc8c8c564ff634303ef29d0acac206f45147db39841bc81c391137fb736e8ca6f301c70d0933509bf99c3859941227f59c506d3569dfe6d0a43d56a8ed79877ffec2119482ceb9552ba0c27443c7c928abe4a89a69c265586cbc61ab88d407d20c850f97b7f0b9a1c784dc09472179e57d5224454e20f3f89b9fff5e85380ff666", 0x1000}, {&(0x7f0000001480)="e50022e138fb9d0c544ac79444f93a482e9e7013db887451b4215983079763a46499ea0d52ec102ab38e986e805b25ae695ee74609d83145d11249ffb532a3acc1d6d97334d2af4650388881efb00195450581a870302345c0db397bbb7bfd1bd119a0e8421b9a", 0x67}, {&(0x7f0000001500)}, {&(0x7f0000001540)="4758f3a658ddb69fdcd9cb8d4cecdc63cf96e1d8b2a600a2d61111b0234cf6362095ff4c253f6d465b042fc4faddc6ef2c72c66b308375e8cb1b7b2100e453c408f4f5b09a3110af3c87effcac61c5d52f3c087227b64bdeffc2254bef23c457fb688775e4bde4e7bd19db1ec83f34c7798d0af6baa3c1ae5d134d64a60d73e828990c604242c28654d572065a12d1eff88a406db105a1449efb2f05ec09b7d362a3c805db253d328d9cdd21cd036f15de1b20cff24166a6f86d0ca851", 0xbd}, {&(0x7f0000001600)="b2cc6699f603a93664f5c7f22dbe4167d9e8435a58092efb5aa4d4f63ceceb34dbebc58821c2c17fe12fbf872e08e2e8aad23040fcc3afa7febc77a24c0372e8eb16449e641e73dc0f15c5c76dccf59b30c80da4794fa8adaf061d50cb25efd7391a25c6b325cbc2dcd88c9bd08675af70dba040c66d9fa3f78c436c8d3eed8b2b1c6b40de1055b466e2928714d70f46b4a6829e5bab7d058ecc157c2bce2cb76d1b1299a791423b5c18ff9db9a12050e352b87da915fcd685c8e39d24bc907ba3b21225bfd7ddd3e55987bbf14d0074b036a340b0dd3b5ebfae6a852d50ae225d2ef41f54", 0xe5}, {&(0x7f0000001700)="9a46e9a88d6b0879e4f72597be3151def402dfa4ebf5ae54bd7885e3344aad2308a3f6e1b02396e2f54a83575297cb2d136e3de96b133b938b1e36644d50a4cefbb82a0c063352ef9643d1c5ab02fabc1dee83094ec24cdb23f200cfb10f9f381b4f7098fccf0b094c8f7ade8871705fec39c85460dc4d50c1de316b8cc05880dff4d8309acada227ae6dcfb9f27599e722229c423517525b10521a6c26eded0c73d4c1ea609fa698946ee85e0c752704f3c87cd66b895579fa74cda7b114a5ade595a62680732fc4e4ef4c43fa733194d6dc922e9b0d841e5e39fdebc17", 0xde}, {&(0x7f0000001800)="b48ddd7bebacbcee691e42a934c0a8ee617b87a044120968a6e63e71c08c78e5afaa16e6f325de5e65a11cd59f60a9a1bf91d8cc51c304e26c6c0a55a3180ff7d021a7e31fbd27e2c86f4086f6f90b3655089dee230cbf7b01aac599141e2003857497fb3d02341ecc8ce86aef9443ca2abe1716be06b5925e49acebe9348858fa0f510dbed82af643c2f31018b597a527f8c22259b5bed6b32871e132a7d455b42cf612a144273905398975babbb225b3eb151d85ffb60e406ffdbd61a63bcd31aa57cc063a20f7e2461d6a7115dd8c3fe0982218f1e57fcde452", 0xdb}], 0x8, &(0x7f0000001980)=[{0x60, 0x114, 0x7f, "c52924bffa61fcaa258758de6c167315a8ea0b6910f1d90999a85e5f481d8623654c5bbb54e41e211b1b6977d7d95aa9fd53fee9268a81e98f5faf8bc6afeb4441e9efc61b45fb2bd5e513aa"}], 0x60}}], 0x1, 0x4000000) 17:05:00 executing program 2: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:00 executing program 4: r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 264.212042] binder: 8508:8510 got transaction with too large buffer [ 264.225482] binder: 8508:8510 transaction failed 29201/-22, size 88-24 line 3493 [ 264.242749] binder: undelivered TRANSACTION_ERROR: 29201 17:05:00 executing program 4: r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 264.300288] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 264.329025] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:05:00 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) 17:05:00 executing program 4: r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 264.489114] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 264.510652] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 264.576306] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 264.589714] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:05:00 executing program 4: r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:02 executing program 3: creat(0x0, 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:02 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000, 0x0, 0x12}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 266.409683] binder: 8562:8564 got transaction with too large buffer [ 266.416892] binder: 8562:8564 transaction failed 29201/-22, size 88-24 line 3493 [ 266.428358] binder: undelivered TRANSACTION_ERROR: 29201 17:05:03 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:03 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r0, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:03 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = socket(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000034c0)={@local, @mcast2, @empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x206}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r3, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000300)={&(0x7f00000002c0)='./file0\x00', r3}, 0x10) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000640), &(0x7f0000000680)=0x8) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)=ANY=[@ANYRES16=r2, @ANYBLOB="00082dbd7000ffdbdf250b000000b000010024000200080004000500000008000400e500000008000100070000000800040002000000080003000100008008000300000000001c000200080003004f92000008000400ff0f0000080001001c000000100001007564703a73797a3100000000100001007564703a73797a31000000003c00020008000200648b1dd2080003001e000000080004001f00000008000300080000000800040001010000080001000200000008000400200000002400090008000200030000000800020000000100080002000000000008000100060000008c0004001400010062726f6164636173742d6c696e6b00001400010062726f6164636173742d6c696e6b000054000700080004000010000008000200010400000800030007000000080004000700000008000200ff01000008000100090000000800020001000000080001000a0000000800020003000000080004008f0000000c00010073797a30000000002c0007000c00040004000000000000000c0004000900000000000000080002004a9a00000800020000100000d40004001400010062726f6164636173742d6c696e6b00000c00010073797a30000000000c00070008000200000000001400010062726f6164636173742d6c696e6b00002400070008000100020000000800030008000000080004003f00000008000400050000000c00010073797a30000000002c0007000800020005000000080001001d00000008000300010000000800010011000000080003000500000014000700080004008000000008000300040000000c00010073797a30000000001400010062726f6164636173742d6c696e6b0000d4000400240007000800040006000000080001000b000000080003001c05000008000300090000000c00010073797a30000000000c00010073797a31000000002c000700080001000200000008000200a90000000800010017000000080001000f00000008000300018000005400070008000400000000000800030000040000080003000002000008000400080000000800040008000000080001001a00000008000300720c00000800020004000000080002000100000008000300ff0000001400010062726f6164636173742d6c696e6b0000b00001000800030000040000080003000200000008000300040000001c00020008000400fbffffff080003000100000008000200ff00000044000400200001000a004e24000000009635bfaa487f4c9defbd134edaf65ca804000000200002000a004e2300000ebf00000000000000000000000000000000050000003400020008000200ffff0000080004000800000008000300030000000800010020000000080004000400"], 0x2}}, 0xbd96b9f073d96152) sendmsg$TIPC_NL_MON_GET(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0xe0, r2, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x44, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffff7}]}]}, @TIPC_NLA_NET={0x34, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffffffff8001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}]}, @TIPC_NLA_SOCK={0x34, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8f4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xd696}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3b7}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}]}, @TIPC_NLA_MEDIA={0x20, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x2c009008}, 0x20004010) 17:05:03 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000140)='cpu.stat\x00', 0x0, 0x0) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000300)='tunl0\x00') r2 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000080)={0x0, 0xffffffffffffff7c, &(0x7f00000bfff0)={&(0x7f0000006440)=ANY=[@ANYBLOB="b800000019000100000000005b000000ff010000000000000000000000000001e000000100000000800000000000000000000000000000000a0001000000002e", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000fbbccf810000000000000000fd85d16e79bad40ac3794899000000000000000000000000000000d94bfeadbfce0d4ed6f71b242b42000000ea0000000000000000000000000000000000000500000000000000000000000000000000000000e6010000000100000000000000"], 0xb8}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x1000000000000002, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0x80fe) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x8) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$KDDISABIO(0xffffffffffffffff, 0x4b37) syz_open_dev$binderN(0x0, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r5, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r5, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x6bc, 0x0, &(0x7f0000000340)=[@acquire_done, @exit_looper, @release={0x40046306, 0x1}, @increfs={0x40046304, 0x1}], 0xfffffffffffffd2a, 0x0, 0x0}) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r5, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={0xec, r6, 0x204, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1000}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xebda}, @IPVS_DEST_ATTR_TUN_TYPE={0x8, 0xd, 0x1}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xc}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x32de}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x7e}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xb0}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x13, 0x6}}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x804}, 0x4010) 17:05:03 executing program 4: r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:03 executing program 4: r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 267.238299] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 267.263148] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:05:03 executing program 2: r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 267.338712] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 267.353659] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:05:03 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup(0xffffffffffffffff) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000001480)={0x28, 0x2, 0x0, {0x6, 0x5b14, 0x62}}, 0x28) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r3) chmod(&(0x7f00000002c0)='./file0\x00', 0x128) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r4, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r4, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000001380)={{{@in=@empty, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@mcast2}}, &(0x7f0000000280)=0xe8) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000140)='./file0\x00', 0x8, 0x1, &(0x7f0000000180)=[{&(0x7f0000000380)="da0b627c9acbd5e72c3e59c2abc54b2b6480a15abc8bb4c24285d98eec78d1571e97be6247f8dcae9e046b91df338a4c5299c96ae69e08f8e1ee7922b85b46aa8a2db73b6230b5341d5a44b24068d4e23b82cbce78313b8b1919008bf05658ab56b270ce8ecb30037f12b56a41c1a660ef9181ad2b7ae0b91b65a00d7c58234855fc6025c1b0dfc38b1be7428e8457e944fb9c13337fc5418c8deacd60aa38aed9b5a6441fd48da8bac2412cbb05d793087dcc0197e3e36d4c0f09d349ecc81ab8bff79a026cb714570d8c7be12aa560619c0b61f3a30ccaefaefa14cade87dc8cc2528f3dc755d480b05e14bf5b1f35bae0efb93f675e75b86f9f61234f1912149d9a7c0d0129665c514ef7689e0a90e0a4f64e104d9fe4c62c90c44ff800f34dd13b521ebb0905a482266dab64584ea6c2d0b64f296b3c76d3c8d9dce4709a2284d221fe9daf6ffab3a81bb8a8abf85dd84dcc639a4aa6243575bfc1e3b3dfaa4ec8167b94307532f766bb9ad8e14cba2e850427072f2778595790387cb56be35ccd256021495eef375bdb0dc25e1669c36128d2c42c757c99741f9fd8872437671bca2b12fa3a8ddb8f62fcc3c3e13c0ec4773245e522b3d76029e84e6e3f52c5b0d7ff0c44f462ec2213bb24c6ffbf05ba7ce08dba30035298e082b375de834ec1a51ad8d34f822476f9cd5fe7199f776100871162194e6796fdbbb3a3bd9e97510d4dc49671d146691aab4fd80dc07c64c68f483832365935a8a8e4696e284e77a31275113db38719cbee3a7164d709d0b8521fe33184f64bfd1dfae90b5d7c394d1ee29620f9fa51538e7296a2ef9e43c392b46e3529ffc887d506b28604bf54e898398177e57df721840d0f18604ba985a2305772fa0c8652346b3000e47891cdfd04b5cd2ce3eb36c4c2c90704adc7b4c3681a2b4c695a1337536ce84320ffc45988f849cfc04bb48873bac2a6023693fb669d13548e667fb9546e1993addc5342624865356842a1ea8faf5ed0d372db52e0c6605a02fa9e6bdf6c1cfb1f2b7c2cc051454beb952665da9cbad91f61f524e0195fdd6cf2d6a3060dc0ce45bc81d414b91cdc909351039247ab3a6b99e9f13031e281db19b207736990cdb7176733475d8f3fc3d416d34d45cb0b33af6b471e4000ecad9ce3aa7616fe2729980e80a8f463e2e20a0b583c30a3eb4d3579b57c574e8f995b75a3a885aa40891a50c5bc1bcb8678f63025df96922afa0e6535371e48a37542461985005ce99b9ec840ab36fbf5207932b78dbad6c2b42fe0f768402ba0f5bdc71a345ceb8cd6cec55273d814def58412bbe24ccac091ed635ea42e1d7f457f0d973b5265106f19b2282cdbd00aba4901589ba1294819b1045b7189c1bf8cf97a1ea0fa93bb9ef8d2fd9b3eb698b5de0760caf5d6df5c48fd405936cddfc00a34feecfed322f4e98d071e1ba63b6ccfee9967e74ace93bceec6ba376df43cba7ca071d29970ea4398f6352593cea3eed5d6cd7229968834f8f5ee7760e2d7a457c9492bc819cdd9ca431a6ec22562a66943918fb676892a201fe3c242ca78e0c5bffcfacf3b3d5b833d4bee2994f8b307c47cb64627a550aa99fdee5125bc219e158f4ebfe1a29e20da4675d1cfbd4031808bead866b954f1e723ddbaf2401d972da0981752fc024ec38d883a26f2484c3ab1d74b8ad09a617ac1a90113a77c5a186d68508a1579859de01b139b7666041aa754b3b0baf4bbe27f9ed5dc910c7e6d889b85a1dae7ae08113fb6a5aac3bd3ce7a8ff408253bc3b17c78b20f2c8155bcdb239f6df20a28639a3068e2b7493a8b9aea5d65888e5f3a4326f34a2ec884308817bf7abe7ff500f1f6cd537dea50b4fcfa36de3c69578bd958096c8415ab443e96e48c10561b84733c34b78fe0931650304e87bc2feaa5d7a4c2f17394a6f51515efc320bfe34d9009ed35ec9e35806a7353bd5264cb36f2d6f04aeabba7b2d0d84fe3e0d84f1f78d2d14f9d2f4ec5b5a59f3910de53f1a47617e6ba1eaa7978a1102fec8d599db87bf9dfc4b76d45d4484658875b7cb1adc18d38267ecf4c05c18d5a521601d958d307a0ad8a23aaf00934b987aafbdbb28be88ddbd80891b033e4e4f823567187b93f656c3c30b275f5e3ad1bbdf17483ddfab6272def299d335d60f47a62f132ca580a50484f7a79773cae4427f46b456224b0e390ccffb1ebf15f00ab011cf743d297ea34423e431ca95a9af4270dad1dff8cfb1fd4606e28a4165b6c431b7732d3575d0a224a919c9cb91bf45baef15138356acfcf5303926f9d208c91dc504b6b9fe05d2b2579b20f1b820d1b96c47f5db8edb69552ba018207e6e1c82d903fc12f2838288ed56a30c3236037269577005b8519c3e17237327cc5b5100aedc6cc425d5e47b374e009b2c1fe8b95b1e52377dc20b72ce2d80c2c00bb202b943701186892b68aa0683be264fbb5e0be7b2ec9ba9ee31886ee235e9b854f6328df87bc90f3e0c74f469f8a340695944d36dd414eef164a33fb25a3d1f7e6da08263d1f4aeac8fc9e55d067170c167d915404dfcff1df15ff822884369e05f61c8f199b21353b323aecf790aaced2fb0a551ce36fc10cdbf6ad3a57c58b753af917689bc8ceee5ee06220c9522f2dbf8429420fe8a2b70d7e310a9ec33457e5ef5a33ef8e955b6a4d6107e81b7fc6d4f353958a58749da34d293cbd8b871e1d9d81c2cba33e7b924ce0efce614e7da185999c5544d38c5715c9f651194ef4aa62da3e803c28201421c0cefe9ca06af7afb0b83fd704435cd954a32a62b54c1b9faf2b001611a111a036855e80cbf223029481fbc410459752e04c2cbaa41b2eb39fcabbe9095498be2617343cef86f3d940b631db4b6d59685f668c078d945e0047169208bc24ea828a43ad0f4eb9949b855e538e0a36cebe1bb0227d18e57f4098f4a269e39ccf2f343ba03f3279c872051cf57339c6fb661fc1efc3f1406ab449ba792fa07382d1ea4a4605c7000908f3dd8fb9a7e88b824dc31543b5106089ec339248282d2084aadf4ec6b79fad48141b27704b850d564eb008931c9cbe28c5fb7fceaab2d0bfe673d7b1b284cb2b8d1ebddb779ed9baf1074b2aa459e4e468f0f95f771e2df3b273025574edf5fb9b1fa9500b8b33b6815def7b2e7ccb431b40989cf229cd1ed87035378e4c008aed5808c6ab645b23223e7c3058e98252d3c3ba33fc9f2b0193b37f9cf1cab0a5c3eb4fd5acead6dff092ece95cea74baa5831390130ed2396202287a8313564323bef2b2bfe917c28ea644683f7a4ddbac9dc6e64494d736f9fe152e32f9a3ea6f52bf414d0c23bd4282c7358e95929809c1ade953f11642059a05e669858d91819af96835fab77df79e1c4dfc91083f4603187a82a486d152a4da216a32b1b48ecc0384274e2cb2ad3f15ecccadbc2c61af3c5cbb7dcfea5def6ad76617a71335b95b40cb86a98dea3e495326ed8dd28418d78cc9d68f4bebca596a5863ee1e2668e9ac06748c5efe414646ad5add403f8a9e4eab65c894be79796f4203701ed895991d2aa566e64b95fbbc55abe9825db8fb37323db14c12f0afbaadfa6f2bff29088db043a4e4f7f4dcbe819c3d8ae4542767f5c11c97aeef2f8d44549a2572d55a17e37fd826ec9c74edb6aeb2f56e33d51463d1895e47ed37105a528cd25da861d73bdbf7c78316b8c93961bd33a52b4bb8a5e5ba49c486cfb6bc726ed35e4b9ce956bd5965a88191838ab795d4b82393a58d207d41b1a49d6af7813c8d9d999122a1415292918521f316e9734ab93125f720e67d50ee4d7e4866852fb13967126623b6e3dfbc3da35c17c0cbf0cdbed90bc44e5893c8304400633ff671a013d27f754558cd0f011e1e8ab8edca41b8b111c936f9373e4d07fdd64aa2e15b570ad9c3a8cc1754c70c860c002c360a585443c00b655d5a1347be3110c766a11b8472c61bf8b2435e2b541492dec82ce8888f9bee4767680a4a51ac8797c89a8da422f32977adf58e6a5e0a0f97a5661b725c31a08eb09711d3f339c739a05d670a7078cf04bb9cc42d9ff9eca550a607dc5e6656dd8b8af2a3ba93fa07812ef4f0f8a37cc5baeca1602ca1213d046661dbbff828f6cb77d10c24a6d10ac983aae6438ea4f30bf8060cccd5455ce92b548fd5c788884c90a6a354fcbac3e29d687272f344a3cfe3b572fcddf91d2982e740765739f8e979b2240ce1a5625d8bc7171ef68bcc4031e48e30a16b6f3c84c89e5513fc26bb71e92278413c6d7c86454cd85ff5e996764439d4ab9277148097a3b657939319f6bf9e62ada31351ff65a92fca79895f8ba3767eabcef35b8f78a85e495557d47cacb873c7f2a1053116849ef4283d45a8ae40f7bc79c7c75338cc5f98bbce36176eedbc518a2e704b0f289cf1a886da5692ce399f1359975958ae3cbe3a1b17ac4c8ecb8a69189489be858ca21b4bd57067b12546c174fbd5566cf6c9c01464aa0c3eb4714b56bfe9b089bf2fc05fd367fcbec2c369d668fd68bf4a1518034ae92f16572f6227aa818d3bbbb1bf400b53597fdcc6a9fe791de9212868bd8e6846a37c2f7f4cdc6b651fd09723b0afa17b1b45bec4777a1a712f7ca44f73cd7de4cf5f75c1ede8fcd625fb3fa6769eb830a3ec4951c47726adbc4c6dcedd56d7d3e48c9059cb53b07ba2fdc77d4b734f579a1bb62379a3e100d8716d7e230d518fdfb3d9ae9240a37f51f81d93a21266d59acb332cb5ccf2bde2285dc5fd6f6b82b0ac27325f5b231e5e029ff854c3230d13f4e9bc8dc038c89f52e8a866f5e0fdae50ff4a6679faa2edcb7458b6fc6e65c790936e6931357d123e217ae982b3efbab95dacee8a1f8979795020416e19f3146a48c408f0bccb6c0cbb6fbe80f6e53bffe889fd0a33d007d9381929c3a00f06bf1043c4c2cdb25deba2128f3adafdf70403c6ce2b2d6e1ed1d4952e686b19b6c01d50ac5142dd40cfc8c01a7c1782773ffc9fcf310dc557630b49327fb583e19c34cb1ed70441660bb2b82ec33f6ed408d8f425a7149f202f3fa2629d3a9d56d16a9976f4d697cc1955017624ed017ba70d5b95d72fa827e767e93a633f361e1055451dded56c0db71c19ba5d945008030c7f9a2253480aba8853bf93d5bfcc8547c9b973ebbac2146a338b6ec9d29b86a29cdfefbf9e61cf2d5221b68194742cfcce4dc209735b3c14c9b08b690b2e3b58961f7e624c01a13259b83f2b5230a265d774a5ed4855c9121bfe777578d0c0cbd2f2893bcbe4090e63e688d799a3758f0be394638c8e44977224317fec8dd249895c594c7c37ea8dcd6e64bb32bf2c5ac54bc9f073db059b94b9931277587b4168a76c4af356ffff892fede414414a035666383e6674a188135c7d68e4aa48bb96e2c958918d21bd62082a1698deb0cf82f29ec4fdb04887ed30dae3ee098650b775e269f668634d15a127a008473a6b74d5a0484f24cc36dbb6b8580e9583d2432e0ab50b673d5d82a8629e383c4164c0e6b0d00f84687955aa8777ba4c5cdf131d69ef9ea89981a5a6dab653fe51ba1c40b0f0880fdf3d406f734651484dcb9f0ee1415b6b68dfb6ec2760f3d651681e63022c44745f672fb913c1ebfe67e4c53297c43b5af5c166ef1174996dca8d49932b41db1edca16559d77685eaa2cff575de374157f29d5e6e82a7378d2140b2ca91d66eaa69557740125475fc1cd9395f6b4379fd2b35dcf2c38626e1a13f5a596427a700125fae1a16d3200439d40060aa08364fbcbaa1e6fc7c7f9", 0x1000, 0x4}], 0x5eaa1ed288a241e7, &(0x7f00000015c0)=ANY=[@ANYBLOB='i_version,journal_checksum,errors=continue,nombcache,uid>', @ANYRESDEC=r0, @ANYBLOB=',uid>', @ANYRESDEC=r1, @ANYBLOB="2c736d0e016b6673666c6f6f703d65557433002c666f77f97b723e7c03172434fa1da830558273e897ee0eed31e5e9a2ba03a5b6b3d66db71754f30ec7bcf050260241c052252a59f68914e9f4836ca621bbe906ec09dcd99de9037319dace560392fffe661961b23df06e4a71cd9c21f4b095df123d395824060a315c31180198931210c09a75261b3cc30eadef38db594f5ee4fb94f248320d58dbc692b10000000000000000", @ANYRESDEC=r3, @ANYBLOB=',euid<', @ANYRESDEC=r5, @ANYBLOB=',\x00']) 17:05:03 executing program 4: r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 267.473830] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 267.496342] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:05:03 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) r7 = syz_open_procfs(0xffffffffffffffff, 0x0) r8 = syz_genetlink_get_family_id$SEG6(0x0) sendmsg$SEG6_CMD_SET_TUNSRC(r7, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r8, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x1f}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @broadcast}}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000140) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4001}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r8, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRET={0x10, 0x4, [0x2, 0x1, 0x10000]}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) renameat2(r0, &(0x7f0000000000)='./file0/file0\x00', r1, &(0x7f0000000140)='./file0\x00', 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000380)) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 267.554065] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 267.572056] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 267.683799] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities 17:05:05 executing program 3: creat(0x0, 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:05 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) r7 = syz_open_procfs(0xffffffffffffffff, 0x0) r8 = syz_genetlink_get_family_id$SEG6(0x0) sendmsg$SEG6_CMD_SET_TUNSRC(r7, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r8, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x1f}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @broadcast}}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000140) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4001}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r8, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRET={0x10, 0x4, [0x2, 0x1, 0x10000]}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) renameat2(r0, &(0x7f0000000000)='./file0/file0\x00', r1, &(0x7f0000000140)='./file0\x00', 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000380)) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 269.446010] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities 17:05:06 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:06 executing program 1: r0 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f0000000380)="a0a5bdc68632252d5c4b0c9894147416ec08d5d9339ccda8ffe439f72fc91d0ff94bfdb784eb6cf4e629868ba8b0c821f47f183fd551c1f4752acd8b133a6a3d6989d3cc702f00f4f7d30bfd18859abd5cbda870acb32fa40bd24297cef7f055399a66ef8356989c7895bb76e3b7f1967cbc54d1c302a4ff32b72f409313c0d99847bc2fbbfa04a21a67e94e08bf6f91b06715210e55c88ee2440ad989d710a63a7c94047ef619b3d7e0a504eb1bd9bb745c0e8a9a5d10b25c9a3a0d03fa98906384702cbb99806e9bd7a1ed35a6f6e3f8e3aaf76f490d014a8b7673504f1f1feaa79215471525adc54783305734e050105179434f2f54fcf78d878c870d5dfcde4bbb40e6832f3f57184dcc530b3269c597d2200e6f899f5f1d8ec347569f937f3332629db69c1e81df9726858a4272ff40884003b1b05a35d3d6cba3110d1c6c3ecbbb42898991474c99d0e1138571aac6fc4945418e48238268f94f2484e3ff83297d34ce8d405911b0773af4acee4ff367863dd98104197cace0aaddd499c7d13fc7ba5af0b2cc7eec0980bfb517c6c92ca5d175fea958cd3e5606201462a07724067135580a4e346a35327f60258f2e0000aba0b103bac3ea82dd8804dd2e8d37dce19df010b0c2b49cc040ea06dad5520c4daf4a154eae15da4659ac01145414c2f808dc20110b25eb996c8be22e9796cbf0a1648491c0db76788a42392cd7e42b70d1962a49edae2f1ec356afdcb05f98fe34c96437e53928605145a7aee75ec2093041a734a1dca377372d73b0933c684a198080e058651c0207568ce4e5df275d7589d722645948cbebcd039d02697f5edbde79366836a63c414a2617688d837c6b6eea932f1bfc0ec43b71ebd45c5c1902778d249309e0405804a5394dabec72a9cd672e9f08559173fec918e01114197b4f66dd990a0044ebfd1fa09a959dd5d16af57d63ca56dca1dd701f48e8d0b9a1d964dc91cc382c23d59abff61d8357443c2998753acd39ce1f809a835ffade859d23c7e00247af811a834e97040e075151647d37fc1e9ab5eb5d682a752218c196be641ce4afc2aa12c55fc29c15c10a553c6537c4c6915245b6963a627e898184f2c483fbb129b753b9344cdc1b327ea3643cd8d36ecf57353d8a58dfce0b16318c33aa152cf39756181a43a8837d6fc646c76388bc51e25867de5d282e56b2718064a9f1e05628e8ab4f58434f028d1b369284358ab26eab0fbde9899bf2050ace0822f36253ad57baa51e36f913b620f86cbbba8e6b82ca03e6c18daf9e2203033b056aab669e8f6a08e49b539da20d96b37669eb13ca5ca8e69ce3dbde641a8e78e65d197b6084dcf349c51c9f47e233758d08062dd911258e277c5a5cd84955a64556e5ab0e68e752d94a1955cf3769a2b4ea83076598e14c7b3dd58405fba931bb8e033eaf178cd48c30e75770cbe5f3cf52172e22cfa1f460c348b5720d0fff4fb9a24f95307444ce17431c7a9135b5781fbcf214be2e8f86582aca7c93f11351b319c87c584a929f1bd8d6e83743975995af987e7a84afb10e9924e2f45706a2da0046931c853fc2899900eddcba6e13d910a4acd7c55caff04184cbf1521bcbad95dbf81559f71cab92cc34ad3f70e4c56b9a8021074de187801394360051d2d8bc95c20faee9c6e9eb2427fa2668954d369733a22c6d7163f92e7c1c44ffe91ca62d5df0731173205f464d4fadbd93e36bddb6d170b150a6de1e16d407c67e6e485f317f4a723913ef042a4077f5ae9ae758a9d780c763ee6395a5351402acb42f6e0485387be21812a7eefa780dfb126aa41b1f37d4bd5de98931d4a876c0087f3a04bd8f9812e31a8cf29ca6853a1df2716e16cbf8a3c9f6c8b99d5815b8c0cf3d0d970cc59394607b1ce1102810704dceb4d9c07408c233996da79b607c08575aab44da474cc6d0a47a1e598ecb696b538c49b2bfa141131b84e0a13e6ac503c7f8660b1138ca22bf27302d2bef3a7cec1036a0b1d6eab7a9fdc0e1e98511b902f1983c4bf66404f0d9dafd64d98e299fee2aed0c12f5409e96a85fd05976a35e80dff185b0c1658649b2aec83474cf14d86dae5d9b0f1264511b57d0b1f536193571768fe849b9943f0f41c3810cdacb2a35660c00e8b111082d7c7d605a0086e814df6563b78b06a23be88b6c97c7f9cbad6bd55ebef677c17c725e6b158dcb28f8138099d9fc316b644a367ec635584c2a4bb6156c3ff3d54842ebdb1fc801d95669a542bd1ec50022400d003cc735d5eee4870269186577c513ccb713aefce640ae4da4ef1aa465529b6bb293377a294c383a0b957c43b1891ea9486eb80183018d80d7e45d8dacb995195d26b7178526f5926a63949f5318437fde0803f8455ac83fccaec19fe041583a7e34aa387c7648ed598f89e6e531e1a03edad5bcbb7369b096acf52d7a511672aa691a5036453ba075f24630789cce7a75ca4fc72a3164ca082ddb4611908b3c961c90b73b3dbe5816695d4ecb4060139b3da29cdad91e2df5ec0dd80b2e9511ca96f13428158251c85de60822e63bd2a812c425e93fbedff5be0443c66f3a0641d6f2449d99aa632678f81305722bc9a5c72667d8979c85c904716a344d3ef186c27872d85a1dcc93a652c3fb1424ecc12faaccba0e69c79f1510075fefd30ede21b7ca1c1d156baa8e784b790ec95b7331cd3c38b9e44b1d26226edf580e58c73adf27184ef9314acdac162b05cf4eda2d63c4af91ec8927cadeb080644153f02cd7b8d105cfd00100472e467ca1d443d68e557c57bd95b32a3303053fc0ad0aaa2d62066e330af1a9c77a0d1b8f8037ad3112b64256746b98b26d61a6c7bdb5f2b760fdcae33ab5bfd7d807f279114e4f1e81507788b4bd1b5a3628c9a43aa2c4dd91c6c8e63122358aa3806bffef876ef572141a9a32132de32fbad0af6f4677269d92979c5aef0822555f1e3febfc78f027b6142992addf0d37224735acd58093509d3fa39d6e7b157997b0ca9e4b86496086b8bf81841facf5ffe4a090848929757a26e4c885968cd284d24e3e246cece0c32f9daf44a7bfe4afc3454822a98a1a66846ffab75d19f8b62244ea788f3bb97d81f33cee6893ac386b12cf8aa16239b39318eff2402f56769330f8679e29bef87f5273c01ca4ad81e2e753677b51b8a2b591c92a2f6de58d23e9081bc2abb16493ef0aee4e377333a335eda7eec5b639acd5c1d7ff370586a426a5c6b8eafcbbc50aafe8765fb8195f2df846f8879bf79965e24447023f680a69e3157880980430797cdd176304f497dda959a2be2cb74fbb1025595e5ccc884b253a963e51cef662a587ca4f34e6eb5ad5088c2f2c64756c40fb0a2ed877835bd1e9781d6e2abc6c99897b5321a82dc295353dbb7276080a88de6a27cfdc3ab748a349ae12b53906da868ad95342bfd88f1516b1897a6d93c3273cbac557da8cea0f481062b1020939fe29c74e45f413caadf00214139b4e86e3412c8ec15d57d3ff356e1d481d5bb80503488f4549a20e1a1e6945db0eeafd0238671ebb4a3d5b8435b789728700aeef4c9e4d3e9b7bb043faeac3ff5ec539d89b64627803f20f1a0ab374482635fc8bb6b0b869c8f816d19d71bb028a960bb030a5a634bb3371cfd54d03f2b42f180c784a077f28b7738d43da8607383a6a26a4927120841814568ab4756f0ec426a8d7c6bf0293460017f1f63c1bb13017645fa356275ffca824270d80a3ec29295b564056a11cbdfd95c609e43610ed8ecf141fd48ca71d49032bafcf8d103b1db5c29ae1a08baafdbfcae640aa5193f5e3a9e0397181abd407063e679da30040a33474dc0c8d87626aa399ada154a078b414a25ffe10935e50f65188cdd31cd2a690362b7362eddb5c28abe8442de5e04e92d5cd619388c67b07fe2c7579bd2fa4c11d17e100925f040f4f1d0de181b80c094555708285f3407fb36745f39ab4a26b489dce8bd37db17c4466086115273dba0c274b99c15fb4fa5b6a3b55fe562755dd26881c0e9bec208df0b9847e5a487a5dd82a6831d23638f43f1af74229b95d17c6155571bf031c41ee2144d09b26dfdd4d6428390cb801eeb1022561198ec417bdb5555842a1acc2041908cf6e705d96a9610bffd376165f0e14b08dcaa63219146c6a5076ebc257671e48206176141e666aebb1e494fe1bb5370df61bc032dec624cb57b3603732a3dc0ae3fc4ad10deb5f685e70db8711c3690eee29f408354a8cc1a5c89b0c68c791d75bfa3dcd5f12662aaa91250b3b60214a086c6a28e5188c3a239ddd2c90799a083de46b5f8774f26eeba2a814710020171a7fe1d3578a49834c33e44294c703937a7df5cefa0afa255ed2b2209a8d8363191b2a854a5271eea8db7e1e4037782652008f8f739970c67793d0a4a90077ba336da7e7c79b74a61974cd20fcf39de0301bc41dc090c907658bcab791891456405b52d79746165d3f0baa29bdf03c98311249336a4c78e9c62717eeb0b5b94921dbe6bb6515d1187e8c16509d67464e1ab36f38a43998847ea700a037c676e36fc9383dd421fab0ebc8d68a3b366668245b7a6389052521747cda6eb8d69006333f528b28ae071d65f437e56b48d3569cbd3e13dcc2f2a90ba9f44bdbf5d7cdf411bcd7afff9e11286a5b0b4ce6b2b540eb164b615699370f2ba31b942e1c9a48e119e03c940179d1564541c21355c090cf938432569adde29c2935cb619a1f66200d2cfa6d6ce801bbfb5d09deba694468ad0052ace6f9b423e27d4ab5b13555f7c2aca6559902257ca220c1b7e1f9723f76ec3c371dfa9a59f4808841e73794d3860dba8e1b9c8417080f1d99eb2a7d7e165ffee3e0d7bcf3060693f9463aef5967275af2698784b247a5df693a37a36a5544938f7e02ebb4c50a90b85e8977d31187feb98f0a4482c4418f590b467f96a9158b384a33bda4cac53c3d5cc881b31f92203e5b7d6315289d72d1df5f75a39ce8348ab907f0db0a97f37ff8612143f05728482d4320f76b4cb2fa3ef82e6b25da3e1aea4ff5bc6976c083f3a9d0011ef4118622f1ea7063d6be7138009793b326cb9cfc5feaadde57052b2144ea84d7c9cfbf1740a67ea891fd5c38f51aa3ed6d3f6197177927c636bd2b29c2d6af909218dfe60996915073f6e5bdee1ac157492199c485a5ce901421e2cffc785413ce7686bb6a2d7f9b88478bd461b589a28017b5b47a6f3737a39ca1fd0445a80360b16fd189b33b12463d0c1f993a7fe8dac0cab8e11a5556f1a556236da44a521de007369777b8d5c1fe2d988fa43cf1d117c8c1f4950e3955cba4af4ba1d16e405ca195893e67ce88b679d68ddacbe78ade992821a57b04d8532b1b013a5b5f01fe06a23893062ca8fe3ace1314907c9590c0cdabeb2197a31329ddaec167a8f9fc38cbd518cc47a4ac27ec18044a64a7fa37a7976dc5de1bac4f776c3fe91fdbd5d3b962532192499fd982be012898b48cc16922ea9aca8487d52a2d07d67b9d6cdd72c081d432121c70e06aaeecfaf2e9b216f6343aade4a2128006cf33a193dd221295dbeb10522877a35fcb0cd9462411639e0656b467eae2ab3a81c3b69cee849db6356a944081570b426df3a9560c976986ac96b85dfcee417590fd2c8f305acdde5dbd7618a9874f96ac1b368e54fe01d1f06c395d02e5652c622b4aac5f3364460b9e1d57efb6cf2dc9b8306c243c78527d446d6181fcb3c6e642f3417c4820add4ec21e3428d63be6b90a0f2917c098ded5811bc605cc446e6", 0x1000, 0xfffffffffffffff9) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f00000001c0)={r0, 0x27, 0x8f}, 0x0, &(0x7f0000000200)="fc1e6f5c456a7c3432466c8879e29184e208ef6dcb24dc85e656b50bac966250ed8baeec10dcd2", &(0x7f0000000240)=""/143) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000300)) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfe, 0x100000}, 0xc) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) 17:05:06 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) r7 = syz_open_procfs(0xffffffffffffffff, 0x0) r8 = syz_genetlink_get_family_id$SEG6(0x0) sendmsg$SEG6_CMD_SET_TUNSRC(r7, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r8, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x1f}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @broadcast}}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000140) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4001}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r8, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRET={0x10, 0x4, [0x2, 0x1, 0x10000]}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) renameat2(r0, &(0x7f0000000000)='./file0/file0\x00', r1, &(0x7f0000000140)='./file0\x00', 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000380)) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:06 executing program 2: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:06 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) r7 = syz_open_procfs(0xffffffffffffffff, 0x0) r8 = syz_genetlink_get_family_id$SEG6(0x0) sendmsg$SEG6_CMD_SET_TUNSRC(r7, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r8, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x1f}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @broadcast}}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000140) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4001}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r8, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRET={0x10, 0x4, [0x2, 0x1, 0x10000]}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) renameat2(r0, &(0x7f0000000000)='./file0/file0\x00', r1, &(0x7f0000000140)='./file0\x00', 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000380)) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 270.248035] audit: type=1400 audit(1574442306.400:22): avc: denied { bind } for pid=8644 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 270.290525] EXT4-fs (loop5): couldn't mount as ext3 due to feature incompatibilities [ 270.297318] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 270.297327] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:05:06 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) accept$unix(r0, &(0x7f0000000180), &(0x7f0000000200)=0x6e) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x4, 0x4) 17:05:06 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) r7 = syz_open_procfs(0xffffffffffffffff, 0x0) r8 = syz_genetlink_get_family_id$SEG6(0x0) sendmsg$SEG6_CMD_SET_TUNSRC(r7, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r8, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x1f}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @broadcast}}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000140) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4001}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r8, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRET={0x10, 0x4, [0x2, 0x1, 0x10000]}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) renameat2(r0, &(0x7f0000000000)='./file0/file0\x00', r1, &(0x7f0000000140)='./file0\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 270.326569] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 270.384247] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem 17:05:06 executing program 5: creat(0x0, 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 270.392699] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) 17:05:06 executing program 1: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0612687ecb86a5c8802a9d8aea872943afd874e2f98b579a7186270146d0e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df", 0x5d, 0x400}], 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) accept$unix(r0, &(0x7f0000000180), &(0x7f0000000200)=0x6e) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x4, 0x4) 17:05:06 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) r7 = syz_open_procfs(0xffffffffffffffff, 0x0) r8 = syz_genetlink_get_family_id$SEG6(0x0) sendmsg$SEG6_CMD_SET_TUNSRC(r7, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r8, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x1f}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @broadcast}}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000140) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4001}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r8, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRET={0x10, 0x4, [0x2, 0x1, 0x10000]}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 270.483355] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 270.535899] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 270.559865] EXT4-fs (loop1): Unsupported filesystem blocksize 0 (1923657432 log_block_size) [ 270.647810] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities 17:05:08 executing program 3: creat(0x0, 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:08 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) r7 = syz_open_procfs(0xffffffffffffffff, 0x0) r8 = syz_genetlink_get_family_id$SEG6(0x0) sendmsg$SEG6_CMD_SET_TUNSRC(r7, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r8, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x1f}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @broadcast}}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000140) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4001}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r8, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRET={0x10, 0x4, [0x2, 0x1, 0x10000]}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) renameat2(r0, &(0x7f0000000000)='./file0/file0\x00', r1, &(0x7f0000000140)='./file0\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 272.460475] EXT4-fs (loop1): couldn't mount as ext3 due to feature incompatibilities 17:05:09 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:09 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) r7 = syz_open_procfs(0xffffffffffffffff, 0x0) r8 = syz_genetlink_get_family_id$SEG6(0x0) sendmsg$SEG6_CMD_SET_TUNSRC(r7, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r8, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x1f}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @broadcast}}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000140) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4001}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r8, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRET={0x10, 0x4, [0x2, 0x1, 0x10000]}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:09 executing program 2: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:09 executing program 1: creat(0x0, 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:09 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) r7 = syz_open_procfs(0xffffffffffffffff, 0x0) r8 = syz_genetlink_get_family_id$SEG6(0x0) sendmsg$SEG6_CMD_SET_TUNSRC(r7, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r8, 0x300, 0x70bd26, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x1f}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @broadcast}}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20000140) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 273.265659] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities 17:05:09 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) syz_open_procfs(0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$SEG6(0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 273.411244] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities 17:05:09 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, @perf_bp={&(0x7f0000000180), 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xa, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) io_submit(0x0, 0x0, 0x0) write(r2, &(0x7f0000000100)="6ae8e82e42f8a61e", 0x8) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x0) r4 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r4, 0x800002, 0x0) ioctl$EXT4_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000001c0)) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYBLOB="000e6dc95336cbdcf4a41540dd8376d5e035ecb526317facb73644584a978bf8ba7dce77ca4479db5145be40dc0098688f727069fa08a335ef310eabdf0b624eae624438c2e8678853b21943efaff1a9269e99cbd7ef790f80b3357a58d4859c6ebab5f1b4296ef6694768f38716228df79c54bc233c5158d279e25d5fcd63115fdf47325bfde12df3fad26193fb950ed34953dfdbd2e65e5d43fd0f71d3e24923c191d8f131baafd8471c698acc15e3c38c6010573ccec0af557763c1bcf98fe3dc5d1fcdb837eb3f408a33eee257afbbd2d0823e800ffd53c1fffa48f57dab1964574354f1df67e7626b1813c733f6bab0dd78f13b8405c073b79dbdb3e897bf6f608199106272da648b60500944c853b8c29a22f461c9e7bd39a54b749775d14823f63c1dc0b37593750c7713721d75fe444c7522d2d4b0b0564ccacdcf4cf0a50e4171f86c788be448d66ee5d2e3364f8ed3ee0ea6fa12f6acf7f569aa0fc32376ad22046524dd9918ea5b4fb45296c3910e95b3e58906b81686e536f7ac9c687b86b594b94b7b9fcbf96fde99c168d000"], 0x2) fallocate(r4, 0x3, 0x0, 0x8020003) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000200)="e5"}], 0x1) lseek(r4, 0x0, 0x3) ioctl$TCGETX(0xffffffffffffffff, 0x5432, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='net/arp\x00') bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0xba, @remote, 0x120}, 0x1c) 17:05:09 executing program 2: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, @perf_bp={&(0x7f0000000180), 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xa, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) io_submit(0x0, 0x0, 0x0) write(r2, &(0x7f0000000100)="6ae8e82e42f8a61e", 0x8) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x0) r4 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r4, 0x800002, 0x0) ioctl$EXT4_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000001c0)) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYBLOB="000e6dc95336cbdcf4a41540dd8376d5e035ecb526317facb73644584a978bf8ba7dce77ca4479db5145be40dc0098688f727069fa08a335ef310eabdf0b624eae624438c2e8678853b21943efaff1a9269e99cbd7ef790f80b3357a58d4859c6ebab5f1b4296ef6694768f38716228df79c54bc233c5158d279e25d5fcd63115fdf47325bfde12df3fad26193fb950ed34953dfdbd2e65e5d43fd0f71d3e24923c191d8f131baafd8471c698acc15e3c38c6010573ccec0af557763c1bcf98fe3dc5d1fcdb837eb3f408a33eee257afbbd2d0823e800ffd53c1fffa48f57dab1964574354f1df67e7626b1813c733f6bab0dd78f13b8405c073b79dbdb3e897bf6f608199106272da648b60500944c853b8c29a22f461c9e7bd39a54b749775d14823f63c1dc0b37593750c7713721d75fe444c7522d2d4b0b0564ccacdcf4cf0a50e4171f86c788be448d66ee5d2e3364f8ed3ee0ea6fa12f6acf7f569aa0fc32376ad22046524dd9918ea5b4fb45296c3910e95b3e58906b81686e536f7ac9c687b86b594b94b7b9fcbf96fde99c168d000"], 0x2) fallocate(r4, 0x3, 0x0, 0x8020003) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000200)="e5"}], 0x1) lseek(r4, 0x0, 0x3) ioctl$TCGETX(0xffffffffffffffff, 0x5432, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='net/arp\x00') bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0xba, @remote, 0x120}, 0x1c) [ 273.567214] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities 17:05:09 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) syz_open_procfs(0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:09 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, @perf_bp={&(0x7f0000000180), 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xa, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) io_submit(0x0, 0x0, 0x0) write(r2, &(0x7f0000000100)="6ae8e82e42f8a61e", 0x8) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x0) r4 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r4, 0x800002, 0x0) ioctl$EXT4_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000001c0)) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYBLOB="000e6dc95336cbdcf4a41540dd8376d5e035ecb526317facb73644584a978bf8ba7dce77ca4479db5145be40dc0098688f727069fa08a335ef310eabdf0b624eae624438c2e8678853b21943efaff1a9269e99cbd7ef790f80b3357a58d4859c6ebab5f1b4296ef6694768f38716228df79c54bc233c5158d279e25d5fcd63115fdf47325bfde12df3fad26193fb950ed34953dfdbd2e65e5d43fd0f71d3e24923c191d8f131baafd8471c698acc15e3c38c6010573ccec0af557763c1bcf98fe3dc5d1fcdb837eb3f408a33eee257afbbd2d0823e800ffd53c1fffa48f57dab1964574354f1df67e7626b1813c733f6bab0dd78f13b8405c073b79dbdb3e897bf6f608199106272da648b60500944c853b8c29a22f461c9e7bd39a54b749775d14823f63c1dc0b37593750c7713721d75fe444c7522d2d4b0b0564ccacdcf4cf0a50e4171f86c788be448d66ee5d2e3364f8ed3ee0ea6fa12f6acf7f569aa0fc32376ad22046524dd9918ea5b4fb45296c3910e95b3e58906b81686e536f7ac9c687b86b594b94b7b9fcbf96fde99c168d000"], 0x2) fallocate(r4, 0x3, 0x0, 0x8020003) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000200)="e5"}], 0x1) lseek(r4, 0x0, 0x3) ioctl$TCGETX(0xffffffffffffffff, 0x5432, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='net/arp\x00') bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0xba, @remote, 0x120}, 0x1c) [ 273.725145] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities 17:05:11 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(0x0, 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:11 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, @perf_bp={&(0x7f0000000180), 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xa, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) io_submit(0x0, 0x0, 0x0) write(r2, &(0x7f0000000100)="6ae8e82e42f8a61e", 0x8) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000200)) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x0) r4 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r4, 0x800002, 0x0) ioctl$EXT4_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000001c0)) write$binfmt_elf64(r4, &(0x7f0000000680)=ANY=[@ANYBLOB="000e6dc95336cbdcf4a41540dd8376d5e035ecb526317facb73644584a978bf8ba7dce77ca4479db5145be40dc0098688f727069fa08a335ef310eabdf0b624eae624438c2e8678853b21943efaff1a9269e99cbd7ef790f80b3357a58d4859c6ebab5f1b4296ef6694768f38716228df79c54bc233c5158d279e25d5fcd63115fdf47325bfde12df3fad26193fb950ed34953dfdbd2e65e5d43fd0f71d3e24923c191d8f131baafd8471c698acc15e3c38c6010573ccec0af557763c1bcf98fe3dc5d1fcdb837eb3f408a33eee257afbbd2d0823e800ffd53c1fffa48f57dab1964574354f1df67e7626b1813c733f6bab0dd78f13b8405c073b79dbdb3e897bf6f608199106272da648b60500944c853b8c29a22f461c9e7bd39a54b749775d14823f63c1dc0b37593750c7713721d75fe444c7522d2d4b0b0564ccacdcf4cf0a50e4171f86c788be448d66ee5d2e3364f8ed3ee0ea6fa12f6acf7f569aa0fc32376ad22046524dd9918ea5b4fb45296c3910e95b3e58906b81686e536f7ac9c687b86b594b94b7b9fcbf96fde99c168d000"], 0x2) fallocate(r4, 0x3, 0x0, 0x8020003) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000200)="e5"}], 0x1) lseek(r4, 0x0, 0x3) ioctl$TCGETX(0xffffffffffffffff, 0x5432, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='net/arp\x00') bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0xba, @remote, 0x120}, 0x1c) 17:05:12 executing program 0: openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:12 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000001700)={{0x3b, @dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x1, 'nq\x00', 0x1, 0x1, 0x7a}, {@broadcast, 0x4e24, 0x10005, 0x5, 0x9, 0x5}}, 0x44) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = add_key(0x0, &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="352940c5c8f212ea6fe693cc4723ec", 0xf, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000240)={r5}, 0x0, 0x0, 0x0) r6 = request_key(&(0x7f0000000140)='logon\x00', &(0x7f0000000200)={'syz', 0x2}, &(0x7f00000012c0)='system\x00', 0xfffffffffffffff8) keyctl$search(0xa, r5, &(0x7f00000000c0)='rxrpc_s\x00', &(0x7f0000000100)={'syz', 0x2}, r6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000001800d6f97ba7b0786e0e000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) umount2(&(0x7f0000001300)='./file0\x00', 0x8) 17:05:12 executing program 1: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x8000, 0x0) ioctl$KDDISABIO(r0, 0x4b37) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet(0x2, 0x5, 0x7) ioctl$sock_ifreq(r2, 0x8931, &(0x7f00000000c0)={'ip6tnl0\x00', @ifru_mtu=0x6}) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x800) getsockopt$IP_VS_SO_GET_DESTS(r4, 0x0, 0x484, &(0x7f0000000200)=""/116, &(0x7f0000000140)=0x74) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0xe1, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000516786980000003cd7b481f1e92c00000000000058000000000000001800000000000000646aa4f3bf38eaec8c5bd37240d5dc71335c8dc0197ef690e4b54fc8ff9ddd221d60c60202a204ba1d3980685d5be7a067a077ff0b5a2841ddfe621dbd71ff9fefc0e105a6a85c6a8247965adaf34a63518224b3e1396867d7b75d2284826b9075f1a8f456e4336de851b6702c364940b132a5165a6ec517db392cbb94e4ad4dbf029da76ddae7c5b2a3f1df3d15", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000"/88], @ANYPTR=&(0x7f0000000000)=ANY=[@ANYRES64=r5], @ANYBLOB="0000000000000016"], 0x0, 0x0, 0x0}) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r6, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r6, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r6, 0x54a0) 17:05:12 executing program 5: creat(0x0, 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 276.293009] binder: 8796:8801 got transaction with invalid offset (8696635031366795288, min 24 max 88) or object. 17:05:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x1) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x400a00, 0x0) fstat(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getuid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xa) setreuid(0x0, r4) r5 = geteuid() getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in=@multicast2, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000140)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@ipv4={[], [], @empty}, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000480)=0xe8) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r9 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r9, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r9, 0x0, 0x0) r10 = syz_genetlink_get_family_id$net_dm(&(0x7f00000006c0)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r9, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x14, r10, 0xc00, 0x70bd2d, 0x25dfdbfc, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8}, 0x1) preadv(r8, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r8, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@multicast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@loopback}}, &(0x7f00000005c0)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r12) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r13) getgroups(0x1, &(0x7f0000000700)=[r13]) fsetxattr$system_posix_acl(r1, &(0x7f0000000100)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {0x1, 0x4}, [{0x2, 0xa, r2}, {0x2, 0x2, r3}, {0x2, 0x33a29226fe67361d, r4}, {0x2, 0x0, r5}, {0x2, 0x0, r6}, {0x2, 0x4, r7}, {0x2, 0x3, r11}, {0x2, 0x3, 0xee00}], {}, [{0x8, 0x1, r12}, {0x8, 0x5, r13}], {0x10, 0x5}, {0x20, 0x4}}, 0x74, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r14 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r14, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000"/88], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB="0100708300000000"], 0x0, 0x0, 0x0}) 17:05:12 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x2a7) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_int(r1, 0x29, 0x3a, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1e) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f00000000c0), 0x4) wait4(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x1, 0x2, 0x1e}, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x20, 0x38}}}], 0x0, 0x0, 0x0}) [ 276.299377] binder: 8793:8800 transaction failed 29201/-28, size 6341068275337658412-1729382256910270464 line 3284 17:05:12 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r4, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r5, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 276.300061] binder: undelivered TRANSACTION_ERROR: 29201 [ 276.301521] binder: 8793:8809 transaction failed 29201/-28, size 6341068275337658412-1729382256910270464 line 3284 [ 276.302180] binder: undelivered TRANSACTION_ERROR: 29201 [ 276.306041] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 276.357175] binder_alloc: 8813: binder_alloc_buf, no vma [ 276.357194] binder: 8813:8815 transaction failed 29189/-3, size 88-24 line 3284 [ 276.357437] binder: undelivered TRANSACTION_ERROR: 29189 [ 276.409997] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 276.515522] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities 17:05:12 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r3, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r4, &(0x7f00000000c0)={0x28, 0x2, 0x0, {0x1}}, 0x28) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 276.538423] binder: 8796:8801 transaction failed 29201/-22, size 88-24 line 3379 [ 276.559810] binder: undelivered TRANSACTION_ERROR: 29201 [ 276.632872] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities 17:05:14 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(0x0, 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:14 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') fcntl$getownex(r0, 0x10, &(0x7f0000000140)={0x0, 0x0}) syz_open_procfs(r2, &(0x7f0000000200)='net/ip_vs_stats\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f0000000100)) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) pipe2(&(0x7f00000000c0), 0x81000) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0x0, 0x0, 0x0) r6 = dup3(r4, r5, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 278.475321] binder: 8848:8851 got transaction with too large buffer [ 278.482105] binder: 8848:8851 transaction failed 29201/-22, size 88-24 line 3493 [ 278.490750] binder: undelivered TRANSACTION_ERROR: 29201 17:05:15 executing program 0: openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000"/88], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00000000e1ff00001fe9b451000000000000000000000000a58747f2319c21b6188d4ff23055fe49bf5287005c6ce3ca8c4bf2e9de2f905b827bfa27cf1bee07daeefa93b69a292944b4c5c9ff633c4d22e6c56524bf70f3fef1adf148a6f8920d3cffbd5d121332c130362236f507585fea77aff580cca1a7f498c2c2e2a65265704af2508b7c3fb18c9d5db5eb0ffc"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:15 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r3, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x501100, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000540)={&(0x7f0000000100), 0xc, &(0x7f0000000500)={&(0x7f0000000900)={0x2c4, r3, 0x2, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x1c, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ce}]}]}, @TIPC_NLA_LINK={0xec, 0x4, [@TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x490f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x6, 0x2, 0x800}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_PRIO={0xffffffffffffff3e, 0x1, 0x2}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x28}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}]}, @TIPC_NLA_LINK={0xa8, 0x4, [@TIPC_NLA_LINK_NAME={0x0, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x68}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2a894a75}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}]}, @TIPC_NLA_BEARER={0xa0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x9, @mcast2, 0x1}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x0, @local, 0xd95}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x14, 0x2, @in={0x2, 0x4e28, @remote}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'tunl0\x00'}}]}, @TIPC_NLA_BEARER={0x3c, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x24}}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x0, @mcast1, 0x8}}}}]}]}, 0x2c4}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040040) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup3(r4, r5, 0x0) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r7, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r7, 0x0, 0x0) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x100, 0x2, 0x4, 0x10000}]}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000011000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a627300000000fcffffffffffffff0000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000012c0)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="00104000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB="6242b062e515a0d2"], 0x0, 0x0, 0x0}) 17:05:15 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(0x0, 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 279.296715] binder: BINDER_SET_CONTEXT_MGR already set 17:05:15 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r3, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x48, 0x18, &(0x7f0000001240)={@flat, @flat, @flat=@binder={0x73622a85, 0x1, 0x2}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 279.309993] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 279.329654] binder: 8858:8861 ioctl 40046207 0 returned -16 [ 279.332286] binder: 8860:8864 transaction failed 29201/-28, size 88-24 line 3284 [ 279.335762] binder: undelivered TRANSACTION_ERROR: 29201 17:05:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a627300000000000000000000000000000000000000f92a00852a7470000000000600"/90], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 279.365104] binder: BINDER_SET_CONTEXT_MGR already set [ 279.370898] binder: 8858:8872 ioctl 40046207 0 returned -16 [ 279.391334] binder: 8875:8876 got transaction to context manager from process owning it 17:05:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) setitimer(0x0, &(0x7f00000000c0)={{0x0, 0x2710}, {0x0, 0x2710}}, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 279.411075] binder: 8875:8876 transaction failed 29201/-22, size 72-24 line 3129 [ 279.421284] binder: BINDER_SET_CONTEXT_MGR already set [ 279.421293] binder: 8880:8881 ioctl 40046207 0 returned -16 [ 279.421603] binder: 8880:8881 sending u0000000000000000 node 834, cookie mismatch f900000000000000 != 0000000000000000 17:05:15 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r3, &(0x7f00000017c0), 0x0, 0x400400000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 279.421650] binder: 8880:8881 transaction failed 29201/-22, size 88-24 line 3395 [ 279.421804] binder: undelivered TRANSACTION_ERROR: 29201 [ 279.423549] binder: BINDER_SET_CONTEXT_MGR already set [ 279.423558] binder: 8880:8882 ioctl 40046207 0 returned -16 [ 279.423923] binder: 8880:8882 sending u0000000000000000 node 837, cookie mismatch f900000000000000 != 0000000000000000 [ 279.423960] binder: 8880:8882 transaction failed 29201/-22, size 88-24 line 3395 [ 279.424186] binder: undelivered TRANSACTION_ERROR: 29201 [ 279.429000] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 279.457140] binder: BINDER_SET_CONTEXT_MGR already set [ 279.457148] binder: 8887:8889 ioctl 40046207 0 returned -16 [ 279.457945] binder: release 8887:8889 transaction 839 out, still active [ 279.457950] binder: unexpected work type, 4, not freed [ 279.457952] binder: undelivered TRANSACTION_COMPLETE [ 279.517802] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 279.619605] binder: undelivered TRANSACTION_ERROR: 29201 17:05:17 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(0x0, 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:17 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BLKFRASET(0xffffffffffffffff, 0x1264, &(0x7f00000000c0)=0xe2) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) timerfd_create(0x9, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) epoll_wait(r2, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}], 0x7, 0x20) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000001240)={@flat, @flat, @flat=@weak_handle={0x77682a85, 0x1, 0x1}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r3, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r3, 0x80045400, &(0x7f0000000140)) [ 281.482497] binder: BINDER_SET_CONTEXT_MGR already set [ 281.488395] binder: 8901:8904 ioctl 40046207 0 returned -16 [ 281.496709] audit: type=1400 audit(1574442317.650:23): avc: denied { wake_alarm } for pid=8901 comm="syz-executor.1" capability=35 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability2 permissive=1 [ 281.524089] binder: 8901:8904 got transaction with invalid handle, 1 [ 281.530974] binder: 8901:8904 transaction failed 29201/-22, size 72-24 line 3411 [ 281.540562] binder: undelivered TRANSACTION_ERROR: 29201 [ 281.547655] binder: BINDER_SET_CONTEXT_MGR already set [ 281.553498] binder: 8901:8906 ioctl 40046207 0 returned -16 17:05:18 executing program 0: openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:18 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) preadv(r3, &(0x7f00000017c0), 0x0, 0x400400000000) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:18 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r5, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r5, 0x0, 0x0) r6 = mmap$binder(&(0x7f0000ff8000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0xfff) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000140)={0xc, 0x0, &(0x7f0000000100)=[@free_buffer={0x40086303, r6}], 0xe2, 0x0, &(0x7f00000012c0)="58415e2d4823966f87f35dec55cac03278c8cbb0607f95256b269c175edde6dae5d535d30ec0d7f553a993b4043bc2c7a77ea41c2de6bea047e62bb61e413bcf018545db1535a0d64a31563d4ec0052918a80900df26cf8ddbe89c2e50d24fb370624ecba5116392d244129efd52ca98c6a15932d739aecf98918ede53a7d9924f621bb3f5d278f8647efb85ee20b06823dcdf6c8efd2c02612a0a53b38935fba40ce426a581cd502a82a30265feb14246f3da1b407e38f13ca64f40a28bcc8b61a6c6cd7fb8ed82c4d680bed3fa6088f63f4f8da45f46ac39d625662a7a13b227a5"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000c264babd50f965c69f"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x7) ptrace$setregs(0xb, r2, 0x6ae, &(0x7f0000000000)="67c0b3306a77ccaf45b41148701faebebdd3167bbce8e2936b08f551f6d927fa4f914fdb86b66e738b3186e70e6987fd6391d6f0bab14744c303f3738e181690c3d9408f028f") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000005800000000000000180000000000000060ba5f3bf743d342e53b7a7ea9b79de4c9eddaa039e8357f36d19ac60475a2984bdc458b8889ab419f66aa03716e50ae3b75bd93e05040b73753d00cf1da9ac5e8edf18e5dfcff6f07fdd88fdb8276ddf5f520e3d4052d68cda37d1813157cec447e41563c95", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000"/88], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:18 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BLKFRASET(0xffffffffffffffff, 0x1264, &(0x7f00000000c0)=0xe2) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) timerfd_create(0x9, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) epoll_wait(r2, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}], 0x7, 0x20) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000001240)={@flat, @flat, @flat=@weak_handle={0x77682a85, 0x1, 0x1}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r3, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r3, 0x80045400, &(0x7f0000000140)) 17:05:18 executing program 5: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(0x0, 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 282.325935] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 282.328863] binder: 8914:8917 got transaction with invalid offset (-4467570830351532008, min 24 max 88) or object. 17:05:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) r2 = accept(r1, &(0x7f00000000c0)=@hci, &(0x7f0000000140)=0x80) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000200)='veth1\x00', 0x10) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000001240)={@flat, @flat, @flat=@binder={0x73622a85, 0xf, 0x1}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 282.328900] binder: 8914:8917 transaction failed 29201/-22, size 88-24 line 3379 [ 282.329176] binder: undelivered TRANSACTION_ERROR: 29201 [ 282.331759] binder: 8913:8919 got transaction with invalid handle, 1 [ 282.331858] binder: 8913:8919 transaction failed 29201/-22, size 72-24 line 3411 17:05:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 282.334527] binder: undelivered TRANSACTION_ERROR: 29201 [ 282.335545] binder: BINDER_SET_CONTEXT_MGR already set [ 282.335555] binder: 8912:8920 ioctl 40046207 0 returned -16 17:05:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) fstat(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r2) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000000200)={0x90, 0x5bb19479b4264a9c, 0x7, {0x4, 0x2, 0x8, 0x84, 0x10001, 0x0, {0x4, 0xd0c0, 0x1, 0x77f, 0x1f, 0x9, 0x6, 0x9, 0xfffffffe, 0x8, 0x9, r1, r2, 0xc3, 0x6}}}, 0x90) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000005800000000000000180000f500000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000"/88], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x200000, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000100), 0x4) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 282.396132] binder: BINDER_SET_CONTEXT_MGR already set [ 282.396142] binder: 8929:8930 ioctl 40046207 0 returned -16 [ 282.396655] binder: release 8929:8930 transaction 853 out, still active [ 282.396660] binder: unexpected work type, 4, not freed [ 282.396663] binder: unexpected work type, 4, not freed [ 282.396666] binder: undelivered TRANSACTION_COMPLETE [ 282.413741] binder: BINDER_SET_CONTEXT_MGR already set [ 282.413751] binder: 8929:8933 ioctl 40046207 0 returned -16 [ 282.447605] binder: BINDER_SET_CONTEXT_MGR already set [ 282.447616] binder: 8935:8936 ioctl 40046207 0 returned -16 [ 282.448053] binder: release 8935:8936 transaction 858 out, still active [ 282.448058] binder: unexpected work type, 4, not freed [ 282.448061] binder: undelivered TRANSACTION_COMPLETE [ 282.452376] binder: BINDER_SET_CONTEXT_MGR already set [ 282.452385] binder: 8935:8937 ioctl 40046207 0 returned -16 [ 282.453618] binder: release 8935:8937 transaction 861 out, still active [ 282.453622] binder: unexpected work type, 4, not freed [ 282.453625] binder: undelivered TRANSACTION_COMPLETE [ 282.491210] binder: BINDER_SET_CONTEXT_MGR already set [ 282.491219] binder: 8939:8940 ioctl 40046207 0 returned -16 [ 282.492345] binder_alloc: 8821: binder_alloc_buf size 4110418032 failed, no address space [ 282.492352] binder_alloc: allocated: 432 (num: 4 largest: 112), free: 15952 (num: 1 largest: 15952) [ 282.492370] binder: 8939:8940 transaction failed 29201/-28, size 88-4110417944 line 3284 [ 282.492510] binder: undelivered TRANSACTION_ERROR: 29201 [ 282.497174] binder: BINDER_SET_CONTEXT_MGR already set [ 282.497183] binder: 8939:8941 ioctl 40046207 0 returned -16 [ 282.497401] binder_alloc: 8821: binder_alloc_buf size 4110418032 failed, no address space [ 282.497408] binder_alloc: allocated: 432 (num: 4 largest: 112), free: 15952 (num: 1 largest: 15952) [ 282.497433] binder: 8939:8941 transaction failed 29201/-28, size 88-4110417944 line 3284 [ 282.497672] binder: undelivered TRANSACTION_ERROR: 29201 [ 282.545239] binder: BINDER_SET_CONTEXT_MGR already set [ 282.545249] binder: 8945:8946 ioctl 40046207 0 returned -16 [ 282.552351] binder: release 8945:8946 transaction 866 out, still active [ 282.552357] binder: unexpected work type, 4, not freed [ 282.552359] binder: undelivered TRANSACTION_COMPLETE [ 282.557210] binder: BINDER_SET_CONTEXT_MGR already set [ 282.557222] binder: 8945:8947 ioctl 40046207 0 returned -16 [ 282.558038] binder: release 8945:8947 transaction 869 out, still active [ 282.558043] binder: unexpected work type, 4, not freed [ 282.558046] binder: undelivered TRANSACTION_COMPLETE 17:05:20 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:20 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x8000, 0x0) write$FUSE_DIRENT(r1, &(0x7f0000000140)={0x30, 0x0, 0x3, [{0x2, 0x0, 0x7, 0x53a, '\'md5sum'}]}, 0x30) r2 = openat$smack_task_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/attr/current\x00', 0x2, 0x0) signalfd4(r2, &(0x7f0000000100), 0x8, 0x800) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@increfs_done={0x40106308, 0x3}], 0x224, 0x0, 0x0}) [ 284.495341] binder: BINDER_SET_CONTEXT_MGR already set [ 284.500897] binder: 8950:8952 ioctl 40046207 0 returned -16 [ 284.508229] binder: 8950:8952 BC_INCREFS_DONE u0000000000000003 no match [ 284.515490] binder: 8950:8952 unknown command 0 [ 284.520398] binder: 8950:8952 ioctl c0306201 20000180 returned -22 [ 284.528759] binder: BINDER_SET_CONTEXT_MGR already set [ 284.534963] binder: 8950:8955 ioctl 40046207 0 returned -16 [ 284.541304] binder: 8950:8955 BC_INCREFS_DONE u0000000000000003 no match [ 284.548551] binder: 8950:8955 unknown command 0 [ 284.553582] binder: 8950:8955 ioctl c0306201 20000180 returned -22 17:05:21 executing program 0: openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:21 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x88, 0x0, 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000000)=0x80, 0x4) splice(r3, 0x0, r4, 0x0, 0x10005, 0x0) r5 = getpid() ptrace$getsig(0x2, r5, 0xffffffffff600003, &(0x7f0000000040)) r6 = epoll_create1(0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r7, &(0x7f0000000180)) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf32(r8, &(0x7f00000007c0)=ANY=[@ANYBLOB="955a0000040900000023107d0b6e5fbdf500dfff"], 0x14) epoll_ctl$EPOLL_CTL_MOD(r8, 0x3, r7, &(0x7f0000000000)={0x15}) r9 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x133a}, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getownex(r10, 0x10, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r13 = dup3(r11, r12, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r13, 0x8912, 0x400200) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000600)={r13, 0xc0, &(0x7f0000000c40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=0x9, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x2, 0xfffffffc}, 0x0, 0x0, 0x0, &(0x7f0000000340)=0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=0x1003}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000004c0)={0x0, r10, 0x0, 0x4, &(0x7f0000000240)='/.@\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001dc0)={0xffffffffffffffff, r9, 0x0, 0x5, &(0x7f0000001d80)='user\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000240)='wlan0)&\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000004c0)={r5, r7, 0x0, 0x8, &(0x7f0000000480)='\x00@\x00\x00\x00\x00\x00\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000a00)={r2, r3, 0x0, 0x2, &(0x7f00000009c0)=')\x00', r14}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r1, 0xffffffffffffffff, 0x0, 0xd, &(0x7f0000000100)='/dev/binder#\x00', r14}, 0x30) r15 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r15, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r15, 0x40046207, 0x0) r16 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r19 = dup3(r17, r18, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r19, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r16, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB="6bcd980000576a5a"], 0x0, 0x0, 0x0}) 17:05:21 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0xc) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f0000000100)={0x8, 0xa5}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) fcntl$getown(r2, 0x9) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = add_key(0x0, &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="352940c5c8f212ea6fe693cc4723ec", 0xf, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(r6, &(0x7f0000000100)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r9, @ANYBLOB="004f700000257e12"], 0x20}}, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000300)={r9, 0x1, 0x6, @remote}, 0x10) keyctl$dh_compute(0x17, &(0x7f0000000240)={r4}, 0x0, 0x0, 0x0) r10 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, r4) keyctl$describe(0x6, r10, &(0x7f0000000240)=""/166, 0xa6) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:21 executing program 5: 17:05:21 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 285.335424] binder: BINDER_SET_CONTEXT_MGR already set [ 285.343335] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 285.365990] binder: 8961:8964 ioctl 40046207 0 returned -16 17:05:21 executing program 5: 17:05:21 executing program 5: [ 285.411809] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 285.436006] binder: release 8961:8964 transaction 872 out, still active 17:05:21 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000d65000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000000201ffff000000000000003f4aeaa5f04aebe21f", @ANYRES32=0x0], 0x1c}}, 0x0) 17:05:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0x0, 0x0, 0x0) signalfd(r5, &(0x7f0000000040)={0x40000000000000}, 0x8) r6 = dup3(r3, r4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}, 0x960de66e8cf778d9}], 0x0, 0x0, 0x0}) syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x4) [ 285.436011] binder: unexpected work type, 4, not freed [ 285.436014] binder: undelivered TRANSACTION_COMPLETE [ 285.481380] audit: type=1400 audit(1574442321.630:24): avc: denied { write } for pid=8985 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 285.485879] binder_alloc: 8989: binder_alloc_buf, no vma [ 285.485896] binder: 8989:8990 transaction failed 29189/-3, size 19-24 line 3284 [ 285.490698] binder: undelivered TRANSACTION_ERROR: 29189 [ 285.529941] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 285.540173] binder: BINDER_SET_CONTEXT_MGR already set [ 285.540183] binder: 8961:8991 ioctl 40046207 0 returned -16 17:05:23 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:23 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 287.507853] binder: 8998:8999 got transaction with too large buffer [ 287.514453] binder: 8998:8999 transaction failed 29201/-22, size 88-24 line 3493 [ 287.523066] binder: undelivered TRANSACTION_ERROR: 29201 17:05:24 executing program 0: openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:24 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) removexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@random={'system.', 'ppp0em1.\x00'}) 17:05:24 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = eventfd(0x0) writev(r2, &(0x7f0000000a40)=[{&(0x7f00000004c0)="df015be2a1043cce", 0x8}], 0x1) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100)="aba732e9970a72a4", 0x8}], 0x1) r3 = gettid() timer_create(0x0, &(0x7f0000000780)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) 17:05:24 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$IP6T_SO_GET_ENTRIES(r4, 0x29, 0x41, &(0x7f00000012c0)=ANY=[@ANYBLOB="6d616e676c650000000001000000000000000000000000000000000000000000770000000883247f6ee9dda7abdfd3d10c2396c1b0c2e8e1b64a2965023b9782b535f222a311c562bad7075c97be263e0410277afce99dd99c3083e889dc9953cc375a6f65fd376fa2d7b1c51728e9513598eb1a5b78ddde26c9d098ae1c6c441b10890fe4a21fca53899ae8daab56b6ce2a78d83c82dbcd828475"], &(0x7f0000000100)=0x9b) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0xfffffffffffffdfb, 0x0, 0x0}) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r5, 0x40286608, &(0x7f00000000c0)={0xe7ee, 0x101, 0x1, 0x1, 0x0, 0x4}) r6 = perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x8, 0x0, 0x0, 0xe0, 0x0, 0x2, 0x80100, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfff, 0x1, @perf_bp={&(0x7f0000000000), 0x4}, 0x20, 0xfbf, 0x5, 0x1, 0x40, 0x401, 0x7}, 0xffffffffffffffff, 0x2, r4, 0x8) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r6, &(0x7f0000000040)={0x1}) 17:05:24 executing program 2: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x11}, 0xc, &(0x7f0000000140)={&(0x7f00000015c0)={0x220, r1, 0x0, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0xc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_NODE={0x40, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x800000}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2ec}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7ff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}]}, @TIPC_NLA_BEARER={0x14, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}]}, @TIPC_NLA_BEARER={0x38, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'bond0\x00'}}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'bond_slave_1\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}]}, @TIPC_NLA_MEDIA={0x28, 0x5, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xcd0}]}]}, @TIPC_NLA_LINK={0x50, 0x4, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4aee366b}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_BEARER={0xfc, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x2, @loopback, 0x1}}, {0x14, 0x2, @in={0x2, 0x4e24, @multicast2}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e22, @rand_addr=0x401}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x3f, @mcast2, 0x2}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x0, @loopback, 0x81}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @empty}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x1, @loopback, 0x7}}}}]}]}, 0x220}, 0x1, 0x0, 0x0, 0x400}, 0x8088) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x0, 0xfff) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) getsockname$unix(r2, &(0x7f0000001500), &(0x7f0000001580)=0x6e) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r3, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r3, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x100000000000) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r6 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r6, 0x88, 0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) r7 = dup3(r5, r6, 0xe7be80aca33d5391) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 288.360370] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 288.373923] binder: BINDER_SET_CONTEXT_MGR already set [ 288.375859] binder: 9013:9019 ioctl c0306201 20000180 returned -14 [ 288.386034] binder: 9007:9015 ioctl 40046207 0 returned -16 [ 288.394206] binder: release 9007:9015 transaction 882 out, still active [ 288.403380] binder: unexpected work type, 4, not freed 17:05:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/attr/current\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = add_key(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000200)="da3d1952c486b9fb519cde94527149464f0dd0d4c69644e2d25403f48866cbc070643c0c9b4085fe628b8d2a1167f91fb452a374925913e9422c7ab6d744901d9538ac6373aa0b5a77849c5f056a838e4507645e77abbf198c94", 0x5a, 0xfffffffffffffffa) r2 = add_key(0x0, &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="352940c5c8f212ea6fe693cc4723ec", 0xf, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000240)={r2}, 0x0, 0x0, 0x0) keyctl$reject(0x13, r1, 0x4, 0x10001, r2) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0xc0406618, &(0x7f00000000c0)={{0x1, 0x0, @descriptor="45344e78b451837e"}}) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000100)={0x0, @empty, @dev}, &(0x7f0000000140)=0xc) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r3) [ 288.406478] binder: BINDER_SET_CONTEXT_MGR already set [ 288.406488] binder: 9007:9022 ioctl 40046207 0 returned -16 [ 288.433911] binder: BINDER_SET_CONTEXT_MGR already set [ 288.433919] binder: 9027:9029 ioctl 40046207 0 returned -16 [ 288.435236] binder: BINDER_SET_CONTEXT_MGR already set 17:05:24 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup3(r3, r4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) ioctl$EVIOCRMFF(r2, 0x40044581, &(0x7f0000000100)) preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) write$P9_RRENAMEAT(r1, &(0x7f00000000c0)={0x7, 0x4b, 0x1}, 0x7) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 288.435244] binder: 9027:9029 ioctl 40046207 0 returned -16 [ 288.459103] binder: 9024:9026 transaction failed 29189/-22, size 88-24 line 3138 [ 288.464015] binder: 9031:9034 ioctl c0406618 200000c0 returned -22 [ 288.465108] binder: 9031:9034 ioctl 400454da 20000200 returned -22 [ 288.473330] binder: 9031:9035 ioctl c0406618 200000c0 returned -22 [ 288.504953] binder: undelivered TRANSACTION_COMPLETE [ 288.520049] binder: BINDER_SET_CONTEXT_MGR already set [ 288.520057] binder: 9039:9042 ioctl 40046207 0 returned -16 [ 288.520177] binder: 9040:9041 got transaction with too large buffer [ 288.520215] binder: 9040:9041 transaction failed 29201/-22, size 88-24 line 3493 [ 288.532787] binder: BINDER_SET_CONTEXT_MGR already set [ 288.532986] binder: 9039:9042 ioctl 40046207 0 returned -16 [ 288.567126] binder: release 9039:9042 transaction 902 out, still active [ 288.573929] binder: unexpected work type, 4, not freed [ 288.579200] binder: undelivered TRANSACTION_COMPLETE [ 288.584422] binder: release 9039:9042 transaction 899 out, still active [ 288.591166] binder: unexpected work type, 4, not freed [ 288.596527] binder: undelivered TRANSACTION_COMPLETE [ 288.601954] binder: undelivered TRANSACTION_ERROR: 29201 [ 288.607516] binder: release 9031:9035 transaction 892 out, still active [ 288.614303] binder: unexpected work type, 4, not freed [ 288.619576] binder: undelivered TRANSACTION_COMPLETE [ 288.624793] binder: release 9031:9034 transaction 889 out, still active [ 288.631537] binder: unexpected work type, 4, not freed [ 288.636846] binder: undelivered TRANSACTION_COMPLETE [ 288.642108] binder: undelivered TRANSACTION_ERROR: 29189 [ 288.647616] binder: release 9027:9029 transaction 885 out, still active [ 288.654396] binder: unexpected work type, 4, not freed [ 288.659697] binder: undelivered TRANSACTION_COMPLETE 17:05:26 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:26 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat=@weak_handle={0x77682a85, 0x100, 0x1}, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 290.525482] binder: 9050:9051 got transaction with invalid handle, 1 [ 290.533351] binder: 9050:9051 transaction failed 29201/-22, size 88-24 line 3411 [ 290.541848] binder: undelivered TRANSACTION_ERROR: 29201 17:05:27 executing program 0: openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:27 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) write$P9_RSYMLINK(r1, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x80, 0x1, 0x6}}, 0x14) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a7470005d980400"/88], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:27 executing program 5: 17:05:27 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = getpid() ptrace$setsig(0x4203, r1, 0x5, &(0x7f00000000c0)={0x2d, 0x6b, 0x9}) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup3(r3, r4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:27 executing program 5: 17:05:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000280)={@fda={0x66646185, 0x5, 0x1, 0x18}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/79, 0x0, 0x1, 0x24}, @fda={0x66646185, 0x4, 0x1, 0x7}}, &(0x7f0000000140)={0x0, 0x18, 0xffffff78}}}], 0x0, 0x0, 0x0}) 17:05:27 executing program 5: sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x151, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(&(0x7f0000000100)='./file0\x00', 0x0) unlink(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x0, 0x0, 0x8020001) epoll_wait(0xffffffffffffffff, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x4) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f000055dff6)='/dev/ptmx\x00', 0x40101, 0x0) write(r1, &(0x7f0000f03f44)="09000000b36c5529a5534195cbffb4fffffff6091715f12f8f549f29496490f3f2afa9fd016f97ea68e0b7400fd558010287ce86ed8d843591ec4c782f85000000097f39147a2c89310932b0f6017ef5f00dfc01010000000000ffbf13", 0x5d) ioctl$TCSETS(r1, 0x5404, &(0x7f0000000000)={0x0, 0xffffffc1}) 17:05:27 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 291.379413] binder: 9062:9067 got transaction with too large buffer [ 291.386696] binder: BINDER_SET_CONTEXT_MGR already set [ 291.386706] binder: 9060:9066 ioctl 40046207 0 returned -16 [ 291.387312] binder: release 9060:9066 transaction 911 out, still active 17:05:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000005c0)={0xa4, 0x0, &(0x7f0000000440)=[@clear_death={0x400c630f, 0x2}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000300)={@fda={0x66646185, 0x0, 0x0, 0x2d}, @flat=@handle={0x73682a85, 0x100, 0x3}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/248, 0xf8, 0x2, 0x39}}, &(0x7f0000000140)={0x0, 0x20, 0x38}}}, @acquire={0x40046305, 0x1}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000380)={@fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x0, 0x3}, @fda={0x66646185, 0x0, 0x0, 0xf}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}, @register_looper], 0xae, 0x0, &(0x7f0000000500)="3800d2847c99962ad1a662fbb4226ca8a5aaa65ae319711d6244a79d86591d6a7cefa403d0b3d4732fb0ddd6373de4da85d00dd53fd6a2f10a2f6c054e37864173b1e2845087f46ac6524a9decf9d7ff23a523c2d2f9a143459c1eebac01b4080d88303bc6512c73033320206ed0bc432ddfe1060cdfcc691310ec39e450241bea2496b3cb13cf47e0f770037cc11a17dd2ba0266370c1287e8296be7e94d469f17a62a1f5e7f855a7076ab24771"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) pread64(r1, &(0x7f0000000600)=""/187, 0xbb, 0x1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind(r4, &(0x7f00000000c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x1, 0x3, 0x2, 0x1, {0xa, 0x4e20, 0x7, @mcast2, 0x5f9}}}, 0x80) [ 291.387317] binder: unexpected work type, 4, not freed [ 291.387320] binder: undelivered TRANSACTION_COMPLETE [ 291.387912] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 291.389887] binder: BINDER_SET_CONTEXT_MGR already set [ 291.389897] binder: 9060:9073 ioctl 40046207 0 returned -16 [ 291.391315] binder: release 9060:9073 transaction 914 out, still active [ 291.391319] binder: unexpected work type, 4, not freed [ 291.391322] binder: undelivered TRANSACTION_COMPLETE [ 291.446378] binder: BINDER_SET_CONTEXT_MGR already set [ 291.446387] binder: 9075:9081 ioctl 40046207 0 returned -16 [ 291.447198] binder: 9075:9081 got transaction with invalid parent offset or type [ 291.447224] binder: 9075:9081 transaction failed 29201/-22, size 88-24 line 3454 [ 291.447427] binder: undelivered TRANSACTION_ERROR: 29201 [ 291.452852] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 291.456584] binder: BINDER_SET_CONTEXT_MGR already set [ 291.456595] binder: 9075:9084 ioctl 40046207 0 returned -16 [ 291.499409] binder: BINDER_SET_CONTEXT_MGR already set [ 291.499417] binder: 9087:9088 ioctl 40046207 0 returned -16 [ 291.501285] binder: release 9087:9088 transaction 918 out, still active [ 291.501290] binder: unexpected work type, 4, not freed [ 291.501293] binder: undelivered TRANSACTION_COMPLETE [ 291.507585] binder: BINDER_SET_CONTEXT_MGR already set [ 291.507594] binder: 9087:9088 ioctl 40046207 0 returned -16 [ 291.632334] binder: 9062:9067 transaction failed 29201/-22, size 88-24 line 3493 [ 291.641419] binder: undelivered TRANSACTION_ERROR: 29201 17:05:29 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(0x0, 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:29 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 293.558740] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities 17:05:30 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:30 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@ipv6_delroute={0x1c, 0x19, 0x1}, 0x1c}}, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a74700000000000000000000000000000000000000000000000000000000000000000000000007a54cea3f09012e13a0ff7fc38ab27ca541d"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:30 executing program 5: sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x151, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(&(0x7f0000000100)='./file0\x00', 0x0) unlink(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) fallocate(r0, 0x0, 0x0, 0x8020001) epoll_wait(0xffffffffffffffff, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}], 0x6, 0x4) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f000055dff6)='/dev/ptmx\x00', 0x40101, 0x0) write(r1, &(0x7f0000f03f44)="09000000b36c5529a5534195cbffb4fffffff6091715f12f8f549f29496490f3f2afa9fd016f97ea68e0b7400fd558010287ce86ed8d843591ec4c782f85000000097f39147a2c89310932b0f6017ef5f00dfc01010000000000ffbf13", 0x5d) ioctl$TCSETS(r1, 0x5404, &(0x7f0000000000)={0x0, 0xffffffc1}) 17:05:30 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getresgid(&(0x7f00000000c0), &(0x7f0000000100)=0x0, &(0x7f0000000140)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, r5) r6 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/checkreqprot\x00', 0x305000, 0x0) ioctl$UI_SET_FFBIT(r6, 0x4004556b, 0x25) getgroups(0x1, &(0x7f0000000700)=[r5]) setregid(r4, r5) r7 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484019203e8872c8ebfe5029bb4bea2900000000000000000000000000000000005800", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:30 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:30 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) alarm(0x9) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e24, 0x0, @loopback, 0x8}, 0x1c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000180000000000000030000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 294.370032] binder: BINDER_SET_CONTEXT_MGR already set [ 294.381069] binder: 9107:9108 ioctl 40046207 0 returned -16 [ 294.394349] binder: 9109:9112 got transaction to invalid handle [ 294.394359] binder: 9109:9112 transaction failed 29201/-22, size 137440149504-137439068160 line 3138 17:05:30 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:30 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 294.394649] binder: undelivered TRANSACTION_ERROR: 29201 [ 294.410175] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 294.447677] binder: 9120:9123 got transaction with too large buffer 17:05:30 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 294.447721] binder: 9120:9123 transaction failed 29201/-22, size 88-24 line 3493 [ 294.447989] binder: undelivered TRANSACTION_ERROR: 29201 [ 294.478563] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities 17:05:30 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000b6dfc8)={0xffffff7f00000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000080)={0x2, 0x400000000000003, 0x0, 0x3, 0xf, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast2}}, @sadb_address={0x5, 0x9, 0x0, 0x0, 0x0, @in6}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @remote}}]}, 0x78}}, 0x0) [ 294.527380] binder_alloc: 9129: binder_alloc_buf, no vma [ 294.533278] binder: 9129:9130 transaction failed 29189/-3, size 88-24 line 3284 [ 294.542379] binder: undelivered TRANSACTION_ERROR: 29189 [ 294.554178] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 294.568667] binder: BINDER_SET_CONTEXT_MGR already set [ 294.577809] binder: 9107:9108 ioctl 40046207 0 returned -16 [ 294.612838] binder: release 9107:9121 transaction 929 out, still active [ 294.623457] binder: unexpected work type, 4, not freed [ 294.633352] binder: undelivered TRANSACTION_COMPLETE 17:05:32 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(0x0, 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:32 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) getpeername$inet(r1, &(0x7f0000000100)={0x2, 0x0, @broadcast}, &(0x7f0000000140)=0x10) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x5) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup3(r3, r4, 0x0) r6 = dup(0xffffffffffffffff) ioctl$UI_SET_FFBIT(r6, 0x4004556b, 0x60) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r7 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r7, 0x88, 0x0, 0x0, 0x0) dup(r7) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="00100000280d0000002d000800000000ebff000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r8 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r8, 0x88, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r8, 0x891a, &(0x7f00000000c0)={'vxcan1\x00', {0x2, 0x4e22, @multicast1}}) [ 296.564261] binder_alloc: 9151: binder_alloc_buf, no vma [ 296.569864] binder: 9151:9153 transaction failed 29189/-3, size 88-24 line 3284 [ 296.578608] binder: undelivered TRANSACTION_ERROR: 29189 17:05:33 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x4, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0xf820, 0x7f, 0x40, 0x8000}, {0xa1b5, 0x1f, 0x0, 0x1855d95a}]}) lseek(r1, 0x2, 0x2) ftruncate(r0, 0x10001) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) getsockname(r2, &(0x7f00000000c0)=@isdn, &(0x7f0000000140)=0x80) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 17:05:33 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:33 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000000)={0x0, 0xffffffffffffffa1, 0x0, 0x0, 0xfffffffffffffffd, 0x40000}, 0x0) sendmsg(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000000000001000000010000000300000003000000ae155a30e425a6fa073e8c93858a5834776eea7b560c4cd7992b3396a516b7a8891e5596c3d5ac18a8b2131e05a6cfb6846cbc0c683fa7707f0c84c60e59cbbd523a0c1f1ae9177e2f59499e6d401a6d773c6da09f8b6c361c6e099b56027e132dad8104b5ef156ef1939d9b83d797ae9ad41e8b4fc100bbf2ae05fc66ab5bc5a783b07daa13293b9a51d541d1fa4babe8e7877738a377da881a23267fc06f13"], 0x18}, 0x0) 17:05:33 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB="0000000000000d04"], 0x0, 0x0, 0x0}) 17:05:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f0000000200)=[{&(0x7f0000000300)=""/179}, {&(0x7f0000000600)=""/239}, {&(0x7f0000000700)=""/221}, {&(0x7f0000000800)=""/4096}, {&(0x7f0000000140)=""/113}, {&(0x7f00000003c0)=""/182}, {&(0x7f0000001800)=""/143, 0xff7d}], 0x1dc, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000500)={0xfffffffffffffc93, 0x0, &(0x7f0000000480)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000280)={@flat=@handle={0x73682a85, 0x1, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f0000000540)=""/130, 0x82, 0x0, 0x37}, @fd={0x66642a85, 0x0, r1}}, &(0x7f00000000c0)={0x0, 0x18, 0x40}}, 0x40}], 0x0, 0x0, 0x0}) [ 297.402795] binder_alloc: 9163: binder_alloc_buf size 291889550848950384 failed, no address space [ 297.410502] binder: BINDER_SET_CONTEXT_MGR already set [ 297.410510] binder: 9158:9167 ioctl 40046207 0 returned -16 [ 297.412492] binder: BINDER_SET_CONTEXT_MGR already set [ 297.412502] binder: 9158:9171 ioctl 40046207 0 returned -16 [ 297.419708] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities 17:05:33 executing program 5: syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, 0x0) 17:05:33 executing program 4: syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:33 executing program 5: quotactl(0x0, &(0x7f0000000040)='\x00', 0x0, 0x0) 17:05:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat=@weak_handle={0x77682a85, 0x9d0fb503cb90a998}, @flat=@weak_handle={0x77682a85, 0xa, 0x2}, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 297.455841] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) [ 297.475590] binder: 9163:9166 transaction failed 29201/-28, size 88-24 line 3284 [ 297.488255] binder: BINDER_SET_CONTEXT_MGR already set [ 297.488264] binder: 9175:9181 ioctl 40046207 0 returned -16 [ 297.490298] binder: BINDER_SET_CONTEXT_MGR already set [ 297.490308] binder: 9175:9182 ioctl 40046207 0 returned -16 [ 297.515805] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 297.539762] binder: BINDER_SET_CONTEXT_MGR already set [ 297.539771] binder: 9190:9191 ioctl 40046207 0 returned -16 [ 297.543579] binder: 9190:9191 got transaction with invalid handle, 0 [ 297.543605] binder: 9190:9191 transaction failed 29201/-22, size 88-24 line 3411 [ 297.543810] binder: undelivered TRANSACTION_ERROR: 29201 [ 297.562446] binder: BINDER_SET_CONTEXT_MGR already set [ 297.562457] binder: 9190:9191 ioctl 40046207 0 returned -16 [ 297.563581] binder: 9190:9191 got transaction with invalid handle, 0 [ 297.563609] binder: 9190:9191 transaction failed 29201/-22, size 88-24 line 3411 [ 297.563784] binder: undelivered TRANSACTION_ERROR: 29201 [ 297.625414] binder: undelivered TRANSACTION_ERROR: 29201 17:05:35 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(0x0, 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:35 executing program 5: r0 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) creat(&(0x7f0000000000)='./bus\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) ftruncate(r1, 0x8200) openat$ashmem(0xffffffffffffff9c, &(0x7f0000002800)='/dev/ashmem\x00', 0x48c880, 0x0) syz_open_procfs(0x0, 0x0) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x294ad, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xdf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000008600)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0/file0\x00'}, 0x80, &(0x7f0000007380), 0x0, &(0x7f0000000600)}}], 0x2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, 0x0, 0x0) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) getresuid(&(0x7f0000004180), 0x0, 0x0) socket$inet(0x2, 0x4000000805, 0x0) 17:05:36 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:36 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x2040, 0x0) setxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@known='trusted.overlay.nlink\x00', &(0x7f0000000200)='(*\x00', 0x3, 0x1) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:36 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:36 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x7ff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup3(r3, r4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = epoll_create1(0x0) r7 = epoll_create1(0x0) close(r6) eventfd2(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f00000000c0)={0x4}) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{}], 0x200000000000006f, 0x0, 0x0, 0x451) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:36 executing program 5: r0 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) creat(&(0x7f0000000000)='./bus\x00', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) ftruncate(r1, 0x8200) openat$ashmem(0xffffffffffffff9c, &(0x7f0000002800)='/dev/ashmem\x00', 0x48c880, 0x0) syz_open_procfs(0x0, 0x0) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x294ad, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xdf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000008600)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0/file0\x00'}, 0x80, &(0x7f0000007380), 0x0, &(0x7f0000000600)}}], 0x2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, 0x0, 0x0) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) getresuid(&(0x7f0000004180), 0x0, 0x0) socket$inet(0x2, 0x4000000805, 0x0) 17:05:36 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) wait4(0x0, 0x0, 0x80000000, 0x0) syz_open_procfs(0x0, 0x0) tkill(0x0, 0x10010000000035) sendmmsg(r0, &(0x7f00000092c0), 0x4000000000002a5, 0x4008000) 17:05:36 executing program 4: syz_mount_image$ext4(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:36 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 300.422477] binder: BINDER_SET_CONTEXT_MGR already set [ 300.431209] binder_alloc: 9213: binder_alloc_buf, no vma [ 300.431230] binder: 9213:9221 transaction failed 29189/-3, size 88-24 line 3284 17:05:36 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="ffff00010000000000000000000000000000000500008000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:36 executing program 4: syz_mount_image$ext4(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) [ 300.431695] binder: undelivered TRANSACTION_ERROR: 29189 [ 300.439884] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 300.505587] binder: release 9234:9237 transaction 941 out, still active [ 300.505592] binder: unexpected work type, 4, not freed [ 300.505595] binder: undelivered TRANSACTION_COMPLETE [ 300.511843] binder: send failed reply for transaction 941, target dead [ 300.558573] binder: 9215:9218 ioctl 40046207 0 returned -16 [ 300.565112] binder: 9241:9243 got transaction with invalid offset (16842751, min 0 max 88) or object. [ 300.565145] binder: 9241:9243 transaction failed 29201/-22, size 88-24 line 3379 [ 300.565510] binder: undelivered TRANSACTION_ERROR: 29201 [ 300.622669] binder: BINDER_SET_CONTEXT_MGR already set [ 300.628170] binder: 9215:9231 ioctl 40046207 0 returned -16 [ 300.635873] binder: release 9215:9231 transaction 946 out, still active [ 300.646078] binder: unexpected work type, 4, not freed [ 300.651521] binder: undelivered TRANSACTION_COMPLETE 17:05:38 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:38 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff}) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000012c0)={0x0, r2, 0x3ff, 0x9, 0xffffffff, 0x5}) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000140)={0xfff, 0x8001, 0x9, 0x2}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup3(r4, r5, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/mls\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) openat$random(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom\x00', 0x100, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r7, 0x88, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFADDR(r7, 0x8916, &(0x7f0000001300)={'syzkaller1\x00', {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="da00000000000000333000000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000001800000000000000bd00000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 302.583887] binder: 9259:9261 got transaction with invalid offset (189, min 48 max 88) or object. [ 302.593410] binder: 9259:9261 transaction failed 29201/-22, size 88-24 line 3379 [ 302.602525] binder: undelivered TRANSACTION_ERROR: 29201 17:05:39 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) wait4(0x0, 0x0, 0x80000000, 0x0) syz_open_procfs(0x0, 0x0) tkill(0x0, 0x10010000000035) sendmmsg(r0, &(0x7f00000092c0), 0x4000000000002a5, 0x4008000) 17:05:39 executing program 4: syz_mount_image$ext4(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:39 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, 0x0, 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000039d6cf8b1446f8f5e258000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) arch_prctl$ARCH_SET_CPUID(0x1012, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) write$binfmt_elf32(r5, &(0x7f00000012c0)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x4, 0x40, 0xe3, 0xac3, 0x3, 0x3, 0x1000, 0x71, 0x38, 0x303, 0x3, 0xff, 0x20, 0x2, 0x14, 0xa}, [{0x2, 0x1, 0x80000000, 0xe46e, 0x81, 0x40, 0xffff, 0x200}, {0x4, 0xe12, 0x7f, 0x5, 0x800, 0x9, 0xbdaa, 0x9}], "3516b231dceaf04a43f98cc5de872f8a844418e0db89375ac14ce7343845b303439576dd104b221d141810e3d6178670386ff5ab991412f2fcbacacce3a303060998ef1041c9a4437cd9f4bee82004797394bfd0acbdc968b5f9d660df121247d54aa8b2c5dbd6a5d09ad246616d06e98dbcd4e4e8bea0c7f7696993163af521b9", [[], [], [], [], [], []]}, 0xffffffffffffffd1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:39 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet(r0, 0x0, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r4, 0x0, 0x27, &(0x7f0000000040)={@multicast1, @local, @multicast1}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x15, 0x0, 0x0) [ 303.440581] binder: BINDER_SET_CONTEXT_MGR already set [ 303.448093] binder: 9267:9275 ioctl 40046207 0 returned -16 [ 303.455441] binder_alloc: 9270: binder_alloc_buf size -722750548694929624 failed, no address space [ 303.455449] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) 17:05:39 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000440)='cpuset.cpus\x00\xaa\xef+e\xcb\x98\xe6xm\xbe\xf2F\x96%\x12G\xc8X`\xed\xbe\xce\xdea', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000280)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x1000) 17:05:39 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', 0x0, 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f00000012c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f5a81f7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfff00"/4100], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 303.455469] binder: 9270:9273 transaction failed 29201/-28, size -722750686134020551-22754 line 3284 [ 303.455743] binder: undelivered TRANSACTION_ERROR: 29201 [ 303.498272] binder: 9283:9286 got transaction with too large buffer [ 303.498316] binder: 9283:9286 transaction failed 29201/-22, size 88-24 line 3493 [ 303.498496] binder: undelivered TRANSACTION_ERROR: 29201 [ 303.560268] binder: 9295:9298 got transaction with too large buffer [ 303.560304] binder: 9295:9298 transaction failed 29201/-22, size 88-24 line 3493 [ 303.560473] binder: undelivered TRANSACTION_ERROR: 29201 [ 303.589478] binder: BINDER_SET_CONTEXT_MGR already set [ 303.595414] binder: 9267:9284 ioctl 40046207 0 returned -16 17:05:41 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:41 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', 0x0, 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:41 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000012c0)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB="00000000000000000674e08fdcc7db47a5270fee081dfde8e15a53ed8d24a6cf85cfb1524c4b7e258712e19c10ae03002080bd9fba4be5c2093b627775fe079c2759f3ca9cafbe2edb227ce4444ef6562864a9c1f0c15b0c481fde6b04b545950fa097b2b385a41c9ce28b29586d1dbf7c88996830e7aae94a78c1414f204de84bef"], 0x0, 0x0, 0x0}) 17:05:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x7}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:41 executing program 5: request_key(&(0x7f00000004c0)='asymmetric\x00\x89 P\x0e\x1e\xe94\xbd\x03\x16\x9d\xff)F\xb2$t\x1b\x84S?\xff\x8e\x14\xe0\xaf\xf3\xed\x94Y>\x95\xe2\x99\xa9(\xd9\x8cG\x19\x1ey\xec\xfb\xc7|]a.3\x0f\xa4\xba\xf9p\xf8\xd1\xec?\xf9\xff\xa4\xa8t\xc7a?\xf0\x8d\x93\xf9\xf9\x1b\xf0\xb6\xe1\n#,\x92\x8cI\xe7\xcc_\xf5\xc7\r\x80*\xab_\xe4P>\x03\xaa\xf7\x88\xab\x04\xc3[ \xeey5\xcc\xc5i$\xcdtjV\x15Q(\xbf3\xca\xda\xb1\x9d#\xfb\xd3\x1e/\xc0\x89\x89\x16\xed\x9b\xcf\x18;:bz\x83\xab\x9be`d6&kF\xeaZ\xca~\xc50fk\xbd\xd8\xf6OS\xd98\xc9\xef\x8aj\x96\xfd\x89\x97\xbc\xb2\x9f.\xa9.\xdc\x8c_k\xf6\xff\xa6\x94\xa7\xe1\x96\x1d\x80\x94zK\x1f\f\xb7\x06h\xacH\xa2\xbb6\xc6wK\xad\xb4\x91k\xe1.$}\x9bQ\x06yeg\xca2\x8e\xd7\x8e\x14\x9al_\xf0\xef\xd2u\xff\xfd\xe4\x93\xb8\xc0\xeak\xab7\xe4*\xf7\x18\x99{\x9d%\xee%y\xa6\x1e\x1a]\x7f\xe1;\x93\xbd$\xba\x92$\x05|\xb3*\xfcu\xf1\xd9\xd6R\xdeG`p\x82\xf4<\xb0n1\xe5\xe2\xe7\xc1\xfc\\I\xca\xae\xbeJ2\x94\xed\xe4\xd0<\xd9\xef\x1drN\x18^$\xb3\xd4]\x9b\x19\xdf\xda', &(0x7f0000001ffb)={'cyz', 0x1}, 0x0, 0x0) [ 305.602613] binder: BINDER_SET_CONTEXT_MGR already set [ 305.609745] binder: 9311:9313 got transaction with too large buffer [ 305.609785] binder: 9311:9313 transaction failed 29201/-22, size 88-24 line 3493 [ 305.610064] binder: undelivered TRANSACTION_ERROR: 29201 [ 305.660456] binder: 9312:9315 ioctl 40046207 0 returned -16 [ 305.668803] binder: BINDER_SET_CONTEXT_MGR already set [ 305.674803] binder: 9312:9323 ioctl 40046207 0 returned -16 17:05:42 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, 0x0, 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:42 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x100000001) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@mcast2, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x33}, 0x0, @in=@multicast2, 0x0, 0x0, 0x0, 0x6, 0xb8, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000007e00), 0x400000000000058, 0x0) 17:05:42 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r1, 0x0, 0x0) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f00000012c0)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup3(r3, r4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) r6 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @loopback}, &(0x7f0000000100)=0x10, 0x41000) getsockopt$inet_mreq(r6, 0x0, 0x23, &(0x7f0000000140)={@empty, @empty}, &(0x7f0000000200)=0x8) 17:05:42 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', 0x0, 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe924dc0452161523ae869eaecb64a69c45d403745a42cebfc390821de36504b74e32291f57d9b30803949cc19b9aefc7eb3e06bf0ee4753f8bc0939e7cf0b3898548ab913c8b46ed3c8d0e3fdd2c63e3724026256761a0f2a7b5020eb850168d3749a3343d29fa6cbe41066c223ee530dc6f61edc3ea5c85dcd4d29a7db4bd52490db9061a5b7265d7469b1847654059236db72dbaf352fe7d6c3b8e2f719f2725c", 0x141, 0x400}], 0x0, 0x0) 17:05:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) read(r1, &(0x7f0000000000)=""/22, 0x16) 17:05:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x200000, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x2}], 0x0, 0x0, 0x0}) 17:05:42 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 306.459822] binder: 9332:9336 got transaction with too large buffer [ 306.467722] binder: 9332:9336 transaction failed 29201/-22, size 88-24 line 3493 [ 306.470077] binder: BINDER_SET_CONTEXT_MGR already set [ 306.470084] binder: 9333:9340 ioctl 40046207 0 returned -16 [ 306.470864] binder: BINDER_SET_CONTEXT_MGR already set [ 306.470871] binder: 9333:9340 ioctl 40046207 0 returned -16 [ 306.527280] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 306.533531] binder: undelivered TRANSACTION_ERROR: 29201 17:05:44 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="11634808000000000000000000f3ffffffffffffff0000a6cdb0da000080000000000058000000080000001800000000000000f986e146af9f4935352075d356c2b026a26b296f005ce0fde115333dfba9477eaa3a940bddaa0ab98a20d7ef10fdc9a7bdf1c969c13a509604f3e08fa3e7c8f28e69481434329eb192eeb11b2ff4489d6389832a402c7eff3ab554403a3142facc8609bf1d926864e7f58015b39d805c08e7a918239f903c899ce56296a1130f8b00", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000"/88], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x40100, 0x0) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000100)=0x4080000) 17:05:44 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup3(r3, r4, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:44 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:05:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x4e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) io_submit(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x10004) sendfile(r1, r1, &(0x7f0000000000)=0x2, 0x8080fffffffe) socket(0x8, 0x0, 0x20) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000280)) [ 308.615596] binder: BINDER_SET_CONTEXT_MGR already set [ 308.624524] binder: 9360:9362 ioctl 40046207 0 returned -16 [ 308.638750] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 308.652759] binder: 9361:9368 got transaction with too large buffer [ 308.652908] binder: 9361:9368 transaction failed 29201/-22, size 88-24 line 3493 [ 308.653237] binder: undelivered TRANSACTION_ERROR: 29201 [ 308.663480] FAT-fs (loop5): codepage cp437 not found [ 308.703694] binder: BINDER_SET_CONTEXT_MGR already set [ 308.715427] binder: 9360:9377 ioctl 40046207 0 returned -16 [ 308.726177] binder: 9360:9377 ioctl 40047459 20000100 returned -22 [ 308.752525] FAT-fs (loop5): codepage cp437 not found 17:05:45 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, 0x0, 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:45 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:05:45 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x20) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000001800"/52, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852ae96423b95c7162730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00!\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='rdma.current\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000440)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000100)={@ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/236, 0xec, 0x1, 0xa}, @fda={0x66646185, 0x4, 0x0, 0x38}, @ptr={0x70742a85, 0x1, &(0x7f0000000300)=""/217, 0xd9, 0x1, 0x2e}}, &(0x7f0000000400)={0x0, 0x28, 0x48}}}], 0x75, 0x0, &(0x7f00000004c0)="1c7fbc6d2228bb6de4bc844664cce21d708749dbb64ab2ebededfebaab59393da6f7988c497f81d29242f91fa9c282194b2bb32ada9023d621a6fc4da7f338e395dbe9f8260e86841c6d17ff1797dba671b6a717158b11a40253f2c2580dd0e02e374169499f4d326db73a810eab240c8cca891a60"}) 17:05:45 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) open(0x0, 0x0, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) fcntl$setstatus(r1, 0x4, 0x4c) open$dir(0x0, 0x0, 0x0) fcntl$dupfd(r0, 0xa, 0xffffffffffffffff) 17:05:45 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpgid(0x0) capget(&(0x7f0000000100)={0x20080522, r0}, &(0x7f0000000140)) 17:05:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x7) r2 = syz_open_procfs(r1, &(0x7f0000000100)='net/fib_trie\x00') ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x2000, 0x3}) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r3, 0x88, 0x0, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000200)=@security={'security\x00', 0xe, 0x4, 0x3c0, 0x0, 0x200, 0x200, 0x0, 0x0, 0x2f0, 0x2f0, 0x2f0, 0x2f0, 0x2f0, 0x4, &(0x7f00000000c0), {[{{@uncond, 0x0, 0xc8, 0x108}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0xdc, 0x26, 0x1}}}, {{@ipv6={@empty, @local, [0x0, 0xffffffff, 0x0, 0xffffff00], [0x0, 0x0, 0xffffff00, 0xff000000], 'ip_vti0\x00', 'veth0_to_bond\x00', {}, {}, 0xca, 0xff, 0x5e0f928525171cda, 0x20}, 0x0, 0xc8, 0xf8}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x30, 0x7, 0xfd}, {0x6, 0x7f, 0x81}, 0x7, 0x9}}}, {{@ipv6={@mcast2, @local, [0xff000000, 0x7f, 0xffffffff], [0xff000000, 0x1000000fe, 0xffffff00, 0xff], 'netdevsim0\x00', 'bond_slave_1\x00', {0xff}, {}, 0x2b, 0x1, 0x1, 0x2}, 0x0, 0xc8, 0xf0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffb}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x420) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = add_key$keyring(&(0x7f0000000640)='keyring\x00', &(0x7f0000000680)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$get_security(0x11, r4, &(0x7f00000006c0)=""/107, 0x6b) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) [ 309.474308] binder_alloc: 9395: binder_alloc_buf size 26388279075072 failed, no address space [ 309.481454] binder: BINDER_SET_CONTEXT_MGR already set [ 309.481462] binder: 9393:9397 ioctl 40046207 0 returned -16 [ 309.482112] binder: release 9393:9397 transaction 977 out, still active [ 309.482116] binder: unexpected work type, 4, not freed [ 309.482119] binder: undelivered TRANSACTION_COMPLETE [ 309.482730] binder: BINDER_SET_CONTEXT_MGR already set [ 309.482739] binder: 9393:9405 ioctl 40046207 0 returned -16 [ 309.483273] binder: release 9393:9405 transaction 980 out, still active [ 309.483277] binder: unexpected work type, 4, not freed [ 309.483279] binder: undelivered TRANSACTION_COMPLETE [ 309.489755] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 309.591360] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) [ 309.600626] binder: 9395:9398 transaction failed 29201/-28, size 26388279066624-0 line 3284 [ 309.611498] binder: undelivered TRANSACTION_ERROR: 29201 [ 309.617340] binder: BINDER_SET_CONTEXT_MGR already set [ 309.617349] binder: 9395:9419 ioctl 40046207 0 returned -16 17:05:47 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:47 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000340), 0x0, 0x0) 17:05:47 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c07bc3376003639405cb4aed12f0000000000aebb7c25d86800278dcff47d010000805adda681dc460234432479ae48295dc831a6aa885af3ff7130f824d7737a511291884c70e2d61c37804047b5f2b13183687e098092a73a", 0x60}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$PPPIOCSCOMPRESS(r2, 0x4010744d) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 17:05:47 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x88, 0x0, 0x0, 0x0) r1 = accept$inet6(r0, 0x0, &(0x7f0000000440)) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000480)={0x7f, {{0xa, 0x4e23, 0x5, @mcast2, 0x1}}, {{0xa, 0x4e20, 0x1, @empty, 0x101}}}, 0x108) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000140)={&(0x7f0000000100)='./file0\x00', 0x0, 0x8}, 0x10) ioctl$EXT4_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000200)=0x1c170) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') r4 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000280)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r3, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1204200}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, r4, 0x100, 0x70bd2a, 0x25dfdbfd, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x40000) preadv(r3, &(0x7f00000017c0), 0x0, 0x3ffffffffffc) sendmsg$SEG6_CMD_GET_TUNSRC(0xffffffffffffffff, 0x0, 0x40000) write$FUSE_OPEN(r3, &(0x7f00000000c0)={0x20, 0x0, 0x6, {0x0, 0x37}}, 0x20) r5 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000040)=[@timestamp, @window={0x3, 0x3, 0x7c}, @mss={0x2, 0x4}, @mss={0x2, 0xc38}], 0x4) setxattr$smack_xattr_label(&(0x7f0000000380)='./file0/file0\x00', &(0x7f00000003c0)='security.SMACK64IPOUT\x00', &(0x7f0000000400)={'/dev/binder#\x00'}, 0xe, 0x1) r7 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r7, 0x88, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x20, 0x0, &(0x7f0000000000)=ANY=[@ANYRES64, @ANYPTR=&(0x7f0000001240)=ANY=[@ANYRESOCT], @ANYPTR=&(0x7f00000001c0)=ANY=[], @ANYBLOB=' \x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:47 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TIOCLINUX2(r5, 0x541c, &(0x7f0000000140)={0x2, 0x4, 0x8, 0x4, 0x81, 0x5d15}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r6, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r6, 0x0, 0x0) write$P9_RLERROR(r6, &(0x7f0000000200)=ANY=[@ANYBLOB="21000000070100180200726873785f61636c5f616363657373"], 0xffffff22) [ 311.650800] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 311.665740] binder: 9427:9433 got transaction with too large buffer [ 311.667562] binder: BINDER_SET_CONTEXT_MGR already set [ 311.667569] binder: 9424:9428 ioctl 40046207 0 returned -16 [ 311.668128] binder: 9424:9428 unknown command -1 [ 311.668165] binder: 9424:9428 ioctl c0306201 20000180 returned -22 [ 311.674762] binder: BINDER_SET_CONTEXT_MGR already set [ 311.674771] binder: 9424:9441 ioctl 40046207 0 returned -16 [ 311.675319] binder: 9424:9439 unknown command -1 [ 311.675326] binder: 9424:9439 ioctl c0306201 20000180 returned -22 [ 311.755429] binder: 9427:9433 transaction failed 29201/-22, size 88-24 line 3493 [ 311.766264] binder: undelivered TRANSACTION_ERROR: 29201 17:05:48 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x8, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0xffffff70, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r2, 0x88, 0x0, 0x0, 0x0) writev(r2, &(0x7f0000000300)=[{&(0x7f00000000c0)="303d2988492e358d6bf462ce6e4983c0271493f277ad34b692636c8440a2744c057acf4d0006702e821b79a7de2a10da4a96902841bd1a9f2958647c8a6b3a73b44e90b74adc6d0b0d7f78c9cac45ab9976ecec98a3954bfa774dd47cac4e6cc73e0d1f07fec0d1a022ad330cef1f201e2bcb7301e98c2a2f8c20335540947a6d4d8de8f8d0ef135c88e8d11c9458348aa278fbcb8213de834a4c0e2a1aedfed0c31ba0ffb5cda61a9e5d94568b389720912b776f1", 0xb5}, {&(0x7f0000000200)="4c2d6efa3c0d103c8a682c1ea880f66621ad04a2f46a7eebda744fe2428e8cd3eb1e6763f60be2ef158c170bb6afb0e527b49ba867d291eb4375515c70d1725a83c8fc75906fc05d8176fa017bb0c788d3a994b9457a373f32888cdbabb3b509e6d8d91452acee73ce8fbc645a", 0x6d}, {&(0x7f0000000280)="b06862aae87d309d777c274db65be9579a67aef8943fd591331a5dc25810596674c064511782cdae3b5de2b30cdb23c2fbb463e51e3ff465f22aace7383af897a4fa311a381c5ee18bead1df7a0c4dc46a9a1ec791ceff58c22cc1235dcfd9096b9f", 0x62}], 0x3) ioctl$ION_IOC_HEAP_QUERY(0xffffffffffffffff, 0xc0184908, &(0x7f0000000380)={0x34, 0x0, &(0x7f0000000340)}) 17:05:48 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:48 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000340), 0x0, 0x0) 17:05:48 executing program 2: mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000013c0)={'broute\x00', 0x0, 0x4, 0xed, [], 0x3, &(0x7f0000000200)=[{}, {}, {}], &(0x7f00000012c0)=""/237}, &(0x7f0000001440)=0x78) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = getgid() setgid(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup3(r3, r4, 0x0) r6 = gettid() ptrace$setopts(0x4206, r6, 0x0, 0x0) tkill(r6, 0x7) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x23, 0x4, @tid=r6}, &(0x7f0000000100)=0x0) timer_gettime(r7, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a6273000000000000000000000000000000f4ffffff00852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:48 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 312.494832] binder: BINDER_SET_CONTEXT_MGR already set [ 312.506547] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 312.518654] binder: 9450:9454 ioctl 40046207 0 returned -16 17:05:48 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000340), 0x0, 0x0) [ 312.539358] binder: 9450:9454 got transaction with invalid offset (4294967152, min 0 max 88) or object. 17:05:48 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:48 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) [ 312.571385] binder: 9450:9454 transaction failed 29201/-22, size 88-8 line 3379 [ 312.589774] binder: undelivered TRANSACTION_ERROR: 29201 [ 312.599444] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 312.611434] binder: BINDER_SET_CONTEXT_MGR already set [ 312.623967] binder: 9450:9475 ioctl 40046207 0 returned -16 [ 312.636258] binder: 9450:9475 got transaction with invalid offset (4294967152, min 0 max 88) or object. [ 312.666608] binder: 9450:9475 transaction failed 29201/-22, size 88-8 line 3379 [ 312.678145] binder: undelivered TRANSACTION_ERROR: 29201 17:05:50 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{0x0, 0x0, 0x400}], 0x0, 0x0) 17:05:50 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:50 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(&(0x7f0000000100)='./file0\x00', 0x0) unlink(0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000055dff6)='/dev/ptmx\x00', 0x40101, 0x0) write(r0, &(0x7f0000f03f44)="09000000b36c5529a5534195cbffb4fffffff6091715f12f8f549f29496490f3f2afa9fd016f97ea68e0b7400fd558010287ce86ed8d843591ec4c782f85000000097f39147a2c89310932b0f6017ef5f00dfc01010000000000ffbf13", 0x5d) socket(0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x5404, &(0x7f0000000000)) 17:05:50 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) write$P9_RLOCK(0xffffffffffffffff, &(0x7f00000000c0)={0x8, 0x35, 0x1, 0x3}, 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x7) getpgid(r1) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') ptrace$cont(0x2f, r1, 0x1, 0xa9) preadv(r5, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r5, 0x0, 0x0) r6 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) r8 = mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r7, 0x40) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000040)={0xc, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r8}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x28, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x3}, @free_buffer={0x40086303, r8}, @free_buffer, @increfs={0x40046304, 0x2}], 0x46, 0x0, &(0x7f0000000100)="49b848f32fca72b8374f87c8d8e5b01b153d249e4cce069ad817a9b5373cce31efa4e9dee4b5296a92e5a51edcecb63a9568428f78928a1c8b6827c3c2c6aab7771403ba7ad0"}) r9 = dup3(r3, r4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:50 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x36e, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/4096, 0x1000}}, &(0x7f00000001c0)={0x0, 0x12, 0x30}}}], 0x0, 0x0, 0x0}) [ 314.650131] binder: BINDER_SET_CONTEXT_MGR already set [ 314.667345] binder: 9490:9492 ioctl 40046207 0 returned -16 [ 314.683765] EXT4-fs (loop4): VFS: Can't find ext4 filesystem 17:05:50 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{0x0, 0x0, 0x400}], 0x0, 0x0) 17:05:50 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:50 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r1, 0x88, 0x0, 0x0, 0x0) fsetxattr$trusted_overlay_opaque(r1, &(0x7f00000000c0)='trusted.overlay.opaque\x00', &(0x7f0000000100)='y\x00', 0x2, 0x1) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup3(r3, r4, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 314.710752] binder: BINDER_SET_CONTEXT_MGR already set [ 314.717991] binder: 9509:9510 got transaction with invalid offset (18, min 24 max 878) or object. [ 314.718078] binder: 9509:9510 transaction failed 29201/-22, size 878-24 line 3379 17:05:50 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 314.721721] binder: undelivered TRANSACTION_ERROR: 29201 [ 314.796257] EXT4-fs (loop4): VFS: Can't find ext4 filesystem 17:05:50 executing program 2: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000012c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5412, 0x1) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r2, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r2, 0x0, 0x0) ioctl$IOC_PR_RESERVE(r2, 0x401070c9, &(0x7f00000000c0)={0x5, 0x5}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_buf(r5, 0x88, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000002800)={0x150, 0x0, &(0x7f00000025c0)=ANY=[@ANYBLOB="0f630c40000000000000000000000000106308400000000000000000046304400200000011634840030000000000000000000000000000000000000011000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000002400)=ANY=[@ANYBLOB="852a627301010000020000298cf9c4ad4fa21ef5c02bb0f223deac00000000000000000000000000852a747001000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/84], @ANYBLOB="540000000000000001000000000000003000000000000000852a6877000100"/48], @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="000000000000000018000000000000004000000000000000"], @ANYBLOB="001000000000000011634840020000000000000000000000000000000000000011000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000002340)=ANY=[@ANYBLOB="852a747000000000", @ANYPTR=&(0x7f0000001340)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000000000000000000000000000002500000000000000852a62730000000001000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f00000023c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="40060000000000000b630000056304400100000000634040020000000000000000000000000000000000000010000000000000000000000050000000000000001800000000000000", @ANYPTR=&(0x7f0000002840)=ANY=[@ANYBLOB="852a68899d5f32314d3f71854d742a4376f92500000000", @ANYRES32=r1, @ANYBLOB="0000000000000000000000008561646600000000030000000000000002000000000000003900000000000000852a646600000000", @ANYRES32=r5, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000002480)=ANY=[@ANYBLOB="000000000000000018000000000000003800000000000000"], @ANYBLOB="01634040020000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR=&(0x7f0000002500)=ANY=[@ANYBLOB="8561646600000000080000000000000002000000000000003e00000000000000852a747001000000", @ANYPTR=&(0x7f00000024c0)=ANY=[@ANYBLOB='\x00'/10], @ANYBLOB="0a0000000000000001000000000000000800000000000000852a6877140000000200"/48], @ANYPTR=&(0x7f0000002580)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00']], 0x9b, 0x0, &(0x7f0000002740)="ff9b9020ef2f20e1c96ccd79bfaca003688ce694dfb803c1421f45539ea715a98913a593b5c05ecac3596064f12edb450257544b1773273ebe36daf334a1ca1ec6d67d40a65e70defac09e754df86d2b446fa0465da15c895731288963b55f5f9fd905fc750633f6908bc0229a512e2385f297ba7c0799d3dc2efdc9512658cee581d5aef70908442df118bc5310145ea1590b2dc698451868d22c"}) r6 = dup3(r3, r4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r7, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r7, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f00000028c0)=[@dead_binder_done], 0x0, 0x0, 0x0}) 17:05:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000340)={@flat, @flat, @flat=@weak_binder}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 17:05:51 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{0x0, 0x0, 0x400}], 0x0, 0x0) [ 314.809291] binder: 9524:9530 got transaction with too large buffer [ 314.809330] binder: 9524:9530 transaction failed 29201/-22, size 88-24 line 3493 [ 314.809648] binder: undelivered TRANSACTION_ERROR: 29201 [ 314.887070] binder: 9539:9545 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 314.887212] binder: release 9539:9545 transaction 999 out, still active [ 314.887217] binder: unexpected work type, 4, not freed [ 314.887220] binder: undelivered TRANSACTION_COMPLETE 17:05:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000"/88], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="00f9ffffffffffff1700000000e0000030000000000000007eb87d2520b36422d6ff47afdf878f083f6ba3458e76710f320d2b90f08d5c493074641298cfdc19f6968067c6064b38fcb0de3597d2e50fb4aed2a6301d72f2c7a0f68e2de5b7d90c18695ff615c4b1a15a7afafb3e8c781abfc6fff369e9b9a0aece94430d9fc8cb5ab7f6d93a4d571c37eb"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:51 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:51 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:51 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0), 0x0, 0x400}], 0x0, 0x0) 17:05:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001380)=ANY=[@ANYBLOB="852a6273000000000000003800000000000000000000000000002a62730000000000000000000000000000000000000000852a747000000000cf2874588ef5190f21a343703103a523f22d4d7fe8f606d20dcef3a1b070f99379c6531db5c2bbc0976a5936419424deaace5a21a606d1592a51bd0f5064a99a6b98071edec0121ab64152484ea4641eb453c5c6893e73465673de2edeec1ad3a636e45a50d6eb7c9ff047e5e9a5c6a0aad2916aa06a78e367ef1b489e684f0cf17d00b7fc217a9d221bd182955372d948e2f8530a1c328cedb04340f8040824baae167410464089188315306a032316", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000340)={@flat, @flat, @flat=@weak_binder}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 314.887828] binder: send failed reply for transaction 999, target dead [ 314.890877] binder: release 9539:9549 transaction 1003 out, still active [ 314.890881] binder: unexpected work type, 4, not freed [ 314.890884] binder: undelivered TRANSACTION_COMPLETE [ 314.899937] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 314.905824] binder: send failed reply for transaction 1003, target dead [ 314.984158] binder: 9490:9507 ioctl 40046207 0 returned -16 17:05:51 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:51 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0), 0x0, 0x400}], 0x0, 0x0) [ 315.010819] binder: 9563:9566 got transaction with invalid offset (24, min 24 max 88) or object. [ 315.026865] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 315.042688] binder: BINDER_SET_CONTEXT_MGR already set 17:05:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000340)={@flat, @flat, @flat=@weak_binder}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 17:05:51 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x4002011, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:51 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r0, 0x0, 0x0) sendto$unix(r0, &(0x7f00000001c0), 0x0, 0xc008, &(0x7f0000000300)=@abs={0x1, 0x0, 0x4e24}, 0x6e) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) lsetxattr$security_selinux(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='security.selinux\x00', &(0x7f0000000440)='system_u:object_r:sshd_key_t:s0\x00', 0x20, 0x1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001240)={@flat, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f0000000100)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000200)={{{@in=@empty, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@remote}}, &(0x7f00000000c0)=0xe8) setfsuid(r3) io_setup(0x1, &(0x7f0000000140)) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r4, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) sendmsg$SEG6_CMD_GET_TUNSRC(r4, 0x0, 0x0) r5 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/checkreqprot\x00', 0x101000, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) [ 315.042696] binder: 9569:9572 ioctl 40046207 0 returned -16 [ 315.043602] binder: 9569:9572 got transaction with invalid offset (-1792, min 0 max 88) or object. 17:05:51 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, r1, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000040)=0x480100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f85e) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000100)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x20) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x19) wait4(0x0, 0x0, 0x0, 0x0) 17:05:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000340)={@flat, @flat, @flat=@weak_binder}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 17:05:51 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0), 0x0, 0x400}], 0x0, 0x0) [ 315.043629] binder: 9569:9572 transaction failed 29201/-22, size 88-24 line 3379 17:05:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 315.043863] binder: undelivered TRANSACTION_ERROR: 29201 [ 315.048044] binder: BINDER_SET_CONTEXT_MGR already set [ 315.048055] binder: 9569:9577 ioctl 40046207 0 returned -16 [ 315.048429] binder: 9569:9577 got transaction with invalid offset (-1792, min 0 max 88) or object. [ 315.048554] binder: 9569:9577 transaction failed 29201/-22, size 88-24 line 3379 [ 315.048767] binder: undelivered TRANSACTION_ERROR: 29201 [ 315.059396] binder: 9558:9574 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 315.059773] binder: release 9558:9574 transaction 1014 out, still active [ 315.059778] binder: unexpected work type, 4, not freed [ 315.059780] binder: undelivered TRANSACTION_COMPLETE [ 315.063246] binder: send failed reply for transaction 1014, target dead [ 315.117662] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 315.126091] binder: 9586:9594 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 315.126331] binder: release 9586:9594 transaction 1018 out, still active [ 315.126336] binder: unexpected work type, 4, not freed [ 315.126339] binder: undelivered TRANSACTION_COMPLETE [ 315.147379] binder: send failed reply for transaction 1018, target dead [ 315.167269] binder: BINDER_SET_CONTEXT_MGR already set [ 315.167279] binder: 9595:9598 ioctl 40046207 0 returned -16 [ 315.169641] binder: release 9595:9598 transaction 1021 out, still active [ 315.169646] binder: unexpected work type, 4, not freed [ 315.169649] binder: undelivered TRANSACTION_COMPLETE [ 315.185334] binder: BINDER_SET_CONTEXT_MGR already set [ 315.185346] binder: 9595:9604 ioctl 40046207 0 returned -16 [ 315.189842] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 315.191247] binder: 9600:9605 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 315.191419] binder: release 9600:9605 transaction 1025 out, still active [ 315.191423] binder: unexpected work type, 4, not freed [ 315.191426] binder: undelivered TRANSACTION_COMPLETE [ 315.205088] binder: send failed reply for transaction 1025, target dead [ 315.250785] binder: 9611:9613 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 17:05:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000200)='team\x00') mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="852a08730000000000000000000000000000000000000000852a6273000000004edce1870dfcf747000000cf324efa647e540000000000852a747000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00'/4096], @ANYBLOB="001000"/24], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000000c0)=0x3) 17:05:51 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)="25bca274769e620aa734fa0095e06b2687ecb86a5c8802a9d82ea872943afd874e2f98a95c88727a2b8a340e0206e73ba8c63cd7dcc6760253efc1c8b63edad3c020f5027972060e8ac2a8b6001fd635da8bbdf3c158d110d784a764df4c0c1230ba42eeaf486c6b1373fe50d3573d0947b9f5b1657c34c1d08a9af7894103190de4beb11e212a2f7a6c1db9be7ce428db7b466347231431d264d97e03189dfe92", 0xa1, 0x400}], 0x0, 0x0) 17:05:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x1) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, &(0x7f00000000c0)={0x2, 0x80, 0xffff93cc, 0x6, 0x80000001}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000"/88], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000050000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 315.415031] binder: 9563:9566 transaction failed 29201/-22, size 88-24 line 3379 [ 315.426831] binder: undelivered TRANSACTION_ERROR: 29201 [ 315.434092] binder: 9563:9618 got transaction with invalid offset (24, min 24 max 88) or object. [ 315.443235] binder: 9563:9618 transaction failed 29201/-22, size 88-24 line 3379 [ 315.451318] binder: undelivered TRANSACTION_ERROR: 29201 [ 315.482859] binder: BINDER_SET_CONTEXT_MGR already set [ 315.488497] binder: 9622:9624 ioctl 40046207 0 returned -16 [ 315.496983] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 315.497708] binder: 9622:9624 got transaction with invalid offset (327728, min 48 max 88) or object. [ 315.497744] binder: 9622:9624 transaction failed 29201/-22, size 88-24 line 3379 [ 315.497985] binder: undelivered TRANSACTION_ERROR: 29201 [ 315.498513] binder: BINDER_SET_CONTEXT_MGR already set [ 315.498520] binder: 9622:9624 ioctl 40046207 0 returned -16 [ 315.526177] binder: 9621:9625 got transaction with invalid offset (0, min 0 max 88) or object. [ 315.526230] binder: 9621:9625 transaction failed 29201/-22, size 88-24 line 3379 [ 315.526557] binder: undelivered TRANSACTION_ERROR: 29201 17:05:54 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/member\x00', 0x2, 0x0) clone(0x7f8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet(0x2, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="40040030d2bb2040182014a70f34"], 0xe}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:05:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 17:05:54 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="11ae5c33d95404c9f8f8d3f4731c56be63484000000000000000002c2efdcfc22b3012000000000000000000000058000000000000001800000000000000", @ANYPTR=&(0x7f0000001240)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a747000"/88], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 17:05:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x21) ioctl$VT_ACTIVATE(r4, 0x5606, 0xdd5) r5 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000001240)={@flat, @flat, @fda={0x66646185, 0x8, 0x5, 0x2}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 17:05:54 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f00000004c0)='%', 0x1, 0x400}], 0x0, 0x0) [ 318.037203] binder: 9634:9639 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 318.044275] binder: BINDER_SET_CONTEXT_MGR already set [ 318.046689] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 318.054896] ------------[ cut here ]------------ [ 318.054900] kernel BUG at drivers/android/binder_alloc.c:1108! [ 318.054907] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 318.054912] Modules linked in: [ 318.054921] CPU: 1 PID: 9644 Comm: syz-executor.2 Not tainted 4.9.202+ #0 [ 318.054927] task: 000000003a697e3d task.stack: 00000000d25d6f4c [ 318.054948] RIP: 0010:[] [<000000000d8c3ae8>] binder_alloc_do_buffer_copy+0xcb/0x500 [ 318.054953] RSP: 0018:ffff8801c90874a8 EFLAGS: 00010212 [ 318.054959] RAX: 0000000000040000 RBX: 0000000020ffa000 RCX: ffffc90002b48000 [ 318.054964] RDX: 000000000000051a RSI: ffffffff8222a21b RDI: ffff8801c8fb9dd8 [ 318.054969] RBP: ffff8801c9087528 R08: ffff8801c90875a8 R09: 0000000000000008 [ 318.054974] R10: ffffed0039210f11 R11: ffff8801c908788f R12: 0000000000000060 [ 318.054979] R13: 0000000000000078 R14: 0000000000000008 R15: ffff8801c90875a8 [ 318.054986] FS: 00007fa420542700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 [ 318.054991] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 318.054996] CR2: 0000000020001240 CR3: 00000001c94cd000 CR4: 00000000001606b0 [ 318.055004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 318.055008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 318.055010] Stack: [ 318.055022] ffff8801c9087560 0000000000000246 ffff8801a21017c0 ffff8801c90874d0 [ 318.055035] ffff8801d3b59030 ffff8801c8fb9e58 00ff8801c9087870 ffff8801c8fb9e00 [ 318.055045] ffffffff814fdae6 ffff8801d0725400 0000000000000078 ffff8801c90875a8 [ 318.055047] Call Trace: [ 318.055058] [<0000000034ff9701>] ? memcpy+0x46/0x50 [ 318.055066] [<00000000b247cc8c>] binder_alloc_copy_from_buffer+0x37/0x42 [ 318.055075] [<00000000905a5d41>] binder_validate_ptr+0xc5/0x1b0 [ 318.055084] [<00000000cecaa827>] ? binder_get_object+0x1b0/0x1b0 [ 318.055091] [<00000000b247cc8c>] ? binder_alloc_copy_from_buffer+0x37/0x42 [ 318.055098] [<00000000717c0a24>] ? binder_get_object+0x12f/0x1b0 [ 318.055105] [<000000006bd8454d>] binder_transaction+0x20a4/0x5890 [ 318.055113] [<00000000459c1ba5>] ? binder_inc_ref_for_node+0xba0/0xba0 [ 318.055123] [<000000009e85206c>] ? __save_stack_trace+0x7a/0xf0 [ 318.055132] [<00000000aa8bb532>] ? depot_save_stack+0x13c/0x4a0 [ 318.055140] [<00000000876b11bd>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 318.055149] [<000000001f056a88>] ? __might_fault+0x114/0x1d0 [ 318.055158] [<00000000b7d5382a>] binder_thread_write+0x730/0x20e0 [ 318.055166] [<0000000096b78d05>] ? trace_hardirqs_on+0x10/0x10 [ 318.055175] [<000000006e0d3334>] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 318.055186] [<00000000aef4ea98>] ? binder_transaction+0x5890/0x5890 [ 318.055201] [<00000000876b11bd>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 318.055215] [<000000004856b09e>] binder_ioctl+0xecd/0x1720 [ 318.055226] [<000000009647c1cc>] ? rtnl_unlock+0xe/0x10 [ 318.055233] [<0000000031828fef>] ? binder_poll+0x240/0x240 [ 318.055240] [<0000000047f419b3>] ? __lock_acquire+0x5e0/0x4390 [ 318.055247] [<0000000096b78d05>] ? trace_hardirqs_on+0x10/0x10 [ 318.055255] [<000000001f8c1840>] ? __might_sleep+0x95/0x1a0 [ 318.055262] [<0000000031828fef>] ? binder_poll+0x240/0x240 [ 318.055271] [<000000008ac09ef5>] do_vfs_ioctl+0xb87/0x11d0 [ 318.055280] [<000000002f1756a1>] ? selinux_file_ioctl+0x103/0x550 [ 318.055299] [<000000008b59b9be>] ? ioctl_preallocate+0x210/0x210 [ 318.055313] [<000000005b5752d4>] ? selinux_parse_skb.constprop.0+0x16b0/0x16b0 [ 318.055324] [<00000000d33d9ea8>] ? __fget+0x208/0x370 [ 318.055333] [<00000000b3de5472>] ? __fget+0x22f/0x370 [ 318.055341] [<00000000829af8d7>] ? __fget+0x47/0x370 [ 318.055350] [<00000000b1648e72>] ? security_file_ioctl+0x8f/0xc0 [ 318.055358] [<000000005b06b119>] SyS_ioctl+0x8f/0xc0 [ 318.055367] [<000000007a218b98>] ? do_vfs_ioctl+0x11d0/0x11d0 [ 318.055374] [<000000007534e11f>] do_syscall_64+0x1ad/0x5c0 [ 318.055384] [<000000001200f779>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 318.055514] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 0a 04 00 00 4d 8b 64 24 58 49 29 dc e8 df 83 0f ff 4d 39 e6 76 07 e8 d5 83 0f ff <0f> 0b e8 ce 83 0f ff 4c 8b 6d d0 4d 29 f4 4d 39 e5 77 e8 e8 bd [ 318.055522] RIP [<000000000d8c3ae8>] binder_alloc_do_buffer_copy+0xcb/0x500 [ 318.055525] RSP [ 318.055634] ---[ end trace 6be72d82e4b99f80 ]--- [ 318.055641] Kernel panic - not syncing: Fatal exception [ 318.056686] Kernel Offset: disabled [ 318.473419] Rebooting in 86400 seconds..