y: 2 callbacks suppressed [ 1104.236403] binder: send failed reply for transaction 1231, target dead [ 1104.309376] binder_alloc: binder_alloc_mmap_handler: 1769 20ffd000-20ffe000 already mapped failed -16 [ 1104.338606] binder: send failed reply for transaction 1235 to 1769:1773 [ 1104.347493] binder: undelivered TRANSACTION_COMPLETE [ 1104.353637] binder: undelivered TRANSACTION_ERROR: 29189 23:36:10 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:10 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfec0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:10 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = msgget(0x1, 0x22) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000040)={{{@in=@remote, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@empty}}, &(0x7f0000000140)=0xe8) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getuid() lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r2, 0x10, &(0x7f0000000300)={0x0, 0x0}) r9 = getpid() msgctl$IPC_SET(r3, 0x1, &(0x7f0000000340)={{0x8, r4, r5, r6, r7, 0x44, 0x7ff}, 0x3, 0x3, 0x6, 0x5, 0x20, 0x6, r8, r9}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000001000/0x18000)=nil, 0x0, 0xfe5e, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x30, 0x0, 0x0, 0x117) syz_genetlink_get_family_id$team(&(0x7f0000000000)='team\x00') ioctl$KVM_RUN(r2, 0xae80, 0x0) socket(0x9, 0x2, 0x4) 23:36:10 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x9}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x14}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:10 executing program 5: r0 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) r1 = ioctl$KVM_CREATE_VCPU(r0, 0x80045510, 0x81001c) ioctl$int_out(r1, 0x2, &(0x7f0000000000)) 23:36:10 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:10 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x16, 0x4, &(0x7f0000346fc8)=ANY=[@ANYBLOB="180000000000300000009160c77fd34fbe1700009500000000000000"], &(0x7f0000000240)='GPL\x00'}, 0x48) 23:36:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x2, 0x1) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffff9c, 0x84, 0x13, &(0x7f0000000a40)={0x0, 0x1}, &(0x7f0000000a80)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000ac0)={r2, @in={{0x2, 0x4e24, @loopback}}, 0x1690, 0xfffffffffffffffe}, &(0x7f0000000b80)=0x90) ioctl(r0, 0x6, &(0x7f00000009c0)="0adc1f123c12a41d88b070") r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000bc0)=ANY=[@ANYBLOB="00ae05d9c312b2ef7558102c764408284ffbf81f10de25147ce8d72097c5634065252d000000000000dfff0000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000e00)=ANY=[@ANYBLOB="00000000000000006aad5e8ec44e0145b66b950e84501868dacf51659ebbce37add15b51fb92dd3e378d245a6d6afa18634ed73e0d987bf4882cf1717969894b3f3bf2793683b2be1bf34fef9483796b3a8c1ac9b8c85597fa4cbb0b7cd4154c37127b84f4c9aba345997262c5244dd420b210e772abf9c1c99ee6e6b05d1876cc05ffadaf7cd2b9c73c5ca48317eecce2dced28367d5fa30390f735870c2d26741012c68810eb86a699ce9ea0fc0edc7ecd6deec005c8c9d714c48efe46c6c832af032c91230f6e2ea22009551f7f0000000000bf19e586d0c4008517da5a7e2ba11a407e19dfe695d39d97b8d732b6c4b5c05226587dca711d070009597a3ab5eb1fe3eccb85c21dd59392b7fd9805fe6ac8756ff72fbcd63bca14b8340ddd3e68047c7b4e0256e41603b6a07bc2373ba94e4a788f24874e9873f70af811e80e56d29ec35e0776cf055d5d8a944c632b580a48f3f96042b84aab8f1a912bf60375a345731df00432d59f64f4f6a9e91099dee1d40c3cb99592d9d4b8b6b1789a913280fe2347c939313f713635fe43563ee2b76d2f609e397ba55671d7eadb0af917db1984a737ab971270454d69bd8f8403bf44e23c58be7526b2bf256314ecdfc228e6fb59cedaecf5878dc5ad8bb31dbe9fa4ae34f3b4df403b067fe5a09eb91135aa000a0e7ada0b56b4c508990a4dd75e7a5902866a273e2cf22f0f1bd33e2c9ffcd096d0bf365ef499761a5803b52a0084e742197362d2dd9e68ff8bcd794f3054f9b23e30247eeb0d4064124e9397dca8ff039351"]], 0x0, 0x0, 0x0}) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x100) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000a00)) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x8102, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f0000000940)='memory.swap.current\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f00000004c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000440)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r5, 0x4008ae48, &(0x7f00000003c0)=0x4) write$RDMA_USER_CM_CMD_MIGRATE_ID(r7, &(0x7f0000000900)={0x12, 0x10, 0xfa00, {&(0x7f0000000400), r8, r6}}, 0x18) getsockopt$IPT_SO_GET_REVISION_MATCH(r7, 0x0, 0x42, &(0x7f0000000480)={'icmp6\x00'}, &(0x7f0000000980)=0x1e) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e22, 0x54, @ipv4={[], [], @empty}, 0x9}}, [0x3, 0xd0f, 0x2, 0x1, 0x4, 0x5, 0x4, 0x9, 0x0, 0x0, 0x5, 0x2, 0x7f, 0x1, 0xffffffff80000001]}, &(0x7f00000000c0)=0x100) setsockopt$RDS_CONG_MONITOR(r6, 0x114, 0x6, &(0x7f0000000100), 0x4) fcntl$setstatus(r0, 0x4, 0x800) getsockopt$netrom_NETROM_N2(r6, 0x103, 0x3, &(0x7f0000000140)=0x4, &(0x7f0000000380)=0x4) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r6, 0x84, 0x6, &(0x7f00000002c0)={r9, @in6={{0xa, 0x4e23, 0x100, @mcast1, 0xfffffffffffffff7}}}, 0x84) ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000500)={"9d0d6eaa317b8f49cac2bfa98625779b91c3d5c2bbba98d718761a2a979ef9d89c36b2cd06db866c63e62516059739a30cee63a6d10b346184a281a6f4a5fafc4e7d6e2c9dc64ed9cf96eae558509ca92042ff7286a145b72cbb5ab5e1c04f8705a25642e19023d049ea09d45a10ddaf306381b47454432ba3cf206d895175fa967381682cc69ee65de7c87d0112fee4a21d70ecf95212515d86411a1edd9bcc63fbef5ff3206e91ea0a52cd4729f95a88deaad50977ba4cbfc2334e6ecf35934496dd0c0d93766a7fa5ab5a7f058d6c04a180ed4136eb0559b3f68643276b1411e1cd7f775a3a401c92613c2c318e0c1cbb7db32e8a49070c9563818e1f047a36292a2d589c46311cfe376327cd884da0d3034098c1e76ccb88af6730dce2e231ec581bc56a087bbaebd8c3080e4b2e0e890c548a9e496462f1aad08134b75556a05b698a87db57b6a4e516f23d0da9baa1c4d784cf0360dbf396bfe3cbc7e001930b250aff5ea495084c406f9e5502cbf014cca91574da70f7709cc53f6a6fc7e1813c69e5ed82e4148894f30f584bdea6b3f44978587ec5716fda9b8a72c0102cd99a77888bdd30144f91e591115282b9a8d4511023da21294bac3c44162513f7b07d819e03f515af075ff1abaa4f0b12ad3de592a5c30f9c681ebc5a36ac48d672f1831fea6febdbfd832dc26d7870a7b9efee31cb83114b70395cc59e2319a91bdbd12e3cd66c5b6bd6dae49d1083abf119392e540496e99629af7d0842e7b5ecdaa59f99dce8f5788063d1c206f9158a5f5fdf60f520a52b30e73d78cf81d058d68828aa5c435a432d1564de419c3761b0f4386418fc7b1f78371160abb7294cf5531319ce229b9d1de55b6659a3d656c6dfa2d7771aaf33e3df6977f1397dbe1aa72f81d8c0960e7533fee3775d2b8752479e46722565ba7d3aee0ba6c94dd250bb98522715b057c82b38339302109e603cbc40b7998bca3052351916f5d9fb896575e16dc52afda5bc19f3478995ab25d2c4caa7c5361d91b067a640c38c7ada03837802abd7196a31ba3fd8c9b9c36c44957147f52cf61b61c98fd1745f07ac105cc2b58d6418b763561f2601c47e25528b7afb99a0aadaa61078e1a661b7feacb098d4a94244152f3ce90de367a22d1090a4f28fde7cbca7cee5d4e7c69402b99a207d8881e25761764a958afe848661d130b6f2a6dbd14d19de156bc765b94d3a6a811734df4646bf5e007eba69e5b73b80e556d102cdf9c73e9846fbf11b31e81e9162f3723bf22a97857a46d248b9f193e3ca6b668faaea543a18b99512da22f6fd170b7badba4898c6488e255720bef82e1bab703b93f21834260d35a9609b61d5c0e6cc39cea738e40709a5a59fd94f516435c6c2e52788ba280ad1150ac047aebb4ecb11a108b385e77681c4525b023e741ab1b5f4a37a4f"}) [ 1104.958041] binder: BINDER_SET_CONTEXT_MGR already set 23:36:10 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1104.994954] binder: 1794:1802 ioctl 40046207 0 returned -16 [ 1105.000262] binder_alloc: 1794: binder_alloc_buf, no vma [ 1105.013058] binder: release 1794:1802 transaction 1239 out, still active [ 1105.020349] binder: 1794:1806 transaction failed 29189/-3, size 24-8 line 3035 [ 1105.031957] binder: undelivered TRANSACTION_COMPLETE [ 1105.051572] binder: send failed reply for transaction 1239, target dead [ 1105.069927] binder: 1810:1813 unknown command -653939200 [ 1105.089281] binder: undelivered TRANSACTION_ERROR: 29189 23:36:11 executing program 2: mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x2000000) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x401, 0xc000) ioctl$VIDIOC_G_FBUF(r0, 0x8030560a, &(0x7f0000000180)={0x2, 0x40, &(0x7f0000000100)="6286c0b64e3ff5ffd61394f0722c7af5a44fbe0f52", {0x3, 0x1000, 0x35365f5f, 0x2, 0x8, 0x81, 0xe, 0xe3e3}}) r1 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000580)="fbe2408be2e80fd358da3dda4658cc690f61f06d4f71cdbbb8644ec35bcb6e5543b1ffae8702d0ad3fca4f4b5dc9db5d934120b2bceb62d9e9718f7c498c36dddfa5aa8470eb62c5aeaa1f2512383c6078f301f1892867d0266a633849723116cd8809c762e293e312cf7509264ae7c9cc6cdb1b75194c82c7fc656fa6dba515ae8378b0ff7a9d8bf07db6f6bf21ba93667afbfe34495098e3417e52", 0x9c, 0xfffffffffffffffb) keyctl$describe(0x6, r1, &(0x7f0000000640)=""/254, 0xfe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000400}, 0xc, &(0x7f0000000300)={&(0x7f0000000880)={0x1a8, r2, 0x4, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x58, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x400}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xffffffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7f}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x100}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x80}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x35b17e2f}, @TIPC_NLA_NET_NODEID={0xc}]}, @TIPC_NLA_LINK={0x84, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd8fe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffffffffa34f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46e8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_BEARER={0xb8, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x800}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x100, @dev={0xfe, 0x80, [], 0x22}, 0xffff}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x2, @mcast1, 0x7}}}}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x946}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffff7}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6d}]}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x20040000}, 0x40010) chdir(&(0x7f0000000340)='./file0\x00') mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x40010, 0xffffffffffffffff, 0x0) unlink(0x0) lstat(0x0, &(0x7f0000000400)) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, &(0x7f0000000040)) mremap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000005000/0x2000)=nil) mremap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000000a000/0x1000)=nil) setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f0000000740)={0x0, 0xfb, 0x10a, 0x6, 0x2, "9b4bd80dbdc1ecfd8ee2d35b77e0307c", "afcbcc16b963ae96dd946f71e2b344afe4b18cb01525e9a69059539957fab4658f7abc400a383be85af195aece2ef716c5dd0ea397b0e8c288c884717ece10534d757c66e9133f9742068a9e5af3a6dc1292a59fc51535f5e8bd39c2719fdec90c47eb6747113c70a9caf19f9ada47e13815bb8e45fef2cbcb0264c85f10265c8dce65dcb4cdcf0d4f64b3252bb7882fb0d43a8ca21c965a67bc4ef24f32119eb6f481ff13a9d4bcc6e2bd1e5c9eee532ada3dd58995bc761477ca18616afa40c4599d46a0810594bc36bb7441a45390a02a40947c76b7fe5c6011ca59697ab5d63644816421672d06bf6f6c95eb718288ce776351"}, 0x10a, 0x2) 23:36:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x1200}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1105.101963] binder: 1810:1813 ioctl c0306201 20000180 returned -22 [ 1105.160379] binder: BINDER_SET_CONTEXT_MGR already set [ 1105.180953] binder: 1810:1819 ioctl 40046207 0 returned -16 [ 1105.191587] binder: 1810:1813 unknown command -653939200 [ 1105.220813] binder: BINDER_SET_CONTEXT_MGR already set [ 1105.236988] binder: 1823:1825 ioctl 40046207 0 returned -16 [ 1105.245193] binder: 1810:1813 ioctl c0306201 20000180 returned -22 [ 1105.266655] binder_alloc: 1810: binder_alloc_buf, no vma [ 1105.296551] binder: 1823:1829 transaction failed 29189/-3, size 24-8 line 3035 [ 1105.366358] binder: undelivered TRANSACTION_ERROR: 29189 23:36:11 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xa7020000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:11 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfe800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:11 executing program 2: mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x2000000) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x401, 0xc000) ioctl$VIDIOC_G_FBUF(r0, 0x8030560a, &(0x7f0000000180)={0x2, 0x40, &(0x7f0000000100)="6286c0b64e3ff5ffd61394f0722c7af5a44fbe0f52", {0x3, 0x1000, 0x35365f5f, 0x2, 0x8, 0x81, 0xe, 0xe3e3}}) r1 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000580)="fbe2408be2e80fd358da3dda4658cc690f61f06d4f71cdbbb8644ec35bcb6e5543b1ffae8702d0ad3fca4f4b5dc9db5d934120b2bceb62d9e9718f7c498c36dddfa5aa8470eb62c5aeaa1f2512383c6078f301f1892867d0266a633849723116cd8809c762e293e312cf7509264ae7c9cc6cdb1b75194c82c7fc656fa6dba515ae8378b0ff7a9d8bf07db6f6bf21ba93667afbfe34495098e3417e52", 0x9c, 0xfffffffffffffffb) keyctl$describe(0x6, r1, &(0x7f0000000640)=""/254, 0xfe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000400}, 0xc, &(0x7f0000000300)={&(0x7f0000000880)={0x1a8, r2, 0x4, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x58, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x400}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xffffffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7f}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x100}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x80}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x35b17e2f}, @TIPC_NLA_NET_NODEID={0xc}]}, @TIPC_NLA_LINK={0x84, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd8fe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffffffffa34f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46e8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_BEARER={0xb8, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x800}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x100, @dev={0xfe, 0x80, [], 0x22}, 0xffff}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x2, @mcast1, 0x7}}}}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x946}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffff7}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6d}]}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x20040000}, 0x40010) chdir(&(0x7f0000000340)='./file0\x00') mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x40010, 0xffffffffffffffff, 0x0) unlink(0x0) lstat(0x0, &(0x7f0000000400)) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, &(0x7f0000000040)) mremap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000005000/0x2000)=nil) mremap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000000a000/0x1000)=nil) setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f0000000740)={0x0, 0xfb, 0x10a, 0x6, 0x2, "9b4bd80dbdc1ecfd8ee2d35b77e0307c", "afcbcc16b963ae96dd946f71e2b344afe4b18cb01525e9a69059539957fab4658f7abc400a383be85af195aece2ef716c5dd0ea397b0e8c288c884717ece10534d757c66e9133f9742068a9e5af3a6dc1292a59fc51535f5e8bd39c2719fdec90c47eb6747113c70a9caf19f9ada47e13815bb8e45fef2cbcb0264c85f10265c8dce65dcb4cdcf0d4f64b3252bb7882fb0d43a8ca21c965a67bc4ef24f32119eb6f481ff13a9d4bcc6e2bd1e5c9eee532ada3dd58995bc761477ca18616afa40c4599d46a0810594bc36bb7441a45390a02a40947c76b7fe5c6011ca59697ab5d63644816421672d06bf6f6c95eb718288ce776351"}, 0x10a, 0x2) 23:36:11 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xa}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:11 executing program 5: mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x2000000) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x401, 0xc000) ioctl$VIDIOC_G_FBUF(r0, 0x8030560a, &(0x7f0000000180)={0x2, 0x40, &(0x7f0000000100)="6286c0b64e3ff5ffd61394f0722c7af5a44fbe0f52", {0x3, 0x1000, 0x35365f5f, 0x2, 0x8, 0x81, 0xe, 0xe3e3}}) r1 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000580)="fbe2408be2e80fd358da3dda4658cc690f61f06d4f71cdbbb8644ec35bcb6e5543b1ffae8702d0ad3fca4f4b5dc9db5d934120b2bceb62d9e9718f7c498c36dddfa5aa8470eb62c5aeaa1f2512383c6078f301f1892867d0266a633849723116cd8809c762e293e312cf7509264ae7c9cc6cdb1b75194c82c7fc656fa6dba515ae8378b0ff7a9d8bf07db6f6bf21ba93667afbfe34495098e3417e52", 0x9c, 0xfffffffffffffffb) keyctl$describe(0x6, r1, &(0x7f0000000640)=""/254, 0xfe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000400}, 0xc, &(0x7f0000000300)={&(0x7f0000000880)={0x1a8, r2, 0x4, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x58, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x400}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xffffffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7f}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x100}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x80}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x35b17e2f}, @TIPC_NLA_NET_NODEID={0xc}]}, @TIPC_NLA_LINK={0x84, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd8fe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffffffffa34f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46e8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_BEARER={0xb8, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x800}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x100, @dev={0xfe, 0x80, [], 0x22}, 0xffff}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x2, @mcast1, 0x7}}}}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x946}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffff7}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6d}]}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x20040000}, 0x40010) chdir(&(0x7f0000000340)='./file0\x00') mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x40010, 0xffffffffffffffff, 0x0) unlink(0x0) lstat(0x0, &(0x7f0000000400)) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, &(0x7f0000000040)) mremap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000005000/0x2000)=nil) mremap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000000a000/0x1000)=nil) setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f0000000740)={0x0, 0xfb, 0x10a, 0x6, 0x2, "9b4bd80dbdc1ecfd8ee2d35b77e0307c", "afcbcc16b963ae96dd946f71e2b344afe4b18cb01525e9a69059539957fab4658f7abc400a383be85af195aece2ef716c5dd0ea397b0e8c288c884717ece10534d757c66e9133f9742068a9e5af3a6dc1292a59fc51535f5e8bd39c2719fdec90c47eb6747113c70a9caf19f9ada47e13815bb8e45fef2cbcb0264c85f10265c8dce65dcb4cdcf0d4f64b3252bb7882fb0d43a8ca21c965a67bc4ef24f32119eb6f481ff13a9d4bcc6e2bd1e5c9eee532ada3dd58995bc761477ca18616afa40c4599d46a0810594bc36bb7441a45390a02a40947c76b7fe5c6011ca59697ab5d63644816421672d06bf6f6c95eb718288ce776351"}, 0x10a, 0x2) 23:36:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x1400}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:11 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfec00000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:11 executing program 2: mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x2000000) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x401, 0xc000) ioctl$VIDIOC_G_FBUF(r0, 0x8030560a, &(0x7f0000000180)={0x2, 0x40, &(0x7f0000000100)="6286c0b64e3ff5ffd61394f0722c7af5a44fbe0f52", {0x3, 0x1000, 0x35365f5f, 0x2, 0x8, 0x81, 0xe, 0xe3e3}}) r1 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000580)="fbe2408be2e80fd358da3dda4658cc690f61f06d4f71cdbbb8644ec35bcb6e5543b1ffae8702d0ad3fca4f4b5dc9db5d934120b2bceb62d9e9718f7c498c36dddfa5aa8470eb62c5aeaa1f2512383c6078f301f1892867d0266a633849723116cd8809c762e293e312cf7509264ae7c9cc6cdb1b75194c82c7fc656fa6dba515ae8378b0ff7a9d8bf07db6f6bf21ba93667afbfe34495098e3417e52", 0x9c, 0xfffffffffffffffb) keyctl$describe(0x6, r1, &(0x7f0000000640)=""/254, 0xfe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000400}, 0xc, &(0x7f0000000300)={&(0x7f0000000880)={0x1a8, r2, 0x4, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x58, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x400}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xffffffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7f}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x100}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x80}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x35b17e2f}, @TIPC_NLA_NET_NODEID={0xc}]}, @TIPC_NLA_LINK={0x84, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd8fe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffffffffa34f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46e8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_BEARER={0xb8, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x800}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x100, @dev={0xfe, 0x80, [], 0x22}, 0xffff}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x2, @mcast1, 0x7}}}}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x946}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffff7}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6d}]}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x20040000}, 0x40010) chdir(&(0x7f0000000340)='./file0\x00') mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x40010, 0xffffffffffffffff, 0x0) unlink(0x0) lstat(0x0, &(0x7f0000000400)) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, &(0x7f0000000040)) mremap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000005000/0x2000)=nil) mremap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000000a000/0x1000)=nil) setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f0000000740)={0x0, 0xfb, 0x10a, 0x6, 0x2, "9b4bd80dbdc1ecfd8ee2d35b77e0307c", "afcbcc16b963ae96dd946f71e2b344afe4b18cb01525e9a69059539957fab4658f7abc400a383be85af195aece2ef716c5dd0ea397b0e8c288c884717ece10534d757c66e9133f9742068a9e5af3a6dc1292a59fc51535f5e8bd39c2719fdec90c47eb6747113c70a9caf19f9ada47e13815bb8e45fef2cbcb0264c85f10265c8dce65dcb4cdcf0d4f64b3252bb7882fb0d43a8ca21c965a67bc4ef24f32119eb6f481ff13a9d4bcc6e2bd1e5c9eee532ada3dd58995bc761477ca18616afa40c4599d46a0810594bc36bb7441a45390a02a40947c76b7fe5c6011ca59697ab5d63644816421672d06bf6f6c95eb718288ce776351"}, 0x10a, 0x2) [ 1106.001273] binder_alloc_mmap_handler: 3 callbacks suppressed [ 1106.001292] binder_alloc: binder_alloc_mmap_handler: 1847 20ffd000-20ffe000 already mapped failed -16 23:36:12 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xff000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:12 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x8000, 0x0) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getegid() fchownat(r1, &(0x7f0000000040)='./file0\x00', r2, r3, 0x1000) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000180)={&(0x7f0000000140)='./file0\x00', 0x0, 0x10}, 0x10) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000200)='/\x91\x0f\xe8\x0e\xb5\x959\xf1;E6\xb1\x10\xf2\xeb\xdd\t\'\xb4\x85\xa5at$\xbdr{\xc7E\x06\xa3\x18\f\xe4\xd8+\x8d]eRf\xad\xcd\xa0h{\x80\xc8\'n\xef\xa2Y\xa5\x82\xc4T\xbb\xe1]\x193\xf8\x98*\x81\x14X\xbatb\x12g\x907\xdc\x06lL\x8aU\x03\r\"\xacq\xa7k}\x1e\xab\xad\x17\xba\xf6W\xfe8\xfdg\xf0\x1f\xddq!\xaeE\xa0\x0e\x83\x1e\xd4\x12\xfb%\xf27N\xbb@_\xd0>\x03_\xd4\xa5\x90\x89\n\"\f\x9a\xbe\x84\x01\xb2U\xb5:\xcb\x05\x84\xe6\x05\xc1\xfd\xfc\xa1:\xddS\x9c\xb4\r@#L\xc0\v\xa9^\xa5\xc3\xbf%\xe6\x99_2P[\x96\x8aN\x1da\x9bo\xda`\xe6\v\xda\x85\xf0\xa0Y\xd1)\x15>\xbf\x8f\r\x9d\x9f\xc7JF\xe6\ad\xfd\xe8Ou\x01\xee5\xd2k\x80\xf5\xcec\x12\x0erS\xddo\x1c\xc8\x82\xa8\xbbO[*\x98\xa8x\xfe\x9f\xfdU\xe7\x8e\x02\xed1\xba1\xc1aP\xe9]\x9d\xfe\xca\x11\x0ev6\x87\x12\xf9\x92\x98\xa4\xc2\xbdc)\xb2?\x93\x13\x16\x88]\x06A\xe8\x18\x80\xde\x99 \xfa\x9d\x1fh\xafO\x80\a\x13\xf55\x1f') 23:36:12 executing program 5: perf_event_open(&(0x7f0000000d40)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes192\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000440)='./file0\x00', 0x1, 0x80) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000480)=[@in={0x2, 0x4e21, @rand_addr=0xf753}, @in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e24, @remote}, @in6={0xa, 0x4e24, 0x1000, @dev={0xfe, 0x80, [], 0x12}, 0xfffffffffffff800}], 0x4c) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000200), 0xffffffffffffffff) r2 = getpid() rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f0000000100)={0x2c}) ptrace(0x10, r2) rt_sigreturn() ptrace$cont(0xffffffffffffffff, r2, 0x0, 0x0) wait4(r2, 0x0, 0x2000000a, &(0x7f0000000a40)) semget$private(0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, &(0x7f0000000300), &(0x7f0000000340)=0x4) semctl$GETPID(0x0, 0x2, 0xb, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000040), &(0x7f0000000640)=0xfffffffffffffef7) getpeername$packet(0xffffffffffffffff, &(0x7f0000000380), &(0x7f00000003c0)=0x14) [ 1106.081097] binder: send failed reply for transaction 1249 to 1847:1849 [ 1106.091527] binder: undelivered TRANSACTION_COMPLETE [ 1106.107104] binder: undelivered TRANSACTION_ERROR: 29189 23:36:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x2000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1106.276112] binder_alloc: binder_alloc_mmap_handler: 1869 20ffd000-20ffe000 already mapped failed -16 [ 1106.349806] binder: BINDER_SET_CONTEXT_MGR already set [ 1106.361314] binder: 1869:1880 ioctl 40046207 0 returned -16 [ 1106.386160] binder_alloc: 1869: binder_alloc_buf, no vma [ 1106.397112] binder: release 1869:1873 transaction 1253 out, still active [ 1106.406863] binder: 1869:1873 transaction failed 29189/-3, size 24-8 line 3035 [ 1106.415725] binder: undelivered TRANSACTION_COMPLETE [ 1106.437549] binder: send failed reply for transaction 1253, target dead 23:36:12 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x1000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:12 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:12 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x8000, 0x0) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getegid() fchownat(r1, &(0x7f0000000040)='./file0\x00', r2, r3, 0x1000) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000180)={&(0x7f0000000140)='./file0\x00', 0x0, 0x10}, 0x10) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000200)='/\x91\x0f\xe8\x0e\xb5\x959\xf1;E6\xb1\x10\xf2\xeb\xdd\t\'\xb4\x85\xa5at$\xbdr{\xc7E\x06\xa3\x18\f\xe4\xd8+\x8d]eRf\xad\xcd\xa0h{\x80\xc8\'n\xef\xa2Y\xa5\x82\xc4T\xbb\xe1]\x193\xf8\x98*\x81\x14X\xbatb\x12g\x907\xdc\x06lL\x8aU\x03\r\"\xacq\xa7k}\x1e\xab\xad\x17\xba\xf6W\xfe8\xfdg\xf0\x1f\xddq!\xaeE\xa0\x0e\x83\x1e\xd4\x12\xfb%\xf27N\xbb@_\xd0>\x03_\xd4\xa5\x90\x89\n\"\f\x9a\xbe\x84\x01\xb2U\xb5:\xcb\x05\x84\xe6\x05\xc1\xfd\xfc\xa1:\xddS\x9c\xb4\r@#L\xc0\v\xa9^\xa5\xc3\xbf%\xe6\x99_2P[\x96\x8aN\x1da\x9bo\xda`\xe6\v\xda\x85\xf0\xa0Y\xd1)\x15>\xbf\x8f\r\x9d\x9f\xc7JF\xe6\ad\xfd\xe8Ou\x01\xee5\xd2k\x80\xf5\xcec\x12\x0erS\xddo\x1c\xc8\x82\xa8\xbbO[*\x98\xa8x\xfe\x9f\xfdU\xe7\x8e\x02\xed1\xba1\xc1aP\xe9]\x9d\xfe\xca\x11\x0ev6\x87\x12\xf9\x92\x98\xa4\xc2\xbdc)\xb2?\x93\x13\x16\x88]\x06A\xe8\x18\x80\xde\x99 \xfa\x9d\x1fh\xafO\x80\a\x13\xf55\x1f') [ 1106.456489] binder: undelivered TRANSACTION_ERROR: 29189 23:36:12 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x3f00}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:12 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfe80000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:12 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1106.713163] binder_alloc: binder_alloc_mmap_handler: 1896 20ffd000-20ffe000 already mapped failed -16 [ 1106.741928] binder: BINDER_SET_CONTEXT_MGR already set 23:36:12 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1106.766206] binder: 1896:1900 ioctl 40046207 0 returned -16 [ 1106.790273] binder_alloc: 1896: binder_alloc_buf, no vma 23:36:12 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfec0000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:12 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1106.811111] binder: release 1896:1897 transaction 1258 out, still active [ 1106.818459] binder: 1896:1897 transaction failed 29189/-3, size 24-8 line 3035 [ 1106.826339] binder: undelivered TRANSACTION_COMPLETE [ 1106.838565] binder: send failed reply for transaction 1258, target dead [ 1106.856052] binder: undelivered TRANSACTION_ERROR: 29189 23:36:15 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xff00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x1000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:15 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x2000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:15 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x40000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:15 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x2c7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:15 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1109.541080] binder_alloc: binder_alloc_mmap_handler: 1927 20ffd000-20ffe000 already mapped failed -16 [ 1109.553280] binder: BINDER_SET_CONTEXT_MGR already set [ 1109.558578] binder: 1937:1939 ioctl 40046207 0 returned -16 [ 1109.580221] binder: BINDER_SET_CONTEXT_MGR already set 23:36:15 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1109.585952] binder: 1927:1932 ioctl 40046207 0 returned -16 [ 1109.597941] binder_alloc: 1927: binder_alloc_buf, no vma [ 1109.610158] binder: release 1927:1932 transaction 1263 out, still active [ 1109.617031] binder: undelivered TRANSACTION_COMPLETE 23:36:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x2000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1109.653142] binder: 1937:1939 transaction failed 29189/-3, size 24-8 line 3035 [ 1109.662248] binder: send failed reply for transaction 1263, target dead [ 1109.690204] binder: undelivered TRANSACTION_ERROR: 29189 23:36:15 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$vcsn(&(0x7f0000000300)='/dev/vcs#\x00', 0x6, 0x2000) ioctl$SG_GET_LOW_DMA(r1, 0x227a, &(0x7f0000000900)) r2 = creat(&(0x7f0000000240)='./file0\x00', 0x80000001a7) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000800)=ANY=[], &(0x7f00000002c0)) getsockopt$inet6_int(r1, 0x29, 0xd9, &(0x7f0000000700), 0x0) request_key(&(0x7f0000000600)='logon\x00', &(0x7f0000000640)={'syz', 0x1}, &(0x7f0000000680)='$', 0xfffffffffffffff9) request_key(&(0x7f0000000540)='cifs.spnego\x00', &(0x7f00000007c0)={'syz', 0x3}, &(0x7f0000000800)='keyring\x00', 0xffffffffffffffff) r4 = add_key$keyring(&(0x7f0000000880)='keyring\x00', &(0x7f00000008c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$instantiate_iov(0x14, r4, &(0x7f0000000840), 0x47, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, 0xffffffffffffffff) r5 = socket$kcm(0x29, 0x1000000000003, 0x0) write$binfmt_misc(r5, &(0x7f0000000a80)=ANY=[], 0x241) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'veth1_to_team\x00', 0x5001}) fsetxattr$trusted_overlay_upper(r3, &(0x7f0000000140)='trusted.overlay.upper\x00', &(0x7f0000000380)={0x0, 0xfb, 0x73, 0x4, 0x9, "d042da3e7d548fd6daba866b03677270", "17389cff95f983c3775bad7b5a61c900237ff40546d20316c0b6f1b3558b1e2573fea329a3cf1c0cdf7d5ec0d0f3a3cd178546d74b438fbead8ba46947cd510284132f20b7b8c06a51378117022524f899185e169abf2e8d76645fab59f4"}, 0x73, 0x1) write$FUSE_NOTIFY_INVAL_INODE(r2, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000940)={{{@in6, @in6=@ipv4={[], [], @dev}}}, {{@in6=@mcast1}, 0x0, @in=@multicast1}}, &(0x7f0000000580)=0xe8) sendmsg(0xffffffffffffffff, &(0x7f0000000ec0)={&(0x7f0000000ac0)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x3, 0x2, 0x4}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000480)="302fc1fa784003f2617e2e66d5fd613d2566a8c0cceed0716ada1e0aeb030dde2cc34d8fd144eefa48acfaf522a0a052ef2b94cad8d8bdade4f2c895fc76f24a029f43ee26e5f94c02a893df5c170015637f4fb710cd4d4f29ef19aec239d5f62c8f5145ab3618d970a985ef59c8f9815ed9c9ba8421b8cdbcbc8fd1f59c023971faa0394dbb6326cf2d6823318bba1e9f6c391218b8cd11b9b78f8915993778c3489f0638d372d02391b7a3acb618ac2d14db58b0698582622f3c", 0xbb}], 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000b40)}], 0x1, 0x0, 0x0, 0x8004}, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000c40)=@nat={'nat\x00', 0x19, 0x3, 0x578, [0x20000f00, 0x0, 0x0, 0x20000f30, 0x20000f60], 0x0, &(0x7f0000000840), &(0x7f0000000f00)=[{0x0, '\x00', 0x0, 0x4df136561bcb0da}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{{{0x11, 0x13, 0xe88f, '\x00', 'syz_tun\x00', 'team_slave_1\x00', 'vcan0\x00', @dev={[], 0x15}, [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], @link_local, [0x0, 0xff, 0xff, 0xff, 0x0, 0xff], 0x70, 0xe0, 0x130}, [@snat={'snat\x00', 0x10, {{@broadcast, 0xfffffffffffffffd}}}, @common=@dnat={'dnat\x00', 0x10, {{@empty, 0xffffffffffffffff}}}]}, @common=@log={'log\x00', 0x28, {{0x3, "fb84ac62b7d7d916a04b93734e4bd1df5daaa9ac2bbeef7013c57ea67a87", 0x3}}}}, {{{0x9, 0x20, 0x88e5, 'nlmon0\x00', 'netdevsim0\x00', 'ip6gre0\x00', '\x00', @dev={[], 0x26}, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], @remote, [0xff, 0x0, 0x0, 0xff, 0xff, 0xff], 0x70, 0xe0, 0x118}, [@snat={'snat\x00', 0x10, {{@empty, 0xffffffffffffffff}}}, @snat={'snat\x00', 0x10, {{@dev={[], 0x10}, 0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0x10, {{@local, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffc, 0x1, [{{{0x15, 0x3, 0x9300, 'vcan0\x00', 'veth1\x00', 'lo\x00', 'caif0\x00', @dev={[], 0x23}, [0xff], @dev={[], 0x26}, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], 0xf0, 0x140, 0x270, [@nfacct={'nfacct\x00', 0x28, {{'syz0\x00'}}}, @cgroup0={'cgroup\x00', 0x8, {{0x200, 0x1}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x9, 'syz1\x00', 0x85}}}]}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x8, 'system_u:object_r:audisp_remote_exec_t:s0\x00'}}}}]}]}, 0x5f0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000280), 0x8) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000000)) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000440)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000780)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x201000}, 0xc, &(0x7f0000000740)={&(0x7f00000005c0)={0x34, r6, 0x100, 0x70bd27, 0x25dfdbfe, {{}, 0x0, 0x4107, 0x0, {0x18, 0x18, {0x9, @bearer=@l2={'ib', 0x3a, 'syzkaller1\x00'}}}}, ["", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x804}, 0x80) write$UHID_INPUT2(0xffffffffffffffff, &(0x7f0000000400), 0x6) 23:36:15 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1109.780389] binder_alloc: binder_alloc_mmap_handler: 1956 20ffd000-20ffe000 already mapped failed -16 [ 1109.807560] binder: BINDER_SET_CONTEXT_MGR already set [ 1109.823124] binder: 1956:1957 ioctl 40046207 0 returned -16 [ 1109.844635] binder: release 1956:1957 transaction 1269 out, still active [ 1109.873046] binder: undelivered TRANSACTION_COMPLETE [ 1109.878267] binder: send failed reply for transaction 1269, target dead 23:36:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x12000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:15 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}}}, 0x48) 23:36:15 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1110.001656] rpcbind: RPC call returned error 22 23:36:15 executing program 5: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x201, 0x2) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0x20123, 0x4}) [ 1110.028429] binder_alloc: binder_alloc_mmap_handler: 1970 20ffd000-20ffe000 already mapped failed -16 [ 1110.076370] binder: BINDER_SET_CONTEXT_MGR already set [ 1110.128981] binder: 1970:1972 ioctl 40046207 0 returned -16 [ 1110.134929] binder: release 1970:1972 transaction 1273 out, still active [ 1110.143488] binder: undelivered TRANSACTION_COMPLETE [ 1110.163809] binder: send failed reply for transaction 1273, target dead 23:36:16 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x100000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:16 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}}}, 0x48) 23:36:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x14000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:16 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:16 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x4000, 0x0) ioctl$VIDIOC_SUBDEV_G_EDID(r0, 0xc0285628, &(0x7f0000000180)={0x0, 0x1, 0x2, [], &(0x7f0000000080)=0xffffffff}) r1 = socket$inet6(0xa, 0x803, 0x3) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x8, 0x10}, &(0x7f0000000200)=0xc) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000240)={r2, 0xa, "e01fbec24398e258e4ef"}, &(0x7f0000000280)=0x12) write$binfmt_misc(r0, &(0x7f0000000100)={'syz0', "9b2a8610da9aa10fc2855f20010b138a6963b9d51101149fdca518db2ef5564e118b7434b02067f8ef8c92881a2d235c99e30e1c5e40e4213594846d3c6b0d99b55960a4a4b3f8e2711493fb9bdc6fda3df9e908e6e9dd4c94"}, 0x5d) open(&(0x7f00000002c0)='./file0\x00', 0x8001, 0x192) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="0a5c2d023c126285718070") rt_sigprocmask(0x0, &(0x7f00001b6ff8)={0xfffffffffffffffe}, 0x0, 0x8) r3 = memfd_create(&(0x7f0000000000)='\xc4:/\x00', 0x0) ftruncate(r3, 0x100000000040001) 23:36:16 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x300}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:16 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1110.627693] binder_alloc: binder_alloc_mmap_handler: 1991 20ffd000-20ffe000 already mapped failed -16 [ 1110.650671] binder: BINDER_SET_CONTEXT_MGR already set [ 1110.658975] binder: release 1991:2003 transaction 1277 out, still active [ 1110.667645] binder: 1991:2003 ioctl 40046207 0 returned -16 23:36:16 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}}}, 0x48) 23:36:16 executing program 5: openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/attr/current\x00', 0x2, 0x0) clone(0x3102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(r0, 0x0, 0x8, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x8) tkill(r0, 0x2000000000024) ptrace$cont(0x9, r0, 0xfffffffffffffffb, 0x7) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0xfffffffffffffffe, 0x0, 0x3}) ptrace$cont(0x20, r0, 0xb198, 0xffffffffffffff81) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) rt_tgsigqueueinfo(r0, r0, 0x2b, &(0x7f0000000000)={0x14, 0x81, 0xffffffffffffffff}) ptrace$cont(0x21, r0, 0x0, 0x0) [ 1110.675874] binder: undelivered TRANSACTION_COMPLETE [ 1110.699361] binder: send failed reply for transaction 1277, target dead 23:36:16 executing program 5: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000180), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) clone(0x19010900, &(0x7f0000000180), &(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0)) r1 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f00000001c0)) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="160000000a008475f66d1fd96a6fa36029170000000000000000000000000000"], 0x14}}, 0x0) 23:36:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x20000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:16 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) [ 1110.903695] binder_alloc: binder_alloc_mmap_handler: 2024 20ffd000-20ffe000 already mapped failed -16 [ 1110.949663] binder: BINDER_SET_CONTEXT_MGR already set [ 1110.964184] binder: 2024:2029 ioctl 40046207 0 returned -16 [ 1110.994326] binder: release 2024:2029 transaction 1281 out, still active [ 1111.003157] binder: undelivered TRANSACTION_COMPLETE [ 1111.017230] binder: send failed reply for transaction 1281, target dead 23:36:17 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) 23:36:17 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:17 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x300000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:17 executing program 5: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)='X', 0x1, 0xfffffffffffffffe) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f8be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c217", 0xc0) r3 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f00000000c0), 0x0, r2) syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x1, 0x80000) keyctl$dh_compute(0x17, &(0x7f0000000080)={r3, r0, r3}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) close(r1) 23:36:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x3f000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:17 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x900}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) [ 1111.537706] binder_alloc: binder_alloc_mmap_handler: 2036 20ffd000-20ffe000 already mapped failed -16 23:36:17 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) [ 1111.593050] binder: BINDER_SET_CONTEXT_MGR already set 23:36:17 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0xfdfdffff}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1111.616275] binder: 2036:2039 ioctl 40046207 0 returned -16 [ 1111.617122] binder: send failed reply for transaction 1285 to 2036:2039 [ 1111.629465] binder: undelivered TRANSACTION_COMPLETE [ 1111.643143] binder: undelivered TRANSACTION_ERROR: 29189 23:36:17 executing program 5: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)='X', 0x1, 0xfffffffffffffffe) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f8be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c217", 0xc0) r3 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f00000000c0), 0x0, r2) syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x1, 0x80000) keyctl$dh_compute(0x17, &(0x7f0000000080)={r3, r0, r3}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) close(r1) 23:36:17 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) [ 1111.818027] binder_alloc: binder_alloc_mmap_handler: 2163 20ffd000-20ffe000 already mapped failed -16 [ 1111.839927] binder: BINDER_SET_CONTEXT_MGR already set 23:36:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000001480)={0x7, 0x0, [{0xd000, 0x1e, &(0x7f0000000080)=""/30}, {0x0, 0xaa, &(0x7f00000001c0)=""/170}, {0x4000, 0x5a, &(0x7f0000000280)=""/90}, {0xd000, 0x95, &(0x7f0000000300)=""/149}, {0x3004, 0x1000, &(0x7f00000003c0)=""/4096}, {0x5000, 0x9b, &(0x7f00000013c0)=""/155}, {0x6000, 0x4, &(0x7f0000000140)=""/4}]}) r2 = eventfd2(0x6, 0x0) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000180)=r2) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f00000000c0)) utime(&(0x7f0000001580)='./file0\x00', &(0x7f00000015c0)={0x1ff, 0x7}) 23:36:17 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfc000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1111.868076] binder: 2163:2166 ioctl 40046207 0 returned -16 [ 1111.897919] binder: release 2163:2166 transaction 1289 out, still active [ 1111.910468] binder: undelivered TRANSACTION_COMPLETE 23:36:17 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) [ 1111.937290] binder: send failed reply for transaction 1289, target dead 23:36:18 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0xfffffdfd}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:18 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:18 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xa00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:18 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) 23:36:18 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x400000000000000, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000200000002001000e000000100002800000000000800120002000200000000007d220000180000000303000000000300000000000000001f03000000160000000301000000000000000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000000)={'batadv0\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x16}}}) [ 1112.467519] binder_alloc: binder_alloc_mmap_handler: 2190 20ffd000-20ffe000 already mapped failed -16 [ 1112.496634] binder: BINDER_SET_CONTEXT_MGR already set [ 1112.528256] binder: 2190:2192 ioctl 40046207 0 returned -16 [ 1112.562853] binder: release 2190:2192 transaction 1293 out, still active 23:36:18 executing program 2: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r0}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) [ 1112.574606] binder: undelivered TRANSACTION_COMPLETE 23:36:18 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfec00000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x100000000000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1112.601444] binder: send failed reply for transaction 1293, target dead 23:36:18 executing program 2: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r0}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) [ 1112.703810] binder_alloc: binder_alloc_mmap_handler: 2214 20ffd000-20ffe000 already mapped failed -16 [ 1112.738951] binder: BINDER_SET_CONTEXT_MGR already set 23:36:18 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x400000000000000, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000200000002001000e000000100002800000000000800120002000200000000007d220000180000000303000000000300000000000000001f03000000160000000301000000000000000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000000)={'batadv0\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x16}}}) [ 1112.757817] binder: 2214:2216 ioctl 40046207 0 returned -16 [ 1112.769169] binder: release 2214:2216 transaction 1296 out, still active [ 1112.787999] binder: undelivered TRANSACTION_COMPLETE 23:36:18 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1112.810600] binder: send failed reply for transaction 1296, target dead 23:36:19 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x900000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x200000000000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:19 executing program 2: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r0}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) [ 1113.374702] binder_alloc: binder_alloc_mmap_handler: 2234 20ffd000-20ffe000 already mapped failed -16 [ 1113.400186] binder: BINDER_SET_CONTEXT_MGR already set [ 1113.408259] binder: 2234:2235 ioctl 40046207 0 returned -16 [ 1113.430148] binder: release 2234:2235 transaction 1300 out, still active [ 1113.436997] binder: undelivered TRANSACTION_COMPLETE [ 1113.437226] binder_alloc: 2234: binder_alloc_buf, no vma [ 1113.445618] binder: send failed reply for transaction 1300, target dead [ 1113.454759] binder: 2234:2237 transaction failed 29189/-3, size 24-8 line 3035 [ 1113.476607] binder: undelivered TRANSACTION_ERROR: 29189 23:36:19 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:19 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x8080, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000340), &(0x7f0000000380)=0x4) openat$uhid(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/uhid\x00', 0x802, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000140)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@initdev}}, &(0x7f0000000240)=0xe8) r4 = getegid() write$FUSE_ENTRY(r2, &(0x7f0000000280)={0x90, 0xfffffffffffffffe, 0x5, {0x1, 0x2, 0x6, 0x800, 0x0, 0x6, {0x2, 0x6, 0xd, 0x3f, 0x9, 0x27, 0x8, 0x1f, 0x2, 0x7, 0xff, r3, r4, 0x8000, 0x2}}}, 0x90) bind$bt_hci(r0, &(0x7f00000000c0), 0xfffffffffffffde7) r5 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x4a5, 0x101000) ioctl$sock_ax25_SIOCDELRT(r5, 0x890c, &(0x7f0000000040)={@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x3, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null]}) ioctl$sock_SIOCGIFINDEX(r0, 0x400448e7, 0x0) 23:36:19 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:19 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x1200000000000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:19 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1113.705082] binder_alloc: binder_alloc_mmap_handler: 2244 20ffd000-20ffe000 already mapped failed -16 23:36:19 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:19 executing program 5: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xa00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) [ 1113.749181] binder: BINDER_SET_CONTEXT_MGR already set [ 1113.768000] binder: 2244:2248 ioctl 40046207 0 returned -16 23:36:19 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1113.808869] binder: release 2244:2248 transaction 1305 out, still active [ 1113.820366] binder: send failed reply for transaction 1305, target dead 23:36:20 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xa00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x1400000000000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:20 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1114.481071] binder_alloc: binder_alloc_mmap_handler: 2378 20ffd000-20ffe000 already mapped failed -16 [ 1114.527028] binder: BINDER_SET_CONTEXT_MGR already set [ 1114.544078] binder: 2378:2379 ioctl 40046207 0 returned -16 [ 1114.566712] binder_alloc: 2378: binder_alloc_buf, no vma [ 1114.577305] binder: 2378:2379 transaction failed 29189/-3, size 24-8 line 3035 [ 1114.588233] binder: undelivered TRANSACTION_ERROR: 29189 23:36:20 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x4000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:20 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:20 executing program 5: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xa00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:20 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x2000000000000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:20 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:20 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1114.802902] binder_alloc: binder_alloc_mmap_handler: 2394 20ffd000-20ffe000 already mapped failed -16 [ 1114.831076] binder: BINDER_SET_CONTEXT_MGR already set [ 1114.840534] binder: 2394:2402 ioctl 40046207 0 returned -16 23:36:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x3f00000000000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1114.876993] binder: send failed reply for transaction 1314 to 2394:2396 [ 1114.890280] binder_release_work: 2 callbacks suppressed [ 1114.890285] binder: undelivered TRANSACTION_COMPLETE [ 1114.945250] binder: undelivered TRANSACTION_ERROR: 29189 23:36:20 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1114.995953] binder_alloc: binder_alloc_mmap_handler: 2508 20ffd000-20ffe000 already mapped failed -16 [ 1115.030913] binder: BINDER_SET_CONTEXT_MGR already set [ 1115.050924] binder: 2508:2524 ioctl 40046207 0 returned -16 [ 1115.059328] binder_thread_release: 1 callbacks suppressed [ 1115.059338] binder: release 2508:2524 transaction 1317 out, still active [ 1115.089256] binder: undelivered TRANSACTION_COMPLETE [ 1115.108402] binder_send_failed_reply: 1 callbacks suppressed [ 1115.108408] binder: send failed reply for transaction 1317, target dead 23:36:21 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:21 executing program 5: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xa00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:21 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:21 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0x8000000000000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:21 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) 23:36:21 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4e84}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x8) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xfffffffffffffffc}) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) [ 1115.893930] binder_alloc: binder_alloc_mmap_handler: 2647 20ffd000-20ffe000 already mapped failed -16 [ 1115.935071] binder: BINDER_SET_CONTEXT_MGR already set 23:36:21 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) 23:36:21 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1115.963575] binder: 2647:2653 ioctl 40046207 0 returned -16 [ 1115.977788] binder: release 2647:2653 transaction 1321 out, still active [ 1115.987079] binder: undelivered TRANSACTION_COMPLETE 23:36:21 executing program 5: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, 0xee01, r1) setfsuid(r1) [ 1116.008588] binder: send failed reply for transaction 1321, target dead 23:36:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0xfdfdffff00000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1116.134193] binder: BINDER_SET_CONTEXT_MGR already set [ 1116.149388] binder: 2684:2686 ioctl 40046207 0 returned -16 [ 1116.163491] binder: release 2684:2686 transaction 1325 out, still active [ 1116.171912] binder: undelivered TRANSACTION_COMPLETE 23:36:22 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:22 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) 23:36:22 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x2) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x1a, 0x4) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000040)=0x80000000014, 0x4) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0x0) keyctl$update(0x2, r1, &(0x7f00000001c0)="cd26f20238e1413aa67ea1b24cc8acfa8fe855f40a8376d95ec6bca9e8a4e659f47d17fd980d2064c22f2ace7d6ec929b20c62bef52853de40d4fd6374a1c10f4d7e9a085c54b9e106fd6cb66f8e00c6cb76d584304fe960ad78b72203aad6f0f84beee15a46a0ebece7fdd08deb43e41ce6b79c65d80d13555d65b5", 0x7c) keyctl$get_security(0x11, r1, &(0x7f0000000240)=""/120, 0x78) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000080)={'nr0\x00', 0x7ff}) [ 1116.221697] binder: send failed reply for transaction 1325, target dead 23:36:22 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xc702}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:22 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85, 0x0, 0x0, 0xffffffff00000000}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:22 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x4000000000c) writev(r0, &(0x7f0000000140)=[{&(0x7f00000000c0)="1f00000002031900000007000000068100023b0509000100010100ff3ffe58", 0x1f}], 0x1) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000180)="dd94192d55de3463d1fcd6f791f751e629a794a76d89337eb266a38b962e417f9358ec95874ad7150c415ea0d03c9e65998ea02bbf445f86e1f82584d8876d7ccaaac6d1dfd1fbdb90991500d4e9e74823096933a8a39ad3fc07ae0c76c2cd6dc86a17e4ac33", 0x66}], 0x105f) 23:36:22 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) 23:36:22 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) 23:36:22 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_yield() r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/current\x00', 0x2, 0x0) sendfile(r0, r0, 0x0, 0x7fffffff) [ 1116.958562] binder_alloc_mmap_handler: 1 callbacks suppressed [ 1116.958581] binder_alloc: binder_alloc_mmap_handler: 2704 20ffd000-20ffe000 already mapped failed -16 [ 1116.980591] binder: BINDER_SET_CONTEXT_MGR already set [ 1116.985890] binder: 2704:2714 ioctl 40046207 0 returned -16 23:36:22 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1117.035962] binder: release 2704:2708 transaction 1329 out, still active [ 1117.042966] binder_alloc: 2704: binder_alloc_buf, no vma [ 1117.048916] binder: 2704:2708 transaction failed 29189/-3, size 24-8 line 3035 [ 1117.057144] binder: undelivered TRANSACTION_COMPLETE 23:36:23 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) [ 1117.080236] binder: send failed reply for transaction 1329, target dead [ 1117.091715] binder: undelivered TRANSACTION_ERROR: 29189 23:36:23 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xa702000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x2]}}], 0x0, 0x0, 0x0}) 23:36:23 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x5) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e0000002b00812de45ae087185082cf0124b0eba06ec4000b00000000000014000000000000000051894dd65b2f", 0x2e}], 0x1}, 0x0) r2 = accept4(r0, &(0x7f0000000000)=@pptp={0x18, 0x2, {0x0, @broadcast}}, &(0x7f0000000080)=0x80, 0x80800) connect$unix(r2, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e21}, 0x6e) [ 1117.249330] binder: 2737:2738 got transaction with invalid offset (2, min 0 max 24) or object. [ 1117.300158] binder: 2737:2738 transaction failed 29201/-22, size 24-8 line 3097 [ 1117.331590] binder_alloc: binder_alloc_mmap_handler: 2737 20ffd000-20ffe000 already mapped failed -16 [ 1117.380133] binder: BINDER_SET_CONTEXT_MGR already set [ 1117.386076] binder: undelivered TRANSACTION_ERROR: 29201 [ 1117.392623] binder: 2737:2738 ioctl 40046207 0 returned -16 23:36:23 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x400000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:23 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:23 executing program 5: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="a2aaaa041b6100730000000000d304ff25000c0000000000000000000039a7710e2dcba9dc0000000053eef28c6d"], 0x0) 23:36:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x12]}}], 0x0, 0x0, 0x0}) 23:36:23 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1117.620390] QAT: Invalid ioctl [ 1117.626206] binder: 2751:2752 got transaction with invalid offset (18, min 0 max 24) or object. [ 1117.636109] QAT: Invalid ioctl [ 1117.650323] binder: 2751:2752 transaction failed 29201/-22, size 24-8 line 3097 23:36:23 executing program 5: r0 = syz_open_dev$swradio(&(0x7f00000001c0)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_ASSIGN_SET_INTX_MASK(0xffffffffffffffff, 0x4040aea4, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}}) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000000), 0x0) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000600), 0x1000) semctl$SEM_STAT(0x0, 0x0, 0x12, &(0x7f0000000340)=""/113) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={&(0x7f0000000000)={0x10, 0xa00}, 0xc, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) write$P9_RLINK(0xffffffffffffffff, &(0x7f0000000080)={0xfe08}, 0x351b21c22502589) ioctl$PPPIOCSFLAGS(0xffffffffffffffff, 0x40047459, 0x0) pipe(0x0) 23:36:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1117.682611] binder_alloc: binder_alloc_mmap_handler: 2751 20ffd000-20ffe000 already mapped failed -16 [ 1117.721943] binder: undelivered TRANSACTION_ERROR: 29201 23:36:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x14]}}], 0x0, 0x0, 0x0}) [ 1117.885095] binder: 2775:2779 got transaction with invalid offset (20, min 0 max 24) or object. [ 1117.925764] binder: 2775:2779 transaction failed 29201/-22, size 24-8 line 3097 [ 1117.964003] binder_alloc: binder_alloc_mmap_handler: 2775 20ffd000-20ffe000 already mapped failed -16 [ 1118.009104] binder: BINDER_SET_CONTEXT_MGR already set [ 1118.038926] binder: 2775:2779 ioctl 40046207 0 returned -16 [ 1118.091234] binder: undelivered TRANSACTION_ERROR: 29201 23:36:24 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xffffffff00000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:24 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:24 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:24 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x1000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x1200]}}], 0x0, 0x0, 0x0}) 23:36:24 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:24 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec00000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:24 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) syz_open_dev$media(&(0x7f0000000240)='/dev/media#\x00', 0x1, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000100)={0xfffffffffffffff9, 0x3, 0x8, 0x887d, 0x1a, 0x5, 0x2ae5, 0x80, 0x10000, 0x2e, 0x8, 0x6}) socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x83, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000680)={0x0, 0x0}, &(0x7f00000006c0)=0xc) syz_mount_image$gfs2(&(0x7f0000000180)='gfs2\x00', &(0x7f0000000280)='./file0\x00', 0x4, 0x5, &(0x7f0000000600)=[{&(0x7f00000002c0)="86f78f", 0x3, 0x67b}, {&(0x7f0000000380)="ddb35b62e8b870cb2829ec8e4acfa1bf2a279bd12b928f90475a236bee776da18c518c984dac52b1efce6cd6c0d51fb15abe5d250d3271e544c1b73d3567bba757be03fa945d6cb20bf3e1ee3f6d8ee9a2dbb16c8a346f63b538ae856acf325a16da2ad726b5d87e777c433143c46deb1b601be3635a6ebc3b63e5db5260be5a513fe6ae1b8b0801af7637634371ca76ae8ac8a5f83e63a2c8a2129e52b64640062e0ecebea614ea432bb08da02933b208ce87593899e8b85e9f5cb94c275656ce71d60fbfcbb86b73f5f3", 0xcb, 0x9}, {&(0x7f0000000480)="a1e16fed2f5927d5078bb25d2770f667cceca09be2b25a35a549f2d29ac44268c1ae7fdfe1786ab28cae784ac8304d6d587aec5d48db6b028e7f9b6850e038e5fe97926e", 0x44}, {&(0x7f0000000300)="0632e2ff3631731dd4a91c83d0e93e758ece2a7dc1905500711e03a03a", 0x1d, 0xffffffffffff8000}, {&(0x7f0000000500)="f52ac713301c19d2a215240e9eb124e17c20331356acb34f446cb3493fe5b2babaecfc507fc1495ef22e2e087ac4052d01ad15f3fb56eea96077bebf0def9ceea4139a45361ab93d0d22f51474be37d96ff62ba5fe500b638ce8e5e2bc8e1b1c366fc3cae1901726e6fb4199e279330d271cbc438d2651f02310ea2b515de6c046c9d5db6c83f40c8f94e909412070c29ecadf78ac976b23ba3b2da9945b760124ec1a0eca0c2ef94aaaff4f287464b2dc15f2180dcf580cf54caec07a4960b6a5bfb9cfe868cbab4e9bb50de6fbd354c764c2481877f0f9", 0xd8, 0xf232}], 0x8000, &(0x7f0000000700)={[{@spectator='spectator'}, {@noacl='noacl'}, {@noacl='noacl'}, {@noquota='noquota'}, {@suiddir='suiddir'}], [{@euid_gt={'euid>', r4}}, {@measure='measure'}, {@permit_directio='permit_directio'}, {@obj_type={'obj_type', 0x3d, '/dev/sequencer2\x00'}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}]}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$KVM_IOEVENTFD(r0, 0x4040ae79, &(0x7f0000000080)={0x10000, &(0x7f0000000040), 0x2, r2, 0x8}) 23:36:24 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1118.725849] binder: 2899:2905 got transaction with invalid offset (4608, min 0 max 24) or object. [ 1118.757029] binder: 2899:2905 transaction failed 29201/-22, size 24-8 line 3097 23:36:24 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1118.813017] binder_alloc: binder_alloc_mmap_handler: 2899 20ffd000-20ffe000 already mapped failed -16 [ 1118.838739] gfs2: invalid mount option: euid>00000000000000000000 [ 1118.858280] binder: BINDER_SET_CONTEXT_MGR already set [ 1118.881571] binder: 2899:2905 ioctl 40046207 0 returned -16 [ 1118.891622] gfs2: can't parse mount arguments 23:36:24 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1118.910542] binder: undelivered TRANSACTION_ERROR: 29201 23:36:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x1400]}}], 0x0, 0x0, 0x0}) 23:36:25 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:25 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) 23:36:25 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1119.152351] binder: 3033:3036 got transaction with invalid offset (5120, min 0 max 24) or object. [ 1119.269358] binder: 3033:3036 transaction failed 29201/-22, size 24-8 line 3097 [ 1119.346493] binder_alloc: binder_alloc_mmap_handler: 3033 20ffd000-20ffe000 already mapped failed -16 [ 1119.378568] binder: BINDER_SET_CONTEXT_MGR already set [ 1119.394166] binder: 3033:3036 ioctl 40046207 0 returned -16 [ 1119.400124] binder_alloc: 3033: binder_alloc_buf, no vma [ 1119.410153] binder: undelivered TRANSACTION_ERROR: 29201 [ 1119.410610] binder: 3033:3049 transaction failed 29189/-3, size 24-8 line 3035 [ 1119.431710] binder: undelivered TRANSACTION_ERROR: 29189 23:36:25 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x3000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:25 executing program 5: mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getdents64(r0, &(0x7f00000001c0)=""/108, 0x6c) r1 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x7, 0x2) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000100)=0xfffffffeffffffff, 0x4) 23:36:25 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:25 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) 23:36:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x2000]}}], 0x0, 0x0, 0x0}) [ 1119.838092] binder: 3055:3061 got transaction with invalid offset (8192, min 0 max 24) or object. 23:36:25 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) 23:36:25 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x400000, 0x0) ioctl$LOOP_CLR_FD(r3, 0x4c01) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000240)={0xffffffffffffff01}, 0x10) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x2, 0x2) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000480)={[], 0x0, 0x1a200}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0x40405515, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 'y\x14\bK\x16^\x9e\xc5/\x15\x95\x13)\xeb\xf0\x15\xf3{T\x1aWP\xac\xb2\xac\x95\xe9\xad9b\xaf5.S#\xb7y\x82\x1f\xa5^\xe1K\xf9'}) ioctl$KVM_GET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000000)) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000000100)) ioctl$KVM_RUN(r4, 0xae80, 0x0) 23:36:25 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1119.894796] binder: 3055:3061 transaction failed 29201/-22, size 24-8 line 3097 [ 1119.933618] binder_alloc: binder_alloc_mmap_handler: 3055 20ffd000-20ffe000 already mapped failed -16 [ 1119.951141] binder: BINDER_SET_CONTEXT_MGR already set [ 1119.962109] binder: 3055:3061 ioctl 40046207 0 returned -16 23:36:25 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1120.027999] binder: undelivered TRANSACTION_ERROR: 29201 23:36:26 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x3f00]}}], 0x0, 0x0, 0x0}) 23:36:26 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1120.202833] binder: 3098:3101 got transaction with invalid offset (16128, min 0 max 24) or object. [ 1120.234835] binder: 3098:3101 transaction failed 29201/-22, size 24-8 line 3097 [ 1120.285235] binder_alloc: binder_alloc_mmap_handler: 3098 20ffd000-20ffe000 already mapped failed -16 [ 1120.300243] binder: BINDER_SET_CONTEXT_MGR already set [ 1120.306909] binder: undelivered TRANSACTION_ERROR: 29201 [ 1120.313187] binder: 3098:3101 ioctl 40046207 0 returned -16 23:36:26 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:26 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000680)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x28) socket$kcm(0x29, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x10) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840)='/dev/vcs\x00', 0x0, 0x0) stat(&(0x7f0000002e80)='.\x00', &(0x7f0000002ec0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SIOCAX25GETUID(r2, 0x89e0, &(0x7f0000002f40)={0x3, @null, r3}) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e000000220005000000c187185095cf0400b0eba0b4d65c0000000051894d5d1dac000000000000000000000000", 0x2e}], 0x1}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x17, 0x0, 0x3, 0x3a3, 0x0, 0xffffffffffffff9c, 0x6}, 0x2c) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f00000002c0)={r4, 0x0, &(0x7f00000005c0)=""/68}, 0x18) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000004c0)={r0, 0x6, 0x1, 0x6226, &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x3}, 0x20) perf_event_open(&(0x7f0000000200)={0x4, 0x70, 0x1, 0x9, 0x290, 0x7f, 0x0, 0x100, 0x44000, 0x4, 0x7fffffff, 0x5, 0x3, 0x0, 0x1000, 0x2, 0x5, 0x2, 0x0, 0x7, 0xb, 0x6, 0x8, 0x0, 0x0, 0x6, 0xffffffffffffffc0, 0x27, 0x65, 0x74d6, 0x6, 0x0, 0x0, 0x0, 0x0, 0xbba, 0x8001, 0x40, 0x0, 0x100, 0x1, @perf_bp={0x0, 0x8}, 0x20000, 0x1, 0xe8e, 0x2, 0x2, 0x4, 0xfffffffffffffffc}, 0xffffffffffffffff, 0x3, r0, 0x1) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='cpuset.memory_pressure\x00', 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0xf, 0x0, 0x7, 0xaf9, 0xe, r5, 0xff}, 0x2c) write$cgroup_subtree(r5, &(0x7f00000006c0)=ANY=[@ANYBLOB="2c14cf7e45a5fcee93d329f81266c1c85ba77cf8f0ecba5fcf04a92c4d30a1498daf568a6d5c4f43c8a7fdc8bc2eaa3d99e82f58f04f92d24fd07938bbb71a0a451330c0771b261e5958de7466b852f9dab215c224bf6e4e72b5425e5f0941d182c1db77551d1e8f36a6615458bc357ae8d4645409d9d7e54679ab454e09192e1a89658dd6ebf9fd5f6210f9505312de29af080b81464b1cec078a44e9db39644f29dac8317ff60665dc9cfde49d3075f6855231e3a1582fae9e86bc56026114bcc0304840da7adf04db917f53304de105a9957035d1617aa110b828", @ANYRES16=r5, @ANYRESDEC=0x0], 0xf2) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f00000028c0)={{{@in=@broadcast, @in=@dev}}, {{@in=@multicast2}, 0x0, @in6}}, &(0x7f0000000580)=0xe8) syz_mount_image$msdos(&(0x7f0000000340)='msdos\x00', &(0x7f0000000380)='./file0\x00', 0xfffffffffffffeff, 0x1, &(0x7f0000002800)=[{&(0x7f0000002740)="3e7153897279b821635d1d1225810bc46462a65d25ec24d4e2b9477d3ac37e8cf4020c0b5a0a9a4fadfb79c67fa65bbef6413f55c98084ef2cb8355f9c10590924c93c0605befbff08e1542dc60eddaa72b9571b58380ab008d5690b3525bdb174ecd1cfeda442e1ccfc343814121246b32278102dfd1792c95284ba8bbbe6a75008f6910477342e70ffe199bc517af45d11296d472c2c6bb381d3161bc9ced0fa038cf77e", 0xa5, 0x6}], 0xc0404, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r5, 0x89e1, &(0x7f00000000c0)={r0}) socket$kcm(0x29, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000100)={r6, &(0x7f0000000880)="591dc99a6f813fa7547c48d482fa9f5d1d582ba1b4f302a46a26e4f6bb9f0c33d7b73b7ff34e2cdac440ef8d5ba4b98aaa9e1fb0afd91ea4388eef9eec98cdcb152259ebfd072a3085aedb4cd50d4519082c5c20afa7f904219e1adcf6a50e316d381ca114fec707a6d9d50092081d325a20452fae148922e5961116842f19f368b7275d29254f9abf3741256812239eb63d1d5f74f33faf7155cd530af2fa289d88781646f2361cc218643c4fcfb5783558cb3a3cd4e6a6becaa745e2d33c88e9a4bdc2c5ed", &(0x7f00000003c0)=""/74}, 0x18) 23:36:26 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x1000000]}}], 0x0, 0x0, 0x0}) 23:36:26 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:26 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) [ 1120.954819] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1120.992670] binder: 3115:3117 got transaction with invalid offset (16777216, min 0 max 24) or object. [ 1121.034556] binder: 3115:3117 transaction failed 29201/-22, size 24-8 line 3097 23:36:27 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1121.077552] binder_alloc: binder_alloc_mmap_handler: 3115 20ffd000-20ffe000 already mapped failed -16 23:36:27 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) [ 1121.222719] binder: undelivered TRANSACTION_ERROR: 29201 23:36:27 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x9}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x2000000]}}], 0x0, 0x0, 0x0}) 23:36:27 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:27 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r1}}, 0x48) [ 1121.432742] binder: 3278:3285 got transaction with invalid offset (33554432, min 0 max 24) or object. [ 1121.548200] binder_alloc: binder_alloc_mmap_handler: 3278 20ffd000-20ffe000 already mapped failed -16 [ 1121.587748] binder: BINDER_SET_CONTEXT_MGR already set [ 1121.617037] binder: 3278:3285 ioctl 40046207 0 returned -16 23:36:27 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x9000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:27 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:27 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x12000000]}}], 0x0, 0x0, 0x0}) 23:36:27 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setxattr$security_evm(&(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='security.evm\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="05020400000003d400e65f7661f25cfa3e9717b23f4106d5898721135160921b873d42aa6b88e9a377119c1f5af5347ec66c9ae28ddf6a8799d429999d61f39fd9291b1431793045b31a52153dd7addbb60c000008302d8ff99ee9126e477e02386083d12a78c03432c2dadb707c400636e11c6f2faad00d1fd155db2ca2e76e3429d64fca01a01f5b97a0f42f570375a524f2d5deeaa7dbb143a13d36d50a1eefa5ab02a42b2396f9a5b256bca790c34728511a7d19dabbe11bc97d8b400d20d3945e2efb5e49571a28c6a12cfb48de1e946a1e2ffbe46a42d7821be04a6a33695997024cf18716a116655ba0476c54c8f385cadc14cb53566cc0149580516e5235873a9d84b6df62ec73b603bffa364a5045ad87cf933b5e47773ca53348299ce1e47462a881aad1166b3abada97597fc236a5bbd675d0e1577ee9973949fb5a16ca68758b5958e3115b8d0afa72b5c50bab9e70ad70ba3ae3236654c8483b54"], 0x1, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x7a00000000000000, 0x0}) 23:36:28 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1122.050710] binder: 3303:3309 ioctl c018620c 200003c0 returned -1 [ 1122.057815] binder: 3302:3310 got transaction with invalid offset (301989888, min 0 max 24) or object. [ 1122.100288] binder_transaction: 1 callbacks suppressed [ 1122.100306] binder: 3302:3310 transaction failed 29201/-22, size 24-8 line 3097 23:36:28 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1122.158805] binder_alloc: binder_alloc_mmap_handler: 3302 20ffd000-20ffe000 already mapped failed -16 [ 1122.198585] binder: BINDER_SET_CONTEXT_MGR already set 23:36:28 executing program 5: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) ioctl$SIOCAX25GETINFOOLD(r0, 0x89e9, &(0x7f0000000180)) bind$alg(r2, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'salsa20\x00'}, 0x58) accept$ax25(r0, &(0x7f0000000000)={{0x3, @null}, [@default, @default, @default, @netrom, @bcast, @null, @bcast, @netrom]}, &(0x7f0000000080)=0x48) r3 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc04a892ea5400c20000000000", 0x10) readahead(r0, 0x40b06763, 0x7) splice(r3, 0x0, r1, 0x0, 0x20000008, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f00000000c0)={0x2, 0xffffffffffffffff, 0x6, 'queue0\x00', 0x8}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'\x00', r4}) write$P9_RSYMLINK(r2, &(0x7f00000001c0)={0x14, 0x11, 0x2, {0x80, 0x2, 0x5}}, 0x14) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x61, &(0x7f00000003c0)={'filter\x00', 0x4}, 0x68) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0x1, &(0x7f0000000240)=0x6, 0x4) 23:36:28 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:28 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xa}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) [ 1122.220856] binder: 3302:3310 ioctl 40046207 0 returned -16 [ 1122.235937] binder_release_work: 1 callbacks suppressed [ 1122.235944] binder: undelivered TRANSACTION_ERROR: 29201 23:36:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x14000000]}}], 0x0, 0x0, 0x0}) 23:36:28 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1122.394792] binder: 3446:3449 got transaction with invalid offset (335544320, min 0 max 24) or object. [ 1122.446507] binder: 3446:3449 transaction failed 29201/-22, size 24-8 line 3097 [ 1122.476495] binder_alloc: binder_alloc_mmap_handler: 3446 20ffd000-20ffe000 already mapped failed -16 [ 1122.524746] binder: BINDER_SET_CONTEXT_MGR already set [ 1122.537286] binder: 3446:3449 ioctl 40046207 0 returned -16 [ 1122.559480] binder_alloc: 3446: binder_alloc_buf, no vma [ 1122.559585] binder: undelivered TRANSACTION_ERROR: 29201 [ 1122.585422] binder: 3446:3456 transaction failed 29189/-3, size 24-8 line 3035 [ 1122.605552] binder: undelivered TRANSACTION_ERROR: 29189 23:36:28 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}}}, 0x48) 23:36:28 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x80000000, @mcast2, 0xe5b}, 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x22, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) 23:36:28 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:28 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xa000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x20000000]}}], 0x0, 0x0, 0x0}) [ 1122.832889] binder: 3461:3464 got transaction with invalid offset (536870912, min 0 max 24) or object. [ 1122.860192] binder: 3461:3464 transaction failed 29201/-22, size 24-8 line 3097 23:36:28 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}}}, 0x48) [ 1122.882394] binder_alloc: binder_alloc_mmap_handler: 3461 20ffd000-20ffe000 already mapped failed -16 23:36:28 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x3f000000]}}], 0x0, 0x0, 0x0}) [ 1122.965078] binder: undelivered TRANSACTION_ERROR: 29201 23:36:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000006c0)="0adc1f123c123f3188b070") socket$inet6(0xa, 0x2000000000000001, 0x8010000000000084) bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x10001) r1 = syz_open_dev$swradio(&(0x7f00000001c0)='/dev/swradio#\x00', 0x0, 0x2) ioctl$SIOCX25GFACILITIES(r1, 0x89e2, &(0x7f0000000180)) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x4}, 0x0) ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000900)=""/206) socket$inet6(0xa, 0x1, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140), 0x10) socket$xdp(0x2c, 0x3, 0x0) fsetxattr$trusted_overlay_nlink(r2, &(0x7f0000000400)='trusted.overlay.nlink\x00', &(0x7f0000000340)={'\x04\x00', 0x7fff}, 0x28, 0x1) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$VIDIOC_OVERLAY(r1, 0x4004560e, &(0x7f0000000040)=0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000440)={'vcan0\x00', 0x0}) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r5, 0x11b, 0x3, &(0x7f00000000c0)=0x2, 0xc6) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/17, 0x2000, 0x1000}, 0x48) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000700)=""/206) setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, &(0x7f00000008c0)=0x8, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r5, 0x11b, 0x6, &(0x7f00000002c0)=0x80, 0x4) bind$xdp(r5, &(0x7f0000000300)={0x2c, 0x0, r4}, 0x10) recvmsg(r1, &(0x7f0000000640)={&(0x7f0000000200)=@rc, 0x80, &(0x7f0000000500)=[{&(0x7f0000000280)=""/54, 0x36}, {&(0x7f0000000380)=""/86, 0x56}, {&(0x7f0000000480)=""/122, 0x7a}], 0x3, &(0x7f0000000540)=""/234, 0xea}, 0x2102) [ 1123.062254] binder: 3589:3590 got transaction with invalid offset (1056964608, min 0 max 24) or object. [ 1123.120253] binder: 3589:3590 transaction failed 29201/-22, size 24-8 line 3097 [ 1123.142406] binder_alloc: binder_alloc_mmap_handler: 3589 20ffd000-20ffe000 already mapped failed -16 [ 1123.171239] binder: BINDER_SET_CONTEXT_MGR already set [ 1123.194059] binder: 3589:3590 ioctl 40046207 0 returned -16 [ 1123.212542] binder: undelivered TRANSACTION_ERROR: 29201 23:36:29 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:29 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc000000, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:29 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}}}, 0x48) 23:36:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0xfdfdffff]}}], 0x0, 0x0, 0x0}) 23:36:29 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}}}, 0x48) 23:36:29 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1123.354793] binder: 3701:3702 got transaction with invalid offset (4261281791, min 0 max 24) or object. [ 1123.380259] binder: 3701:3702 transaction failed 29201/-22, size 24-8 line 3097 [ 1123.431151] binder_alloc: binder_alloc_mmap_handler: 3701 20ffd000-20ffe000 already mapped failed -16 [ 1123.471638] binder: BINDER_SET_CONTEXT_MGR already set [ 1123.476951] binder: 3701:3702 ioctl 40046207 0 returned -16 [ 1123.478148] binder: undelivered TRANSACTION_ERROR: 29201 23:36:29 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:29 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) semget(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000600), 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4000, 0x0, @mcast2, 0x2}, 0xfffffffffffffde5) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) open(&(0x7f0000000500)='./file0\x00', 0x410240, 0x166) r3 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000400)={0x1, @rand_addr=0x47fd, 0x404, 0x0, 'sh\x00', 0x21, 0xfffffffffffff0b5, 0x3}, 0x2c) ioctl$PERF_EVENT_IOC_RESET(r3, 0x2403, 0x91a2) r5 = syz_open_dev$vcsa(&(0x7f0000000340)='/dev/vcsa#\x00', 0xfffffffffffffffb, 0x123440) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r5, 0x28, 0x2, &(0x7f0000000540)=0x10005, 0x5) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000080)={0x0, 'veth0_to_bridge\x00'}, 0x18) sendfile(r3, r3, &(0x7f00000000c0), 0x6) ioctl(r4, 0x800000000008982, &(0x7f0000000080)) signalfd4(r5, &(0x7f00000003c0)={0x4}, 0x8, 0x80800) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f0000000480)={0x5}, 0x1) openat$ppp(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ppp\x00', 0x400, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000040)) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x101800, 0x0) r7 = socket(0x2000000000040, 0x7, 0x0) ioctl(r7, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") openat$urandom(0xffffffffffffff9c, &(0x7f0000000440)='/dev/urandom\x00', 0x80000, 0x0) r8 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00\x87\xec\x80\xa4\xb5.\x17\'\x8c\x97\xcd]K\xd01@\xea\x82\xb4x\xe9\xceNC\xe4\xd6\xf1\x89\x8bIY\xbbE\xaf\xb9\x8a\x12e\x1c\xc7;\x00\xb2\xfc\xff\x03\xfb\x19\xb7\xf3\xf1\xf333\xed\x05#4\x98\xfc>_\x98\x7f\x86%\xf7\x8e\x8a\x13@\xd7\xd3#\x98\xec>\xae\x1e];\x10\xea\x93\xff\xb0\xfe\xd1\xcfU\xce\x17\xbb\xc7\x92h\x1cb\r}r\x03\f\xbe\x10Nzj\x15l\xe3\x17\xab\x8b\x8fnX\xb1DT\xa9\xf7\xfd\x17{R2P\xa55\x94R\x92;y\x8e\xe8', 0x200002, 0x0) fchdir(r9) 23:36:29 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}}}, 0x48) 23:36:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0xfffffdfd]}}], 0x0, 0x0, 0x0}) 23:36:29 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec00000, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1123.952297] IPVS: set_ctl: invalid protocol: 1 0.0.71.253:1028 [ 1123.989130] binder: 3732:3739 got transaction with invalid offset (4294966781, min 0 max 24) or object. 23:36:29 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}}}, 0x48) [ 1124.022622] binder: 3732:3739 transaction failed 29201/-22, size 24-8 line 3097 [ 1124.049517] binder_alloc: binder_alloc_mmap_handler: 3732 20ffd000-20ffe000 already mapped failed -16 [ 1124.088716] binder: BINDER_SET_CONTEXT_MGR already set [ 1124.110129] binder: 3732:3739 ioctl 40046207 0 returned -16 [ 1124.129868] binder: undelivered TRANSACTION_ERROR: 29201 23:36:30 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x2a7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:30 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:30 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x100000000000000]}}], 0x0, 0x0, 0x0}) 23:36:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$dspn(&(0x7f0000006240)='/dev/dsp#\x00', 0x6, 0x4000) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000062c0)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r1, &(0x7f0000006400)={&(0x7f0000006280)={0x10, 0x0, 0x0, 0x22000000}, 0xc, &(0x7f00000063c0)={&(0x7f0000006300)={0xac, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3cbf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x80}, 0x20008010) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r3 = socket$inet(0x10, 0x3, 0x0) fcntl$F_SET_FILE_RW_HINT(r3, 0x40e, &(0x7f0000000000)=0x5) ioctl$void(r3, 0xc0045c79) readv(r3, &(0x7f0000001680)=[{&(0x7f00000002c0)=""/219, 0xdb}], 0x1) sendmsg(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000001c0)="24000000240007031dfffd946fa2830020200a0009000400001d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000003c0)={{{@in=@loopback, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@remote}}, &(0x7f0000000100)=0xe8) fstat(r3, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(r4, r5) 23:36:30 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1124.380622] binder: 3856:3861 got transaction with invalid offset (72057594037927936, min 0 max 24) or object. [ 1124.468247] binder: 3856:3861 transaction failed 29201/-22, size 24-8 line 3097 [ 1124.488068] binder_alloc: binder_alloc_mmap_handler: 3856 20ffd000-20ffe000 already mapped failed -16 [ 1124.533229] binder: BINDER_SET_CONTEXT_MGR already set [ 1124.558252] binder: 3856:3861 ioctl 40046207 0 returned -16 [ 1124.602848] binder: undelivered TRANSACTION_ERROR: 29201 [ 1124.603067] binder_alloc: 3856: binder_alloc_buf, no vma [ 1124.658950] binder: 3856:3861 transaction failed 29189/-3, size 24-8 line 3035 [ 1124.688797] binder: undelivered TRANSACTION_ERROR: 29189 23:36:30 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:30 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:30 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = socket$inet6(0xa, 0x2, 0x8) r2 = syz_open_dev$mouse(&(0x7f0000000140)='/dev/input/mouse#\x00', 0xfffffffffffffffc, 0x80000) getsockopt$llc_int(r2, 0x10c, 0x4, &(0x7f0000000180), &(0x7f00000001c0)=0x4) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e24}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) set_robust_list(&(0x7f0000000300)={&(0x7f0000000240)={&(0x7f0000000200)}, 0x29a, &(0x7f00000002c0)={&(0x7f0000000280)}}, 0x18) recvmmsg(r1, &(0x7f0000001dc0)=[{{&(0x7f0000000080)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, 0x0}}], 0x1, 0x0, 0x0) 23:36:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x200000000000000]}}], 0x0, 0x0, 0x0}) [ 1125.022283] binder: 3981:3986 got transaction with invalid offset (144115188075855872, min 0 max 24) or object. [ 1125.046032] binder: 3981:3986 transaction failed 29201/-22, size 24-8 line 3097 23:36:31 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1125.073290] binder_alloc: binder_alloc_mmap_handler: 3981 20ffd000-20ffe000 already mapped failed -16 [ 1125.113868] binder: BINDER_SET_CONTEXT_MGR already set [ 1125.136122] binder: undelivered TRANSACTION_ERROR: 29201 [ 1125.143502] binder: 3981:3995 ioctl 40046207 0 returned -16 23:36:31 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x300}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:31 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:31 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x1200000000000000]}}], 0x0, 0x0, 0x0}) 23:36:31 executing program 5: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x6, 0x2c00) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cpuacct.usage_all\x00', 0x0, 0x0) timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12}, &(0x7f0000044000)) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) r5 = syz_open_dev$mice(&(0x7f00000003c0)='/dev/input/mice\x00', 0x0, 0x40000) ioctl$UI_DEV_CREATE(r5, 0x5501) listen(r4, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000340)=0x0) ptrace$poke(0x5, r6, &(0x7f0000000380), 0x3) sendto$inet6(r3, 0x0, 0x0, 0x20000003, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x410) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000100), 0x28) sendto$inet6(r3, &(0x7f00000005c0), 0xc00500200000923d, 0x0, 0x0, 0x0) r7 = gettid() lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) r9 = getuid() mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x80, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYBLOB=',cachetag=/\\%nodev,,uid=', @ANYRESDEC=r8, @ANYBLOB="2c736d61636b6673736f6f743d2f6465762f736e642f70636d4323442370002c726f6f74636f6e746578743d73797361d6ee40fe3c646d5f752c6575e9643e75a32ee997af8deae35c6b0133ccc7193deff9745f7543da4704c995bb5a449711ac95c7a0bba9", @ANYRESDEC=r9, @ANYBLOB=',\x00']) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r7, 0x14) r10 = syz_genetlink_get_family_id$fou(&(0x7f0000000440)='fou\x00') sendmsg$FOU_CMD_GET(r0, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x14000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x44, r10, 0xd5eb607fd9d84a0a, 0x70bd28, 0x25dfdbfe, {}, [@FOU_ATTR_TYPE={0x8}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x32}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e23}, @FOU_ATTR_AF={0x8, 0x2, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x400c014) [ 1125.381071] binder: 4113:4117 got transaction with invalid offset (1297036692682702848, min 0 max 24) or object. [ 1125.395681] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 23:36:31 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0000000000000, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1125.432496] binder_alloc: binder_alloc_mmap_handler: 4113 20ffd000-20ffe000 already mapped failed -16 [ 1125.479654] binder: BINDER_SET_CONTEXT_MGR already set [ 1125.498247] binder: 4113:4117 ioctl 40046207 0 returned -16 23:36:31 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:31 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x1400000000000000]}}], 0x0, 0x0, 0x0}) 23:36:31 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xc7020000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:31 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.events\x00', 0x0, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x6) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000080)={@loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x1, 0x2, [@broadcast, @multicast2]}, 0x18) [ 1125.883581] binder: 4233:4238 got transaction with invalid offset (1441151880758558720, min 0 max 24) or object. 23:36:31 executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000640)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030303030303030303030303030306169ad1312c333322c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB="dc85ec77016e8ac30000aad0caf99c64367a836d0a3cbc80998aef487e9494c935d1e095baa16a9a1154f3a7d1420b329a509459b57620b27ec47f2bb1dee333db55c0e13da6f2f6eecece8889e04facb330470906167616b5d3402d5b256f0b520c10c96a407a91da44b5b83623ae73de30602ac4154125c6c29fa9ff5d9dcaf4ffffca40f4301048590eed515704e91d088ab9cf7bf58915c23c2d19", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="2800000004000000000000c4ffb747e7255a260000000100000000000032e09a37b7bc94208f2a0f"], 0x28) [ 1125.933528] binder_alloc: binder_alloc_mmap_handler: 4233 20ffd000-20ffe000 already mapped failed -16 [ 1125.955879] binder: BINDER_SET_CONTEXT_MGR already set [ 1125.973889] binder: 4233:4238 ioctl 40046207 0 returned -16 23:36:32 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x900}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:32 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:32 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x2000000000000000]}}], 0x0, 0x0, 0x0}) 23:36:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_FREQUENCY(r1, 0x402c5639, &(0x7f00000000c0)={0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x19000000]}) 23:36:32 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:32 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = accept4$inet(0xffffffffffffff9c, 0x0, &(0x7f0000000080), 0x80000) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f0000000180)={0x2, 0x1af, 0x7}, 0xc) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000280)="803f8e15d67d000019000300e60100006cff6169d0d8bfff2300000001e0ffffff3f000000400000800000005ebe5ae2fffeff53efead76c3aa948d9aef0981dddd72cee2036858aa3032b22b1679f7cb722f6cf31e100a259f3f35eb5db3b80538911b03bb0cfa3f08e54ff954aa01912ea7b5a00cb7201a059f4", 0x7b, 0x400}], 0x22, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vsock\x00', 0x4001, 0x0) ioctl$KVM_GET_PIT(r2, 0xc048ae65, &(0x7f0000000200)) [ 1126.349171] binder: 4258:4265 got transaction with invalid offset (2305843009213693952, min 0 max 24) or object. [ 1126.380949] binder: BINDER_SET_CONTEXT_MGR already set 23:36:32 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1126.396297] binder: 4258:4265 ioctl 40046207 0 returned -16 23:36:32 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x1000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x3f00000000000000]}}], 0x0, 0x0, 0x0}) 23:36:32 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:32 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1127.004147] binder: BINDER_SET_CONTEXT_MGR already set [ 1127.024665] binder_alloc: 4390: binder_alloc_buf, no vma [ 1127.040165] binder: 4390:4393 ioctl 40046207 0 returned -16 23:36:33 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xa00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:33 executing program 5: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000100)={0x30}, 0x30) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="3300000006000800000001ef5e00000000000a000000000000002f6465762fd74f9100169bd36375736500f6"], 0x2c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null-generic\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x80800) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)={0x0, 0x80000}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x4000, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={r2, 0x80000, r3}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000040)={r4, 0x80000}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) r5 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x80000000, 0x402) ioctl$INOTIFY_IOC_SETNEXTWD(r5, 0x40044900, 0x8) stat(0x0, 0x0) getgroups(0x0, 0x0) syz_init_net_socket$llc(0x1a, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet(0x2, 0x6000000000000001, 0x0) bind$inet(r6, &(0x7f0000deb000)={0x2, 0x4e23, @remote}, 0x10) sendto$inet(r6, 0x0, 0x0, 0x1, &(0x7f0000000040)={0x2, 0x404e23, @remote}, 0xffffffffffffff54) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x25, &(0x7f00000008c0)=0x7fe, 0x370) sendto$inet(r6, &(0x7f00000000c0)="8b", 0x1, 0x4000001, 0x0, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000080)='tunl0\x00\x00\x00\x00\x00\x00\x00\xe4\xa1\x00', 0x10) write(r6, &(0x7f0000000ec0)="89f9d765312b4001000000b0967bdae72ee5094371136a6477ba0a51a2969dbc2d4028ac7b5af67f178f9314ea2bb3ac1c442eaf749c21ae2af8e39a40c3dc032e6f8eb738786a79df71302ff3b5d42731597d995bed6103ff63b9a908bcc05e0400000092bdf4d3282f62d6928117f82c2dae48742dac857de846096e82c1a02e1edcadda721a3f8dc9a54da05d467ed35b6f931d8686986960e756048c61c2a2c374c318d21d7a7ef550779190066e82ea3f6724a9f61ff028ec7e8d7a04352e7a78f777a68b823abb646bdc55dbde285ce15bf45820f0ae20e4023f57c71f8b41e08eff14c3441485c6f54a30750c780852dad879d6d4be7243bd07f841f89009000000c23d6b4f70fe48b54577449cfcbc4d5dbefb8b465d45bc2d11afbe7bfbe6ca76ac259e634eebf8db694ff02fe2b4c80783b443ef68287e9cf7cbcc2ee196f10c4ffb3f59e4921e0f9f08cba9a2c56c49fa7465b4836da5b2d9b142763889caa718d8a4fcb2f3ef6dc6185708fb1e0f9081d29fb3defae8c525f07437c7835b4eac8f86e2a22a81eff4120340e4a379446aac45dbff791d147805cd2748d74b8996c9b51ec03b410ef8fe126117fbf106795bc1b25d8dd786b6496bd743b7c75c638b516214ff56ec99a9c0f2919fa781cd8b4f2f2e425a6780c630a05c8e60011bc8e10055a6b6b652e5a13c73fd96f79038a65d6991ac38899ab98486d92bbcffdcf39a08a248ae1045ff8c6123de2f15d9ac360a3497c07001a3a1936ff1c03194ace131d380f515629ff016bd890ff822704c0db8bc68efad2eace5466628e7d6c2f2b3043698c46fdd62588fc54b72a786af0d026353879892c58007f7988a3f2240a43303218cc1df27807bfbde117c505f060396850a82459830a89a6a8601ea2e47f2e41379d110b96576f8f7705bba7ec63d6b44ccf84073cf9bdcf1aee48cb60c2f6dd3e89f3626a5e23339ea99c918d76a43fecf7401f7550e8eaefa4d84f1143320599daf7699858b2bf408e9093aa91d6dd9ae39d8decf3f7a199b0c1918d47be3b7aeff9a8c10efabe787b43141e7abaa4317158864b0361568140ab79cade1223c3ef81da4c4eefdd5b21fcc1b87872fc3b346737105589b84ba9814679b7510ed9b4f290083ee634ae12243ccc63413d7bc35eee0d1a4bc9dd33c37f5130303edddfc2636ffbf1ee0febb953436710c2ed9bd001d2ebe878788ddf7f7ad55b7a8cbcb348e82cd65b59315858086606115d04a3cda0e4af2a703afe09e4afedf00d5fbb2284df9af1d1ec9f15356c58fdcde45fff250568347f3b0b49e11e44c0a4d98a1e3393ce5d76614990f23b2e146842b166fb070894c128f957b0cc7d80a16275efd15659e0f81990062ebfdf9454d12e63d1ce1dad7848fcbab642a0d62ebb17abc824883e4c6e1e81992f28f5bbd7b26e2645c7941b03dd2f27c29baa2412976a05fa13d8fc4d6bd152a8668d986a9cf605b8b4a61600481e01bdd74c96d73390518add968100ac742aaf5dd7eb4ccf0868ee3ef7f12c32298737dea65bd5d7161dd679b4dd6799aa086bf3b8c889780ac102b7b1ebcf2569dd77f201d74d94a61400ced9c613414012b451628a96e6cc8fe738e964940f7b753065677776f3b5398975aeac974fced560667cead03a8976eb4229ff4e1bca5588d5d544cbca8588215a2f5ef7a5fc1a07438d3a3e05d21eb30d46f1688543d4327d36e07635396eaab4e9bc862ee9c7fa24de38c5cbf8fa5afd024116bc84854d01072145ecc4bb415d94a333e0d91e9cf6fda5a2c244a585e3a32c95398f44800c578faf4a2ccc5979664db7a55aa5cc02789f84321ccaeed4f37dd48c8d1484ade0588fc4255ec8780534a693e2bfe88b622034552084492c6757429239bbe8dad8b904e58007639ca773344040a441dc0027a46c22198f3d0b0588e164881a9fc7a85a63c459b0d002e3d890edd250742d363e85250badb91a734759baf773c32b177d36eefb662be70", 0x595) sendto$inet(r6, &(0x7f00000003c0), 0xfffffdef, 0x5940, 0x0, 0x11000000) dup(r0) 23:36:33 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={0x0, r2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:33 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x8000000000000000]}}], 0x0, 0x0, 0x0}) [ 1127.279298] binder_transaction: 5 callbacks suppressed [ 1127.279313] binder: 4406:4410 transaction failed 29201/-22, size 24-8 line 3097 [ 1127.338251] binder_alloc_mmap_handler: 2 callbacks suppressed [ 1127.338268] binder_alloc: binder_alloc_mmap_handler: 4406 20ffd000-20ffe000 already mapped failed -16 23:36:33 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={0x0, r2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:33 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1127.414141] binder: BINDER_SET_CONTEXT_MGR already set [ 1127.433239] binder: 4406:4410 ioctl 40046207 0 returned -16 [ 1127.464562] binder_release_work: 5 callbacks suppressed [ 1127.464569] binder: undelivered TRANSACTION_ERROR: 29201 23:36:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0xfdfdffff00000000]}}], 0x0, 0x0, 0x0}) [ 1127.687314] binder_transaction: 2 callbacks suppressed [ 1127.687328] binder: 4430:4431 got transaction with invalid offset (-144678142324244480, min 0 max 24) or object. [ 1127.748616] binder: 4430:4431 transaction failed 29201/-22, size 24-8 line 3097 [ 1127.779898] binder_alloc: binder_alloc_mmap_handler: 4430 20ffd000-20ffe000 already mapped failed -16 [ 1127.807334] binder: BINDER_SET_CONTEXT_MGR already set [ 1127.825831] binder: 4430:4431 ioctl 40046207 0 returned -16 [ 1127.845237] binder: undelivered TRANSACTION_ERROR: 29201 23:36:33 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x40000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:33 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:33 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={0x0, r2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:33 executing program 5: symlink(&(0x7f0000000140)='..', &(0x7f00000000c0)='./file0\x00') socket$netlink(0x10, 0x3, 0xd) mount$bpf(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080)='bpf\x00', 0x0, 0x0) umount2(&(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci\x00', 0x80001, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000180)={0x7, 0x7b, 0x1}, 0x7) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)={&(0x7f00000001c0)='./file1\x00', 0x0, 0x10}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e21, @remote}}, [0xa6c, 0x80000001, 0x1, 0x7, 0xf9, 0x0, 0x7fffffff, 0x0, 0x0, 0x2, 0x3ff, 0x77, 0x4, 0x9, 0x3c05dc9]}, &(0x7f0000000440)=0x100) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000240)={r1, 0x38}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000002c0)=@assoc_value={r2, 0x3}, &(0x7f0000000300)=0x8) 23:36:34 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0xffffffff00000000]}}], 0x0, 0x0, 0x0}) 23:36:34 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:34 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0), r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004880)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(r1, 0xc0845657, &(0x7f0000000000)={0x0, @bt={0x200, 0x80000001, 0x0, 0x2, 0x9, 0x5, 0xed74, 0x8, 0xffffffffffffff63, 0xfac0, 0x6, 0xb00, 0xfffffffffffffffa, 0x5, 0x0, 0x1}}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000180)={0x0, 0x0, 0x4}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x40c80, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x1, 0x0) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r2, 0xc0905664, &(0x7f00000001c0)={0x0, 0x0, [], @raw_data=[0x0, 0x5, 0x8, 0x9, 0xb547, 0x2, 0x2, 0xfffffffffffffffa, 0x6, 0x0, 0x1000, 0x7, 0x80, 0x0, 0x45, 0x1000, 0x3f, 0x100000001, 0xbc0, 0x4, 0x20, 0x8, 0x3, 0x2, 0xdbcf, 0x1, 0x1, 0x1, 0x8, 0x3f, 0x8001, 0x200]}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0}) [ 1128.252210] binder: 4552:4554 got transaction with invalid offset (-4294967296, min 0 max 24) or object. [ 1128.301065] binder: 4552:4554 transaction failed 29201/-22, size 24-8 line 3097 23:36:34 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0), r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:34 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc000000, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1128.356743] binder_alloc: binder_alloc_mmap_handler: 4552 20ffd000-20ffe000 already mapped failed -16 [ 1128.401173] binder: BINDER_SET_CONTEXT_MGR already set [ 1128.447110] binder: 4552:4554 ioctl 40046207 0 returned -16 [ 1128.532664] binder: undelivered TRANSACTION_ERROR: 29201 23:36:34 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0), r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:34 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x100000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:34 executing program 5: r0 = syz_open_dev$vbi(&(0x7f0000001280)='/dev/vbi#\x00', 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000140)={0x18, 0x0, {0x6, @local, 'bridge0\x00'}}, 0x1e) sendmmsg(r1, &(0x7f000000d180), 0x4000000000000eb, 0x6) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x10) r2 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r2, 0x107, 0x0, 0x0, 0x6d) bind$packet(r2, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r2, 0x107, 0x5, &(0x7f0000001000), 0x35e) ioctl$VIDIOC_CROPCAP(0xffffffffffffffff, 0xc02c563a, &(0x7f0000000100)={0x0, {0x0, 0x8, 0x8f}}) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x40) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e24, @rand_addr=0x10001}}, 0x2, 0x7}, &(0x7f00000000c0)=0x90) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000180)={r4, 0x5, 0x30, 0xffffffffffff0000, 0x6}, &(0x7f00000001c0)=0x18) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000440), &(0x7f0000000540)=0xc) close(0xffffffffffffffff) 23:36:34 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x2, 0x0, 0x0}) [ 1129.028691] binder: 4687:4688 ioctl c0306201 200003c0 returned -14 [ 1129.069807] binder_alloc: binder_alloc_mmap_handler: 4687 20ffd000-20ffe000 already mapped failed -16 [ 1129.106925] binder: BINDER_SET_CONTEXT_MGR already set [ 1129.130493] binder: 4687:4688 ioctl 40046207 0 returned -16 [ 1129.163140] binder: release 4687:4688 transaction 1432 out, still active [ 1129.180783] binder: undelivered TRANSACTION_COMPLETE [ 1129.205364] binder: send failed reply for transaction 1432, target dead 23:36:35 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x4000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:35 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:35 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec00000, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x12, 0x0, 0x0}) 23:36:35 executing program 5: pipe(&(0x7f0000002c00)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet(0x2, 0x3, 0x7f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_int(r2, 0x0, 0x3, 0x0, 0x0) r3 = getpgrp(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000000)={{{@in6=@empty, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@remote}}, &(0x7f0000000100)=0xe8) write(r0, &(0x7f0000000180)="38b5e1ba0877e684de23f1623c824c6c4737357975f9310b48fef01f2b5d113996cfbc236ab998679fdf3eb4fba87408ae5a1da424bcb8e5a2e375b72f6a2a000d274afa48bd62dd2b8317865f65ef08e29f15a3a8d25ec8a223c8e44c706c0fd9e3d32c4f0702b80c56d5c471b0d41b27a8f8ecb9f0850de250866d6eea41241f3fcddda732008df351f837338888cd0a8dded75202a8d17fe65fca48cdaca4c020056b66bd76b3398021b4814dada6f5f6513e1c61dd49d781c3273dbb64b8a762d42e2ac2a75d964722cb677681af94c4da53577453bd3c6ff98f55c6463ca63090df58e85091e4", 0xe9) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000140)={0x2, 0x80, r3, 0x0, r4, 0x0, 0x800000000000000, 0xffffffff7fffffff}) 23:36:35 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1129.382475] binder: 4806:4807 ioctl c0306201 200003c0 returned -14 [ 1129.414746] binder_alloc: binder_alloc_mmap_handler: 4806 20ffd000-20ffe000 already mapped failed -16 23:36:35 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1129.453613] binder: BINDER_SET_CONTEXT_MGR already set [ 1129.473151] binder: 4806:4807 ioctl 40046207 0 returned -16 [ 1129.495691] binder: release 4806:4807 transaction 1435 out, still active [ 1129.505433] binder: undelivered TRANSACTION_COMPLETE [ 1129.535744] binder: send failed reply for transaction 1435, target dead 23:36:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x14, 0x0, 0x0}) [ 1129.644026] binder: 4936:4937 ioctl c0306201 200003c0 returned -14 [ 1129.654097] binder_alloc: binder_alloc_mmap_handler: 4936 20ffd000-20ffe000 already mapped failed -16 [ 1129.679127] binder: BINDER_SET_CONTEXT_MGR already set [ 1129.684679] binder: 4936:4937 ioctl 40046207 0 returned -16 [ 1129.685401] binder: release 4936:4937 transaction 1439 out, still active [ 1129.703584] binder: undelivered TRANSACTION_COMPLETE [ 1129.717616] binder: send failed reply for transaction 1439, target dead 23:36:35 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x300000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:35 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:35 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f000033efc8)={0x0, 0x0, &(0x7f0000aa8000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0209e3000200000023000000ff070000ec8512ccc2f69b9add31b5018c295744b94f5a70747613b21ac0650b9d27afc38b394fae71a1d93ac941448f9fab46f9375bcca70fd9a6ebd180788b42c82b8991d15c04b1a817fda0c6dc0fcf38648ecde447b41203cf85000000000000000000000000000000933f94d555018d98bff49ec00905654cb32747a1bd5c9c05a4cf1a24417b5f799ba99f018455e1c6c3b01da948f22405a4b5eee0a57a8f1d102f35b2405733138df08341c7fb402a9fa6f9e9b778ce1a17554d730a610438daa36864621b676ef51c3c06ed485b8c335228993d867c513e78194f27c1b8b353f3de04c89c1d185c911c53f3fbd663499e0ad07d394bb340793c04f848e1a6965363d5544903e10de1b9af577c3ef9a783ad7dd528b1ae72d511b4ea92f52565d80d4cbfdbeb3856cbeddb28119ef18291d40c8d21948288c9e21dd2555f9cb2643a285f585563ddfc80eda871768a33e856e6a20bf2d46dcb81b738"], 0x12}}, 0x0) r1 = getgid() stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setregid(r1, r2) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r3, 0x84, 0x21, &(0x7f0000000040), &(0x7f0000000280)=0x12a) 23:36:35 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:36 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x1200, 0x0, 0x0}) 23:36:36 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:36 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:36 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$9p(0xffffffffffffffff, 0x0, 0x0) ioctl$RTC_EPOCH_READ(r0, 0xc0287c02, &(0x7f0000000040)) 23:36:36 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1130.346981] binder: 4959:4963 ioctl c0306201 200003c0 returned -14 [ 1130.373523] binder_alloc: binder_alloc_mmap_handler: 4959 20ffd000-20ffe000 already mapped failed -16 23:36:36 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0000000000000, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:36 executing program 5: keyctl$negate(0xd, 0x0, 0x2, 0x0) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r0, 0x80dc5521, &(0x7f0000000040)=""/243) perf_event_open(&(0x7f0000000a00)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = gettid() madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x2000000000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) process_vm_writev(r1, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) [ 1130.433720] binder: release 4959:4963 transaction 1443 out, still active [ 1130.466403] binder: undelivered TRANSACTION_COMPLETE [ 1130.480322] binder: send failed reply for transaction 1443, target dead 23:36:36 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x1400, 0x0, 0x0}) 23:36:36 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:36 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1131.010340] binder: 5089:5091 ioctl c0306201 200003c0 returned -14 [ 1131.040515] binder_alloc: binder_alloc_mmap_handler: 5089 20ffd000-20ffe000 already mapped failed -16 [ 1131.075107] binder: BINDER_SET_CONTEXT_MGR already set [ 1131.090503] binder: release 5089:5091 transaction 1447 out, still active [ 1131.097414] binder: undelivered TRANSACTION_COMPLETE [ 1131.103724] binder: 5089:5101 ioctl 40046207 0 returned -16 [ 1131.110506] binder: send failed reply for transaction 1447, target dead 23:36:37 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xa702}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:37 executing program 5: r0 = socket(0x5, 0x80001, 0x4800000000000000) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) r1 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r1, 0xc0305710, &(0x7f0000000080)={0x0, 0x3, 0x2, 0x1}) bind$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x7, 0x101, 0xb322, 0x1}, 0x10) munmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000) ioctl$NBD_SET_SOCK(r1, 0xab00, r1) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000100)={0x5, [0x1, 0x9, 0x8, 0xfffffffffffffff9, 0x1]}, &(0x7f0000000140)=0xe) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000180)='trusted.overlay.opaque\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) ioctl$CAPI_GET_MANUFACTURER(r1, 0xc0044306, &(0x7f0000000200)=0x5) readv(r0, &(0x7f0000000340)=[{&(0x7f0000000240)=""/133, 0x85}, {&(0x7f0000000300)=""/39, 0x27}], 0x2) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000380)='trusted.overlay.nlink\x00', &(0x7f00000003c0)={'L+'}, 0x28, 0x1) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup/syz1\x00', 0x200002, 0x0) lsetxattr$security_smack_entry(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='security.SMACK64EXEC\x00', &(0x7f00000004c0)='ppp0userbdevnodev\x00', 0x12, 0x3) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000500)={0x10001, 0x9b1}, 0x2) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f00000005c0)={@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x4, 0x3, 0x1, 0x2, {0xa, 0x4e24, 0x2, @local, 0x7fff}}}, {&(0x7f0000000540)}, &(0x7f0000000580), 0x41}, 0xa0) write$FUSE_NOTIFY_POLL(r1, &(0x7f0000000680)={0x18, 0x1, 0x0, {0x1ff}}, 0x18) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r0, 0x12, 0x2, &(0x7f00000006c0)=""/103, &(0x7f0000000740)=0x67) write$cgroup_type(r1, &(0x7f0000000780)='threaded\x00', 0x9) ioctl$FS_IOC_GETFSLABEL(r2, 0x81009431, &(0x7f00000007c0)) ioctl$TCFLSH(r1, 0x540b, 0x81) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000940)={{{@in6=@dev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000000a40)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@mcast2}}, &(0x7f0000000b80)=0xe8) mount$9p_fd(0x0, &(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x210040, &(0x7f0000000bc0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_L='version=9p2000.L'}, {@dfltuid={'dfltuid', 0x3d, r3}}, {@access_client='access=client'}, {@fscache='fscache'}, {@access_client='access=client'}, {@access_uid={'access', 0x3d, r4}}], [{@appraise='appraise'}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}]}}) r5 = add_key$keyring(&(0x7f0000000cc0)='keyring\x00', &(0x7f0000000d00)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$set_timeout(0xf, r5, 0x6) timer_create(0x7, &(0x7f0000001d80)={0x0, 0x2d, 0x4, @thr={&(0x7f0000000d40)="97688f4477a8be16fbaf423ebdf9d96a6fc8db01a1ed00021a86fe6198f40b40a6c490c65e27bd914e1202a44d7253a9859839c87820e5e09df5d9c647f56eda", &(0x7f0000000d80)="5a90ebab79af0fd63d5b7d06b3cc402aba6644b19603cdae990e818138e8b19771c3ed529d322707cc21d6670e763c09270ed8c8cc9f089e016f427c7c40d40e2c23b7f5478704e03c9b12210b7245d3a96fc86b37227b5249e743b9bd2c1a36fe48ad872725d1bb2cdb2b988575a0eb81e4f27302a1a28cbdda006e391d54d849c980539048f5ff127d8560e6c41e31b529d73c890121a919d639981116ba51896a623203770ed3dc51f63d845189e082f2c11208ac19486eb91980322607cb30574ee835d23333702c2abc7e9a10ffed63d51bc0ca86dc5375ba7541b5f04678793f281a19374ea65c299173f1afa74d49e5061ec51dc3e2b4978583726111929b291514eff24e18d824aedae9895d89a11cb472650729c423f17f030d17a8ea3e79514b342e22b5af41f89ed56ccd6f6ecdb2aef621f70fffdc2671c0ec7cf6dfdec5765261a082884613b4ff816473d8db987b0139ce0ded0b92993d85a7daf9cd30b0c4ed0c6fb1522cdae5be7771f4053c3191d1ff2c1d77bf6af6e66d6f5c1f6ea5c6219f4ab6fa48539ff85bb45c266eb384507f0b5701844537721158a0854bd008d4c1095620c235b399d58e775710888d09807d31567e53b3f4728163d7dc9f8ee9a21c0fe3a84139be7796ff97f8b88bbb9427e1de7dee76ad39eec8c02c36472c8ede8d5d66637e1126aea7e503c70c3da1d52b43f484a68e94b11c6c5e6710cdf901e35963207c1d5b5d41cd76bca8387107b03f64464379cdd4316032b021a745e7befd5ceecce91849d83f7b6cd1328fbaaabb819f6365322b972c5f00c1f8c544825286ac0af9b4f416c5bf626b2b27e878f621464252dbf55f8354478ad877298bf4bf5ed9683f0d1eab64347d72871bf0338b148b7c303b5e47a36f58989e2003848636a6ff0e7c4724eb0dad65220f8c33768927ad247e6b516ef5b8648d1b1d780df78b0a1b80210bbd6d4b5b1da84d10ddee4fea981e3bfe7f365a48365ba8cadbf3f49e765774d7d97d411aa77c1d7d1cc59512074116522741ae8acd12ac41c4420ca86363c5044a2e58f1456417256e7c1dcf9a9011d9e97bd6e01af2cc69c7450e871187732e750a81593cb31a648c8a27484eb3ac290249efdba99d326cbdfe56426731a94c21fc37fdfbbba2333e11df13619189005994a420d9ece43b2e734f0bb27c119e4a241e84db7adc07d6f80e1b8b501d2bd9ae55ba44ff0c27d00acf9fdb7d1214f6ba4fb49d9a1b0af8cd7582527e8770f69862a028365ce9d2608158ec9e0810f69a914fa79dfd2af6462223f5ee5a0d9b3e6f4ee8aa55a0e8750a8c21fd5a04cd702f86727b27af124a7c32e4154d51bc815b58cbcffb79eac2adc75b8c2478301008597553d36834d1da610dd276e27ca09ee1645e7765d1bbbef1c664678406ab912e9624133086fcb51e0104e911d453021afa9c85d95a2216f25d12e721627685565d4c484abc7a3a8108755e4fce03f424754b96c2a5c5489fde4d4aa4e28d0484028a7bb05a33ac90312ff2d6836828c5dc88180896bc2305c209778cc866d246f6042fd9c0d501e3bdcee870065bf21785bed4402752166979cc1d94e882e7c6c2f53e706d13849d740cdd44c41861949b5b9777f8c5b68ecb2abd02dcc8cbf15bd2f1de8836c6b38484cb6711b793569429f083d6003fd7170cb31970066a963660a176e62ac8e5828081af4b5748a6b0fd6fe60eecb3bc4003c0b2853af3e273bc02868e763fdd02bad4c8e888a8a67a79d7599edbd1e8dd55f762f02a05c1f0f192edeff969e36f32b6d57abe101e49b39d21271106d19e2210a67f20af20c247ac62c8aa0cae1199116658bcbfbbb20616243eb118b1d87d4c38cd101d9ba193c9b2873ad750e0f5a071e59118d296aecc40f267dc10f4f7343c04dc596e2af3ad8784b48bbd95d3e261079e46ed39c26df61ece5c136b30fd5d7b87b42ecba02360ca4e9b641c25f61fddd85d9164f461fc6fc356ebce1e59fe41fb155d503d8fd589d8d81820542b179781e8a4dd400e2051d74179309522168c2f3c6ed17031c67ce41ccb2735388dc8c6c1ae9642877281b6caa362949477699a0ce641cc0767b3846f053ac773b74be7da1c19cfa5d4e710cf2c7c0bcaca6279d8504477a3ce9fc1fec7d7386292a05f78ed6c45917a63fa858ae0ca368345a945829a7063b06ca444ebe6ec73cc27da787aefbec197257572683b351241776015350e856f4bf6181326834e60c9d86cf281f918f99b6e462b9eb44879a61d77c0aef6aadf533ca885dd14dd08099007f6540ab0cd08a99aa6e9d07df544d88cf4a339810c2a70594f6588c980cb606fac2a7a6162c82513ee7ab267c9d9ade25c5f1bdfa5bc301c54881bc0f4dd666ac1f2e568452592addd9a2198e1f37d6ac7dea90d19cef553bbfe47190528717f47c22da5b15819934e969745ca210faf8c83a3d5b3f48605533fb040d9598fcb2fa742d944002c6a123a30f8ca507f16d936ef0bad2e0aaec353b04773dc82f5d06d7a34fb7acfdf9816d48a52d2980af6ae4e0dbc77a42bdf070a617982db8e4ff57f0957719d1f6184eea69ef9061abdeb36f245500e655275220ffdfac9200690aee5df0e26c701f17c7ab051f3de2de2728b06e894d7299bd16a1ef3642e96096294cb0764427924002583872a3f28b99bb71395b2b549b883e1e44d019747a7aa50a64adb890a27e2d5024ddc7e0a4ebd4414ea03fd64cf6f52d9af6ac6b4f30ee82097230c2d487f50fdf9b9c0d8ece593efcad91e6b736d03f9e992c35700a11603389d5166262e457680b026ae126250057ba7b4f86bbb8e65a7fa6d40f17705d122b8ddf1215d093e1a54a5287fe5d1afced80582338f5b1061d168bbb776fd2bfe054c27f4e9d35dff0cbf64a1deacfb785fecaabf4c0c181a9959b98cf0d5803d2d6fcf429c9fd9e21de77590c186700bf50c259b4c625ee9e0e137d7bbdbc62d60dd92ce80edda6074a2714a0751b47fcf258fd829df0d51b16ccb9a28040669e21961096508ee649da9b0307ac54537aba92e5f1074f1aa62a2b918775d4e380a251e85ee95225cad16cd552d199b9c63eeb08e76429fdab9ce000466b6df83302f9c1817e9f8f6262b75aa9dee3b5c3fa8ea422588598e01af14e29cb29c986580083bf16248d17587679182ad417491edb6eff0ae11d7ef5c502874c5182b8f962eaad28567128957cc5cd01cc1013f0d650ce251e7a58516970ee82bf7417bb59fa3cb714f8dcb994764c490cc2152c14a6f0deefbce7e538191478f04140bad824204162e28c925dd5d61a3ca064281ae7f8375f868ae4d8fb76a06879d750847559416b2de00ba1826e26809d1db24304216f3c95d56440feb7f03cc835e673b63637bb2a55ca71a19a8e47bab95c2216c6bdf8bc9f3ec9f3039d236e2570c2e1c06af6df8c5208eef0abcad5c9e5d9a4094ec90ec7cb3a67b3b0c27c26464df2c09279493b8e7b172906c9e735a59ca6e8336dc5d24bc35d73f68f59f9fb9ccea67a81083cd2969b09aaf484e4eaf398b1cd6b04a69bd2e11e128f81cfe9c1599c5f2fced56faaa0e6d88b01c29f3659efdab34d2d93d4adb44f0b4e50d6c55e55de04ba0655d027da2d8f5d05fe6290da7c55ae1512399e87bc8c86a72b8e879b4836facf52c65e4e24d0bacc903183ed06abd28950917546332c683e433a20c88c1904d0ed6cd748819d45fa2f73cd7b1a4778446bb718f230e670f1d0218191673f3d61cbae6ed977a7b2b70092787707c954bff15340bef2822a91a6405bd0c44c1a8b1687d61b7aadd2cef7ca87a7e64994edafcf749cbd1e90d3a302c1a2d6f4c048eedfeaecdf08bf6e7f33d090b167845ff8481da7696d6818dbc633076729a7a07d5ecb09d84a0a149cd18dd5e585373268742e00de8e853746c3427213e325d6036135b2b7dc45b0bae2a8bdc64cdb5bc56ff11c44c0be14bc60c7c87f5a25bfd4ee8e7c97f4df48df7af7b6db66e4c507a409e303e705b5167211a70f096cf68b8b41b96bc3c5a5729a8d927c65b5f094555d9aafb799a42f8aeebc3377c477f6266e871243406904940855d6f661563a5e5b59f7f5a4f15429b07480032431d8e20351ff02fb9d168722508114272299e4c2d7d9c8e87d8f24b2c9e9ea45e71dc7395afb92f642ac9e3883304ad6ff64020e7673e48523436d13d9031429908f222dab2d5a2c4316b73420ef7cca2499dd97db19974ea5e2357a184bdbcd5ec1a9e29bef2416b43ae29cf0f013b8d66a6052682d367f7ae77ea1f8ccb511893b4774c9dbb4586b00eacc913b12aaf1107b14e68523f29c0ebdb33b370f7869c6dc9907e63c0663b153490b36453c71732262750bf1fecad5ae216247d3a3c76b92ada4e788dbf0b8af33ef1203aff8d96ca95448ed93af76dc26dcc23b3b15ab353c3625a17a28ea796ab97f80a5684c93daad926094173e62f9e65a910cc736523878e9550b9353f4f42cca2e18367b7779bfde85aa172b9e126a977be379f8f822e7b8849588af1311b965cc639688831d6c8763d1398cdd56c49c352bb46c3b4a8003b9eea4a710d82e208b68955798146e81ae4c0c74a8589b501cde95d2f8b71f72dc4e4f386abc71d1a08bbeb20258d51e09c5ccf486c3513d1aaecf6e407bcd05f00567357f1698425192b158bfe431d86c980b6dd28da3860b6b99c0fb67f3ff449271cfdf4e74a2bb5f70a1e473f2754e44d239e46aa024dde5a9c04e3c3acf16068bac638406f77f161c3b89a38c336cb012b3fb1147d247e9b35a0f2f61308eae4e922f89ed199d96f0759c518106e3b62689b241da1395308a46db10729261b973922619d54d3f66146b30453c5fef1a221575ac03263724a3c1bd20d583a43b2cb1a9209ed04d7c77df5692c29f4238c5039ddf45313a3469cce70a3fbfc7ccd5dd95233dcb0d9b5612b7954285b8bb42de5785583154cd41875afa13617d4b628396f8d9bf774f787a95d080e86b49dd73eb24966c17979985eb6d4478145c626b2d0a03ac140a02d16cc6ffa18b2358c4595829ac7bf211d3866b118c04bfbeb291f37d20503ff56768d6819b3dea84a749e78a50601a111a947063269c027fc4c6d55ac3edb4501a22a659714e80fe0a4e6c50cc09084153a0537f309bc7c0fd808c5c6a7d38fa3e7ef5b495231aacfc555ab0fc92076ddd0ea437bd0d577789c2bd782f4016b3bcb9502c64913c9f21b38851b8f0f6d1a718e53cc53befc2c14954be06d62ffe107b1169c31753a1f8e875e2da0b6317bd0b8cc874096b134e6e474ed5d69280fda7949ca053eefb48c77b8ddec7c4c1b84b307e97915c1f37d2845f86599b38b8f11ac8a91b9466f0a601805592f138609d8d89057de3f8f085949a52dfbe102ca357e4b8494de93fb1e1a638c7d8764e2bfcdaa9903fda69ac8778b5151149b9f7e4ecbfd80134570b2d5399fee602ee2e78595dd97d22ef63bbb93adc2ecc2363799e7cec68f7069828126562bd22a095efbc5976a5c66d20d6bea25eba510147d22bebd89735938b341257c606f9f59662e4f927a4ea8c3aca0d7c4c02b94241011985f1ef815be472d25604f9d701e8e42f327b2cd902a5ba7fd0cf0d326b5aa52899854ea3bde29126f5e08989fd4fdc41f86165e5c182c59f80610bd8a40e9c83ac3a3ff4c590485ad41650e95c1e1a370e59d7711152acc8cd34dc20020d87906db1b36184d3d5ba86bafd6cf5d9d6ae7ce43846102134d1c"}}, &(0x7f0000001dc0)=0x0) timer_delete(r6) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x80000000) ioctl$VIDIOC_G_ENC_INDEX(r1, 0x8818564c, &(0x7f0000001e00)) 23:36:37 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:37 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, 0x0, 0x0) 23:36:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x2000, 0x0, 0x0}) 23:36:37 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, 0x0, 0x0) [ 1131.326480] binder: 5106:5113 ioctl c0306201 200003c0 returned -14 [ 1131.387609] binder_alloc: binder_alloc_mmap_handler: 5106 20ffd000-20ffe000 already mapped failed -16 [ 1131.418816] binder: BINDER_SET_CONTEXT_MGR already set [ 1131.443395] binder: 5106:5113 ioctl 40046207 0 returned -16 [ 1131.466987] binder_alloc: 5106: binder_alloc_buf, no vma [ 1131.467574] binder: release 5106:5113 transaction 1451 out, still active [ 1131.479673] binder: undelivered TRANSACTION_COMPLETE 23:36:37 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1131.490166] binder: 5106:5171 transaction failed 29189/-3, size 24-8 line 3035 [ 1131.504824] binder: send failed reply for transaction 1451, target dead [ 1131.530180] binder: 5106:5171 ioctl c0306201 200003c0 returned -14 23:36:37 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, 0x0, 0x0) [ 1131.567917] binder: undelivered TRANSACTION_ERROR: 29189 23:36:37 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x900000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:37 executing program 5: r0 = syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x200, 0xffffffffffffffff) pread64(r0, 0x0, 0xfffffffffffffe73, 0x0) 23:36:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x3f00, 0x0, 0x0}) 23:36:37 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1132.049857] binder: 5243:5244 ioctl c0306201 200003c0 returned -14 [ 1132.085293] binder_alloc: binder_alloc_mmap_handler: 5243 20ffd000-20ffe000 already mapped failed -16 [ 1132.110315] binder: BINDER_SET_CONTEXT_MGR already set [ 1132.117672] binder: 5243:5244 ioctl 40046207 0 returned -16 [ 1132.139021] binder: release 5243:5244 transaction 1455 out, still active [ 1132.150155] binder: undelivered TRANSACTION_COMPLETE 23:36:38 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x400000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:38 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:38 executing program 5: syz_emit_ethernet(0xab, &(0x7f0000000200)={@empty=[0x2b], @link_local, [{[], {0x8100, 0x20, 0x8, 0x4}}], {@llc_tr={0x11, {@snap={0x1, 0x1, "cc", "4aae99", 0x0, "dd8074399b5c086312e96140eed20d9b7dc1bcbe42636518165ce0eb0ac67183722abc3836b9b6067e2f9e0ce746895e6366e520623df640ad0b64e8b1258bb0f99cf7cb4720e623b3adcc04a7fcc11d7fe2657b4dea890a786a2ae5cf79ed2a257ff75603af0b29e8605c6c49bfef5b3aa8c423f2177573916b73e0f983bee3a95cc69193631dfde54f4ea9253589ab9a"}}}}}, &(0x7f0000000040)={0x0, 0xfffffffffffffffe, [0x0, 0x400]}) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x101000, 0x0) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, &(0x7f00000002c0)=""/104, &(0x7f0000000340)=0xfffffffffffffdb1) write$apparmor_exec(r0, &(0x7f0000000100)={'exec ', '.eth0}\x00'}, 0xc) ftruncate(r0, 0x8) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f00000001c0)={'veth0_to_hsr\x00', {0x2, 0x4e23, @broadcast}}) ioctl$KVM_S390_UCAS_MAP(r0, 0x4018ae50, &(0x7f00000000c0)={0x3, 0x3, 0x8001}) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000080)={&(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0, 0x1, &(0x7f0000ffc000/0x2000)=nil, 0x8}) 23:36:38 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x1000000, 0x0, 0x0}) [ 1132.168040] binder: send failed reply for transaction 1455, target dead [ 1132.273435] binder: 5255:5261 ioctl c0306201 200003c0 returned -14 23:36:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000003200190000000000000802000000ffd38d9b0c00010008001000040005000000"], 0x24}}, 0x0) [ 1132.314496] binder: BINDER_SET_CONTEXT_MGR already set 23:36:38 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:38 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1132.343298] binder: release 5255:5261 transaction 1459 out, still active [ 1132.351144] binder: 5255:5261 ioctl 40046207 0 returned -16 [ 1132.358810] binder: undelivered TRANSACTION_COMPLETE [ 1132.375100] binder: send failed reply for transaction 1459, target dead 23:36:38 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xa00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x2000000, 0x0, 0x0}) 23:36:38 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r0, r1) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video36\x00', 0x2, 0x0) r4 = creat(&(0x7f0000000340)='./bus\x00', 0x0) fcntl$setstatus(r4, 0x4, 0x44000) r5 = shmget(0x2, 0x14000, 0x4, &(0x7f0000f71000/0x14000)=nil) shmctl$SHM_INFO(r5, 0xe, &(0x7f0000000580)=""/4096) fallocate(r4, 0x0, 0x0, 0xa6ba0) io_setup(0x0, &(0x7f0000000200)=0x0) io_submit(r6, 0x653, &(0x7f0000000540)=[&(0x7f00000000c0)={0x804000000000000, 0x0, 0x8, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7, 0xc00}]) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c831, 0xffffffffffffffff, 0x0) close(r3) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 23:36:38 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}}}, 0x48) [ 1132.831405] binder: 5283:5285 ioctl c0306201 200003c0 returned -14 [ 1132.854430] binder_alloc_mmap_handler: 1 callbacks suppressed [ 1132.854447] binder_alloc: binder_alloc_mmap_handler: 5283 20ffd000-20ffe000 already mapped failed -16 [ 1132.870361] binder: BINDER_SET_CONTEXT_MGR already set [ 1132.875708] binder: 5283:5285 ioctl 40046207 0 returned -16 [ 1132.899146] binder: release 5283:5285 transaction 1463 out, still active [ 1132.910864] binder: undelivered TRANSACTION_COMPLETE [ 1132.916130] binder: send failed reply for transaction 1463, target dead 23:36:39 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x1000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:39 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:39 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}}}, 0x48) 23:36:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x12000000, 0x0, 0x0}) 23:36:39 executing program 5: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x4000, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000025c0)=0x204, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='lp\x00', 0x3) bind$inet(r1, &(0x7f00000003c0)={0x2, 0x200000000004e23, @rand_addr=0x2}, 0x10) r2 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='dctcp\x00', 0x6) ioctl$SIOCRSACCEPT(0xffffffffffffffff, 0x89e3) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, &(0x7f00000001c0)={0x0, r2}) socket$inet6(0xa, 0x3, 0x7) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vsock\x00', 0x0, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000480)={0xffffffffffffffff, r3, 0x0, 0x2}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) r4 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x1f, 0x400000) setsockopt$sock_int(r1, 0x1, 0x0, 0x0, 0x0) accept$nfc_llcp(r4, &(0x7f0000000340), 0x0) recvmsg(r1, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14, 0x2004000000000000}, 0x100) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) syz_genetlink_get_family_id$ipvs(&(0x7f0000000680)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, 0x0}, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r2, 0x84, 0x65, &(0x7f00000004c0)=[@in6={0xa, 0x4e21, 0x9, @rand_addr="3a8d8448a242efbcc6d2f8aac18bb7db", 0x6}, @in={0x2, 0x4e24, @multicast1}, @in={0x2, 0x4e23, @multicast2}, @in6={0xa, 0x4e23, 0x5, @remote, 0x200}], 0x58) r5 = socket$inet(0x2, 0x4000000000000003, 0x2000000007ffd) lsetxattr$security_smack_transmute(&(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000400)='TRUE', 0x4, 0x3) setsockopt$IP_VS_SO_SET_STARTDAEMON(r5, 0x0, 0x48b, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000280)='/dev/dri/card#\x00', 0x5, 0x0) [ 1133.203006] binder: 5398:5402 ioctl c0306201 200003c0 returned -14 23:36:39 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}}}, 0x48) [ 1133.244726] binder_alloc: binder_alloc_mmap_handler: 5398 20ffd000-20ffe000 already mapped failed -16 23:36:39 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1133.288459] binder: BINDER_SET_CONTEXT_MGR already set [ 1133.307756] binder: 5398:5402 ioctl 40046207 0 returned -16 [ 1133.338858] binder: release 5398:5402 transaction 1467 out, still active [ 1133.352554] binder: undelivered TRANSACTION_COMPLETE [ 1133.376367] binder: send failed reply for transaction 1467, target dead 23:36:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x14000000, 0x0, 0x0}) [ 1133.506588] binder: 5423:5425 ioctl c0306201 200003c0 returned -14 [ 1133.528013] binder_alloc: binder_alloc_mmap_handler: 5423 20ffd000-20ffe000 already mapped failed -16 [ 1133.560216] binder: BINDER_SET_CONTEXT_MGR already set [ 1133.565509] binder: 5423:5425 ioctl 40046207 0 returned -16 23:36:39 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:39 executing program 2 (fault-call:5 fault-nth:0): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:39 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x20000000, 0x0, 0x0}) [ 1133.985252] binder: 5429:5435 ioctl c0306201 200003c0 returned -14 23:36:39 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x3000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:39 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:39 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc000000, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:40 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x0, 0x4, 0x80000001, 0x400, 0xfffffffffffffffd, 0x1, 0x3}, 0x29) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x8, 0x12003) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000080), &(0x7f00000000c0)=0x4) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x800, 0x0) close(r0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x40, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x80, 0x0) ioctl$KVM_PPC_GET_PVINFO(r2, 0x4080aea1, &(0x7f0000000380)=""/181) [ 1134.034275] binder_alloc: binder_alloc_mmap_handler: 5429 20ffd000-20ffe000 already mapped failed -16 [ 1134.125343] binder: BINDER_SET_CONTEXT_MGR already set 23:36:40 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x16, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1134.149031] binder: 5429:5449 ioctl 40046207 0 returned -16 23:36:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x3f000000, 0x0, 0x0}) 23:36:40 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:40 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x20000408, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1134.278870] binder: 5505:5522 ioctl c0306201 200003c0 returned -14 [ 1134.346608] binder_alloc: binder_alloc_mmap_handler: 5505 20ffd000-20ffe000 already mapped failed -16 [ 1134.390444] binder: BINDER_SET_CONTEXT_MGR already set [ 1134.425480] binder: 5505:5522 ioctl 40046207 0 returned -16 [ 1134.431406] binder: send failed reply for transaction 1478 to 5505:5522 [ 1134.431528] binder_release_work: 2 callbacks suppressed [ 1134.431532] binder: undelivered TRANSACTION_COMPLETE [ 1134.468456] binder: undelivered TRANSACTION_ERROR: 29189 23:36:40 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:40 executing program 5: accept$packet(0xffffffffffffff9c, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x2, 0x2) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x28}}, 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x5, 0x0) socket$inet6_dccp(0xa, 0x6, 0x0) ioctl$SIOCX25GSUBSCRIP(r1, 0x89e0, &(0x7f0000000200)={'gretap0\x00', 0x101, 0xac04}) perf_event_open(&(0x7f000000a000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:36:40 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfafc, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:40 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec00000, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:40 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0xfdfdffff, 0x0, 0x0}) 23:36:41 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0x2, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1135.077476] binder: 5594:5597 ioctl c0306201 200003c0 returned -14 23:36:41 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1135.130537] binder_alloc: binder_alloc_mmap_handler: 5594 20ffd000-20ffe000 already mapped failed -16 [ 1135.154729] binder: BINDER_SET_CONTEXT_MGR already set [ 1135.180236] binder: 5594:5597 ioctl 40046207 0 returned -16 23:36:41 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0x1b, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1135.204305] binder_alloc: 5594: binder_alloc_buf, no vma [ 1135.204379] binder_thread_release: 2 callbacks suppressed [ 1135.204390] binder: release 5594:5597 transaction 1482 out, still active [ 1135.214696] binder: 5594:5597 transaction failed 29189/-3, size 24-8 line 3035 [ 1135.239201] binder: undelivered TRANSACTION_COMPLETE [ 1135.245387] binder: 5594:5597 ioctl c0306201 200003c0 returned -14 23:36:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0xfffffdfd, 0x0, 0x0}) 23:36:41 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1135.278309] binder: undelivered TRANSACTION_ERROR: 29189 [ 1135.313184] binder_send_failed_reply: 2 callbacks suppressed [ 1135.313191] binder: send failed reply for transaction 1482, target dead 23:36:41 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x3ffff, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1135.404341] binder: 5718:5720 ioctl c0306201 200003c0 returned -14 [ 1135.438068] binder_alloc: binder_alloc_mmap_handler: 5718 20ffd000-20ffe000 already mapped failed -16 [ 1135.486005] binder: BINDER_SET_CONTEXT_MGR already set [ 1135.520906] binder: 5718:5720 ioctl 40046207 0 returned -16 [ 1135.546745] binder: send failed reply for transaction 1487 to 5718:5720 [ 1135.558439] binder: undelivered TRANSACTION_COMPLETE [ 1135.578846] binder: undelivered TRANSACTION_ERROR: 29189 23:36:41 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:41 executing program 5: syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x482400, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000080)={0xffffffff, {0x24b2, 0x0, 0x6, 0x6, 0x7ff, 0x5248}}) 23:36:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x100000000000000, 0x0, 0x0}) 23:36:41 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xc702000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) [ 1136.104263] binder: 5740:5744 ioctl c0306201 200003c0 returned -14 23:36:42 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x9000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:42 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xfc, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:42 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0000000000000, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1136.167622] binder_alloc: binder_alloc_mmap_handler: 5740 20ffd000-20ffe000 already mapped failed -16 [ 1136.186627] binder: BINDER_SET_CONTEXT_MGR already set [ 1136.202194] XFS (loop5): Invalid superblock magic number [ 1136.211480] binder: 5740:5744 ioctl 40046207 0 returned -16 [ 1136.242804] binder: send failed reply for transaction 1490 to 5740:5744 [ 1136.249658] binder: undelivered TRANSACTION_COMPLETE 23:36:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x200000000000000, 0x0, 0x0}) [ 1136.286331] binder: undelivered TRANSACTION_ERROR: 29189 23:36:42 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x80fe, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1136.342005] XFS (loop5): Invalid superblock magic number [ 1136.357129] binder: 5804:5828 ioctl c0306201 200003c0 returned -14 [ 1136.379934] binder_alloc: binder_alloc_mmap_handler: 5804 20ffd000-20ffe000 already mapped failed -16 23:36:42 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1136.401826] binder: BINDER_SET_CONTEXT_MGR already set [ 1136.407505] binder: 5804:5828 ioctl 40046207 0 returned -16 [ 1136.422890] binder: release 5804:5828 transaction 1494 out, still active [ 1136.435541] binder: undelivered TRANSACTION_COMPLETE 23:36:42 executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) perf_event_open(&(0x7f000000a000)={0x3, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000200)=ANY=[@ANYBLOB="fa4cd83ba73b4f6aab0a57b521178f54f60869f774df4fe84d873f8c14c0f60cf947bc4a40e68d9321a60ad79684ebb95e9d7ac8edd9037976bd693ee9098c719f5f0ee0ca229ddd7dec034fe5f1608f871368c80bc0e2e8e15ace2f43c12c5bd794fc0fb20b68ee7d400c8ae4e00ce02ce7bca35aa634d69af5774e2b0a8e90cafd0c513f858ce6f0810ba3fda13ec22243510cddab10cbf22a29d4aef38d9c70887fe3000000"], &(0x7f0000343ff8)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x800, 0x20) syz_mount_image$ceph(&(0x7f0000000100)='ceph\x00', &(0x7f0000000140)='./file0\x00', 0x6, 0x7, &(0x7f0000001680)=[{&(0x7f00000002c0)="1245eae927d26550e200cec43ca196f3dbab5cdfcabce251164416af13a56250d088c4c1c8095e7621f7b41ac79838357052d13eb995fb7cf07ce062ecd87efe80ecd520a973da5213d56c959f5736c7b10df8715fec9e2367a4d0d811d24f34b81c23b032b645a02417b4d65c1f95b960375e1d35e9f81c7dbcfc79604d8e3ff1d3a991158ffd24b76ee66db2558164c48df18ab238b74aaf788e31464a27395f4200fe8f502a2ad744a93df42ce8a29eab00f286356632940f6c710ba6db58", 0xc0, 0x40}, {&(0x7f0000000180)="b8d68667f23bd1eb82633b3eee729d5b9b0fd9c93f3c32d66d851415dd68295e03c24dad3f", 0x25, 0x9}, {&(0x7f0000000380)="e88b434d7211d97cc2e3a63efcbcfbdee306a9034bd9fe1d6a370f6e90574b0cddf4c78971c0f2278a96d951200172b8f3df8b7e72ba43ff9ef2e51c731e06594dee0cd0a666bffb7d705b333173bb1a4d65947be8ffebbaffd56d84492d858c84ef2508ead42b2a1de70fd5bde9dc425875c6ad5d75e677cf9ea735c43ad6b482f6ead7acd4cfd14d3d63194626909d666ff8d94613b19a77dde335fa3da005f5dee6713ead7382734b8d5e0b4a3bcb98c54a6b568265c7cb35e098fcbcc9ec6954a4a094aee726fdb95941febae1bc8af32f5431ece95d0ff5c0491cf7e96ba9d3922907a0b7e136227f9317dd3acf3bfd25a8c3898c19d6c92113e34eb2fbd281c2d092d95d42248e3cc711664eeb533acbc8d959025a8866e1487dbedf3e30f0e4551316cb29472bd5112d5a644eb06e3eedd3a194a11b17324ada9fe40cd9c0452366950367f9eacb20c3ae6d710457a8173b43b6ec0de85cd889daa1a0c3d51dff139a495db0bfe7b26f335458f2d4d126d7ae10cdc011c2bb329cb39824aa8b0ac40d888cda206e30f98602e013f917e28cc79b680982aeb5eb84df2699e35f74baa9008a18755dcf0b1be714e047f2bbded44dcbb93afd9b577da92769bc2cef3b2f943816ffeefdbbadee80320a79bb546a0a07bcb719919f1bf0cbb5a770ec50ab4c37ec4ee794f3ae0c7968cd8a011075520d629be70c84a190738785ad9e36f5d0d74010296414e1dd0326fc580779cfce892bc72ce7c804ed835185ceda344b64a835e02248aad4ffe9c598159c2b997ebe6518165875689952c14dc9dafcac6ad4de4eeea0cfeeb5c174031e48e6b4434278b66da1a4b1f555fd47a41b2815c078cfb427589484b984a76cd868d812b8b395c02d7809bb40314db95e42e6cad69b639a63e3bca455a778b029fdc5070c267fbf3ce24e00df4fce1fcabe484bc218d964b6e029a69f2d8c2d5e4873a663ff5f85faa7fc91a76c030550dc900afe6ab2c910ba8433bf029d30698a6522a763d6be35b237916171761ce12590243b57451fd05fb730b8563aad80b7000245c414cf84e1d294b302574f3fc9ae83f8c559f0f9f357c06d2939d1f104219cbc9c0c21a82520ddcd4758ca9decb560f6cb4285082aa2aac1787781da00c71ea9749ef62a3e3f943fa8bc58c21d3de37bb4e1e4ac2e35b038d450e7f68d6389c5409e0061d1ee82ea874237d3b12243f768d0b47e7f08f39c4990c9107e742a6f49deb0fca41774c3e9748cc2eb7fa43cffde6ad25ad26d09f0a08ba731e37a6bf1b396e43d83a0b02f67bdd48f93c96f06114ae00090bb71e4a777360602ff37d000353d3fbbcb466202a92c72e2bd0314bf473869db51e99941d42b278ba1d7bf7c7584425737cce4ad283b2d98edae818445ee2e393971746a8efe6eed2b8d45d9f3d5bbe49657523a9a223a60008c5e3a719f8ffdbaa8944a4a0a1e9dfc4fb1ff578c507000e8d7e566c12d34b5d5d39cfa1e64d20e5eff51d186f257bf68b2825b16a8469275761fe86d2bab135595c2868a1dec4c0da8764759d2938ff0de4fc8f131d0c523bf5afe852d8234600650c76475b3cc8610849b3e4d81f0cc222ffd9c4684f677edce5ea345cad9d3a52a01f9a778175d89828a29ee85fd63a118f5c248c36bbfcb3e6965a4dd4e4f4a3fa236b42c386225328606ba43d60be7bc7fec85b186116f2c4b935e1bc2770784278dd2c3744feecfda1205849a7198d4ecbf41251b8236539f1711f1623d3b59df5940e7addf4495d6260134a5142e41c1273c2e19884093354c47b9af4366aa8fd3ff6184c3e37f98e296e0c3ffece435199b20a426ab9a9a279b289b67017a10111084300285074ef1264fdb19ab91d1ad55f6347fd41c33f716179317add252bbced8ffe9b024a09f6d2df1d8696547685db1a04e65f7b61008568b554acf49bb48f13def5d914b02a6c93fd06d27f9ed84538013dedb2188f3ae77bc0fa737283ef0456eee6ea95f6b63734e719b553f393cb8c01ae144a766d100b24586c424f8f8fc4010b234f7c92ea38fed4aa174253716c0a55d063729fe3a3edc9c3afff5794ecfa1383cca08898a0c56b881cca446875ec47a92c591aac0995003a74792ae2e0c22c1fad1fb8c5d53f1d13e1ddce197dd46026966bacaa4ab267822c1b7f7a0fd2fb8ca3b4e46f180449be7cf8ecaa8e7c68dac0ac554e4d7be331c9ff4ed093e6780c5c2b33d005ae376fe5269485015b0ae437c8914fe5d9df180ffe78f68a9ea631aa1e541a4d8f0a0a80da0653051234b46dbff6db95013db04d665175a3599b002d4ad05a53c54a15b992c49da14d4c35378365c9e126c68455ec093b18064b06114e0b3162a3e6bbee06fd166bc8ed6dbd40b7fb80910f726732c854a6136613b173af5c2df020e78f5f4be1cbb9a0e37627afd8ea9e0b4ae1627f1bd2744409b53b919cb5d6eda388183ecf03b9effdc8195e25c2f3657b12944bca410e04fa3804b8f0e62b145c6ef0bfe6ef94b8c279faf49dba7939308f2491543bd0fcd0824a990d58c68a565a8733e090f297b4b285611bdf8046c29ba93031a96b7a09fb28f5fc57dacabf35dc4106f40920698d7b3157a3bb3c2d03e39172795aa86d444b12e282d9e5e18bd2e0018a83d1fb0625b94850b828074a76e242913d1bc2ddcbcc26ca63448f4a0f60a3d06cf33d79efd486ca6b665b36b1d5c4b601c22b479c812764aa43d159b54f413869c97a8772b73cac3fd91268cb96eba16e02e754901fc57226f575f8325cdd4b058ed72446dc64a0cae4bcac1e732ad794de611de2bb9cefbd0d9a2336aa8049c0266c98f0130d5da04a6027772c95adeaa475f47e40930ceca8b97eb65fd7cbff125f60a514c4153e9766abee7073e7eab8084f1cd52d8c9f134072d2a60d6e91a16043223e4cfb228a3a55a21c10daa47664653b2e01d14b08639cd001a61df114966315d50f9158154f3850cf31c92028dd8936411696b0df2dfac20d1f46e9714ec8e0e55da4fa5c120d0b5cefe4861075bfea84c14caa66a4f0371160cefa07dc7f330a09a2bda51e8e98d0048a48695f58adbfea2501db5b71db36e72fb0e5f9f3e8ec76f143b253dfc2abc9efee9b7398db9d04bbb63a59ec7f1e9c0de61270a74b6bb4c6afe732ec59b7f036e605bc11f4912029fad09e4f60ac147813ca05f473bcacc3b64163762c61b28684c637aa942175b1445c2867148d985e9b4861b6ac69d1241c5f1fec471af5eb3212d3c31ff132b4361616b5e7c04c3d98ce3e2feef5cfcb87da04b2e1ee7871a29b66abe4bee413d8c6124284611fcabaa24e7db360f10546b62af7e8aa52a422eb4c9b1c06bb2ab5b4743fe837aec681f292c87dc3fb8fcfe15e529c2638f043ba038961fe4e142f50b69930ebede27c4ac30b11066451937cf24e2078cadc38f40305653f61e47d6cdafadf9fd40dbab1e6ca99f55395612edf4f134db031c82e2a4506db7f40e7254e26bfd4365db1d991994223fdbce3bd84c0deb1afd919a8f04c637236181b3f31425cfd985d2a137f9bf67b6b9b90461750253562163a4f11a285ab115707979b28c57daa2c500f5dba51c0cdb58a56c4f3fe003ef66182acf1d661ec0829925752392465fb7a09372aaf74a20da8e2c2252912a7d10bf9ec20eb7bd58cc921fd3b6d622838980f3456cef21c946e48fd897f2a1f0a7f2096bcce466dddbe0024d157b06641c6825bf1bfe01bf9c21c6052b05c2f998e8a31af9d9b508aa3106420f89984ca91a40d25b7aef9709e59a658b541b68268e0a00e2922e7af6a0709d24fd686bbe0cf6718da64c0c9f9bc953bca01690426883b2d0bb08c14649f29a14c328499b306e71b2a547069acf9325973afb8bc6e27898c2e1370982388bdcbe24f7099e0f61833567d24e3cd39cdca226187d0c6797c2d4bd0a06d76fbc7e2970c5522fc3432fa8efc9c55095b676dd49f5d88b7d3983947668c73ffe44334029a0e1518e229f86d9b389bef5c7ea10a395b4bf1262b2bbbdfaeacee373222c14d8abbab11ee5fed884f8bce3ca829ad1ff8bd0edfb9c87844a360f096a002170788ba52d0e73326af7a7a3ccdec7bec5dab98549a557bf2f294521fd8d24822fc99b867ccaa20a56d66d864b7d3561f610b3765f85fe1e4abc2d236b0ac3ac9d51c6124a76e636f1a282e65850ee27ca27ab9973d6a832f959f868e7dec7d6378d7eaf6c950b8e107405c05c2e1b5d78522d843c690490978789fba53926335518234f73122aa928265141525c6ee34ad2bb99de3fb7d62b851924098249d69f66f3292bd441612af76119c563aeb30474e1d41267949c60e4d838a578227420aed0f62596cea5d4513603174b521f5b27327ce192e9d6a93b353db10aecbae9286755f70c211a7277b4ef2f59767582353b50abcb4640afedf471359556d97573c58bc5c8a1b9945fa3db7b58aae12460dfa3cffd2bda502a7940c94102590424915a19bb4f4f094f04d34d1fdfb5acadda5a243fd85ac7aea3ffa61f330b847a99346aa5f1ed40130211b343a1b54e8df8b91bb542cb9ccf7e62e8a6656a2e2e4313bf32f1a633b8f5192eec0acd9830266653878fe543191f37c69f3da5f5c5fc48c40ec57f802e916f960bc47b4fbd3fb15a74f5bcd7a31df1b2ef816b4cb690c78f50cd5e223825b4ee5c3feaec2fa95caddda4fc6aeb3eaa0b607871dc4d0f1243831a3ae3667ea7cbca0f5d6fab75b36fbe59afddded36f8ef309771764c541dd64c750a8f77708d98eac13d26735ceedb9e1df25784e23abae82e73bd465ff93da74360a753e8a28ac729fcf4eff42c4485d17215c9ea120af98d48106b26dc66e83048dd9e86f07b452a5eeb8e4a4bccc770d49f41de747704cf48e58678b790a3db1dec06a86ca29ba050b0f4a872f062d753776220b7cb365112ed93326c78fe8adc344724b41af652a44e7b48db916f121d079daf3a6536f399734b6a231f591e5bbb1a06ab4fb0034b5a93c5ccdc22d0f3cad52fc7959b761cc16d0892741abe75f5a897541a0174b92f74f039e3782c6b81ba00c93b63376776adf16f1b86cb57170ac9ad927bdf0c309d24b7c4714b1c16d6224e0f2fd647693fbe9c6996881d62e1f26ccfdd75449d2fea481953af3d6c21c808b23644b7ac69160a32e1b0bd6879114875961865b1da877662777d41ae2ade3034b20924ea04425d993ee3169585fb6ec72cff3fbb48293ffaf452c3fc3169a7af46e3bce550edcb0dde7e984fee34d40bee6ce29c9a81257c04aed9ed3329f1b20022f79d09a104fd1c0c1d4db529e64269489710d7d0323f36938d73d843c8d4408694fd542ce490865fb70d44d271286081ce6718fdbe2094f59935eb14689e70785af4fdda601beaf6d233ebf05401a0f06efc5d0ec3f6a0d48b6ddbd721ba70a457ad60b0e3690deb67eae35cef99d83cca69dd1329e819dafcf90a7723a17ccb3b6bf51965a42c794df53dcf82fa46d4d22b545565dbb563f24f31fd1154d68230ad99a8df54ef45d2bfc760addca0d507b23223e3e472b86f714329d7400ca3dd46b30ecfb80625a3b998979ad12a8903ec353b4e43243cb103dc8eea9f6e9e658c0f55ff8c700ee24b7cbf028260741a30324fc9591bd0c62d2228efbc3a521a38ec93bedcbf65462dd5e5b4c8ec0d27d78135f59ade8e21d737d724dfcfa1690247a4472a6f8f712c0ad8cf0dfeaf722337afe9ac015afef8ebc94975f7a97744efc08e5", 0x1000, 0x1}, {&(0x7f0000001380)="7044ed1394f9d60dad2e34e7e3464a3bb8a52c3ddf22eb977b2717d08c2929fe2280d14e2d2f63c42527b1ae2f59a1dc2169d61b005d400228306658616ffa5b6e3b4b825cf21b1e5987510342314f5651e7063a63f33e6d9708a3b599ae6961722d99fa1b5add39c57714ac79cc0909c0114184bb5a3a14f7aafd", 0x7b, 0xe0000000000000}, {&(0x7f0000001400)="46a7b7ac330f3123c89dbd6a6cab771e243aac194d4cb419fa306394eb804b33b9566577f533bbd6b0403857138c7281073464c72ab19d9394f4e6aae85c4a013e4c062f6364a0113610c061a66d200e72c29eecf248df513a7d2969e51cf0f5ca12b87af3b7d338ba295a27815f1bb84c310f2adc81aa9aadd2dcfd527d2ea4611c6153c9300d59014d9d009c72", 0x8e, 0x7f}, {&(0x7f00000014c0)="08c235e4af614d2f9e4b5d250e8be560ef0e1166b6432aea20246ffdaccd8a2322837c80b4622a85bd8c8f39230c7889fab712b6844376c0fad239991ddd09f575420136907061edf5ff33df7ed7a4505a93562085087d7314d1266913c9a32e935bae9a02a744dde7228d8dd895945acc2c9d16e92392e4a74e973d12eefba41176a595ed0ed9f89ad369900ad5a48cd90d1a0179e253a4560c54e35ac6e991e6d2274a152220ddeea52a73a20f563794a7c6915baab3991f6c6e3801b0c6bfdbabc08a6e734efe5fd2c576821f3514ef8f026bd260cf0349b6c072b042f4a6f7ef8619834e89a0bebc712da5bc998e", 0xf0, 0xfffffffffffffff9}, {&(0x7f00000015c0)="d1332a584e1fbf856f365fa8ea8e5c44f2def78e63d4c64f0d7c40a832ab5c64bfc2c5a197b584dd72b0bb9d56952d210d549e6e976de33912b13f111813ddc1f90c88981f42c6a6a4f79b8d26c9308954f4a947464b11f1d8bb8d3cef359d9ecd18eacb5ba5ef75dd84bd554206dacba04434eb8e3b7b525eedfc8abc6c7e5fde45628fb608fcedbb3b27f984246f15419a69b6979a40fee642c6fbe7d415", 0x9f, 0x261}], 0x40880, &(0x7f00000001c0)='nfs\x00') getsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 23:36:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x1200000000000000, 0x0, 0x0}) [ 1136.456720] binder: send failed reply for transaction 1494, target dead 23:36:42 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xc0fe, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:42 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1136.588821] binder: 5898:5902 ioctl c0306201 200003c0 returned -14 [ 1136.626829] binder_alloc: binder_alloc_mmap_handler: 5898 20ffd000-20ffe000 already mapped failed -16 [ 1136.640413] binder: BINDER_SET_CONTEXT_MGR already set [ 1136.645837] binder: 5898:5902 ioctl 40046207 0 returned -16 [ 1136.653889] binder: release 5898:5902 transaction 1498 out, still active [ 1136.669505] binder: undelivered TRANSACTION_COMPLETE 23:36:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x1400000000000000, 0x0, 0x0}) [ 1136.687310] binder: send failed reply for transaction 1498, target dead [ 1136.803453] binder: 5911:5915 ioctl c0306201 200003c0 returned -14 [ 1136.825544] binder: BINDER_SET_CONTEXT_MGR already set [ 1136.831007] binder: 5911:5918 ioctl 40046207 0 returned -16 [ 1136.837049] binder: release 5911:5915 transaction 1502 out, still active [ 1136.837629] binder_alloc: 5911: binder_alloc_buf, no vma 23:36:42 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0xffffffff00000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) [ 1136.851644] binder: undelivered TRANSACTION_COMPLETE [ 1136.856910] binder: send failed reply for transaction 1502, target dead [ 1136.865809] binder: 5911:5915 transaction failed 29189/-3, size 24-8 line 3035 [ 1136.888014] binder: 5911:5915 ioctl c0306201 200003c0 returned -14 [ 1136.906019] binder: undelivered TRANSACTION_ERROR: 29189 23:36:43 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xa000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:43 executing program 5: perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x17}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000080)={'IDLETIMER\x00'}, &(0x7f00000000c0)=0x1e) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0xffffffff00000001, 0x8, 0x2}, 0x2f) 23:36:43 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:43 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xfc00, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x2000000000000000, 0x0, 0x0}) 23:36:43 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000100)=0x0) perf_event_open(&(0x7f0000000000)={0x7, 0x70, 0x3, 0x1, 0x3, 0x1, 0x0, 0x0, 0x84000, 0x8, 0x3cf3d64f, 0x5, 0x20, 0x6, 0x8, 0x9, 0x100000000, 0x9, 0x6, 0x6, 0x6, 0x7ef6, 0x0, 0x5, 0x1000, 0x5, 0x5, 0x9, 0x7fffffff, 0x9, 0x6, 0x7, 0x1a5, 0x4, 0x3, 0xffff, 0x0, 0xff, 0x0, 0x81, 0x0, @perf_config_ext={0x10001, 0x9eee00000000}, 0x12000, 0x5, 0x1f, 0x0, 0x8, 0x40, 0xc4}, r3, 0xa, r1, 0x9) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae8a, &(0x7f0000000080)={0x0, 0x600000000000000, [], [0xc2]}) [ 1137.249748] binder: 5928:5938 ioctl c0306201 200003c0 returned -14 23:36:43 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xfe80, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1137.301600] binder: BINDER_SET_CONTEXT_MGR already set [ 1137.313525] binder: 5928:5938 ioctl 40046207 0 returned -16 [ 1137.314557] binder: send failed reply for transaction 1507 to 5928:5938 23:36:43 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x3f00000000000000, 0x0, 0x0}) [ 1137.357686] binder: undelivered TRANSACTION_COMPLETE [ 1137.373077] binder: undelivered TRANSACTION_ERROR: 29189 23:36:43 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:43 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xfec0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1137.526111] binder: 5987:6052 ioctl c0306201 200003c0 returned -14 [ 1137.570217] binder: release 5987:6052 transaction 1511 out, still active [ 1137.578534] binder: BINDER_SET_CONTEXT_MGR already set [ 1137.585195] binder: undelivered TRANSACTION_COMPLETE [ 1137.616468] binder: 5987:6061 ioctl 40046207 0 returned -16 [ 1137.622730] binder: send failed reply for transaction 1511, target dead 23:36:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x8000000000000000, 0x0, 0x0}) [ 1137.941851] binder: 6074:6075 ioctl c0306201 200003c0 returned -14 [ 1137.957665] binder_alloc_mmap_handler: 3 callbacks suppressed [ 1137.957697] binder_alloc: binder_alloc_mmap_handler: 6074 20ffd000-20ffe000 already mapped failed -16 [ 1137.981636] binder: BINDER_SET_CONTEXT_MGR already set [ 1137.987117] binder: 6074:6075 ioctl 40046207 0 returned -16 [ 1137.998391] binder_alloc: 6074: binder_alloc_buf, no vma [ 1138.006846] binder: release 6074:6075 transaction 1515 out, still active [ 1138.019341] binder: 6074:6076 transaction failed 29189/-3, size 24-8 line 3035 [ 1138.029211] binder: undelivered TRANSACTION_COMPLETE [ 1138.038974] binder: send failed reply for transaction 1515, target dead [ 1138.048261] binder: 6074:6076 ioctl c0306201 200003c0 returned -14 [ 1138.067321] binder: undelivered TRANSACTION_ERROR: 29189 23:36:44 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:44 executing program 5: socketpair$unix(0x1, 0x1000000005, 0x0, &(0x7f000087fff8)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5475, &(0x7f0000000100)=0x3e) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvmsg(r1, &(0x7f0000172fc8)={0x0, 0x0, 0x0}, 0x0) dup2(r0, r1) sendmmsg(r0, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) 23:36:44 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xff00, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:44 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:44 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0xfdfdffff00000000, 0x0, 0x0}) 23:36:44 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:44 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xfc000000, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1138.239352] binder: 6083:6089 ioctl c0306201 200003c0 returned -14 [ 1138.271998] binder_alloc: binder_alloc_mmap_handler: 6083 20ffd000-20ffe000 already mapped failed -16 [ 1138.318574] binder: BINDER_SET_CONTEXT_MGR already set [ 1138.344623] binder: 6083:6089 ioctl 40046207 0 returned -16 [ 1138.372782] binder: release 6083:6089 transaction 1520 out, still active [ 1138.390180] binder: send failed reply for transaction 1520, target dead 23:36:44 executing program 5: r0 = socket$inet(0x2, 0x3, 0x1) sendto$inet(r0, &(0x7f0000000080)=')\a', 0x2, 0x0, 0x0, 0x0) 23:36:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0xffffffff00000000, 0x0, 0x0}) 23:36:44 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:44 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xfe800000, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1138.504378] binder: 6213:6214 ioctl c0306201 200003c0 returned -14 [ 1138.529919] binder_alloc: binder_alloc_mmap_handler: 6213 20ffd000-20ffe000 already mapped failed -16 [ 1138.558220] binder: BINDER_SET_CONTEXT_MGR already set [ 1138.564087] binder: 6213:6214 ioctl 40046207 0 returned -16 [ 1138.579294] binder: release 6213:6214 transaction 1524 out, still active [ 1138.587727] binder: send failed reply for transaction 1524, target dead 23:36:45 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:45 executing program 5: semget(0x1, 0x1, 0x600) 23:36:45 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xfec00000, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x2, 0x0}) 23:36:45 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc000000, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:45 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:45 executing program 5: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) close(r0) mknod(&(0x7f0000000040)='./bus\x00', 0x80008002, 0x28ac) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) close(0xffffffffffffffff) close(r0) 23:36:45 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1139.316801] binder_alloc: binder_alloc_mmap_handler: 6230 20ffd000-20ffe000 already mapped failed -16 [ 1139.326672] binder: BINDER_SET_CONTEXT_MGR already set [ 1139.339577] binder: release 6230:6239 transaction 1528 out, still active [ 1139.361464] binder: 6230:6239 ioctl 40046207 0 returned -16 23:36:45 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xff000000, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1139.367422] binder: send failed reply for transaction 1528, target dead 23:36:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x12, 0x0}) 23:36:45 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec00000, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:45 executing program 5: r0 = semget(0x1, 0x0, 0x0) semop(r0, &(0x7f0000000100)=[{0x0, 0x10000fff, 0x1000}], 0x1) [ 1139.563413] binder_alloc: binder_alloc_mmap_handler: 6266 20ffd000-20ffe000 already mapped failed -16 [ 1139.611902] binder: BINDER_SET_CONTEXT_MGR already set [ 1139.634168] binder: 6266:6267 ioctl 40046207 0 returned -16 [ 1139.656671] binder: release 6266:6267 transaction 1532 out, still active [ 1139.677773] binder_release_work: 3 callbacks suppressed [ 1139.677779] binder: undelivered TRANSACTION_COMPLETE [ 1139.702228] binder: send failed reply for transaction 1532, target dead 23:36:46 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xa7020000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:46 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xfc00000000000000, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f00000000c0)=0x8, 0x4) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") socket$inet(0x2, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x0, 0x0) socket$inet(0xa, 0x0, 0x84) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x317, 0x0, 0x0, {{{@in6=@loopback, @in=@multicast2}, {@in6=@local, 0x0, 0x32}, @in6=@remote}, 0x0, 0x8}}, 0xf8}}, 0x0) 23:36:46 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x14, 0x0}) 23:36:46 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x9}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:46 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:46 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xfe80000000000000, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1140.241294] binder_alloc: binder_alloc_mmap_handler: 6280 20ffd000-20ffe000 already mapped failed -16 [ 1140.269096] binder: BINDER_SET_CONTEXT_MGR already set [ 1140.315605] binder: release 6280:6284 transaction 1536 out, still active [ 1140.323248] binder: 6280:6284 ioctl 40046207 0 returned -16 [ 1140.332727] binder: undelivered TRANSACTION_COMPLETE [ 1140.352334] binder: send failed reply for transaction 1536, target dead 23:36:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x1200, 0x0}) 23:36:46 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xfec0000000000000, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:46 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1140.507481] binder_alloc: binder_alloc_mmap_handler: 6378 20ffd000-20ffe000 already mapped failed -16 [ 1140.527562] binder: BINDER_SET_CONTEXT_MGR already set [ 1140.534603] binder: 6378:6407 ioctl 40046207 0 returned -16 [ 1140.546526] binder: release 6378:6407 transaction 1540 out, still active 23:36:46 executing program 5: socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, 0x0, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000280)=0x14) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x40086602, &(0x7f0000000140)={0x8}) write$cgroup_int(r0, &(0x7f0000000080), 0x2001007f) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(0xffffffffffffffff, 0x28, 0x2, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), 0x0) pwritev(r0, &(0x7f0000002480)=[{&(0x7f00000000c0)="17", 0x1}], 0x1, 0x0) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) bind$inet(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x0}, 0x28) [ 1140.558268] binder: undelivered TRANSACTION_COMPLETE [ 1140.593538] binder: send failed reply for transaction 1540, target dead 23:36:47 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x1000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x1400, 0x0}) 23:36:47 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xff00000000000000, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:47 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0000000000000, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:47 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xa}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:47 executing program 5: mknod(&(0x7f0000000140)='./bus\x00', 0x8000, 0x86128) r0 = open(&(0x7f0000000040)='./bus\x00', 0x4001, 0x0) pwritev(r0, &(0x7f0000000000)=[{&(0x7f0000000080)="fa1204a49155ce1e00", 0x9}], 0x1, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000100)='\f\x00', 0x2}], 0x1) pwritev(r0, &(0x7f00000000c0)=[{&(0x7f0000002e80)="022642c541e2c31bd64f1a28db1ae5f7eba00b24d80d7253792160efd623128cfa3cd749a5ca8a2d19b521ac8d6e37d2c0622a1ba276ebe708f9062f4c26a5f3f65428e170f6c31b73b0279b65ef4829b1406ee9a00150ad67850ca34864a9ecd7b19887bf4ebc019df60bab47a42f460c35b8855f3cacda8988c08bd4193e91fb097ae321b9bf6e83bc5eb554a0420d3faf57047d3d3de2b3dee735e5556c4c8285e07aeebbca62f38f84e118da42cd33a4d919d21de161cd767445f0fccf6e4f034e4d5d0db0af87f8840b14e70ea9e7a2fe4e030ea380abebff48cb404cd1ae9ea639f1fdf069a115d82966d1f4c4af825170924ae1621655a6329f6836aa2feaac0ada07b652cf69b265a13ffed403561832c3b1b8178c7ebf0e16da145db054fbb1ecede9947aae73dd4376af6390d9bdfc6159d16a40a707867ebb28ac957fc71f36e479c701ebcf55a4c40e93528204ae74efc9571b8568a83bb74d746b85604a8c38b260352bda9e6b36079e5bccb6537f2f1b68c2555f684b863806fce6075ce929d57a15fd97bd13629bda887178c99d6fe7f46785ce7b2249c2009dcaf60a2770d351c9af728a3360f3aee96a36eae86e396f55d5cfec09bc925a4820b3dabdf22573cc2cb349ad1cb698b91f979bba81cd8bdb015fb633ee393b4b29b8f6aa80adca9273ee6a88c3fca64e447975a769fb259b6f3d262f508873dc17f1d437d2493c5b8f5901eecf36f393f3a2da4a9c2e13c2688eee89d6aae03586f3c24e5bf4362763f86abec5486c6ec6752b3b15f778ec530ecf949736c848fd977abdbb466ab2534220cf8ffc406885c22841d5ac60237ef68756496710b995474691370aa0a636ae44c320ae391477aa3858ff8c2c82961bb0c17dc201db33155b1e095d351ee402ecd78358f9692701a9d2d511de741c2ce4e4b956912fb153e8c0608a5aa48e21336b6b7273400bb3960b781d3bd7d553bbeedd4cca6081f2f638a46fd6656081179139039f9001a5121669ccaefc8cb88763ecadb1a23303b95479f0504839b7b35775fc79eaa22e3633e86260a879a9d3c0f40f7f2c2ebf683172cbeeb41f505501721ebb18b630c3f2183416b3cfd549febe3e86f7e24100e8fa4bb50c4773a2d6987f918233d5f7d1f2dc9f2227acc4ab0a96f70b140067282c7f998ec57c75a0885be54b996d29c49f1e5dc05885e28905392b2b15909c2ff8287ccad5e397c6551e6b66d2c70af7494f961e6644c41fd77d5f8d10289626419306daf5735f2770e153db982f76b5ef739ddc256a80a80030ee783047378e4c9d13ca4371d1a8f34ca9133360c7d889b8a6df0c375ceab8dfddf9a05640cfbdd85267b174bef2f57ca89616d57125540d322cc5c9cc9dc93f0086975d8f3cebe4e2ab934acceafec636221afda0283c6d57d616b5dafc19759a44e1ac56a707392b101b04dd33b3a3f8ea6218a7d66ae120c4840c5a1293cc67dbcb90eeb6188b004366198266b456f7a58e7efb81b58627b76cfda69110d4cbba3b2a7f777ebc6e1310913487a7b1e43b858aa8d024511a08cbebacc629fb38fc3c6da5fc0ddb79ec195a74b1c0f9cd1fceefda385e0beae459c46d6d703554f15a941666eb8077fa17d102896744ec25033b63ac1dba8059", 0x499}], 0x1, 0x0) 23:36:47 executing program 5: r0 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r0, &(0x7f0000000000)={{0x3, @rose, 0x1}, [@default, @bcast, @bcast, @bcast, @remote, @default, @bcast, @null]}, 0x48) 23:36:47 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xfc}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:47 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1141.234699] binder_alloc: binder_alloc_mmap_handler: 6536 20ffd000-20ffe000 already mapped failed -16 [ 1141.269008] binder: BINDER_SET_CONTEXT_MGR already set [ 1141.287241] binder: release 6536:6545 transaction 1544 out, still active [ 1141.307651] binder_alloc: 6536: binder_alloc_buf, no vma [ 1141.320034] binder: undelivered TRANSACTION_COMPLETE [ 1141.330319] binder: 6536:6556 transaction failed 29189/-3, size 24-8 line 3035 23:36:47 executing program 5: mknod(&(0x7f00000001c0)='./bus\x00', 0x8003, 0xa6138) r0 = open(&(0x7f0000001ac0)='./bus\x00', 0x0, 0x0) preadv(r0, &(0x7f0000001880)=[{&(0x7f0000000040)=""/18, 0x12}], 0x1, 0x0) execve(0x0, 0x0, 0x0) [ 1141.353055] binder: 6536:6545 ioctl 40046207 0 returned -16 [ 1141.378658] binder: send failed reply for transaction 1544, target dead [ 1141.390440] binder: undelivered TRANSACTION_ERROR: 29189 23:36:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x2000, 0x0}) 23:36:47 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc, 0xc0fe]}}, r2}}, 0x48) [ 1141.555502] binder_alloc: binder_alloc_mmap_handler: 6578 20ffd000-20ffe000 already mapped failed -16 [ 1141.593859] binder: release 6578:6580 transaction 1549 out, still active [ 1141.604643] binder: undelivered TRANSACTION_COMPLETE [ 1141.621463] binder: send failed reply for transaction 1549, target dead 23:36:47 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x40000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:47 executing program 5: r0 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r0, &(0x7f0000000180)={{0x3, @default}, [@rose, @null, @remote, @remote, @null, @default, @default]}, 0x10) connect$ax25(r0, &(0x7f00000000c0)={{0x3, @netrom}, [@remote, @netrom, @default, @default, @rose, @remote, @null, @bcast]}, 0x48) connect$ax25(r0, &(0x7f0000000040)={{0x3, @netrom}, [@rose, @remote, @bcast, @netrom, @rose, @bcast, @remote, @default]}, 0x48) 23:36:47 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0x80fe}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x3f00, 0x0}) 23:36:47 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe, 0xc0fe]}}, r2}}, 0x48) 23:36:47 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) [ 1142.076391] ax25_connect(): syz-executor.5 uses autobind, please contact jreuter@yaina.de [ 1142.130115] ax25_connect(): syz-executor.5 uses autobind, please contact jreuter@yaina.de 23:36:48 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xc0fe]}}, r2}}, 0x48) 23:36:48 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xc0fe}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x1000000, 0x0}) [ 1142.181597] ax25_connect(): syz-executor.5 uses autobind, please contact jreuter@yaina.de 23:36:48 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000001080)='/dev/dri/card#\x00', 0x0, 0x0) flistxattr(r0, &(0x7f0000000000)=""/10, 0xa) 23:36:48 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xfc00}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:48 executing program 5: mknod(&(0x7f0000000180)='./file0\x00', 0x81c8, 0x401) mlock(&(0x7f0000001000/0x1000)=nil, 0x1000) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) setrlimit(0x6, &(0x7f0000000000)) mlockall(0x8000000000003) mmap(&(0x7f0000000000/0x3000)=nil, 0x20001, 0x2, 0x10, r0, 0x0) [ 1142.350924] binder_alloc: binder_alloc_mmap_handler: 6615 20ffd000-20ffe000 already mapped failed -16 [ 1142.374323] binder: BINDER_SET_CONTEXT_MGR already set [ 1142.387775] binder: 6615:6623 ioctl 40046207 0 returned -16 [ 1142.413917] binder: release 6615:6623 transaction 1555 out, still active [ 1142.423580] binder_alloc: 6615: binder_alloc_buf, no vma [ 1142.431692] binder: undelivered TRANSACTION_COMPLETE [ 1142.449046] binder: 6615:6626 transaction failed 29189/-3, size 24-8 line 3035 [ 1142.459296] binder: send failed reply for transaction 1555, target dead [ 1142.476184] binder: undelivered TRANSACTION_ERROR: 29189 23:36:48 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00, 0xc0fe]}}, r2}}, 0x48) 23:36:48 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xfe80}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:48 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x100000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x2000000, 0x0}) 23:36:48 executing program 5: openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='taskq\x00', 0x2, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt(r0, 0x65, 0x5, &(0x7f0000000000), 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) sendmsg$can_raw(r0, &(0x7f0000000140)={&(0x7f0000000200)={0x1d, r1}, 0x10, &(0x7f00000000c0)={&(0x7f00000001c0)=@can={{}, 0x0, 0x0, 0x0, 0x0, "e96b4b8fdd5fd9b1"}, 0x10}}, 0x0) 23:36:48 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x2c7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:49 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xfec0}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1143.094467] binder_alloc: binder_alloc_mmap_handler: 6640 20ffd000-20ffe000 already mapped failed -16 [ 1143.118712] binder: BINDER_SET_CONTEXT_MGR already set [ 1143.126868] binder: 6640:6644 ioctl 40046207 0 returned -16 [ 1143.137916] binder: release 6640:6644 transaction 1560 out, still active 23:36:49 executing program 5: 23:36:49 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80, 0xc0fe]}}, r2}}, 0x48) [ 1143.154716] binder: undelivered TRANSACTION_COMPLETE 23:36:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x12000000, 0x0}) [ 1143.179869] binder: send failed reply for transaction 1560, target dead 23:36:49 executing program 5: 23:36:49 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xff00}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:49 executing program 5: [ 1143.336617] binder_alloc: binder_alloc_mmap_handler: 6671 20ffd000-20ffe000 already mapped failed -16 23:36:49 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0, 0xc0fe]}}, r2}}, 0x48) [ 1143.392025] binder: send failed reply for transaction 1564 to 6671:6675 [ 1143.398890] binder: undelivered TRANSACTION_COMPLETE [ 1143.428308] binder: undelivered TRANSACTION_ERROR: 29189 23:36:49 executing program 5: 23:36:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x14000000, 0x0}) 23:36:49 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xfc000000}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:49 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x300000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:49 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00, 0xc0fe]}}, r2}}, 0x48) 23:36:49 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x300}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) [ 1143.981417] binder_alloc: binder_alloc_mmap_handler: 6692 20ffd000-20ffe000 already mapped failed -16 23:36:49 executing program 5: 23:36:50 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xfe800000}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1144.033139] binder: BINDER_SET_CONTEXT_MGR already set [ 1144.045739] binder: 6692:6693 ioctl 40046207 0 returned -16 23:36:50 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc000000, 0xc0fe]}}, r2}}, 0x48) 23:36:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x20000000, 0x0}) [ 1144.086449] binder: send failed reply for transaction 1568 to 6692:6693 [ 1144.104864] binder: undelivered TRANSACTION_COMPLETE [ 1144.134612] binder: undelivered TRANSACTION_ERROR: 29189 [ 1144.161828] binder_alloc: binder_alloc_mmap_handler: 6714 20ffd000-20ffe000 already mapped failed -16 23:36:50 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xfec00000}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1144.196408] binder: BINDER_SET_CONTEXT_MGR already set 23:36:50 executing program 5: [ 1144.218001] binder: 6714:6720 ioctl 40046207 0 returned -16 [ 1144.239629] binder: release 6714:6720 transaction 1572 out, still active [ 1144.254549] binder: undelivered TRANSACTION_COMPLETE 23:36:50 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000, 0xc0fe]}}, r2}}, 0x48) 23:36:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x3f000000, 0x0}) [ 1144.281257] binder: send failed reply for transaction 1572, target dead 23:36:50 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xff000000}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1144.378941] binder_alloc: binder_alloc_mmap_handler: 6737 20ffd000-20ffe000 already mapped failed -16 [ 1144.400119] binder: BINDER_SET_CONTEXT_MGR already set [ 1144.410711] binder: 6737:6739 ioctl 40046207 0 returned -16 [ 1144.422201] binder: release 6737:6739 transaction 1576 out, still active [ 1144.432645] binder: send failed reply for transaction 1576, target dead 23:36:50 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:50 executing program 5: 23:36:50 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x900}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:50 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec00000, 0xc0fe]}}, r2}}, 0x48) 23:36:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0xfdfdffff, 0x0}) 23:36:50 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xfc00000000000000}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:50 executing program 5: [ 1145.037649] binder_alloc: binder_alloc_mmap_handler: 6760 20ffd000-20ffe000 already mapped failed -16 23:36:51 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xfe80000000000000}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:51 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000, 0xc0fe]}}, r2}}, 0x48) [ 1145.081160] binder: BINDER_SET_CONTEXT_MGR already set 23:36:51 executing program 5: [ 1145.104628] binder: 6760:6763 ioctl 40046207 0 returned -16 [ 1145.117115] binder: release 6760:6763 transaction 1580 out, still active [ 1145.126003] binder_release_work: 1 callbacks suppressed [ 1145.126009] binder: undelivered TRANSACTION_COMPLETE 23:36:51 executing program 5: [ 1145.158008] binder: send failed reply for transaction 1580, target dead 23:36:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0xfffffdfd, 0x0}) [ 1145.277504] binder_alloc: binder_alloc_mmap_handler: 6788 20ffd000-20ffe000 already mapped failed -16 [ 1145.317857] binder: BINDER_SET_CONTEXT_MGR already set [ 1145.333704] binder: 6788:6789 ioctl 40046207 0 returned -16 [ 1145.349052] binder: release 6788:6789 transaction 1584 out, still active [ 1145.358353] binder: undelivered TRANSACTION_COMPLETE [ 1145.371953] binder: send failed reply for transaction 1584, target dead 23:36:51 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x900000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:51 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xfec0000000000000}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:51 executing program 5: 23:36:51 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0xc0fe]}}, r2}}, 0x48) 23:36:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x100000000000000, 0x0}) 23:36:51 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xa00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:51 executing program 5: 23:36:51 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000, 0xc0fe]}}, r2}}, 0x48) [ 1145.931712] binder: 6796:6798 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1145.952906] binder: 6796:6798 transaction failed 29189/-22, size 24-8 line 2896 23:36:51 executing program 5: [ 1145.984869] binder: 6796:6814 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1146.004861] binder: 6796:6798 transaction failed 29189/-22, size 24-8 line 2896 [ 1146.029643] binder: undelivered TRANSACTION_ERROR: 29189 23:36:51 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0xff00000000000000}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1146.037848] binder: undelivered TRANSACTION_ERROR: 29189 23:36:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x200000000000000, 0x0}) 23:36:52 executing program 5: [ 1146.179447] binder_alloc: binder_alloc_mmap_handler: 6827 20ffd000-20ffe000 already mapped failed -16 [ 1146.224559] binder: BINDER_SET_CONTEXT_MGR already set [ 1146.242688] binder: 6827:6829 ioctl 40046207 0 returned -16 [ 1146.262818] binder: release 6827:6829 transaction 1590 out, still active [ 1146.273249] binder: undelivered TRANSACTION_COMPLETE [ 1146.289086] binder: send failed reply for transaction 1590, target dead 23:36:52 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xa00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:52 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0000000000000, 0xc0fe]}}, r2}}, 0x48) 23:36:52 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0x0, 0x223}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:52 executing program 5: 23:36:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x1200000000000000, 0x0}) 23:36:52 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:52 executing program 5: [ 1146.983494] binder_alloc: binder_alloc_mmap_handler: 6841 20ffd000-20ffe000 already mapped failed -16 [ 1146.993453] binder: BINDER_SET_CONTEXT_MGR already set [ 1147.001274] binder: release 6841:6842 transaction 1594 out, still active [ 1147.008774] binder: 6841:6842 ioctl 40046207 0 returned -16 [ 1147.015081] binder: undelivered TRANSACTION_COMPLETE 23:36:53 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000, 0xc0fe]}}, r2}}, 0x48) 23:36:53 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback={0x0, 0x300}}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1147.040931] binder: send failed reply for transaction 1594, target dead 23:36:53 executing program 5: 23:36:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x1400000000000000, 0x0}) [ 1147.199943] binder_alloc: binder_alloc_mmap_handler: 6863 20ffd000-20ffe000 already mapped failed -16 23:36:53 executing program 5: [ 1147.304149] binder: send failed reply for transaction 1598 to 6863:6864 [ 1147.330414] binder: undelivered TRANSACTION_COMPLETE [ 1147.340488] binder: undelivered TRANSACTION_ERROR: 29189 23:36:53 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:53 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xfc]}}, r2}}, 0x48) 23:36:53 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xfc}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x2000000000000000, 0x0}) 23:36:53 executing program 5: 23:36:53 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x4000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:54 executing program 5: 23:36:54 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0x80fe}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1148.078858] binder: BINDER_SET_CONTEXT_MGR already set [ 1148.090727] binder: 6885:6888 ioctl 40046207 0 returned -16 [ 1148.100611] binder: release 6885:6888 transaction 1602 out, still active [ 1148.104692] binder_alloc: 6885: binder_alloc_buf, no vma [ 1148.109913] binder: undelivered TRANSACTION_COMPLETE 23:36:54 executing program 5: 23:36:54 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x80fe]}}, r2}}, 0x48) [ 1148.129773] binder: send failed reply for transaction 1602, target dead [ 1148.165715] binder: 6885:6888 transaction failed 29189/-3, size 24-8 line 3035 23:36:54 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xc0fe}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:54 executing program 5: [ 1148.200405] binder: undelivered TRANSACTION_ERROR: 29189 23:36:54 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x3f00000000000000, 0x0}) 23:36:54 executing program 5: 23:36:54 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xc0fe]}}, r2}}, 0x48) 23:36:54 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xfc00}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:54 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:54 executing program 5: [ 1149.002577] binder: 6922:6931 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1149.031387] binder: 6922:6931 transaction failed 29189/-22, size 24-8 line 2896 23:36:55 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xfe80}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000000)=0x10001) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x6) 23:36:55 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xfc00]}}, r2}}, 0x48) [ 1149.051376] binder: 6922:6942 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1149.069074] binder: 6922:6931 transaction failed 29189/-22, size 24-8 line 2896 [ 1149.087720] binder: undelivered TRANSACTION_ERROR: 29189 [ 1149.094439] binder: undelivered TRANSACTION_ERROR: 29189 23:36:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x8000000000000000, 0x0}) 23:36:55 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xfec0}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1149.199295] binder_alloc_mmap_handler: 1 callbacks suppressed [ 1149.199311] binder_alloc: binder_alloc_mmap_handler: 6948 20ffd000-20ffe000 already mapped failed -16 [ 1149.309175] binder: release 6948:6951 transaction 1609 out, still active [ 1149.320996] binder: undelivered TRANSACTION_COMPLETE [ 1149.358351] binder: send failed reply for transaction 1609, target dead 23:36:55 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xa702000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:55 executing program 5: r0 = msgget(0xffffffffffffffff, 0x3fd) msgrcv(r0, 0x0, 0x0, 0x0, 0x0) msgctl$IPC_RMID(r0, 0x0) 23:36:55 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xff00}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:55 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xfe80]}}, r2}}, 0x48) 23:36:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0xfdfdffff00000000, 0x0}) [ 1149.963265] binder: 6977:6989 IncRefs 0 refcount change on invalid ref 0 ret -22 23:36:56 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xc702}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:56 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xfc000000}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:56 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xfec0]}}, r2}}, 0x48) 23:36:56 executing program 5: clone(0xfffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) clone(0x40000004001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x8, 0xe3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 23:36:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0xffffffff00000000, 0x0}) [ 1150.293088] binder_alloc: binder_alloc_mmap_handler: 6992 20ffd000-20ffe000 already mapped failed -16 23:36:56 executing program 5: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r0, &(0x7f0000000100)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose, 0x1, @netrom}, 0x1c) [ 1150.335451] binder: BINDER_SET_CONTEXT_MGR already set 23:36:56 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xff00]}}, r2}}, 0x48) [ 1150.363096] binder_alloc: 6992: binder_alloc_buf, no vma [ 1150.383586] binder: release 6992:6996 transaction 1613 out, still active [ 1150.392389] binder: 6992:6996 transaction failed 29189/-3, size 24-8 line 3035 [ 1150.409544] binder: undelivered TRANSACTION_COMPLETE [ 1150.436883] binder: 6992:7002 ioctl 40046207 0 returned -16 [ 1150.452983] binder: send failed reply for transaction 1613, target dead [ 1150.464071] binder: undelivered TRANSACTION_ERROR: 29189 23:36:56 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xffffffff00000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:56 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xfe800000}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x400, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:56 executing program 5: r0 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) ioctl$SIOCAX25DELFWD(r0, 0x89e7, &(0x7f00000001c0)={@default, @null}) 23:36:56 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xfc000000]}}, r2}}, 0x48) [ 1150.794917] binder_alloc: binder_alloc_mmap_handler: 7024 20ffd000-20ffe000 already mapped failed -16 [ 1150.825212] binder: BINDER_SET_CONTEXT_MGR already set [ 1150.835566] binder: 7024:7025 ioctl 40046207 0 returned -16 [ 1150.854968] binder_alloc: 7024: binder_alloc_buf, no vma [ 1150.870161] binder: 7024:7030 transaction failed 29189/-3, size 24-8 line 3035 [ 1150.886815] binder: release 7024:7025 transaction 1618 out, still active [ 1150.909314] binder: undelivered TRANSACTION_COMPLETE [ 1150.915386] binder: undelivered TRANSACTION_ERROR: 29189 [ 1150.927827] binder: send failed reply for transaction 1618, target dead 23:36:56 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x400000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:56 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xfc00]}}, r2}}, 0x48) 23:36:56 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xfe800000]}}, r2}}, 0x48) 23:36:56 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xfec00000}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) r2 = socket$caif_seqpacket(0x25, 0x5, 0x4) ioctl$sock_SIOCDELDLCI(r2, 0x8981, &(0x7f0000000000)={'veth1_to_team\x00', 0x7}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:57 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xff000000}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1151.046475] binder: 7048:7049 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1151.066171] binder: 7048:7049 transaction failed 29189/-22, size 24-8 line 2896 23:36:57 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xfc00]}}, r2}}, 0x48) [ 1151.094436] binder: 7048:7058 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1151.107672] binder: undelivered TRANSACTION_ERROR: 29189 [ 1151.113900] binder_alloc: 7048: binder_alloc_buf, no vma [ 1151.122453] binder: 7048:7049 transaction failed 29189/-3, size 24-8 line 3035 [ 1151.170400] binder: undelivered TRANSACTION_ERROR: 29189 23:36:57 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:57 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xfec00000]}}, r2}}, 0x48) 23:36:57 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xfc00000000000000}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="000000f20b000000"]], 0x0, 0x0, 0x0}) 23:36:57 executing program 5: clone(0x3002001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) tkill(r0, 0x22) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000000c0)={@mcast2, @mcast1, @mcast2, 0x0, 0x0, 0x0, 0x124}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 23:36:57 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x1000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) [ 1151.726493] binder: 7081:7082 got transaction with invalid offset (51304726528, min 0 max 24) or object. [ 1151.758423] binder: 7081:7082 transaction failed 29201/-22, size 24-8 line 3097 23:36:57 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) inotify_init1(0x80800) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$netlink(0x10, 0x3, 0x4) write(r2, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0x9, &(0x7f0000000080)=0x8af9, 0x4) recvmmsg(r2, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 23:36:57 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xfe80000000000000}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1151.785635] binder_alloc: binder_alloc_mmap_handler: 7081 20ffd000-20ffe000 already mapped failed -16 [ 1151.820511] binder: BINDER_SET_CONTEXT_MGR already set [ 1151.825837] binder: 7081:7082 ioctl 40046207 0 returned -16 23:36:57 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xff000000]}}, r2}}, 0x48) [ 1151.847016] binder: undelivered TRANSACTION_ERROR: 29201 23:36:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x80000000, 0x400000) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:57 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xfec0000000000000}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:57 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xfc00000000000000]}}, r2}}, 0x48) [ 1152.045308] binder_alloc: binder_alloc_mmap_handler: 7215 20ffd000-20ffe000 already mapped failed -16 [ 1152.090222] binder: BINDER_SET_CONTEXT_MGR already set [ 1152.114282] binder: 7215:7216 ioctl 40046207 0 returned -16 [ 1152.139836] binder: release 7215:7216 transaction 1630 out, still active [ 1152.152992] binder: undelivered TRANSACTION_COMPLETE [ 1152.158219] binder: send failed reply for transaction 1630, target dead [ 1152.170095] protocol 88fb is buggy, dev hsr_slave_0 [ 1152.175235] protocol 88fb is buggy, dev hsr_slave_1 23:36:58 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x20, 0x2) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001700)={0x0, 0x9, 0x20, 0xb44}, &(0x7f0000001740)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000003c40)={0x0, 0x9, 0x20}, &(0x7f0000003c80)=0x34a) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f0000001dc0)={0x0, 0x8001}, &(0x7f0000001e00)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffff9c, 0x84, 0x7b, &(0x7f0000001e40)={0x0, 0x5}, &(0x7f0000001e80)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000001ec0)={0x5, 0x2, 0x4, 0x2, 0x0}, &(0x7f0000001f00)=0x10) sendmmsg$inet_sctp(r2, &(0x7f0000003a80)=[{&(0x7f0000000100)=@in={0x2, 0x4e20, @multicast2}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000140)="120a", 0x2}, {&(0x7f0000000180)="160a92147e98026eab4db687075e8a5ba4680f612c3504b7b4023bcfed1cf9a0a292f82d2007a53cc8b8b0abb754640c6b860df23e71be93ee166f9e8592a445b97c46e04887b63dd15c457f6b7129ff8291515dce54663eb738f836ef69525239a7a6cc7880f56357d63df9ae35f1b16d199b1f099fa01b42212da009534f1c812d73933e4d94a6f61b11225a829af6ec80271dbfc9d907cac37b90437a07fc6b9fc5955750f119e5d8d9c4c9e8f00ef51031652a279952b5b37b88ec9293d8db08529603d985ef7f30cf", 0xcb}], 0x2, &(0x7f0000000440)=[@init={0x18, 0x84, 0x0, {0x867f, 0x5, 0x200, 0x101}}, @prinfo={0x18, 0x84, 0x5, {0x10}}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x7}}, @dstaddrv6={0x20, 0x84, 0x8, @ipv4={[], [], @multicast2}}], 0x68, 0x1}, {&(0x7f0000000340)=@in6={0xa, 0x4e23, 0x5, @mcast1, 0x2}, 0x1c, &(0x7f00000016c0)=[{&(0x7f00000004c0)="832f317ecf529b2c5ee6dc78ed0b85c2a9dae7c1578619deba893f8a5427dd145bcea8916cb9a2f5ddd2f4e4e2d10eb955df6a3e9477eecf5fe34f4227e3f2ae24f8cf8b965fd2a458d6660b374e55df80e0c1ad83769ec7e71f64e9fc8f99158e03c992e401538f36e0b24b9d6da015d067843fe14c816431422168e0acb7116a9140860ce43e9170f186a5700c3a34d66ad91f90d1883dd2c098ad70c90b8e39fc", 0xa2}, {&(0x7f0000000580)="8269357d8c94b0ecfc2e97381b949c2ce184e4f04e35be374ce360e227c4ca6aea575de365e8ac9fb1fa35e004d890e07d8f14ca19240a35c5c1d01f3b7fe66926ab9f6cc645f8d24e24259c2ea123721ea444de87a50715180af9e52d016fa6d1783e137f307b50b7c0", 0x6a}, {&(0x7f0000000600)="8a255016e095193668e11d6b530ee72eca6d1b2754ff366a31e1a760b92b781b7ebd96bf0718d1cc9c02fe895210cb60a0c409ab8280e4de7c52b0d330a8352c5759e63bc7e106840c6bc3ec5190af6dfdbb4e260996f407270926c54749c146572d9e4f876081755271df8b840fb355fa29859bc9c74579cad7a6b208fc91d60369858e7690ef3e46ede42745336bc5d32c72ca782f0a4b418e11c7a04887e831de68d89c0454872c34cc2f1e5c37426ee4b9ad0ff8772e9cca642e68f5833ca95fc0566a7f7ba22ec2b36a7475c6247fe08c4b1c55a9216916231b9d9a95e82370f45e36dc0596eedf4a87029fad88c134fb4d27f6dbe1602bf69548d93b45114acc754c930accf36a26d21130536d9639f3e3fab00e91dc399ca2bd60065a2fa9e16e402fa0c96d12a48ef96c7db6ce17eb4b44daaa0eaaf0408d71276e4410627dc73c0c59e465b4d0f776b3d867ab27ab826726c8e3fdf97749affa6b972f54416804c32034927c3003d9a3186ad7c4e74144653375593543ed44daef1e938fa1736b28ab94bcf1ba98602df560619ac85733cf67564a7e3b3907c5132d7357a21091604e6e353d1daadd2f4c507a15e0bb67d2e506d3c9a26c44eec4bc8250313a12403a98967c761b3fd287c4c3b544ffe8da7002489fcfee9f4ae09f4310b11489ef1542cfd9e02fa9d79681a08ef25e93b4699a47dbdb791e3bbb4225ed1680311745109f9877daf52b0100107c3423d32ff9f379921c2107f2342bfd77b782f7c5c9329c12ff5d72dc9c854098cf8c0dadf6e6c13f61c9b3959b1ed94036909022614f15c0084a86575570b3b634f6064f8c8a60b66c9170edbe628dfb3d8c17815c31c51a65cb57962935054a7b96673a2d511539dce92e51be96276d83ee5a1531cf7857bf95fe103a8fe39d3a24f34f0627e76cc4eb4196594cba48d590393a5373c10d6a8ccab63210e8c27eaba7866875775b0265f49f75a47d1964681ce9483877b255277cf843bfe507ebfa0257ba04703d2f7f18d1a88a2d4844bb8fd719b7ef2cc714210a10b3cbb5da2a44933b56d1e1a1807731bfc86008678f62e83b95ce130af9d6557e2a26df9b2678a946e1db04c6dfcf7968aa60d0d39fa34fd128b52cfc9096ce16b30b8ac3d4d7a1e73348c02e9df807c5bff535f606691344e4c50cc76369611e5c53d58e5d876b03c27b0c555124c29c67bb802c8089101c7ff487887ec1c45b559b80de383c2513396a61bc222b5df058dee6b8bcc507049b63bac8d655ab078cad13b9c7c80423dcc0b8e430bc6d544af2606476314d346cdcb7643a9f19fe047366cb3db6011d516d39561987354d61652a2a826fc8bafbf1a85fdc080c094d68655aa9cd4f5fa16dbaa099016b16d74e877a5622adec76f62bd590ac0d320a25f69f778af62d63352a66ced93438830b6ec66c8a93027094ef8c7eb0c48139de40c4cf6148ef0e5f71804fe79a12007a571aae66b342dd5e521f06b2573d2b60a4cfbb7a14511ac8851a9bdb766d59c3bc9f4cc3ede3b60d28efd7748e89654ee8938abad3ad8cbfa085e69f24a4444a6956bf74cc7ca35af3e74b7d25c2ade3f0a4ffb08303951210a89070f5ef58cc5303d6fd0658af4b6abf2fffc7e331f0ad73c669bcedc6dbc5837c6cf1cae1cde3a449ea2a53399dc8026b8811de080026566bc6bdd794234948d5275d7b8b00b0f2e3be1332e26bd204adb0b06b52ace0c091bd9d19d034ce918d2ec7a330bbeb54b5bffe1fd7f82c509faa3bfbf97588ac6ea629d5d3e3ba161726065aec53fb87d8b2dd6aef70a0b730850c452145891a6ef3f3087acc9754801e2668ff5343a8e0b9aa8067c0b498fd472b5af80866521c0521b8b21a8dd138d75be16a74a45f5f9293cb40468f993ca6eb2a390f9ee6e3e0ff43b598aea967093357ea6eb677f672f5687ca0ca995b3b1e4eca23e68fcf69baad58a721d3b7c4e5d0237db690474f82acb9c20fa13e5e86a9fae39027db77e439a1707907b737c487d866e7b3dddaaea0b3d2a228ecdd8b4d1db65b412bb5eeedcf46f21a272d257899882da7e07be33dcc1babc70a9982b3170cdfe92f09d14c9d4428f4300aa0084939659d8699c2397d8afda5e7393653514474b31cb9e3dbdf8fdd5d0c0cfe86ee5adaffddbbda95b28a47f5b630250acd531f383edacf2ed728c6b93e66d26eaa4b700c8936aeeefa222c735d8d2773d064aeec7630184bed21604e99695e03a87f82bd74caf298aeddef1d7d4609660761131ce955c0f6016bac5e7370df6f36a7d50a7176e370d7a4242d592b8a6d352a3285d93e6204c7ee201981f64e1fc9223d94f682ab970caac727850e021130c74d710a5ba09c743eddab7cb5ccdf6db782ddebc85b9b46ca5f517b46c129d6c1f9726db0883a60535888c81081cf97860c1bb5f7329148c32e3e974cf0d25c892d2c57637f7950ddc33c37ff88db806a10b6e636618198070358f3f8eed1f9f7ac2b0742878814420d7911d803172035e8be9d470d1c78a79248e51eea068714b045c69b936eb8fbd31c1d14acb00b7e4602f7510cb29aa92d746aefd1251b8b0c01ca27507e23c9b3baa12431582ebcb863ab754ff0441a71fff8d5645878312cf1649da0c57b68f3064483a0f6b902e8eccec7c0af67a123dde380b500b5c0c144fe657f5d3d6ff8a54b7f938ac079d3133e83bec9c47c861e61ad50462730745a9a183a5db1997b00fee1f06d85d427ac049e27e1e204d8195268df05ee0b9e66bdea0c1033f573c75aaf9dab988c39f0e4631804da2aedb4c4e65f4cf37e16db8470a58a396996e5037d1c134f121a757bd910393c5f7f029abea983bf1091eb2dcb6f02f1110fbb8fb87fc638e1ab8906b5e33a5bb76bfa579c2621ce7c7613748b35dc636bc1b9750a97848fb4bb90c0a9d9608a64c3ddb6a0c7c3bdeb67750bc99ea9f7c39e5d7f0af81b5e8028929b8d60ce08206f9bf3d778829da36fd51c8e502e8021787e0cf65b52b2523109ad3e335250c35eaa376a8e6e49d93b26c69ef697d82e5b6243b6ee604b25cd4b7aac537a7f69e2563373f364ee6f65494457cfacea25ca2087c0b0f9c6aaeee9248cb0e83ba1b7f8460847f7ce99f11002c495284d8f624c8a31d715adc4160fdca05be4b45822cdf2e51cd3d6cb12122e4667e0f3fb446fab1305296f31120d5e3008b13401911cf4058e4cda9d8424d01c758478190afbb7669d163a41ed7cb48966b6cd51638a0151e25688325319398ef0438db440340ad96cbea8db972b0ba61d7d9f92aa590665ddf30ebde112f44023293d4da0fadd3e7b472ecda14eab6d4a36b0fa1b92556ddcf1120bac2fd52216741016998074f7ef99b785620d1d29abc9d6126a5e9cf7fde2676397f7a541adeb4e24e07bbee31a9aed8fdb3278d351914106a2c55115dc0aeb58279772ca2a76443323847b64cc2220a7d211be934713c75c25c2f5ec18292bf29b5286c5512c512ea8fc7ce7fe01fab786c0d8c274fcca706c46cc40318dd66f0814745cfd9853adfd6e4c866fdd4caadf5196ed0f2c5d7919a51cfc592d5ae38bac25988dba4bb0018ffde4721421014988c3f7fd588850335c64976b8c22d8a8aa67c0999aab4018bd3a9ffc7ae2c122387c5293ca6d7b68051b6a255f3cbeb71c9cb13057e73677add623792c0528325cec04795f88bd4f3ab987c13b57c0b9cf191b703c47bfb6ab4bd53415d2bd94b2e4b85d712c7c10f01c9b18bd152d99d69952060f3498cce069337b8d9623f458a17ea1374f1102961b85a7d8855405e7fb167c4854e06322d04a313a8a13eac225d2983397b3ce175cf3e669c5907defa00fc2c7353fdb31b9513ecb7b5cfc4990b917a2f0afd8e0660b5647da35de4d5ecf5a4d2b25d2b0fdbba07db3a3ba83c0c8d67d02360430e140eb5e4cb2f423a86599fa51279aa065cdf51fd748ccb038d681c85c02a9489845dc41ad13124c4d58204be7eb9dbe8d3cad195138e8844bc2a44ef2ce0d0ba25673d345f4d4507ee43386c6b2ea1418209494904fcb154ca463655978526cb3657053c9894d03796189f17993b807a1569dfb7d443c6d5880d23d8eab4ab7fc2d2bbc4726d6ce41d4fbeb266cb11bc98959c198ad59a57cb6d0a5a1def2d34646268a4a7735e898c4a7df84f00cdfd597ccd6a527a3b154464c2d437072b98fad3b43453743bfe53b47a94a3133430f4b8d9eee279e9b184bd899da9f9e7828b733a62e1354a18a3ea565c6d02a97c481a543d6b6675620b0609b53cdeb24c5d9c68cd5da3b2d4eeb3e1bb025ba7f94ae620c051fc3b3b6f079605776ea908c7ef62111729a53758a02d2f705ff25309647d6f934d3ea0fc255eabb53326afebfc983885a4c5de1495bf8fcf03d5a921134c07d24466b3e8e109000e0570710714dee781bfbf1add95eae155a08505026799255131210fb77ba1142acf01c9e0ce3bfd425efa42df21a7e7da7688457f9a70e7e695e5321d49f69668f71cc86efe8967f4fc9f656ad0eb8dc198cc8f6bf732cb27dd422ed1223309cd42bc56797d224965ef6bcccc48294edf91bbd8ec3c30e01dae9287742ad73265a2150de2709a2cc88fd37ee1f5b0d32a78007aba444cac9226bf51f2b75f576c867461c6c592a98dc9d636c9cf8b57bb7f0bc6ef61450a0bf9d6000e61fd6ce7f3d17737b17279c830e64c279b8aea033a8a3e1cb49727d0ebb2b0d8d2cf281d0e5653086de210cd78132ba690f80108e032f269f3c7c2643dd0d25b8c65d2e00201f9a7d7081727148eed1d78962b89a81bdd40691253645cc34c72fa2bbb1bea3a1962d6727a568605f691bc2a1fde06a7e584b2635f8bcaa3b67d2400d4d8bb30bdbcacced0353badd37545a661b51a389ec1a8478e54b64159aba1267312e85402d66133db500804e8377049dc455dbcc1b04935069d3cc4e3c9f01113f38b118ebba800a35d8a82afc732dd3dfd776ebd938e8a150262d7aeebec4fcec247bc64ed22e8f42ff0b04bac70afae582a83ddee942ff513b8df1a9b9c93c25ee707f6aaa3a5988e37f829b4790690702c24c63011a064f3a1e27b09b13934e3eabd15b14727785d1af4669b3f3f2c3ac67aae6d6cab5d8742ea1e21a05634efcb2c909ec2b115761702bf964d37683e980b5cdfd8975a03624ffdf4a38e1d9a22a0d3ccb27a398d09942bec9019ac0b0e4d337dd04615b78536f21bf067df42f4a693d22cfae8f45198b84c2ca3cfd8ae5451d0f8a491249bef86c48e55a467258b3fb3a08fd94e03c12eff96828c2397fd666a7f86950c7107bc53d894649b4717ad9ffc467755877f940571d7eb8a8bc091193c8ff74932cc9ff9cdc936251a3fcdbc2ce68f1191c8427fc77a01678ed7186c1ffe10c1621f917def7a7cf11480fd4b00dd85e48f75ab52c4db73541acff432db93c33710bf7c448bbb7c42953a1746ca4e68e4d720c460ba8453ace465775a0df3b9af1c7cf71dfa86aba2bf384164001629175d79b3ddbcf811a3eb821c01d3dccd1f4c17012183aa2f6c000f331e42526f9af9ae67897f8d91581460bd9853da5b154fca7cfeabc836ba516155a16ff1038ddaa0dd93040160cf85f7008799ff5f16c523e434b20f83d1da980c28d91fdbb5a378fd0f5ab9df4c7302db98c5f3e436014044191b51ae666da1503cecf9ed1b0277a9687df8626b432cac6ff34bd241f94dfcb81646b0a6bb398d3dd80cb522f70641e5902f7e505db9016603ab3b4", 0x1000}, {&(0x7f0000001600)="3e3a64a8cf9cb81ad89afeb5e18d65a5701b7bbbfcabdd6314670176ac2a9634f9b63d8cefe75997b9c437ee15dc9c086bf11b9a8e3a152dd95c0ef40cbbc760cb0b08946ab595942aa42f213aa5f681967cda8eed6368d16d583f539d1e6780540717f56f8bbe22ccfa77c5b051765db8a38141a5b80c63f54bea746118d74a818c2a4718c052a1204cfdc377609a655ac2dd802fd24ffceb24cbd784667e8d27de948f12bec1685c348bf65761984ba317c2a3e1bdd3", 0xb7}], 0x4, &(0x7f0000001800)=[@init={0x18, 0x84, 0x0, {0x3, 0x1, 0x9, 0x1f2}}, @dstaddrv6={0x20, 0x84, 0x8, @empty}, @dstaddrv4={0x18, 0x84, 0x7, @local}, @authinfo={0x18, 0x84, 0x6, {0x8}}, @sndinfo={0x20, 0x84, 0x2, {0x3, 0x4, 0x0, 0x263f, r3}}, @sndrcv={0x30, 0x84, 0x1, {0x100000001, 0x7f, 0x205, 0x80000000, 0xfd, 0x1, 0x4, 0x5, r4}}, @dstaddrv6={0x20, 0x84, 0x8, @initdev={0xfe, 0x88, [], 0x1, 0x0}}], 0xd8, 0x14}, {&(0x7f0000001900)=@in6={0xa, 0x4e22, 0x101, @loopback, 0x7fffffff}, 0x1c, &(0x7f0000001b80)=[{&(0x7f0000001940)="361c8b02508537aa37bb483aa5735a456bf95a80cf993278c2d3251d562ad165165e18c842008797b53e300b45032c98ab2257663cec875c4d5c01bc68f660aececbe081869a015cea19d2aa63", 0x4d}, {&(0x7f00000019c0)="64e2b1045aa272fde1cec6d2aed2e2ec05862baff23786e14c0c8472bd8ac6971be1e09428f1196808c131f9797ab311cc15e127ea8c8b9f30547cef64c28ffb7f9f70735e395be2ee4ca1f8d258a0a8109b6c73632b5da130a8f5abaf66c1498dbd6476ee916fd400a46d9fb2c27f887aa339ebb59896f3956403f058ef823f61e844c449ab4d16dbf2a6c4f5a83f6b84c7c24c512a5a79563ce07e29c1eb7cbbc67200b655de67c99d010e28db4a20557d9886a483f2dd", 0xb8}, {&(0x7f0000001a80)="72d3ea2eae3490b344c788744d87d4c4b32cc10ee980802633ddde8d3e348933f1295ebe3b1babf3426c7221c23cabc0c688209219fb13f4c5be7c40257bb4dd56c37febcf3a8ceeac7cfd5fb1ad60768a4de51f5f717045a6504517d415b819485ed81afaad58284cfbeffbfd42e672df349a0af66a6addcbb9f4c99ecf864e59d80d09c6d08d7e3e5c7582e201c8a02006266671b95215eec0626b8fc248637b01aadce0c7e608655493236d7ed37cc3eedcdb8c14c7cf567f1dbc86f920eca73bb89635fa99132680", 0xca}], 0x3, 0x0, 0x0, 0x4008800}, {&(0x7f0000001bc0)=@in={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000001d80)=[{&(0x7f0000001c00)="a8f1aaa93d9d8e6baffaee6bbf5991268ce8cdcb2de534d2b9a45b5ad2c8e4078aa1ba8f7a33fc5f73f9c101ed09558909e1635a25fbdec68a34f68f2d7069fbb240fa1bb67116daa3de9a6774799034d57dcb9343c84a6bf2ae5a1edab82155acca324e6d507640f01adbbbf4d18af882cc22ecc58f3e31b4a8966df69b1cfda82b8a58cbf1153f82bdd9a73bd66f72303d3058c5206a4c8287b03c72f1b7e36133b619c1d11ab8405116fad043b75038bcd792b10f04d85dd26cfbd47304fdc0decb536b5670", 0xc7}, {&(0x7f0000001d00)="4d5e891a114ee497e267f295fa9ddb746f790245394eb473f66df45cf8489886c4482a1a6621efca624bdbc0feb20b038cedae30e1681511cf17a08618267f532cadc8fca1ab6850024515b001b9c9502a97606a09f8e7d5758a2fa4d3c642", 0x5f}], 0x2, &(0x7f0000001f40)=[@sndinfo={0x20, 0x84, 0x2, {0x8, 0x0, 0x66d, 0xffffffffffffffa9, r5}}, @prinfo={0x18, 0x84, 0x5, {0x10, 0x8}}, @dstaddrv6={0x20, 0x84, 0x8, @remote}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x8a}}, @dstaddrv6={0x20, 0x84, 0x8, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}}, @sndinfo={0x20, 0x84, 0x2, {0x4, 0x8, 0x400, 0x3, r6}}, @authinfo={0x18, 0x84, 0x6, {0xfffffffffffffffe}}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x6}}, @sndinfo={0x20, 0x84, 0x2, {0x4, 0x4, 0x12d, 0x40, r7}}], 0x100, 0x20040000}, {&(0x7f0000002040)=@in6={0xa, 0x4e21, 0x1, @loopback, 0x7}, 0x1c, &(0x7f0000002200)=[{&(0x7f0000002080)="732bb59af0c91a1c7435ee04548ece3608cf86cb222c8f467a920e15741043fe4b884817e94d7b0594dc37cefd132458e5d474e93d5a8623f183c887c5ec6ead323dbd0db471efe64df08e98d0a3aa647796847955058c0db6c875c814b789b80d03e5c7025f6c6f713c2388f330da192e3aed1d66773a153743a5b44bbf04f16b9e595c99e2e35468f3f4cfd116dbefaf568a8b26ae7ed1e1fb9c905dda9ba67b1e06ad637b96d971d2672867dc6c61d64cfdff9ca49673808bc8639e141e8e26a2a7c99c1a83c780b1d321c09c621f89025ef4bcf4bf8f3faace7c77698e5c6915a7781b2daf51287382aeb0dde744aa2898", 0xf3}, {&(0x7f0000002180)="fb8a147148152a47a3c5db070fc3a0326678563d2830258e4ed32b3003484cffcef37a47a1ead8c792ccf7e79bda36799d2079d9df6d9f8f2291e2e26ab00a7e4818e0094bb1d1434d730d59cae2de9953cfbb774811b1df528f9c", 0x5b}], 0x2, 0x0, 0x0, 0xc0}, {&(0x7f0000002240)=@in={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000002340)=[{&(0x7f0000002280)="b28c09f52291115835205e062bddb2602539c166bae85e3ad20104b078", 0x1d}, {&(0x7f00000022c0)="0057c5e8a57bbc3aac787eb9b72400cc784acf831ad4ae7820fbf899d62a10f407e4820b84c64e3fade199e2c78b663dd70f8e063e715a7fbe8028858f05df2235beda04bf8388f51b2df3", 0x4b}], 0x2, &(0x7f0000002380)=[@prinfo={0x18, 0x84, 0x5, {0x30, 0x4}}, @dstaddrv6={0x20, 0x84, 0x8, @mcast2}, @dstaddrv6={0x20, 0x84, 0x8, @initdev={0xfe, 0x88, [], 0x0, 0x0}}], 0x58, 0x4000000}, {&(0x7f0000002400)=@in6={0xa, 0x4e22, 0x4, @empty, 0x1}, 0x1c, &(0x7f0000003840)=[{&(0x7f0000002440)="f85935a41363c17b3a5636d9d127c2fd70bc0af3084c95840f342767c8a98bd02b89c76f5d37897de91737d773471f53c9814ee6e470090cfac126a441491032b0b8c1a19db3bd21ccb8382c2e9eaf40e0f1cc93a835d3c5ba529791d20392e4d6e155d10b14388de3005488c8a82398459b1f6a33d510a3bd6976ef7958b7f402719064ce0db620a675ededd2d32e3c83204cad91e9696dea368c6e2914e61968d96754bd7f12f0b68071efdcb61daad0594b203b50074db1c660e426f7d6af133216f96e4b73adf86e46ec063ff55a79638f4f7f887960", 0xd8}, {&(0x7f0000002540)="5b3a94e47871ee1d67f88116f12ed0462ac012982c81d1d1371349c7ad8a6ea8242e8df46d758612cdc2f63eb30273161d191a856964c1bdd3b831f2e71de21fd2f455ee42af44ddca906b6b1f876e", 0x4f}, {&(0x7f00000025c0)="8838ca7af9063fd9eb94f29291905304229948c64b30fec3cbb5b33492f830003cd324a3f9ceebe841789829dc7cd85f9416067e0922f222f709fef6bd9ae491a0f70c2b78cb2e999ee02f747eda8a0166c99d712508bef95567f286", 0x5c}, {&(0x7f0000002640)="6ec17197fe4e2262a71b80c47a7158cc8726a2eab4cb31fe8de479056a8a3f75e399b5d969e555ad5542928c7a1d1c8bcbfa69a9b3c57cdc31938528abb7f13e97871d10717aedff57a91e75b1a9e693f751404c1f61090a0cba34f2df733f745b060d2e48f508f21670a212eac7a7703ab4197cae8d56988653f7a9466d3634", 0x80}, {&(0x7f00000026c0)="03fc7bc5832741b4bfdc87021bfd3b5043446980415cad4d20dbde39d06204d3e791442584f1d342b1da8b7fbdaaa60f6e0b5533b4610b58fded5443886d00c5b8322c31badca0812bc9b5077b42e915cc7dd89de14ea9bcb3ef5fb64dff219187c388fd2b3fb87c19331d25638d1c702296f3e82865221bca47ab554dd221b9921ec00bec2f026161b3accc5bc97ef42150bfefc015653c4d7cb29e866a366683dc805fda3460a93458021c1179767d8cbabeb661c28dcf768dcea5e534ee92ae44d32fafb24137439121a76b964f7c1f8101dfbb0d0ec9c5ea9f96b967268ec46d6c0e9bf475281e286ce26988421f7507b049c671286059925cb68427575eead6f9ad91e98da1a86fa7515d2c621b7936137534ce9befad2d2274085bf295c9a7d3b900cad60e07a72b3a7465467d44d6aeac1d0607c5718221b640cf43d2913fdd8c46fe28b9e36c96797216616e3a3f45f9f4b01a54849fe0d22096c753798d3bac56134091da950e32aba2ed6440cba1538d96abd804885c0182ebc6e7eb1c9c32c114fa14ae5bd7fe5a6f6c6a80de4ebeceb8e5b695f4abddcc989da2971b1faad7018dfe662af98afd1b813de48dff7282d23e5f9ff2f2e6adb17082a90586ec4fffa3bd44f46759a74bfe8b04d34c9128051934bd6baca2152c07e77a6da46387d68dd34337436c1ddf091042909f6b9c7f6d7b92a968e2c6023e1b895a5d5e9e0904b5db76aee7827e900112af53d6df256fb54c6061e5e9e449738cf42412cddded10a15713b56c5a9c3fb52ab0ddc5bbfec8ee7ae7a0957a7275c639dea1c28da91aaf382991f0f4e9bf811e9576129af5d10050a2ca05de7c656ab604c8213565d9300ca2fccf5ce60b97e20e7c090460606db9cfdf94b075d5f585f0254561d95cb3900819ac29fa34f2404f5093cd6cf702039f606c5a35249cad10089b6e3a117f4bfb2720b6ad6a2070b901f981be40edc6e046891fac08006c8a2ab23a4e5792bd185574c92293199ceeae52711a6d05f049b52cc80590a9c4df39c12b667be86a37086b942029383a5d6479ec13db50f5d5cad754458dedc2ef799ffc29a2d395c6795b3c80cbd64711be202cd97a42a91c941c70113f45e5de0289205db2476e07cc7c386069f48ed3e01fdca6b2fb40edcd1c92e860ac22394cd23ae31df15b5d5029d79ae87d7683a513ebee02ac0befadb84853d3967bcc275fa03b9e41a7a2fff668f9f59b7e2c3897bc2513065280ab57c2f2afb26a9b0f46df13680898f34344db2ebaaba4310d2c4c264adfd44648e8effc8b73d0cd964ebc865063997c1176cec97064e1a704b9b5c3beb0601d1cbde80927f85b1d0f143a1299d6fcf88be87783edd3a2c018c05d1353e0eebe9a413ab10eb0b5cfb0c34c86c8c8dceea3259832856ff883adf1a6e1fc6f944804a00836b84557e4346507ea7a054980d2e55892291aec35714cde5bc994c57c732bccbf2ad15c3460bec4ea1d6faa03c3df1afc151292770708a3551b1df3101cf9841fdad799f25ab6adb0eae93ead0bac26a32af04b8dd5cb3fb576c7593d235368f32342dbd422ae17a0c9795bf3712c49496582e952ab4dce5588fea38d8be440db86e9bf90f91584cdc66a1a08ec05f401a7da634861ca45a702e2ef3989beb651f4f38a46f39bd567d5830966373cd1af7daa0946e030448e86a0066482eff233342668aac83a1f8ef3ca525ced78a3f3a00906d72614759b8052a6db8d3c5e4c7972c4c805799abac6e3e8076ac33c6ea44e0005637d304489cb683d5bfe5abdcf327f001e1c2bb761476bbb68ba4d735729fe58deb52448d841e68f0af191619296a516e7ac9a35ee86ac1bf03d4d60d8c6bf0b87d2d831ef0db95f308be4aba5d9f1cb39336f1e3d8555fc7cb11aad571534fd6b46ca8900e0be088460f1b490ede0c52dd2f4e1880b8dd29960d334c96a539af54e8792e37395ef0fe23d888f4b61ecdbccab819df605700ac444aad015bc9fb0d6bc36c80758e7257fed54adca13af1a9bae62995d40406261589fce6b772f59de8ad813e173b71f7f90a545f87731a6806ce2d02e43055aeae9e8cfb252a041855f3395464afdb3b06a53a60ba5161e0527dda31846ea1f686a18f81ea4d2f4529fe5999b2930f059bfc8e2741c96541f0480a7234879b329c8ca22b1d984bad3dfea68c165877950c4746bb3460e6d18c8bd1ed439727881757e343456bdd744c0ed16dd44475d2aee5b108d966fcfd458a1faccfc5c84c9be691a9e5c9fbddf146c8ed1ce599c85e8d2f2affa69637331458f4a6091eddcf21bcf7d2252110b2ebd764e8701fd651ffd05269fb458b938a5018d7759cf2ade529a21c268f47e21c69f910722698ee31f81690717565e86a62007b464944b221845f958e97b5a51242af39a6493ca547be2a94099de717f54516fd4e4e368c8f5272f4b237f75d6f4e073bcceea9bc66fd18f434cb6c652259eb04e3703a8b1122d0a5306e163ad29c09351d0a8d6ba5e0c8264976dcab97568a301606dc2083c73ebbbfcc798ae8a21ad87cb69a65dfcf08a5ca2beda62d3b4bb1d53ff1d44647e728a6d23e2b34810c4afc7aed6ceeff1f9fc5b3672ff86d1fee4ae0a9a9892aa1193f9edff18e26d6209575bde878e9c9a9f7abbe99776b3f98c3614eaf83ffcf108d81f87bb098676da6a837f3d85b174930afeac411c43226a783e4bc6f7c4c532268631eb28b2baeca7e4b3d5842b8cedfc9b649d5f4cf48d83d3843b3b34b666735d21e78687df1038c485ffb30525be85bc703bda30b8c533c467fe1ee6364336e8660362c8e75fe4c721f05840881c26f02af673eae6e3c6922e4596848e2ff32272fc1b2df69873b6f1fc5fdc41ba6ea28fc6478700d4b431007588ca83b2be76f8a2cc56db5a20e0fd674e35ea1d627d337a7eb964b3e1b6528e2cae432b9d271e0df819feb9d1036a70ea702488a9734ac0576156aecf3018efc60e95cbf1add6579822fa2ed508c9627a07c7a8e718f17fc005b6dcbd8023a9a93f761e594e9bd3003719800687d85f63f2420075f1e745d9dec0e852ecf9fe72b908316b4fbe9a57f98869c8a22da7d7845b3401fadfd2e5f4ae177171a31df022882cabdbb0d02b301a4e2908bb572eea2e1fcae68f6777d0e770fe15b6a1ce302877d091ea2db229b8b9c399e365044585ea9bef200b05f03f402e0ea5738b7a03f111a411f09604f1094d54764ec7ff8ca58651a8191d23e15b2cbfd8094258342b35c8f3b3f03a2164677f857c57310a1c902ff64cf43c2bc03e89a9f38f7d800d9cd753275bf175329d7d7cc160bcf18fe1637944aca86836bc79b57c9ef5c32b690c207480ebb32657a5ea77fb49732d39bb664bbf3c245b9c971106d666c3c46f80c67ca06d8c814563dd209a339b18dd34b06e88bb556d8023cc3dded57db02358a430559e8d879629bbe8ef6bb66368dd4e456b55de3774623bc051e81854220013c13f48fd05734ff831ba8ac103e89573268424bd51621400fb5320f2073e51a199ededaa52f47e523c5343c432767cd20771d59330f80f5fda2ac977ac71ccdb49bdc0dde725e1e42a9f1868ff8c7541703d8a9175ddd190b2837d66ff03a8392fa0fc34191fb2bf8c0e6717bae7a504cde3a9005528cf7ea4628d754004f6335914db9b0f885f7901341799a7fec6cec61242d53bc5ccc21346eeebe5b154609571a341dbecad761559dfaf31cef9d267fb81bf6758581b72417efb31a3315d33a29b96443b99fe5f3cc0842541a3fb453504216e3797f20acfdd5f393ffc42a98787752771ea94b7ad025e26236d18fc92ac4d5db7af1882f78436a8113e34e7686684b33f3ec5b6c71990006d1380d3c7f524ba8697f9a17130a91b518369745e9da5c3d93b7364ed962068f826977b77aed5fd3fed7cc5f55b742f8234162a00f93f5bd226b6365f85fe79a7509fc03d6cd74e58c8ffd44c284413db3c456da158d8bb7d9929be9cb19c30e5930fb000886d322ed6538ebc37dfe74bd1d3b6f69b62c3ee0c3482e9e878113025023849541cc91e2dd3047b3708aa4b0fb764cb034b228f3c1a8a12d29471375a6e7eb852fe6d9bc5b7b86d8d0ae5fac1adc3a11de527e7ded473a44c9b8c609a7e526fcd5cd5cde48d8dddbdce20fc95ca5636aa37beebb45952c6c16d409db940ee52efbd31a1266632ac702ec83343e298e845d3a503a22614cb6ab16f63788af4238cc2204b50449b1d8addff80348f214053776a1e64b793d50d48864f02f2f130b40b26e7a678523a6b4643c09d57ed1a05366c27fad66b30acbfdd0cd07a827fdf31b3bd0ee6081e77d9207aba12df093b724b9e51fab95f0e2b2ca94f63c9925eaa3bd07e947cdf8fb9db82872cfd9daadb61b18112a7d1806955641ed8458b8acc5bd34de75f4c6194e9dd0b6ebff9263c41ab0358731ce33795208d80f5ef5d7928f41fee9d0779d2971970890e7aec6c1e205a51c6208548f28bfe8f916ca1720ef7658237001a8c9f8394f3932d0adde43547e6c1a57764cce7cb5bdc980be5fd8baec7a041b1a61f94fe4eb19193cba9df173cbf115ca2fcc106abde1aa8ad2bfd1e146892c79b55a1c1ab2d90bad1fdba49af815ca1b01ea37b79c42662c2ae02106e87713446888391ab7a78a5db7c107b5d2555989169b1d999e9996863ed1b3f7ccdf06754d01b41b8e2e9049370f182c5ae21af774733fa8dd9d42ef5f8e397f36be908297db012c3c2673721837644e38213fff8b1011903a4ab73a81a4e2d46080245afec8a7b48d93fcae69f818a8446e44ada3c397dccab2cd174940aaad7a49c61f713d265fa214dc819f6c21ede8b4fa4a9b82b29208997e71f9bf474e80dfdff6d93c45eb4862dcf65611b2ce86b1f782bbdc585cd3de749d4fc12094b61f9ae22b0dc9f3027e0e42e753aa639da73d523dd79027c06048f01666e96cfaa4d1c419cbe6ec94dfb00d09409d191b9b42e54fcf01f131bfbed8f9ee247d78d3e2bc1acb36dd2af6f5e21ad635c633448de75e341c380fe6a35d67ca377ad09968360c4ad9472822e6c0d668f42534838a2d6b848a635db6eab25dec0361ee238feaff87bc31cce2d4c98145d9b2bc978328f7980a203f376725d0829ee961ded5943b94e58061daae1dfcf15249977b5c122bcbc04fdc8b9707da3ad6792a3bebe6a54f64b5cd5e69e1c13e6046436b3c78da163362f8c80f703e975569abd1b087f2c3f5727be347348d01c071bba8e6754d1b19da34011f92a39af028b34ccb46109c83345c664248b7fff6a7d68453143423d5d941f845a0d239428434053456d3d4d0311f6f371ad21c1bf5cef2f960fcc9b4e0036ef6e0ec7f98b0992d341cdd791e3b34126d8d2c4e6c8097c04a2f8a9780f4a6bbb555cac5c2bfca4e6effe0ae29075119135deb694df37bf66398021ca59728c2adb980b85a4abe60fd3f77879f4d3c5963fa8e02870b77a83e81d5274f4884230effb9b25cb229cfdbebb120b2c1c7b9852ef6e848714ebb57fc3f592e841a0860dcffb0f91f289de09923efd75e7e6cc4ce06f267215b45236059e4e84253104dc97ffaad9704e3fdd453eb326f897c4a17b792d58d9aebd13ba814542fcd231dd8d97fe63101d003d53de4cf976e20af798abc333496f7ea7f09b8694df7197d9b9952ad70f19c93d4416a8387fe2e79d51cf4173b393e5fdfd98666e8da9de120ca295aacd59ef9c29d32b4fd52d0654cf2af3e1f7290afe", 0x1000}, {&(0x7f00000036c0)="5e219a8afad5e5ce312a022a2652d448a8362b50eaca965295056f7a09cc770d5e967aa1929c4d4c648985dca7d63f9094a66e8cfa6fa2dd165d5f1463d0e7978c0fceb325de8a28fffef5a54595d0c047a4f7a1519d5ef788006a7b73", 0x5d}, {&(0x7f0000003740)="8b2a87b16fcf92e53191ab6f15447189046a700d93745f3e62d92a2bb4c1dae533515692f22aa1a544544eb2022e80616b52527d9cf1f49ad5a2e880ce56c5e0b71a6f0922aaa568c375c70801cc08d94c60a6b411aca3bb97dac5df23fa10e34ac13053889b461355d7072de9fbe7e6e26ac610b3ec9f9a8e0ec3e157dea84cd8c5ffdaeb86c626dc31ce9c65293cf08d2dc11c27e229aab0645bc1436ddb70ce90e626318d7e2c7e15c4dd6c07c6c7a22485bf167ad5504b9a6f336e699032ddc7bb855d0e5fbf96d659b4e7461a7b1f5589eb4fb4", 0xd6}], 0x7, &(0x7f00000038c0)=[@init={0x18, 0x84, 0x0, {0x904, 0xf3, 0x3, 0x81}}], 0x18, 0x41}, {&(0x7f0000003900)=@in6={0xa, 0x4e23, 0xff, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x80000001}, 0x1c, &(0x7f0000003a40)=[{&(0x7f0000003940)="f7e4ef370fcafc90944ca59ff904e949e9fe232c3bcfb9f9e7963ad252125cbfd837d054a375e9ae8341783816c0bc72a0a73be061f1fd33b3c1f8902e2c7dae2b47cbf65ef01bece6b4840cbb34ad21b8cf7261f785ca308e7c33f8c2b9290a293e33874a6b0b136ea3a7b396780adc4da0269592ce456f8aa15565b41f008aeee256e66f7fec605e9eaabee08cbace64991421b9d5e7b19bddbfdc50b275ee946bce078e5ba613bb5e78aca4ad5f6463ad788512c9b2bfaf59d72c4fd3722abb57b280ad8908c8339cf7f14908da02435545bf9fc162bdd2eaadc5b54b260fb3309e7598c0ede558307d6ab8f67d33a6", 0xf1}], 0x1, 0x0, 0x0, 0x4}], 0x8, 0x4) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:58 executing program 5: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video35\x00', 0x2, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x0, 0x200000) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f00000000c0)={0x2, 0x40, 0x4, 0x80000, r1}) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000080)={0xd, 0x10000}) 23:36:58 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xfe80000000000000]}}, r2}}, 0x48) 23:36:58 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback, 0xff00000000000000}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1152.656432] binder: BINDER_SET_CONTEXT_MGR already set [ 1152.671337] binder: 7236:7239 ioctl 40046207 0 returned -16 [ 1152.695466] binder_alloc: 7236: binder_alloc_buf, no vma 23:36:58 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x3000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:58 executing program 5: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000140)) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VIDIOC_G_ENC_INDEX(r1, 0x8818564c, &(0x7f0000000180)) gettid() ioctl$sock_ifreq(r0, 0x89f0, &(0x7f00000028c0)={'ip6gre0\x00', @ifru_data=&(0x7f0000000100)="4d18d83388f7e2da149a0f3317b62de064ac0595746eccfe78e2f6bcd9343d18"}) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x2, 0x2) ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000040)={0x8, 0x2, 0x1, {0x473, 0x80000001, 0x7, 0x9808}}) 23:36:58 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xfec0000000000000]}}, r2}}, 0x48) [ 1152.714472] binder: 7236:7239 transaction failed 29189/-3, size 24-8 line 3035 [ 1152.741842] binder: release 7236:7238 transaction 1634 out, still active [ 1152.751000] binder: undelivered TRANSACTION_COMPLETE 23:36:58 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0x2, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x40) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x112, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="04632f9fe027ed134a38b6ed2f84e41dcacb73625a8cf97a29e44e6c1bf25c4a1e0ed84d6d914d472ad621c24bfbcd7795c793f0ae5fc0bcdf93156f4b4d79786680ae8793240503971704237905f0a6897d1c7d67b5ee70c66d246f4a174632bb2345ba8c20d1ea8fb29a9ae09d532c04"], 0x0, 0x0, 0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000000)={0x28, 0x0, 0xffffffff, @reserved}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x5f, 0x0, &(0x7f0000000400)=ANY=[@ANYRES64=r1, @ANYRES16=r2, @ANYBLOB="1c0023bdb7fd53f9e7fac6e6af8c801029d263419f0843ab5c0bdebc9a98fc59dd747c9c76723e7a274b26c00f5ee70d4fdca8c6489a7c068227991f4f21e98baacf342694381b3bbe19b0b3bb4f05b120fa843511cb23e190510e09c46c501eef16591a53efff94bd53b7f3241d07f06e5d9c15688f185fad56c9d1cfd8a87cf6181fec27a3e0c9de6723f556bb27c6c0e44ea0d11c1b4e001a68f49adf9aa54557d32c2c948da84ac5112240ca0fe4ca74726b49a97f4cc0c51e5e080278b2ed1f1642f2f67c07709c726cc387b620f1c5f4ee44ad9cb0319660743cd57442919857a0c445e02368ef867496a8571cb2e8c8c9269b51bbbcf7351f53c73c404079e80f7e94e796324a7cc544a57c5e95fa88cfca2cc34e4bf74c2a037c2d95fb43b2b3167ddf734b1c32cbd0e4d1b346f9f960c007fdb4dae57344019b9c676faa68a241717ec7249000e68ce16e30b581f1f7a73b0db942cc916ddf2803ed67de581440a668714dac446b25bb58c668d8cbd3c79febcd0c531b4ae3d27dc7ad4ef1b285b3dd92d714d7785962fdad808e2f2410a0a8d06f67e43f73be701637875172101c346281bc3daeaf27006b8fd5096dc70c32e1d54f07d842c2b98020803e57c6c8ca1c472dfbe1e5cb23a8203f68fa456a226e3bd2875f8cfcecf35ad538995eee0056b4c283c889cf511a560f6b14011dbd330aced99f03cde8c4c6ea967a5729533cd7d8aaf3d866f3f898b08131c7cfba5df8ebde6606ccd6546d2b0eb801c266dc7b180a362c0f58aeb598bce000e956409617c3b43261b396b5d1d13ad509fcf9482b997f517a36a4e5629940425b9367fb8c88d65726ae8a31d93fa8f5fa34f5b308b240fa5f382cbfcb1ff71d8451c47c2b68de042214363ae47541450519121832142aa9cadfcca355153a4d01ba5fba7133279942eda77db5b4c45c2cdb67ea201ba08e786f9110bbbc623e33fdc4b390c6011bff45ef82e9ef5d5dc7a1ef348c422bf64ab328debd96a7e7df28777211ffcaba8d481ac03f2b8f9e263300d65fc7de1ab4c2add7a9760ab6793d00711cb71ea7237596712a3c97a88fc508f91bf0196913b2b3393956df23d7761402f536b3f65118e017aff3732744d62bfa6a57a2edbdedc719621a53669d729772dc8d470ba152e9470c398126e10dbe301d8c5a5c8a7e667f7e9bf8d627c5b8f17e4bed468dba761ece7217d52af1c6b27852cd7cd4844385baa909d5b84980ecff32b6bd28f4346f727e3675fdf79de1aff738c3d5d55b303345354942baf4f88b7616c545324f760cf856abccc8dff0ba58bf080873a3296ead5bff6ae51d337b8efac89266d66f68d0fd09a6a54b70f7fbebbd74c5adc84dbcb7fc4994ad4250d726fe73116076d06f1b5ac472008b4a8a582db73ac8a8f0643c3047f7a368ba9e3a9c8bcaf934291b8626eadbbfbdafcb6645a78f046c7b9803a4da709a5701f333dc2394d33377911ca8edf3bd42fdd61c7e1af9381f80a939de4ab312fd81c9e49edab0489d51fc784266f4265af6a416175dbba9f8b2213b9ee315178c09bc8f27454e445015f8f3212a639c909b7123533a8653279f0039e78f88e9b190de599a5328f26f9473aacb3b95c598f7365fc615d7a9cc2c537f1fcb3d8eb5a463299a776c8b2d026e1a3f453c0320920bc890fce917b2104c3bb13f33c46b7891afe6b792a57c6816a256345f9925e6bc885901be25a18f5fed815a6a2177d9d6000dd1aa00923d8f01bc165caddf577a80f1de3fb5b68b0abc1c14242c71bf71239b1b5fb87e5db5c0680baee1c4835a2db30b1cdbb4f08c59ba24af8e4f83b0e6668b9711ee5bd8f6ca45caa4279a2ce97d8f4b7390ca1e78fcd06566cf41c891aac634ba784b10485f124a8971c55fe499608888f1145bb2f18067654311154c398cf42dd33449c9ca64eb0e337c2326a3daf8877ea7f51bcb973e6691c74e67746c1a9e031a13287ebebb82540833cb16871b425589e7d9483ed308a1253f420118ff1eb606ae79602d896dab41fec0b318ddeb09c8fa454104fd2d816b7f52564b7207e624272265a306e53cbe450e846bfa185f2672ec5ba0b44c99589d7ab14d352e9820c6d4eb79f84cd16e1199d5e32ddb33d773d844770a5438566d3fc6242db6c1aee2b688e5f314e7c97f792c0fbe88262bb8b42b4e29e25d527d23bf19e28c4385ee9500607020864a6f6e5a2c395f5faa13d53f5ff20df4fec02b5d8fefc24300e5793d6ed1f1b1599af548e58fddabdc87408f56b5b3441000fb6f635abdb20d9b829ccd3f25140f785bf4c99160a86c38eea43aff420f27b0ff4a37ad2cff0fc49d09bf55806368e3cd816ea43a1fad53f17231d0b8031eedd1a6c6cfb89451012a403d642dfe463c569fbdc1f8d0d7414c5d7545157667d02605025d2e0001bb1c6fa5a08ec9f28ed28cdc9f9aa7e65e0eb1ed8cb7761a17df61ad5d69acd2d13d27f0654d44d0b8639088f7025bec9fe59f2808adf03598ac10416e5adea2f2b21e817a2be6441efd3baf3cdfc70eea94f6bcaa5f8c79796530beb43bf03dcd0fe88ae84fc91adbd7247e3f841ca37270f06a82e7f95d4b7c3f052ccb9defaccfec9c0cd2646f7fb2099c44a54d4ebd028d619b42b0227d3611a79d0d3a609df04c3e377a369f3db3078b3f0fae3f6756a74b5c8ea8c5f5dee78bda7fbc816302336fde27dd3c112d8e95ab3ef61d88c06e6f2524c12cf98d94b6291d862ff5b203bcba427d630286322e4fc1cdf003f3aaa7a2a83f149276e393ea952c1aa10bb149837892998e7401fe8adbd5f51d86b4ad0b3255185a033ea77ba2b4ba0eddcc6d70e1c0a9e62d677cefb3f394ac197cfbf807738312ba7c90a6ae08096600132996b3eeeff54cc4ee2d7722d9e733b71caffc9665967449aeb72204ee304f37fca2e61ed287fdd02bd71462622929af9cd781a866948c255aadd8a5e2785de9e8b653560bf720606ce160a310c8f147f7f04528d1ae45d637530654300446e88176820c2f9ca945d030c339f315c93f762095cdb4c2fdcdea1883949cd467b6176be3d91733500a20ea3a2acf56a261267cd3269d676ebc7d58ef3edb96c62e3f60d67d5c2242722394d4fa0e708409b96fff537d5e71ea8ceb02ce6872a0c0e9cdb7b7b770863f74f4930265084645b18c93a04299d8acae2a89eb99932745092d6f9a39e6dc71e3e19a4f07ab800e9d2573ffad7b8df436358304f4beec57e029f74dafd9b2773e8877854a56c375583e0c1bbf16fa4e221c2d79def556d958aa78ee25382251e8485e0863fde23dc4b3190135b2e9aa2e9584e633a0511914e91b5160c925151d5c08c444c81886f195a788eeb70862cec7bf0395c3e672c222d68947cfeaf512171a143ec4fb0292e102fc8695cc68fa0b21010702fd5327c5e9afa88ce77c0c6f3426070cc5d238fe65402494735637ec8729d69f423e6ef9e142a54f710b0122a63dfbde2427c98211f9fb9233e91031ce3598febcc24133a69e913166fc299b994136be1aec1d78757cad95571119f4b01465673cb524d869cfb270276e57ed21a6735901976b2eef9b94c77a929a0168ca44baae3cc9e0a3d70134adbc44f8027408e86994f989680be025bc4562d4b5912756070cf9d1d1a6aa3317f8d8fef1239764a903e58aff91492977cacd8afd181640ca4fada573c3e76319659ae18818934d1c4d111c5c9e641b46b5bccb65112b44db411ca583977d3a7cf69046e998eac97a0221beb83c20bc1899ad341c09448efcf7a57900d5848465f83f0e6e832b30b29a2aa96d504335b14129e414169f65f6ae898b55703745f4e037979098f1c8e6392fb322b3f1eb26a95f0776d64242c6a69e4c8f4195a4d80319d46bc24a613d32e3d6005b608ffe5114ac2f36169d75315800518db0fea078fc541e806b08c96332f8fe0637202da5c6462bfd3d398841f742ac4bbdd63a9e266ffb763ac9c467acc8342135731e39a846c66be7a8a95261b0411f7b6664313af6d61a9a6d9bb8988d71144082dfc62362e98ab6bfaab33154253977259a5aac67d905c4974f687421a5213e7558509b1ee67dd77fa4fd76096a0c781692843d3351af68efba338029c043ad78899e12bdc0c78e41a3d3ad9aadde75430e00e20b3c7f0726cbc0aabe7a36876d2f938dc3f5a1247c49c68346face19694bcf9e32a959dfb8ebe843301443273fa8c3a7f79a265bd73aa85b063d6983dce138c07a1bb59b3d445888a04816d6620cd30f3ad572c547b565f8cd85a9e8480b0ac049d33742dc6fad30bd4076222454d765847df51fae47385c143ba456a92c2fc76c8327db626151c4093ca7def1c04acff5a49474f78c059b5367c5529c6f48d54288fc2a0195c6cbd72deeb5d3787e25eb0b3b82d723c091025d238567f137b344095ce4b85616e121efba00f1b8355b14321dc072d3184918f8a755eb319c489d92ee6541139d87df144a31355cf558f2c5780570fbb40452d06a76c471629c03e1582c3845885dad2cf607ec0ddb8bdf2453c0d27679661e816299a1d3c97515dc88ee41ca5be3e0e55fe9601e079a0344d49dbaf9088dc7c7917da3353809919085efd6da5c6714425d269b768e6cdc8360439734ead18876cd9a3c5a4be17dbe00a277e1e00e661dc9df9a8935efd460729c388af939852d78bb17048c6ef51c6fbd06e776ec7fc72d907d528c363e42c66aa109ff9e544bd14bb7f4da1e3ab8eff5b22a6fdb9bafc85451ed84f405789f9a9f33edc71c64deec554b75d2446b76444c3a55b88f099444b20cb77ddf4147956cf94e598e6dad903a8fdea5578a6ce684da80e17d392e1a7425d9e30f097a970f93754ec8ff90b1956696ec2e0d60e5a1289441766610ed568a94c4858e9717d7ec76dc83e6a31ca247b94264e5e8ea0f3aea9b0b40bfd7f1f16ee85b92b408923f40644dec5d757ce45c3aebb3acc358ee7a314e0a750a074248f6ca591fc692a987f714f3b7a0349c589aa95c8b870e57dfa84cbffe3ac9d0e80fd71ee37dec3e6526093437322a692767992e3f2a8721ce2a4dc955b864daac83091b7847f8af437c29e84a0971b5130652f3de03aefa92a0e76a2133588a0415f4ad7d36ab18223d604597105f5caecdc73cba7b0a4c64ab08928602412cb0f9503a8b258b84976af4335f3e71e1d42401071ca9f7bebe5895354b9e51855fd44aebff64728975d448428ccb8abcfb1b6c0c337b2cd65e4c7cb6b4632a148c81f76a8f370961b9979e9aeb78de8d3dd9cde272506eeece97cc3de695d4d8a3cd7482a55abe27830394b296ab088e3a0c7b4af8f51b30c62079971d93d1723d4e0064b91cbf0cf3cd02b981397b69df4bd72285570b1b0734230afba4ae0f2738befd1c5dfd88bdfe2aae589f0d9345feeb5f0d25474821450b681e975031032bab6ecbfa248faf96f2de47f9ee9ce43d148f0b4f21541658bf870fe6800022f08ab336753899cb1b16b4045d8ea36c82d3f550f5188b26885a2a24319a944b832e3ad8f3060385ead9804e9e06cd9ba616bff7910d0170163121c3dc91fd181367c771beb3f65d12a3668103932ba39a8c39e1b18ee26411831096ddb90eb000930ba6d2af1a9d7bb05aa309af9fe6d1ed6eaedc725e1a49a033de9e85960b1d1b1477df4abc475c057ace2125b37efa57e16829353f08003cc2cc0ad0e2714915f5e10889907f8e1f0a49b3fa685e6c5c60495a45544d6a3312a7d8c4102d65da6f"], 0xabedbe35, 0x0, 0x0}) [ 1152.785592] binder: undelivered TRANSACTION_ERROR: 29189 [ 1152.810223] binder: send failed reply for transaction 1634, target dead 23:36:58 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0xff00000000000000]}}, r2}}, 0x48) 23:36:58 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0x1b, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1152.887636] binder: 7290:7312 unknown command -1624284412 [ 1152.910127] binder: 7290:7312 ioctl c0306201 200000c0 returned -22 [ 1152.939655] binder: 7290:7312 unknown command 4 [ 1152.944530] binder: 7290:7312 ioctl c0306201 200003c0 returned -22 [ 1152.969867] binder: BINDER_SET_CONTEXT_MGR already set [ 1152.990209] binder: 7290:7376 unknown command -1624284412 [ 1153.000150] binder: 7290:7312 ioctl 40046207 0 returned -16 [ 1153.013830] binder: 7290:7376 ioctl c0306201 200000c0 returned -22 23:36:59 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x9}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:36:59 executing program 5: r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000240)='/dev/cec#\x00', 0x1, 0x2) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x7) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@mcast2, 0x800, 0x0, 0xff, 0x100000000000001}, 0x20) mount$9p_rdma(&(0x7f0000000080)='127.0.0.1\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x10000, &(0x7f0000000280)=ANY=[@ANYBLOB="7472616e733d72646d612c706f72743d3078303030303030303030303030346532322c74696d656f75743d3078303030303030303030303030356162322c6d73697a653d3078303030303030303030303030303532362c74696d656f75743d3078303030303030303030303030303038302c72713d3078303030303030b359caf2661a3a56db52501c064dcc303030303030383030312c74696d656f75743d3078303030303030303030303030303030302c7063723d30303030303030303030303030303030303035382c7063723d30303030303030303030303030303030303035392c646f6e745f686173682c00"]) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}, 0x800, 0x1}, 0x20) 23:36:59 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xfc, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:36:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="04630440919f67a0648800020000de9a7cac6cefde583124e89fc1fd0200e84e3c3693ae9633559ef8a94b2b4c77144383d99acb4c5c4e9bc2fce5b16d656015d42dd2b32e38b278b351a5c28f06f041507e9aff7c5ce4366099360b78933a6009c90e7d2b3592a46b0745cb20b84597447cc49ad900"], 0x0, 0x0, 0x0}) fchdir(r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:36:59 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xfc]}}, r2}}, 0x48) [ 1153.793800] binder: 7394:7412 IncRefs 0 refcount change on invalid ref -1603821679 ret -22 [ 1153.830172] binder_alloc: 7394: binder_alloc_buf, no vma [ 1153.835677] binder: 7394:7412 transaction failed 29189/-3, size 24-8 line 3035 23:36:59 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:36:59 executing program 5: add_key(&(0x7f0000000000)='rxrpc_s\x00', 0x0, &(0x7f0000000080)="19a1079ee639ce2c", 0x8, 0xffffffffffffffff) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x101000, 0x0) sendto$ax25(r0, &(0x7f00000000c0)="4576100bc3a6f144d1bb61f6b3093d7dc62f411f6b58f359aecb16358ac19870743ac99e30f23c929a5010b052bb53c8912f07f301cd49cfe62e1080c23b5fffa885af7e933dee59f6ff80e5111e0000b1feddd028872b86189dcdf7f7794948d83ae45886dc69afbbacce4ae5cfb72fc186746cb2d4ad02ce25f4c1712b04decd27213bdfd093a54b05d24610582b8463f6e5059df7c3b96d22089a25fd8663f1c93911fc308aa064cfc7866173eecee6b3b9ed578d6733bc60892bb0ade2", 0xbf, 0x20008004, &(0x7f0000000180)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default]}, 0x48) 23:36:59 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x80fe]}}, r2}}, 0x48) 23:36:59 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x80fe, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1153.847284] binder: undelivered TRANSACTION_ERROR: 29189 23:36:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000780)={0xffffffffffffffb0, 0x0, &(0x7f0000000740)=ANY=[@ANYRES32=r1, @ANYPTR64=&(0x7f0000000580)=ANY=[@ANYPTR64=&(0x7f0000000300)=ANY=[@ANYRESHEX=r1, @ANYRES64=r1], @ANYRESOCT=r0, @ANYPTR64=&(0x7f0000000340)=ANY=[], @ANYPTR, @ANYPTR64=&(0x7f0000000440)=ANY=[@ANYPTR, @ANYRES16, @ANYBLOB="9ea2aedcba8555c3bd99db2aac7f9feda7537d678af0c46a1fb1fa28264e5df06534cdde284457a93d210e62ab35b4948d1e3eba03b98461adf98122287df91a148d97ff8817f03a7aef7a4cbb8b85eb0ab315428db4a5fe9e265cd563b1d106b0f60309a03bd120fa3040dc024d986d21d495f6"], @ANYBLOB="1bb7431354ac4a4a1f1401c708d4be18bb9761daa6476577cc91e9fd1b20287c638d56e8dd1d12ae58d7c385c80ab1d7488b1fe3be101c711f040fbf2c0965926e1f3e952382aef4898ca977ed37e65c1c287b47df66714a159deccc921d144fbac8315003f7196a2557cd9df2ba467e47a0d65efa6474e5815cdb0b7acee4b18af9365ce5073da53630ffb0940b20f25255564d7d4578dd14063d0a4e414332c4f5277775a659eb8eccff85a15029b1c20b879a49645de20c87998a6cd6d19082f6b54952e584cf7fe1a35884861bfa9c3bc2e84f509f303dbbcb00d43307c920f70c4bc8e87d876b9c7819755762e277b1cd5f0e4e160276c8", @ANYPTR64=&(0x7f00000004c0)=ANY=[@ANYRES32=r1], @ANYPTR64=&(0x7f0000000500)=ANY=[@ANYRESHEX=r1, @ANYRES64=r1, @ANYRES16=r0, @ANYPTR, @ANYPTR, @ANYRES16, @ANYRESDEC=r1, @ANYRES16=0x0, @ANYRES32], @ANYPTR], @ANYRES16=0x0, @ANYRES32=r0, @ANYRES16=r1], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000180)='./file0\x00', 0x42, 0x8) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0xc) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000200)) tgkill(r3, r4, 0x39) fremovexattr(r1, &(0x7f00000001c0)=@known='system.advise\x00') openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x0, 0x0) 23:36:59 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1153.973015] binder: 7422:7427 got transaction with invalid handle, 0 [ 1153.989965] binder: 7422:7427 transaction failed 29201/-22, size 24-8 line 3126 23:36:59 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xc0fe, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1154.042939] binder_alloc: binder_alloc_mmap_handler: 7422 20ffd000-20ffe000 already mapped failed -16 [ 1154.085711] binder: BINDER_SET_CONTEXT_MGR already set [ 1154.105971] binder: 7422:7427 ioctl 40046207 0 returned -16 [ 1154.139195] binder_alloc: 7422: binder_alloc_buf, no vma [ 1154.151828] binder: undelivered TRANSACTION_ERROR: 29201 [ 1154.158818] binder: 7422:7448 transaction failed 29189/-3, size 24-8 line 3035 [ 1154.181544] binder: undelivered TRANSACTION_ERROR: 29189 23:37:00 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0xa}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:00 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r0, &(0x7f00000003c0)={&(0x7f0000000100)=@name, 0x10, 0x0}, 0x0) r1 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0x101f2) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000000)=@req3={0x80000000, 0x0, 0x2}, 0x1c) r2 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x6, 0x0) ioctl$VIDIOC_ENUM_DV_TIMINGS(r2, 0xc0945662, &(0x7f0000000140)={0xfff, 0x0, [], {0x0, @reserved}}) ioctl$VHOST_GET_VRING_ENDIAN(r2, 0x4008af14, &(0x7f00000000c0)={0x3, 0x20}) listen(r1, 0x0) accept$alg(r1, 0x4, 0x70a000) sendmsg$tipc(r0, &(0x7f0000001bc0)={&(0x7f00000017c0), 0x10, 0x0}, 0x0) 23:37:00 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xfc00]}}, r2}}, 0x48) 23:37:00 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xfc00, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0x4000000000000802, 0x0) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000440)={0x0, 0x0, 0x2080}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000000)='./file0\x00'}, 0xffffff7a) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r2, 0x0) ioctl$RTC_VL_CLR(r1, 0x7014) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$IOC_PR_CLEAR(r1, 0x401070cd, &(0x7f0000000240)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000180)='./file0/file0\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'U+', 0x49}, 0x28, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1154.612575] QAT: Invalid ioctl [ 1154.638784] QAT: Invalid ioctl [ 1154.649833] QAT: Invalid ioctl [ 1154.683183] QAT: Invalid ioctl [ 1154.692658] binder_alloc: binder_alloc_mmap_handler: 7455 20ffd000-20ffe000 already mapped failed -16 [ 1154.733924] QAT: Invalid ioctl [ 1154.739299] binder: BINDER_SET_CONTEXT_MGR already set [ 1154.755379] binder: 7455:7456 ioctl 40046207 0 returned -16 [ 1154.763441] QAT: Invalid ioctl [ 1154.767488] binder_alloc: 7455: binder_alloc_buf, no vma [ 1154.774572] binder: release 7455:7456 transaction 1645 out, still active [ 1154.783561] binder: 7455:7469 transaction failed 29189/-3, size 24-8 line 3035 [ 1154.791614] binder: undelivered TRANSACTION_COMPLETE [ 1154.797311] binder: send failed reply for transaction 1645, target dead [ 1154.821123] binder: undelivered TRANSACTION_ERROR: 29189 23:37:00 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x9000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:00 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xfe80]}}, r2}}, 0x48) 23:37:00 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xfe80, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:00 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r0, &(0x7f00000003c0)={&(0x7f0000000100)=@name, 0x10, 0x0}, 0x0) r1 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0x101f2) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000000)=@req3={0x80000000, 0x0, 0x2}, 0x1c) r2 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x6, 0x0) ioctl$VIDIOC_ENUM_DV_TIMINGS(r2, 0xc0945662, &(0x7f0000000140)={0xfff, 0x0, [], {0x0, @reserved}}) ioctl$VHOST_GET_VRING_ENDIAN(r2, 0x4008af14, &(0x7f00000000c0)={0x3, 0x20}) listen(r1, 0x0) accept$alg(r1, 0x4, 0x70a000) sendmsg$tipc(r0, &(0x7f0000001bc0)={&(0x7f00000017c0), 0x10, 0x0}, 0x0) 23:37:01 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xfec0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1155.051272] binder_alloc: binder_alloc_mmap_handler: 7590 20ffd000-20ffe000 already mapped failed -16 [ 1155.082955] binder: BINDER_SET_CONTEXT_MGR already set 23:37:01 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xfec0]}}, r2}}, 0x48) [ 1155.097647] binder: release 7590:7595 transaction 1649 out, still active [ 1155.105578] binder: 7590:7600 ioctl 40046207 0 returned -16 [ 1155.111924] binder: undelivered TRANSACTION_COMPLETE [ 1155.134374] binder: send failed reply for transaction 1649, target dead 23:37:01 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:01 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x1, 0x2) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000240)='fou\x00') sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000600)={&(0x7f0000000200), 0xc, &(0x7f0000000300)={&(0x7f0000000640)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000e29bd7000fddbdf2502000000080003003d0000000800020002000000080002000a000000080004000300000004000500080001004e22000004000500787c7be6048b91931ac9c3daad64337e57eea5b194a64adc1143186da6f8150de63a55302fa92accdd50e56a18549858e20d8da7186b317dba418ec0c5d61d7146c35deb6161de4b2e08ca2e35d462e9a89d5983daf746801077e361d8495ee4d376956cb094ce7cb9c30c2bc3da1876c37d764640fddb2d25be844b819801ab475f6a1394733eb51c61"], 0x44}, 0x1, 0x0, 0x0, 0x20000081}, 0x94) sysfs$2(0x2, 0x0, &(0x7f0000000340)=""/225) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x480100, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200003}, 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x190, r3, 0xb00, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x40, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xa4a}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8000}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffff}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1a0}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}]}, @TIPC_NLA_NET={0x64, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xf9ac}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8c}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3ff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3e}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xd70}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}]}, @TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffffffffe01}]}, @TIPC_NLA_MEDIA={0x50, 0x5, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x776}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}]}, @TIPC_NLA_LINK={0x6c, 0x4, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x83e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffffffff0001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffffffffffad}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x62e}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}]}, 0x190}, 0x1, 0x0, 0x0, 0x8080}, 0xc000) 23:37:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x82001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:01 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xff00, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:01 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xff00]}}, r2}}, 0x48) 23:37:01 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xa000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:01 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000006580)='tls\x00', 0x95d59845436eab44) sendmmsg(r0, &(0x7f0000005f00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000001a010000010000007d00000040e6e21a"], 0x18}}], 0x1, 0x0) 23:37:01 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xfc000000, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:01 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xfc000000]}}, r2}}, 0x48) [ 1155.630760] binder_alloc: binder_alloc_mmap_handler: 7624 20ffd000-20ffe000 already mapped failed -16 [ 1155.667368] binder: BINDER_SET_CONTEXT_MGR already set 23:37:01 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000940)='/dev/snapshot\x00', 0x20601, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100004}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x94, r1, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xffff}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xe000}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x401}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x6}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x100000001}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3c9d054f}]}, 0x94}, 0x1, 0x0, 0x0, 0x24008010}, 0x40801) [ 1155.692209] binder: 7624:7629 ioctl 40046207 0 returned -16 [ 1155.692978] binder_alloc: 7624: binder_alloc_buf, no vma [ 1155.739211] binder: send failed reply for transaction 1653 to 7624:7629 [ 1155.749889] binder: undelivered TRANSACTION_COMPLETE [ 1155.774772] binder: 7624:7649 transaction failed 29189/-3, size 24-8 line 3035 [ 1155.783241] binder: undelivered TRANSACTION_ERROR: 29189 23:37:01 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xfe800000, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:01 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xfe800000]}}, r2}}, 0x48) [ 1155.829657] binder: undelivered TRANSACTION_ERROR: 29189 23:37:02 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x2a7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0x0, 0x200000000000) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = accept$inet(0xffffffffffffffff, &(0x7f0000000580)={0x2, 0x0, @broadcast}, &(0x7f00000005c0)=0x10) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f0000000600)={0x0, 0xec, "bc5d8ed91a0ceab7e9fe8b4ec0af3149dd523415372f43bb30cc17ddd989c3f559e33fb88e013502f3f5c82591acd780bf8b7ba31d827a37a8be69d0546d2068f0a69919196b6fd2520134e4b8651955e7bbe3d037c5bd9579614657e35aa7dcea2d815b4c9bd859a4e8b56654ed717cd83ad1da4d60f38ee2f79005c5af9000a7488af68d6b308abf48ee97af43910a7700450d08e083173db1f20edb4455b58d3a8360392ada4235851d6dc7491a62bcddd850c99fbeb6a1b795c74e8f0b9ce81e3e0c8de3040e831936f1a2252fb4af84bdc991841da792f694ba255129e0149944ac81f08c7007e7eebb"}, &(0x7f0000000700)=0xf4) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000740)={r3, 0x101, 0x10, 0x5b6, 0x2}, &(0x7f0000000780)=0x18) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) setsockopt$inet_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f00000007c0), 0x4) r4 = open(&(0x7f0000000000)='./file0\x00', 0x20002, 0x9) ioctl$sock_SIOCDELDLCI(r4, 0x8981, &(0x7f00000000c0)={'nr0\x00', 0x80}) clock_gettime(0x0, &(0x7f0000000500)={0x0, 0x0}) recvmmsg(r4, &(0x7f00000004c0)=[{{&(0x7f0000000100)=@ax25={{}, [@default, @remote, @bcast, @bcast, @remote, @remote, @remote, @rose]}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000180)=""/21, 0x15}, {&(0x7f00000001c0)=""/78, 0x4e}, {&(0x7f0000000400)=""/157, 0x9d}, {&(0x7f0000000240)=""/34, 0x22}], 0x4, &(0x7f0000000340)=""/38, 0x26}, 0x8}], 0x1, 0x40000000, &(0x7f0000000540)={r5, r6+30000000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="030000002c5bc643"]], 0x0, 0x0, 0x0}) 23:37:02 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x80, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x1, 0x2) renameat2(r0, &(0x7f00000000c0)='./file0\x00', 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0xf2, 0x40080000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000600)}, 0x0) r3 = syz_open_dev$vcsn(0x0, 0x9, 0x2000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) getuid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000680)) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000006c0)={0x0, 0x0, 0x0}, &(0x7f0000000700)=0xc) r5 = getegid() ioctl$VIDIOC_ENUMAUDIO(0xffffffffffffffff, 0xc0345641, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r6, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") lstat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x0, 0x0) getgid() recvmmsg(r0, &(0x7f0000002440)=[{{&(0x7f0000000400)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f0000000140), 0x0, &(0x7f0000000300)=""/14, 0xe}, 0xa318}, {{&(0x7f0000000480)=@alg, 0x80, &(0x7f0000000580)=[{&(0x7f0000000500)=""/58, 0x3a}, {&(0x7f0000000540)=""/25, 0x19}], 0x2, &(0x7f00000005c0)=""/16, 0x10}, 0x400}, {{&(0x7f0000000600)=@l2, 0x80, &(0x7f0000001a40)=[{&(0x7f00000008c0)=""/148, 0x94}, {&(0x7f0000000800)=""/13, 0xd}, {&(0x7f0000000980)=""/186, 0xba}, {&(0x7f0000000a40)=""/4096, 0x1000}], 0x4, &(0x7f0000001a80)=""/137, 0x89}, 0x7fffffff}, {{&(0x7f0000001b40)=@ipx, 0x80, &(0x7f0000001d80)=[{&(0x7f0000001bc0)=""/226, 0xe2}, {&(0x7f0000001cc0)=""/150, 0x96}], 0x2}, 0x2}, {{&(0x7f0000001dc0)=@pptp, 0x80, &(0x7f00000023c0)=[{&(0x7f0000001e40)=""/219, 0xdb}, {&(0x7f0000001f40)=""/54, 0x36}, {&(0x7f0000001f80)=""/221, 0xdd}, {&(0x7f0000002080)=""/114, 0x72}, {&(0x7f0000002100)=""/86, 0x56}, {&(0x7f0000002180)=""/87, 0x57}, {&(0x7f0000002200)=""/135, 0x87}, {&(0x7f00000022c0)=""/233, 0xe9}], 0x8}, 0x70}], 0x5, 0x20, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='system.posix_acl_access\x00', &(0x7f0000000840)={{}, {0x1, 0x2}, [], {}, [{0x8, 0x4}, {0x8, 0x4, r4}, {0x8, 0x1}, {0x8, 0x4, r5}, {0x8, 0x0, r7}, {0x8, 0x1}], {0x10, 0x1}}, 0x54, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(r2, 0x40086432, &(0x7f0000000340)=0x3) ioctl$TIOCMBIC(r1, 0x5417, &(0x7f00000002c0)=0x80000004) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x4030582a, &(0x7f0000000000)) ioctl$KVM_S390_INTERRUPT_CPU(r2, 0x4010ae94, 0x0) 23:37:02 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xfec00000, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:02 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xfec00000]}}, r2}}, 0x48) [ 1156.528419] binder: 7675:7688 transaction failed 29189/-22, size 24-8 line 2896 23:37:02 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:02 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xff000000, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1156.587777] binder_alloc: binder_alloc_mmap_handler: 7675 20ffd000-20ffe000 already mapped failed -16 [ 1156.620631] binder: 7675:7695 transaction failed 29189/-22, size 24-8 line 2896 23:37:02 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xff000000]}}, r2}}, 0x48) [ 1156.642650] binder: undelivered TRANSACTION_ERROR: 29189 [ 1156.649517] binder: undelivered TRANSACTION_ERROR: 29189 23:37:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000006, 0x84010, r1, 0x0) r3 = syz_open_dev$audion(&(0x7f0000000240)='/dev/audio#\x00', 0x6, 0x1) write$apparmor_exec(r3, &(0x7f0000000300)={'stack ', '/dev/binder#\x00'}, 0x13) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x7c, 0x0, &(0x7f0000000180)=[@clear_death={0x400c630f, 0x4}, @reply={0x40406301, {0x3, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x20, 0x20, &(0x7f0000000100)=[@fda={0x66646185, 0x1, 0x1, 0x25}], &(0x7f0000000140)=[0x48, 0x18, 0x78, 0x28]}}, @increfs_done={0x40106308, r2, 0x4}, @clear_death={0x400c630f, 0x4, 0x3}, @register_looper], 0x8a, 0x0, &(0x7f0000000440)="cbc4d0c7203cb7c7ffdcbc80b7cd83bedcfa869bab7f5f135c0ecbe6b78e6f1f3003fcfd128ee9ac44ef7421bf5c7a33b751bc69b93c22ee0199c2e175cf8cd0cdc89d608d0a8bf11546bbfbdae3f3fb23a6cccf1c457ca06f374fef9ab8c254b377f4d177dfd298d92f313e35dddafeb7805119f1ff2b4e00f4f255556f17e9cae547babdce1c778ee3"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:02 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xfc00000000000000, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1156.780452] binder: 7733:7739 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 [ 1156.816504] binder: 7733:7739 got reply transaction with no transaction stack 23:37:02 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xfc00000000000000]}}, r2}}, 0x48) [ 1156.856761] binder: 7733:7739 transaction failed 29201/-71, size 32-32 line 2801 [ 1156.857696] binder: 7733:7745 got transaction to context manager from process owning it [ 1156.911404] binder: 7733:7745 transaction failed 29201/-22, size 24-8 line 2887 23:37:02 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xfe80000000000000, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1156.955494] binder_alloc: binder_alloc_mmap_handler: 7733 20ffd000-20ffe000 already mapped failed -16 [ 1156.999029] binder: BINDER_SET_CONTEXT_MGR already set [ 1157.036062] binder: 7733:7739 ioctl 40046207 0 returned -16 [ 1157.048218] binder: 7733:7862 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 [ 1157.066650] binder: 7733:7862 got reply transaction with no transaction stack [ 1157.108029] binder_alloc: 7733: binder_alloc_buf, no vma [ 1157.117441] binder: undelivered TRANSACTION_ERROR: 29201 [ 1157.130548] binder: 7733:7739 transaction failed 29189/-3, size 24-8 line 3035 23:37:03 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x300}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:03 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x200000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000380)={0x2, 0x1c0, [0xc0000101]}) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x511100, 0x0) timerfd_gettime(r3, &(0x7f00000000c0)) fchmod(r0, 0x83) r4 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) r5 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x10001, 0x2) eventfd(0xfffffffffffffffc) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) 23:37:03 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xfec0000000000000, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:03 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xfe80000000000000]}}, r2}}, 0x48) 23:37:03 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000100)=0x2, &(0x7f0000000140)=0x1) arch_prctl$ARCH_SET_CPUID(0x1012, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 1157.533962] binder_alloc: binder_alloc_mmap_handler: 7869 20ffd000-20ffe000 already mapped failed -16 [ 1157.563960] binder: BINDER_SET_CONTEXT_MGR already set [ 1157.604176] binder: 7869:7885 ioctl 40046207 0 returned -16 [ 1157.639165] binder: 7869:7871 got new transaction with bad transaction stack, transaction 1667 has target 7869:0 [ 1157.686631] binder: send failed reply for transaction 1667 to 7869:7871 [ 1157.710117] binder: undelivered TRANSACTION_COMPLETE 23:37:03 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:03 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xfec0000000000000]}}, r2}}, 0x48) 23:37:03 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0xff00000000000000, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") syz_emit_ethernet(0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000000800450000280000000000069078ac14ffaae000000100000000", @ANYRES32=0x42424242, @ANYRES32=0x42424242, @ANYBLOB="50000000907800007da2ccf2cd194c2c420caeaf4d1fe5a72a25edd4122b44c22bfa94bae2e5f615e9eaa75cb379a511c4f8e41b2e4a226149bb97c12114b8910684db56a4ece0d398f76a3cce7de80230076fadd44e579474b0c4fc3ed5c288a8d830711fa7e9b72a66c9db3ffafa0db64c0fb08200a17e2143e8ece3021cb323f96312ab69a08c85e9cef918064d0a90fbc54d4b23845db36dd64a3fa1302bba69c015b3162d4f9588bda16b3f8494329083e644832b093736436345230e48dbf81630cbb6bb7120956bc052cd8ea73fa9e93a76e422b1639b89e6d568a9842075acbba7321a22f7f5ca6c95a9a810734a64de9daf1092fee1756623c77e510afaead8e58d7cddb41f507a2147268a1ed9032224fb45e583a415786c4dc8f077caf2c1d945d8ee2b91309707"], 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x100) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4040000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x64, r2, 0x604, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x8}}, @IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x8800}, 0x1) 23:37:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl(r1, 0x40, &(0x7f0000000500)="d306e6f5125d0d7798234ae4d7c329d726468afdcb83c2e3463819268c6461f3f76c9643a80189b8fae6044d48902f98b15e3d23fdcfb8111209f758282bbe61cda0d4ee34118a6e3f9f8b92476e72865f656b05b42d2fc90417a98ac6a1cc7ffe4f595d802643111a5638a44e604e121c908cb2a2e28ce2311de5e3381cf8cae01a") socketpair(0x15, 0x80000, 0x3, &(0x7f0000000180)={0xffffffffffffffff}) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rfkill\x00', 0x20000, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r2, 0x400442c8, &(0x7f0000000440)={r3, 0xfffffffffffffe00, 0x2, "e73481fddb8b9f5f11c44d9d8e3a58b1c358213aeea9490b45318330fcb0f65f5131ff97ac43d275085e214e04707e0d36aaffb4db1ab4d1d7207ac4fb2e1644fa6b7f98ad8580404e5fc5b0ffa2f198186489de65444440e8fbb9669a918f88edbc3206a4a4e47b1e35ecc14dddf2cb6271c3262724a4f3350e037bbd4d283770f16ec10a677f535e1153139c44943f29"}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) [ 1157.849729] binder: 7987:7992 ioctl 40 20000500 returned -22 [ 1157.883491] binder_alloc: binder_alloc_mmap_handler: 7987 20ffd000-20ffe000 already mapped failed -16 23:37:03 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xfc, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:03 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0xff00000000000000]}}, r2}}, 0x48) [ 1157.908390] binder: BINDER_SET_CONTEXT_MGR already set [ 1157.927832] binder: 7987:8107 ioctl 40 20000500 returned -22 [ 1157.937295] binder_alloc: 7987: binder_alloc_buf, no vma [ 1157.946398] binder: 7987:7992 ioctl 40046207 0 returned -16 [ 1157.966517] binder: release 7987:7992 transaction 1671 out, still active [ 1157.987008] binder: undelivered TRANSACTION_COMPLETE [ 1158.007917] binder_release_work: 3 callbacks suppressed [ 1158.007924] binder: undelivered TRANSACTION_ERROR: 29189 [ 1158.032571] binder: send failed reply for transaction 1671, target dead 23:37:04 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x900}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) r2 = dup(r1) setsockopt$inet6_MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000000)={0x0, 0x1, 0x8, 0x2, 0x7ff}, 0xc) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r3 = getpid() capset(&(0x7f0000000100)={0x399f1336, r3}, &(0x7f0000000140)={0x401, 0x10001, 0x6, 0x0, 0x1}) 23:37:04 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000040)='\xe87y\xd8\x0e\xfaE\xbb\x7fH\xbe\xbc\x95\x87\v\xd0\xcd9\xbd(0\xeeG\xaf\xe7\xb3?\xc7x\xbd\xe2R\xc5\r.', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r2, 0xc0bc5310, &(0x7f00000000c0)) 23:37:04 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x80fe, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:04 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xfc]}}, r2}}, 0x48) [ 1158.654040] binder_alloc: binder_alloc_mmap_handler: 8126 20ffd000-20ffe000 already mapped failed -16 [ 1158.696769] binder: BINDER_SET_CONTEXT_MGR already set [ 1158.704452] binder: 8126:8127 ioctl 40046207 0 returned -16 [ 1158.717834] binder_alloc: 8126: binder_alloc_buf, no vma [ 1158.728131] binder: release 8126:8127 transaction 1676 out, still active [ 1158.762292] binder: undelivered TRANSACTION_COMPLETE [ 1158.782976] binder: undelivered TRANSACTION_ERROR: 29189 [ 1158.801791] binder: send failed reply for transaction 1676, target dead 23:37:04 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xc7020000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:04 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xc0fe, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:04 executing program 5: syz_mount_image$msdos(&(0x7f0000000340)='msdos\x00', &(0x7f0000000280)='./file0\x00', 0xe800, 0x1, &(0x7f0000000180)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = syz_open_dev$sndtimer(0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0xc0505405, &(0x7f0000000100)) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000000200)='./bus\x00', 0x42042, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000000300)=0xffffffffffffffff, 0x4) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000580)="c4c1f9d687c5000000640f22850fae05c3fe0000c4c279db580a0f0096ed056af7c4e27d33fc67670f0fbf3646bfc4e3fd009a00000000c00fc76cb6a2660f38004886", 0x43}], 0x1, 0x0, &(0x7f0000000600)=[@cr0={0x0, 0x10000}, @vmwrite={0x8, 0x0, 0x0, 0x0, 0x101, 0x0, 0x2, 0x0, 0x3}], 0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x80004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_aout(r2, &(0x7f0000000580)=ANY=[], 0x97) sendfile(r2, r2, &(0x7f00000000c0), 0x8080ffffff10) syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0xffffffffffff4836, 0x82) unlinkat(r1, &(0x7f00000003c0)='./bus\x00', 0x200) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000002c0)={0x1, 0x7}, 0x8) ioctl$sock_netdev_private(r1, 0x89f9, &(0x7f0000000480)="b600b98b31f59ebb1ab3f14f51552613de60078c21be0c40ab33cd076c36c12b08cc8569bd1b3fb01360ede2a9926fa8aba6e09d5cae9fb455dfa408badab5b19147b5254a1d933118973482ea4a5184e403ac54cb1a5e320c88f92a78f618") perf_event_open$cgroup(&(0x7f0000000400)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x7, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdf3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_config_ext, 0x404, 0x0, 0x0, 0x7, 0x8, 0x1000, 0x6}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, 0xffffffffffffffff) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) r3 = socket(0x1e, 0x4, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r2, 0x5385, &(0x7f0000000640)={0x9f, ""/159}) r4 = socket(0x1e, 0x4, 0x0) connect$llc(r4, &(0x7f0000000140)={0x1a, 0x30f, 0x800000000000000, 0x0, 0x0, 0x4, @local}, 0x10) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000080), 0x10) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x2}, 0x10) sendmmsg(r3, &(0x7f0000000a40), 0x400000000000224, 0x0) socket$inet6(0xa, 0xe, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c) times(&(0x7f00000001c0)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x117}}, 0x20) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240)='/dev/hwrng\x00', 0x42200, 0x0) 23:37:04 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0x80fe]}}, r2}}, 0x48) 23:37:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x10) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04670440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="857af941c13c5b2a", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 23:37:04 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xfc00, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:04 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1158.960394] binder: 8149:8160 unknown command 1074030340 [ 1158.994976] binder: 8149:8160 ioctl c0306201 200000c0 returned -22 [ 1159.023643] binder: 8149:8169 got transaction with invalid offset (0, min 0 max 24) or object. [ 1159.089132] binder_transaction: 4 callbacks suppressed [ 1159.089149] binder: 8149:8169 transaction failed 29201/-22, size 24-8 line 3097 [ 1159.126313] binder_alloc: binder_alloc_mmap_handler: 8149 20ffd000-20ffe000 already mapped failed -16 [ 1159.141581] binder: BINDER_SET_CONTEXT_MGR already set [ 1159.147867] binder: 8149:8204 unknown command 1074030340 [ 1159.166613] binder: 8149:8169 ioctl 40046207 0 returned -16 [ 1159.186078] binder: 8149:8204 ioctl c0306201 200000c0 returned -22 [ 1159.211610] binder: undelivered TRANSACTION_ERROR: 29201 [ 1159.211796] binder_alloc: 8149: binder_alloc_buf, no vma [ 1159.240342] binder: 8149:8160 transaction failed 29189/-3, size 24-8 line 3035 [ 1159.254086] binder: undelivered TRANSACTION_ERROR: 29189 23:37:05 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0xa00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:05 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xfc00]}}, r2}}, 0x48) 23:37:05 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xfe80, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:05 executing program 5: syz_mount_image$msdos(&(0x7f0000000340)='msdos\x00', &(0x7f0000000280)='./file0\x00', 0xe800, 0x1, &(0x7f0000000180)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = syz_open_dev$sndtimer(0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0xc0505405, &(0x7f0000000100)) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000000200)='./bus\x00', 0x42042, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000000300)=0xffffffffffffffff, 0x4) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000580)="c4c1f9d687c5000000640f22850fae05c3fe0000c4c279db580a0f0096ed056af7c4e27d33fc67670f0fbf3646bfc4e3fd009a00000000c00fc76cb6a2660f38004886", 0x43}], 0x1, 0x0, &(0x7f0000000600)=[@cr0={0x0, 0x10000}, @vmwrite={0x8, 0x0, 0x0, 0x0, 0x101, 0x0, 0x2, 0x0, 0x3}], 0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x80004}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_aout(r2, &(0x7f0000000580)=ANY=[], 0x97) sendfile(r2, r2, &(0x7f00000000c0), 0x8080ffffff10) syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0xffffffffffff4836, 0x82) unlinkat(r1, &(0x7f00000003c0)='./bus\x00', 0x200) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000002c0)={0x1, 0x7}, 0x8) ioctl$sock_netdev_private(r1, 0x89f9, &(0x7f0000000480)="b600b98b31f59ebb1ab3f14f51552613de60078c21be0c40ab33cd076c36c12b08cc8569bd1b3fb01360ede2a9926fa8aba6e09d5cae9fb455dfa408badab5b19147b5254a1d933118973482ea4a5184e403ac54cb1a5e320c88f92a78f618") perf_event_open$cgroup(&(0x7f0000000400)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x7, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdf3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_config_ext, 0x404, 0x0, 0x0, 0x7, 0x8, 0x1000, 0x6}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, 0xffffffffffffffff) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) r3 = socket(0x1e, 0x4, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r2, 0x5385, &(0x7f0000000640)={0x9f, ""/159}) r4 = socket(0x1e, 0x4, 0x0) connect$llc(r4, &(0x7f0000000140)={0x1a, 0x30f, 0x800000000000000, 0x0, 0x0, 0x4, @local}, 0x10) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000080), 0x10) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x2}, 0x10) sendmmsg(r3, &(0x7f0000000a40), 0x400000000000224, 0x0) socket$inet6(0xa, 0xe, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c) times(&(0x7f00000001c0)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x117}}, 0x20) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240)='/dev/hwrng\x00', 0x42200, 0x0) 23:37:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1159.641919] binder_alloc: binder_alloc_mmap_handler: 8292 20ffc000-20fff000 already mapped failed -16 [ 1159.686192] binder: BINDER_SET_CONTEXT_MGR already set [ 1159.710290] binder: 8292:8297 ioctl 40046207 0 returned -16 [ 1159.710661] binder_alloc: 8292: binder_alloc_buf, no vma [ 1159.737752] binder: release 8292:8297 transaction 1684 out, still active [ 1159.749040] binder: 8292:8303 transaction failed 29189/-3, size 24-8 line 3035 [ 1159.757935] binder: undelivered TRANSACTION_COMPLETE [ 1159.772690] binder: send failed reply for transaction 1684, target dead [ 1159.789090] binder: undelivered TRANSACTION_ERROR: 29189 23:37:05 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x1000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:05 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xfe80]}}, r2}}, 0x48) 23:37:05 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xfec0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000440)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000480)={0x100000000000000, 0xf000, 0x9, 0xd}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r2, 0x0) r3 = accept4(0xffffffffffffff9c, &(0x7f0000000100)=@pptp={0x18, 0x2, {0x0, @initdev}}, &(0x7f0000000000)=0x80, 0x800) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@empty}}, &(0x7f0000000300)=0xe8) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000340)={r4, 0x1, 0x6}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB="000000e7ffffff00"], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 23:37:05 executing program 5: clone(0x1ffffffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000540)='/dev/fuse\x00', 0x2, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) fstat(0xffffffffffffff9c, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ATTR(r0, &(0x7f0000000780)={0x78, 0x0, 0x1, {0xf35, 0x8, 0x0, {0x6, 0x5, 0x7, 0x9, 0x6, 0x2, 0x1000, 0x4, 0x8, 0x80000000, 0xffffffffffff0000, r1, r3, 0x20, 0x200}}}, 0x78) r4 = dup3(r0, r0, 0x80000) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r4, 0x3) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000380)=0x1, 0x4) fchown(r0, r1, r2) r5 = socket$inet_tcp(0x2, 0x1, 0x0) r6 = syz_open_dev$swradio(&(0x7f00000002c0)='/dev/swradio#\x00', 0x0, 0x2) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r6, 0x84, 0x13, &(0x7f0000000340)=0x401, 0x4) r7 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) ioctl$TIOCSPGRP(r7, 0x5410, &(0x7f00000000c0)=r8) setsockopt$X25_QBITINCL(r6, 0x106, 0x1, &(0x7f0000000240)=0x1, 0x4) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'veth1\x00', 0x8100}) ioctl$SCSI_IOCTL_SYNC(r6, 0x4) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) getpeername(r5, &(0x7f0000000440)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000280)=0x80) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'vxcan1\x00', r9}) setsockopt$EBT_SO_SET_ENTRIES(r5, 0x0, 0x80, &(0x7f00000003c0)=@nat={'nat\x00', 0x19, 0x2, 0x210, [0x20000100, 0x0, 0x0, 0x200002b0, 0x200002e0], 0x0, 0x0, &(0x7f0000000e40)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000ffffffff020000000d00000000000000080669726c616e300000000000000000000069705f7674693000000000000000000073797a6b616c6c65723100000000000076657468305f746f5d626f6e64000000aaaaaaaaaabb000000000000ffffffffffff000000000000000070000000a0000000d80000004155444954000000000000000000000000000000000000000000000000000000080000000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaebb0000ffffffff000000001f000000000000000000626f6e645f736c6176655f310000002073797a6b616c6c65723000000000000079616d3000000000000000000000000062707130000000000000000000000000aaaaaaaaaa00000000000000aaaaaaaaaabb00000000000000007000000070000000a80000006172707265706c7900000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff000000009774310314849437e7949c902b61f509db2d922ec5ea3a6bee776e702eec18b60d765d0e04175fdbdef50584f10718f12f9d3e842dd80e2a6f10ab3b5a34cfb703660b29dc2c8119f5e4301d2f2d46278ede94013e66064b20ea2bc0d5570ec39e2f7fb28096fcdeb4c200000000736785b69ad2d2d3b564d5d1263d398a3c867d397836859f45ed20411ebcb9f730d95c7564046bc3740e5c76ec7a64e2da419d68a1ad8bd59189c22c5a6e38b5169fa2f65587faac551c27a83867e1210b9373bd52d9aca18fc17ae9299f48794a4b5a6b371b98894054e068c744d519cec5229cb2f4ebb4a49ad9be6bd29dccfc2eb89a58a3a33a7e135e9a55ce1b187c33d97f864720616eaaadc5da5b621f32d26f5409280000000000000050b64660210b38faebe1088407f7d36fee85200bb95258ac88521749c03b491aacad62d2696f94081ac35d4cb71cedb87ac2db25a92976c33d7b6dd883fbf128af190851401d9c97d0ccff2b07de732e589f7ebc6d5293a8209915e20a75e7d16097338b8debadc4fea895106fe398df959f426aefc460a8de30b5812d99e9e72046c021160430f03532379a13341866261d960e4698cfd09963b6e870de3a7db3df72a83eaa9c68696aeea1d6549b0f64687ccdf6e97702b74bbac67d91b43a080e25578aab5ad523a426c63066092f22491d0f43d0b802125b0b22bb4c5ab5acec6cabe33e74eff66cdcfe20cd5d6b676bf6ac5c564c1ee2ca56dc1184e7988ac367ef8a89a3ebbc80004da17a24029cc371f5f9a0782f691af8924d48235aa7700bceb17629a5044b0423cc908291220fd29870370e9575a0b6f6685106af6a097618ca59ccf15eb5d0a2a4a8aeb49906babacf97d973641e9c536c9c0a172fed9626d80960c9aeb013a6c0fe00414407ac5e4ddc39a6f8464d498d8bf10a5310dde535bb3b4d7f630100d29bafd902ba32f2728a909040ebce43a667886cd14fdbd951cb92d58fbb951d42db6ac6599a468a29c7d89304a5861e81794158e66b5da0307af821df71f3ae4439e400fbb13b322fe4b88375e17bece1b75d5debfcc4371bea028af9f7648ff0c550345ea9eb4e6bcd3013a6cc88f8d4f68f0c17430c6dbba364873748fc4631ec8b3864075d"]}, 0x5ab) [ 1160.031286] binder: 8313:8317 unknown command 0 [ 1160.045881] binder: 8313:8317 ioctl c0306201 200000c0 returned -22 [ 1160.045885] kernel msg: ebtables bug: please report to author: Wrong len argument 23:37:06 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xfec0]}}, r2}}, 0x48) [ 1160.087556] binder: 8313:8354 got transaction with invalid handle, 0 [ 1160.102645] binder: 8313:8354 transaction failed 29201/-22, size 24-8 line 3126 23:37:06 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xff00, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1160.134773] binder_alloc: binder_alloc_mmap_handler: 8313 20ffd000-20ffe000 already mapped failed -16 [ 1160.181608] binder: BINDER_SET_CONTEXT_MGR already set [ 1160.198111] binder: 8313:8354 ioctl 40046207 0 returned -16 [ 1160.205675] binder: 8313:8317 unknown command 0 [ 1160.212011] binder: 8313:8317 ioctl c0306201 200000c0 returned -22 [ 1160.218678] binder_alloc: 8313: binder_alloc_buf, no vma [ 1160.224853] binder: 8313:8354 transaction failed 29189/-3, size 24-8 line 3035 [ 1160.235309] binder: undelivered TRANSACTION_ERROR: 29201 [ 1160.242161] binder: undelivered TRANSACTION_ERROR: 29189 23:37:06 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:06 executing program 5: r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xaa, 0x401) getdents(r0, &(0x7f0000000140)=""/231, 0xe7) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000240), &(0x7f0000000280)=0x4) r1 = socket$netlink(0x10, 0x3, 0x4000000000c) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000080)="1f00000002031900000007000000068100023b0509000100010100ff3ffe58", 0x1f}], 0x1) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000040)="1f0000000203193b000007000000068100023b050900020000004042030058", 0x1f}], 0x1) 23:37:06 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xfc000000, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:06 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xff00]}}, r2}}, 0x48) [ 1160.544815] binder_alloc: binder_alloc_mmap_handler: 8449 20ffd000-20ffe000 already mapped failed -16 [ 1160.570473] binder: BINDER_SET_CONTEXT_MGR already set [ 1160.576247] binder: release 8449:8451 transaction 1692 out, still active [ 1160.583932] binder: 8449:8451 ioctl 40046207 0 returned -16 [ 1160.596443] binder: undelivered TRANSACTION_COMPLETE [ 1160.616586] binder: send failed reply for transaction 1692, target dead 23:37:06 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x40000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:06 executing program 5: r0 = perf_event_open(&(0x7f0000000300)={0x400000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8090, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, r0, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x40201, 0x0) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, {0x8, 0x6, 0x5, 0xffffffff, 0x7fff, 0x8000}}, 0x8) mmap(&(0x7f000094f000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x100000073) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) mremap(&(0x7f0000422000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f000091d000/0x3000)=nil) 23:37:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0xffffffffffffffe1, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:06 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xfe800000, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:06 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xfc000000]}}, r2}}, 0x48) [ 1160.754201] binder: 8470:8476 got transaction with invalid handle, 0 [ 1160.766511] binder: 8470:8476 transaction failed 29201/-22, size 24-8 line 3126 23:37:06 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xfec00000, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1160.801697] binder_alloc: binder_alloc_mmap_handler: 8470 20ffd000-20ffe000 already mapped failed -16 23:37:06 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xfe800000]}}, r2}}, 0x48) [ 1160.875999] binder: undelivered TRANSACTION_ERROR: 29201 23:37:07 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x4000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = gettid() prlimit64(r2, 0x0, &(0x7f0000000000)={0x4, 0xfffffffffffffffe}, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:07 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xff000000, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:07 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xfec00000]}}, r2}}, 0x48) 23:37:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="010001000000000088b070") bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x2098, 0x0, &(0x7f0000000180)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2'}, 0x48) r1 = socket$kcm(0xa, 0x5, 0x0) sendmsg(r1, &(0x7f00000006c0)={&(0x7f0000000100)=@in={0xa, 0x0, @local={0xac, 0x214}}, 0xffd6, &(0x7f0000000640), 0x98, &(0x7f0000000000)=ANY=[@ANYBLOB="20000000000000008400d95bcc2c5d3d13c4e2567e002fc9000008000080"], 0x20}, 0x60) [ 1161.502198] binder_alloc: binder_alloc_mmap_handler: 8606 20ffd000-20ffe000 already mapped failed -16 [ 1161.540773] binder: BINDER_SET_CONTEXT_MGR already set [ 1161.546073] binder: 8606:8611 ioctl 40046207 0 returned -16 [ 1161.578376] binder: release 8606:8611 transaction 1698 out, still active [ 1161.590411] binder: undelivered TRANSACTION_COMPLETE [ 1161.595644] binder: send failed reply for transaction 1698, target dead 23:37:07 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x100000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="010001000000000088b070") bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x2098, 0x0, &(0x7f0000000180)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2'}, 0x48) r1 = socket$kcm(0xa, 0x5, 0x0) sendmsg(r1, &(0x7f00000006c0)={&(0x7f0000000100)=@in={0xa, 0x0, @local={0xac, 0x214}}, 0xffd6, &(0x7f0000000640), 0x98, &(0x7f0000000000)=ANY=[@ANYBLOB="20000000000000008400d95bcc2c5d3d13c4e2567e002fc9000008000080"], 0x20}, 0x60) 23:37:07 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xff000000]}}, r2}}, 0x48) 23:37:07 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xfc00000000000000, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000280)=[@enter_looper], 0x0, 0x0, 0x0}) 23:37:07 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_script(r1, &(0x7f0000000340)={'#! ', './file0', [{0x20, 'lo\x00@\x00'}, {0x20, 'vmnet1+'}, {0x20, 'lo\x00\x00\x00\x00\x00\x00\x00Jk\x00'}, {0x20, '{.\'/vboxnet0-'}, {0x20, 'lo\x00\x00\x00\x00\x00\x00\x00Jk\x00'}, {0x20, 'system'}, {0x20, '(+selinux'}, {0x20, 'lo\x00'}, {0x20, 'lo\x00@\x00'}], 0xa, "fd93047890a999f55b155bd0d5804dc256b22ccdd7d978e2fd6d0e5c078db58c6bcbac744ac6d13ea04dc89a831a43eb87390fa3696debc6be3b531bb15fbe26a9ae599ebfc40ff268c50d3a2f1bedceed8c34e9c4515ec94f73f1c13b6d66dd2380f569c85ff45a"}, 0xc4) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000080)=@assoc_value={0x0, 0x6}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000440)={r4, @in6={{0xa, 0x4e24, 0x1d2, @dev={0xfe, 0x80, [], 0xc}, 0x5}}, [0x3, 0x8001, 0x8, 0x6, 0x10001, 0xfff, 0x3, 0x7, 0x7, 0xffffffff, 0x7, 0x2, 0x1000, 0x5, 0x1f]}, &(0x7f0000000140)=0x100) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000200)=ANY=[@ANYBLOB="72617700000000000000000000020000000000000000000000ad000000bebe76ed12ea6305a224f12649d5e9bbf990b8409aef16db9d6cce61499978c491bac410546fafef408a02ccdfc3803b2538025eda5f18ac6625969ce71509e8a334ad65b76a8bcda74755d304456ce745637be17f2992b1ad979540df2db2c87d35fcd2a3783648b84b38b3349effbcf1c6f5e21b99a81923c5ec4c8b0bd621e40acb7870e3c7ac3fe8d4e950ae0c0564cadd4bb545e7654bc4b6982b6d82a51b00e400000000000000"], &(0x7f0000000000)=0xd1) close(r3) r5 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r5, &(0x7f00000001c0)={0x18, 0x0, {0x4, @dev, 'lo\x00'}}, 0x1e) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r1, 0x0, r3, 0x0, 0x200010005, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00\x00\x00\x00\x00\x00\x00Jk\x00'}) [ 1161.820298] binder_alloc: binder_alloc_mmap_handler: 8625 20ffd000-20ffe000 already mapped failed -16 [ 1161.860106] binder: BINDER_SET_CONTEXT_MGR already set 23:37:07 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xfe80000000000000, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1161.880175] binder: 8625:8627 ioctl 40046207 0 returned -16 23:37:08 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:08 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xfc00000000000000]}}, r2}}, 0x48) 23:37:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r0, 0x406, r0) sendto$inet(r2, &(0x7f0000000100)="8e4c6c34f9d53cb3018c3244164e547c284b4665119cf7fd11e6ca2731d9574f521f0e2665834e6cdbc950cd64d81684e08be53aba544f9fbe511248226c46da3c552a014e7346f373b4c97125c45c6a3de6ed411a6241a04098cb1fae5cb5524455296cde81250ceb158011d5ffef07d0b34b08fa5eae14d7b14451c40d3df552007a7f04f1cbc248315fbbbf001410c957dc4187b53a0b68444b568b0feeb3226124633ab1a05405e690d775137ff518bcad9315a07d5bf7571e5ded27c0aaf88d9c79873f38b4", 0xc8, 0x1, &(0x7f0000000200)={0x2, 0x4e24, @empty}, 0x10) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="001f4de600000000"]], 0x0, 0x0, 0x0}) 23:37:08 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xfec0000000000000, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:08 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rtc0\x00', 0x101200, 0x0) getsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f0000000340)=""/10, &(0x7f0000000380)=0xa) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r1, &(0x7f00000001c0)={{0x6, @rose}, [@rose, @rose, @default, @null, @netrom, @rose, @rose, @null]}, 0x48) listen(r1, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000240)='/dev/cachefiles\x00', 0x40, 0x0) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f0000000280)='bcsf0\x00') ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000b00)='bcsf0\x00\x00\x00\x00\x00\x00h\x11\x00') socketpair(0x0, 0x0, 0x0, &(0x7f00000000c0)) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x101002, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r4, 0x80605414, &(0x7f0000000100)=""/50) syz_genetlink_get_family_id$team(0x0) write$binfmt_script(r1, 0x0, 0x0) write$binfmt_misc(r1, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000140)={0x80000000, 0x0, 0x0, 0x4}) ioctl$DRM_IOCTL_SG_ALLOC(r3, 0xc0106438, &(0x7f0000000180)={0x8, r5}) [ 1162.480790] binder: 8761:8766 got transaction with invalid offset (3863813888, min 0 max 24) or object. [ 1162.509845] binder: 8761:8766 transaction failed 29201/-22, size 24-8 line 3097 [ 1162.553831] binder_alloc: binder_alloc_mmap_handler: 8761 20ffd000-20ffe000 already mapped failed -16 [ 1162.574008] binder: BINDER_SET_CONTEXT_MGR already set [ 1162.579940] binder: 8761:8854 ioctl 40046207 0 returned -16 [ 1162.592504] binder_alloc: 8761: binder_alloc_buf, no vma [ 1162.598896] binder: 8761:8860 transaction failed 29189/-3, size 24-8 line 3035 [ 1162.619004] binder: undelivered TRANSACTION_ERROR: 29201 [ 1162.626040] binder: undelivered TRANSACTION_ERROR: 29189 23:37:08 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x300000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:08 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0xff00000000000000, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:08 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xfe80000000000000]}}, r2}}, 0x48) 23:37:08 executing program 5: r0 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000040), &(0x7f0000000080)=0xc) getsockopt$inet_int(r0, 0x10d, 0x2, 0xffffffffffffffff, &(0x7f0000000000)=0x111) 23:37:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) clone(0x800000, &(0x7f0000000100)="ffc1c01bf260738dfa3da3460bb5e5486b2180b7b0e1fcfdcdc9bdeffa822c640ffd345894a86d1f36e8a790c28695c56379353e7ba11e2f7f325c86f9d6a7504a0d3b672eac980d41b9c7f2b5f4338b31f04b5e1614da7dafaa54b23f2d0fdc7759584fdf48e781fc3095dfd2d405e30e5a08d26b312a242e111ddf9da05f20735fd9dbda502a9cb0b7926c0756ab35ad59df1a766eba4b2d0b1987ce4d337e99e7", &(0x7f0000000000), &(0x7f00000001c0), &(0x7f0000000200)="f9f009ab81f5bfcb7f88cfef769e07ff65764409c2f09aac9dbc5f22f19b4331f4fa1076eff86f0bbf9676c56d1c54e7f6935a5103fc668934ebf156d7da918a2cf556258364a6ee07a6") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$amidi(&(0x7f0000000300)='/dev/amidi#\x00', 0x100, 0x400400) ioctl$DRM_IOCTL_AGP_RELEASE(r2, 0x6431) 23:37:08 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000a8eff8)) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000200), 0x4) r0 = syz_open_dev$dmmidi(&(0x7f0000000140)='/dev/dmmidi#\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000380)={'mangle\x00'}, &(0x7f00000001c0)=0x381) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x10, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000500)={{{@in6=@local, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000000300)=0xe8) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x101c01, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=0x8) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0x0, r0, 0x0, 0x1, &(0x7f0000000280)='\x00', 0xffffffffffffffff}, 0x30) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000400)={[], 0x8, 0x9, 0xfffffffffffffffc, 0x3, 0x4, r3}) recvfrom$inet(r0, &(0x7f0000000240)=""/41, 0x29, 0x20, 0x0, 0x0) 23:37:08 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xfec0000000000000]}}, r2}}, 0x48) [ 1163.005888] binder_alloc: binder_alloc_mmap_handler: 8888 20ffd000-20ffe000 already mapped failed -16 [ 1163.022490] binder: BINDER_SET_CONTEXT_MGR already set [ 1163.028693] binder: 8888:8893 ioctl 40046207 0 returned -16 [ 1163.075253] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1163.105200] binder_alloc: 8888: binder_alloc_buf, no vma [ 1163.141503] binder: 8888:8904 transaction failed 29189/-3, size 24-8 line 3035 [ 1163.217246] binder: undelivered TRANSACTION_ERROR: 29189 [ 1163.227947] binder: release 8888:8893 transaction 1710 out, still active [ 1163.252235] binder: undelivered TRANSACTION_COMPLETE 23:37:09 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0xa702}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:09 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xfc, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:09 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe, 0x0, 0x0, 0xff00000000000000]}}, r2}}, 0x48) [ 1163.288512] binder: send failed reply for transaction 1710, target dead 23:37:09 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000a8eff8)) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000200), 0x4) r0 = syz_open_dev$dmmidi(&(0x7f0000000140)='/dev/dmmidi#\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000380)={'mangle\x00'}, &(0x7f00000001c0)=0x381) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x10, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000500)={{{@in6=@local, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000000300)=0xe8) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x101c01, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=0x8) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0x0, r0, 0x0, 0x1, &(0x7f0000000280)='\x00', 0xffffffffffffffff}, 0x30) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000400)={[], 0x8, 0x9, 0xfffffffffffffffc, 0x3, 0x4, r3}) recvfrom$inet(r0, &(0x7f0000000240)=""/41, 0x29, 0x20, 0x0, 0x0) [ 1163.434253] binder_alloc: binder_alloc_mmap_handler: 8922 20ffd000-20ffe000 already mapped failed -16 [ 1163.498663] binder: BINDER_SET_CONTEXT_MGR already set [ 1163.522843] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1163.539191] binder: 8922:8931 ioctl 40046207 0 returned -16 [ 1163.569056] binder: release 8922:8931 transaction 1715 out, still active [ 1163.579502] binder: undelivered TRANSACTION_COMPLETE [ 1163.602268] binder: send failed reply for transaction 1715, target dead 23:37:09 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:09 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x80fe, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:09 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xfc}, r2}}, 0x48) 23:37:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='\a\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:09 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000a8eff8)) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000200), 0x4) r0 = syz_open_dev$dmmidi(&(0x7f0000000140)='/dev/dmmidi#\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000380)={'mangle\x00'}, &(0x7f00000001c0)=0x381) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x10, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000500)={{{@in6=@local, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000000300)=0xe8) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x101c01, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=0x8) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0x0, r0, 0x0, 0x1, &(0x7f0000000280)='\x00', 0xffffffffffffffff}, 0x30) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000400)={[], 0x8, 0x9, 0xfffffffffffffffc, 0x3, 0x4, r3}) recvfrom$inet(r0, &(0x7f0000000240)=""/41, 0x29, 0x20, 0x0, 0x0) [ 1163.978788] binder: 9048:9053 unknown command 7 [ 1163.993986] binder: 9048:9053 ioctl c0306201 200000c0 returned -22 [ 1164.006357] binder: 9048:9053 got transaction with invalid handle, 0 [ 1164.018022] binder: 9048:9053 transaction failed 29201/-22, size 24-8 line 3126 [ 1164.018886] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1164.054440] binder_alloc: binder_alloc_mmap_handler: 9048 20ffd000-20ffe000 already mapped failed -16 [ 1164.089012] binder: BINDER_SET_CONTEXT_MGR already set 23:37:10 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xc0fe, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:10 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0x80fe}, r2}}, 0x48) [ 1164.101513] binder: 9048:9063 unknown command 7 [ 1164.110149] binder: 9048:9053 ioctl 40046207 0 returned -16 [ 1164.139939] binder: 9048:9063 ioctl c0306201 200000c0 returned -22 [ 1164.145967] binder: undelivered TRANSACTION_ERROR: 29201 23:37:10 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x400000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000180)={0x1}) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000000)={0x6b5, 0x5, 0x1, 0x1ff, 0xf6a, 0x1, 0x5, 0x2, 0x0}, &(0x7f0000000240)=0x20) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f00000002c0)={r3, 0x4, 0x8, [0x4, 0x2, 0x4, 0x10001, 0x7226, 0x2, 0xffffffff, 0x800]}, 0x18) r4 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vfio/vfio\x00', 0x80000, 0x0) ioctl$PPPIOCGMRU(r4, 0x80047453, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000001f00000000000000000000000018000000000000000800000000000000b65673286c3419c8aa67d97176d3d7621066d8e86cc457a8ca44d3be6268e349849bfb6ff29d532ebe63d3a1", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 23:37:10 executing program 5: ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000240)='/dev/cachefiles\x00', 0x240080, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)=""/49, 0x31}], 0x10000023, &(0x7f00000002c0)=""/77, 0x4d}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000), 0x26}, 0x0) socket$kcm(0x29, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, 0x0, &(0x7f0000000440)) socket$xdp(0x2c, 0x3, 0x0) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000500)='/dev/net/tun\x00', 0x2, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(0xffffffffffffffff, 0x400448c9, 0x0) ftruncate(0xffffffffffffffff, 0x2007fff) 23:37:10 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xfc00, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:10 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xc0fe}, r2}}, 0x48) [ 1164.763900] binder: 9081:9083 got transaction with invalid data ptr [ 1164.787471] binder: 9081:9083 transaction failed 29201/-14, size 24-8 line 3053 23:37:10 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x900000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) [ 1164.817892] binder: BINDER_SET_CONTEXT_MGR already set [ 1164.829758] binder: 9081:9083 ioctl 40046207 0 returned -16 [ 1164.838177] binder: undelivered TRANSACTION_ERROR: 29201 23:37:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0486ab5df6f38c4dc2630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:10 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xfe80, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1164.977717] binder: 9101:9105 unknown command 1571522052 [ 1164.994863] binder: 9101:9105 ioctl c0306201 200000c0 returned -22 [ 1165.006180] binder: 9101:9105 got transaction with invalid handle, 0 23:37:10 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xfc00}, r2}}, 0x48) [ 1165.023983] binder: 9101:9105 transaction failed 29201/-22, size 24-8 line 3126 23:37:11 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xfec0, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1165.065248] binder_alloc: binder_alloc_mmap_handler: 9101 20ffd000-20ffe000 already mapped failed -16 [ 1165.099619] binder: BINDER_SET_CONTEXT_MGR already set [ 1165.116116] binder: 9101:9116 ioctl 40046207 0 returned -16 [ 1165.130207] binder: 9101:9118 unknown command 1571522052 [ 1165.146246] binder_alloc: 9101: binder_alloc_buf, no vma 23:37:11 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xfe80}, r2}}, 0x48) [ 1165.167493] binder: undelivered TRANSACTION_ERROR: 29201 [ 1165.173525] binder: 9101:9105 transaction failed 29189/-3, size 24-8 line 3035 [ 1165.186032] binder: 9101:9118 ioctl c0306201 200000c0 returned -22 [ 1165.234639] binder: undelivered TRANSACTION_ERROR: 29189 23:37:11 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xff00, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:11 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x1000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) r2 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000000)={0x2, 0x0, @multicast2}, &(0x7f0000000100)=0x10, 0x800) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000140)=[@in6={0xa, 0x4e24, 0x3, @mcast2, 0xb77}], 0x1c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000180)=0x7fff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:11 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0a85322, &(0x7f00000000c0)) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) r2 = fanotify_init(0x0, 0x0) fanotify_mark(r2, 0x4000000000005, 0x8000031, r1, 0x0) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x12000, 0x0) ioctl$VIDIOC_G_PRIORITY(r3, 0x80045643, 0x0) fanotify_mark(r2, 0x2, 0x11, r1, 0x0) 23:37:11 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xfec0}, r2}}, 0x48) 23:37:11 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xfc000000, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1165.693814] binder_alloc: binder_alloc_mmap_handler: 9241 20ffd000-20ffe000 already mapped failed -16 [ 1165.749756] binder: BINDER_SET_CONTEXT_MGR already set [ 1165.780127] binder: 9241:9242 ioctl 40046207 0 returned -16 [ 1165.810878] binder_alloc: 9241: binder_alloc_buf, no vma [ 1165.832242] binder: 9241:9261 transaction failed 29189/-3, size 24-8 line 3035 [ 1165.857830] binder: release 9241:9242 transaction 1728 out, still active [ 1165.868419] binder: undelivered TRANSACTION_COMPLETE [ 1165.889458] binder: undelivered TRANSACTION_ERROR: 29189 [ 1165.904795] binder: send failed reply for transaction 1728, target dead 23:37:11 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xa00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:11 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xfe800000, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:11 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xff00}, r2}}, 0x48) 23:37:11 executing program 5: mkdir(&(0x7f00000002c0)='./control\x00', 0x0) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000040)='./control\x00', 0x2) mount(0x0, &(0x7f00000000c0)='./control\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0) inotify_add_watch(r0, &(0x7f0000000100)='./control\x00', 0x200000000001ff) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo/3\x00') preadv(r1, &(0x7f0000000080)=[{&(0x7f0000000300)=""/246, 0xf6}], 0x1, 0x2) 23:37:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x200) 23:37:12 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xfc000000}, r2}}, 0x48) [ 1166.072091] binder_alloc: binder_alloc_mmap_handler: 9268 20ffd000-20ffe000 already mapped failed -16 [ 1166.110485] binder: BINDER_SET_CONTEXT_MGR already set 23:37:12 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xfec00000, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1166.137782] binder: 9268:9273 ioctl 40046207 0 returned -16 [ 1166.164664] binder_alloc: 9268: binder_alloc_buf, no vma [ 1166.198794] binder: release 9268:9273 transaction 1733 out, still active [ 1166.206030] binder: 9268:9285 transaction failed 29189/-3, size 24-8 line 3035 [ 1166.215318] binder: undelivered TRANSACTION_COMPLETE [ 1166.228883] binder: send failed reply for transaction 1733, target dead [ 1166.261271] binder: undelivered TRANSACTION_ERROR: 29189 23:37:12 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x3000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:12 executing program 5: r0 = syz_open_dev$dspn(0x0, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x1000000) mprotect(&(0x7f0000a2a000/0x1000)=nil, 0x1000, 0x0) socket$inet6(0xa, 0x0, 0x0) openat$vfio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0xffffffffffffffff, 0x0, 0x0) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, &(0x7f0000000080)="68bd0000d7ebd3") ioctl$KVM_RUN(r2, 0xae80, 0x0) socket(0x0, 0x0, 0x0) 23:37:12 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xfe800000}, r2}}, 0x48) 23:37:12 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xff000000, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$media(&(0x7f0000000180)='/dev/media#\x00', 0x7fff, 0x408000) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000001c0)={0x9, 0x0, 0x8000, 0x6, 0x80000000, 0x0, 0x8487, 0xfecf, 0x0}, &(0x7f0000000200)=0x20) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000240)={r3, 0x7, 0x5f}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x100, 0x0) getsockopt$rose(r4, 0x104, 0x7, &(0x7f0000000100), &(0x7f0000000140)=0x4) 23:37:12 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:12 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xfc00000000000000, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1166.699500] binder_alloc: binder_alloc_mmap_handler: 9304 20ffd000-20ffe000 already mapped failed -16 [ 1166.732700] binder: BINDER_SET_CONTEXT_MGR already set 23:37:12 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xfec00000}, r2}}, 0x48) [ 1166.752964] binder: 9304:9306 ioctl 40046207 0 returned -16 [ 1166.785928] binder_alloc: 9304: binder_alloc_buf, no vma [ 1166.806526] binder: 9304:9330 transaction failed 29189/-3, size 24-8 line 3035 [ 1166.851906] binder: release 9304:9306 transaction 1738 out, still active [ 1166.864912] binder: undelivered TRANSACTION_COMPLETE 23:37:12 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xfe80000000000000, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000100)={0x4, 0x3, 0x2}) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:12 executing program 5: socketpair$unix(0x1, 0x8001000000005, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_read_part_table(0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000000)="0200eeffffff1fffffff", 0xa, 0x1c0}]) getrlimit(0xf, &(0x7f0000000040)) [ 1166.896718] binder: undelivered TRANSACTION_ERROR: 29189 [ 1166.920150] binder: send failed reply for transaction 1738, target dead [ 1167.027381] binder_alloc: binder_alloc_mmap_handler: 9444 20ffd000-20ffe000 already mapped failed -16 [ 1167.051613] Dev loop5: unable to read RDB block 1 [ 1167.061335] loop5: AHDI p1 [ 1167.062387] binder: BINDER_SET_CONTEXT_MGR already set [ 1167.071426] loop5: partition table partially beyond EOD, truncated 23:37:13 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xfec0000000000000, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1167.081053] binder: release 9444:9446 transaction 1743 out, still active [ 1167.101351] binder_alloc: 9444: binder_alloc_buf, no vma [ 1167.106997] binder: undelivered TRANSACTION_COMPLETE [ 1167.124011] binder: send failed reply for transaction 1743, target dead [ 1167.131041] binder: 9444:9452 transaction failed 29189/-3, size 24-8 line 3035 [ 1167.131238] binder: 9444:9446 ioctl 40046207 0 returned -16 [ 1167.151641] __loop_clr_fd: partition scan of loop5 failed (rc=-22) [ 1167.189724] binder: undelivered TRANSACTION_ERROR: 29189 [ 1167.220789] Dev loop5: unable to read RDB block 1 [ 1167.225808] loop5: AHDI p1 [ 1167.236315] loop5: partition table partially beyond EOD, truncated [ 1167.390597] __loop_clr_fd: partition scan of loop5 failed (rc=-22) 23:37:13 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:13 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xff000000}, r2}}, 0x48) 23:37:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="046304400867d98a90b1898129a2808ab26800eace8311bd4c8932df6815858d28db18adcf0f187338"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r2, 0xc034564b, &(0x7f0000000140)={0x1, 0x30314247, 0x6, 0x7, 0x3, @stepwise={{0x5, 0xff}, {0x7fffffff, 0x2}, {0x2, 0x3}}}) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x4000, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 23:37:13 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0xff00000000000000, 0x0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:13 executing program 5: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') dup3(r0, r0, 0x80000) openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40, 0x5) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x410000, 0x0) ioctl$VT_RELDISP(r1, 0xb701) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x10000, 0x0) [ 1167.609087] binder: 9469:9471 IncRefs 0 refcount change on invalid ref -1965463800 ret -22 [ 1167.643279] binder: 9469:9471 got transaction with invalid handle, 0 [ 1167.649980] binder: 9469:9471 transaction failed 29201/-22, size 24-8 line 3126 23:37:13 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:13 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xa}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc}}}}}}}, 0x0) r0 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x8001}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x44000}, 0x40000) 23:37:13 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xfc, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:13 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xfc00000000000000}, r2}}, 0x48) [ 1167.695110] binder_alloc: binder_alloc_mmap_handler: 9469 20ffd000-20ffe000 already mapped failed -16 [ 1167.732477] binder: BINDER_SET_CONTEXT_MGR already set 23:37:13 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xa}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc}}}}}}}, 0x0) r0 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x8001}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x44000}, 0x40000) [ 1167.756678] binder: 9469:9471 ioctl 40046207 0 returned -16 [ 1167.777234] binder: 9469:9482 IncRefs 0 refcount change on invalid ref -1965463800 ret -22 [ 1167.807184] binder_alloc: 9469: binder_alloc_buf, no vma [ 1167.830340] binder: undelivered TRANSACTION_ERROR: 29201 [ 1167.836885] binder: 9469:9497 transaction failed 29189/-3, size 24-8 line 3035 23:37:13 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xfe80000000000000}, r2}}, 0x48) 23:37:13 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xa}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc}}}}}}}, 0x0) r0 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x8001}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x44000}, 0x40000) 23:37:14 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x9000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_all\x00', 0x0, 0x0) bind$rose(r2, &(0x7f0000000100)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, 0x6, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast]}, 0x40) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000300)={&(0x7f0000000140), 0xc, &(0x7f0000000240)={&(0x7f0000000440)=ANY=[@ANYBLOB="7233e08d74fff0cbec01273c0000001c0000002abd7000fedbdf25f10000007f551051c2220de82e06bfecb6bd51aaf64f74e54656a1f1317e6eb68a9a80b7f5486c92f32cb5b808d9ab032711c44ab97b44bc8be6de05548b", @ANYRES32=r3, @ANYBLOB="01009e07080005000100000008000b0006000000080006004e22000008000100e0000001"], 0x3c}, 0x1, 0x0, 0x0, 0x4001}, 0x20000010) 23:37:14 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x80fe, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:14 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xa}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc}}}}}}}, 0x0) r0 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0x4, 0x70bd2c, 0x25dfdbfe, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x8001}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x44000}, 0x40000) 23:37:14 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xfec0000000000000}, r2}}, 0x48) [ 1168.547689] binder_alloc: 9533: binder_alloc_buf, no vma [ 1168.548064] binder: BINDER_SET_CONTEXT_MGR already set [ 1168.568526] binder: 9533:9544 transaction failed 29189/-3, size 24-8 line 3035 [ 1168.574721] binder: 9533:9537 ioctl 40046207 0 returned -16 [ 1168.620258] binder: release 9533:9537 transaction 1751 out, still active [ 1168.627126] binder: undelivered TRANSACTION_COMPLETE [ 1168.629081] binder_release_work: 1 callbacks suppressed [ 1168.629087] binder: undelivered TRANSACTION_ERROR: 29189 [ 1168.644359] binder: send failed reply for transaction 1751, target dead 23:37:14 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xc702000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:14 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xa}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc}}}}}}}, 0x0) syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') 23:37:14 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0xff00000000000000}, r2}}, 0x48) 23:37:14 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xc0fe, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xffffffffffffffe1, 0x200) r3 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x0, 0x111000) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000140)={0x3, r3}) openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x101000, 0x0) sync_file_range(r1, 0x6, 0x1ff, 0x5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:14 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xa}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc}}}}}}}, 0x0) syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0xffffffffffffffff) [ 1168.809167] binder_alloc: binder_alloc_mmap_handler: 9554 20ffd000-20ffe000 already mapped failed -16 [ 1168.833685] binder: BINDER_SET_CONTEXT_MGR already set [ 1168.840177] binder_alloc: 9554: binder_alloc_buf, no vma [ 1168.849551] binder: 9554:9557 ioctl 40046207 0 returned -16 23:37:14 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xfc00, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1168.855830] binder: release 9554:9557 transaction 1756 out, still active [ 1168.875509] binder: undelivered TRANSACTION_COMPLETE [ 1168.920519] binder: undelivered TRANSACTION_ERROR: 29189 [ 1168.942059] binder: send failed reply for transaction 1756, target dead 23:37:15 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0xa000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:15 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xfc}}, 0x48) 23:37:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x7fff, 0x4000) mq_getsetattr(r2, &(0x7f0000000100)={0xd3c0, 0x6, 0x200, 0xffffffffffffffff, 0x5, 0x100000000, 0x200, 0xa6d}, &(0x7f0000000140)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:15 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xfe80, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:15 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xa}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc}}}}}}}, 0x0) [ 1169.505588] binder_alloc: binder_alloc_mmap_handler: 9585 20ffd000-20ffe000 already mapped failed -16 [ 1169.525766] binder: release 9585:9590 transaction 1761 out, still active [ 1169.534932] binder: undelivered TRANSACTION_COMPLETE [ 1169.545321] binder: send failed reply for transaction 1761, target dead 23:37:15 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0xffffffff00000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:15 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc}}}}}}}, 0x0) 23:37:15 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xfec0, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="c1d87f0800000020bb058ac0d72ccc3f0a99efd0b545be1990ee36fc88fb6086344de41c477a21f03cb4c102996a000715ac9ef9345c2b266dd5a82155b1c734f613e93e7531844cb9c83b3ae38f09cccca2d47c18503c9c0b765031ec416b20656f6ad7a1a28dc2ef00aba2ccb215d73f35d1b5875d8033e07f3e2804aa4d165095544bc67145f999720a727c9743f8c5d30f2fe1e388390212ed5709bf"], 0x0, 0x0, 0x0}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) setsockopt$inet6_tcp_buf(r2, 0x6, 0x3d, &(0x7f00000001c0)="68afe3c66342c1d13d1ca80b125a269bbe023f4f8b5d4f3805c2357441aeb081c7b693247619f4b87d488daa783e05f6c2013879759b747750c62f1fdf44f51848fa7ca0515a8d67c44ff516772901d66747957788ee39454fff30159588dc41ab62e27395f1fa2acf7c6ca43821fca35958d915c218178b1a27a781c4aaa07a12bb29b5e9a45ba775876bbcefbb566a1355739495", 0x95) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:15 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0x80fe}}, 0x48) 23:37:15 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xff00, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:15 executing program 5: syz_emit_ethernet(0x0, 0x0, 0x0) [ 1169.920879] binder: 9604:9607 unknown command 142596289 [ 1169.926307] binder: 9604:9607 ioctl c0306201 200000c0 returned -22 [ 1169.987202] binder_alloc: 9604: binder_alloc_buf, no vma [ 1169.998306] binder_transaction: 1 callbacks suppressed [ 1169.998323] binder: 9604:9607 transaction failed 29189/-3, size 24-8 line 3035 [ 1170.037863] binder: BINDER_SET_CONTEXT_MGR already set [ 1170.055077] binder: 9604:9626 unknown command 142596289 [ 1170.079091] binder: 9604:9607 ioctl 40046207 0 returned -16 [ 1170.098175] binder: 9604:9626 ioctl c0306201 200000c0 returned -22 [ 1170.109062] binder: undelivered TRANSACTION_ERROR: 29189 23:37:16 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:16 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xc0fe}}, 0x48) 23:37:16 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xfc000000, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:16 executing program 5: syz_emit_ethernet(0x0, 0x0, 0x0) 23:37:16 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x468, 0x80) ioctl$KVM_GET_REG_LIST(r0, 0xc008aeb0, &(0x7f0000000180)={0x4, [0x43, 0x3, 0x7, 0x3]}) r1 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x100, 0x0) write$P9_RVERSION(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="1300000065ffbf9b0a000006003950303058fd04b5dae0b426638781cd87f14bfd000000000000000000"], 0x13) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1170.456913] binder_alloc: binder_alloc_mmap_handler: 9634 20ffd000-20ffe000 already mapped failed -16 [ 1170.483395] binder: BINDER_SET_CONTEXT_MGR already set [ 1170.495358] binder: 9634:9639 ioctl 40046207 0 returned -16 [ 1170.501705] binder_alloc: 9634: binder_alloc_buf, no vma [ 1170.509950] binder: release 9634:9639 transaction 1767 out, still active [ 1170.517230] binder: 9634:9646 transaction failed 29189/-3, size 24-8 line 3035 [ 1170.525286] binder: undelivered TRANSACTION_COMPLETE [ 1170.531007] binder: send failed reply for transaction 1767, target dead [ 1170.546454] binder: undelivered TRANSACTION_ERROR: 29189 23:37:16 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:16 executing program 5: syz_emit_ethernet(0x0, 0x0, 0x0) 23:37:16 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xfe800000, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:16 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xfc00}}, 0x48) 23:37:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0xfe1e, 0x0, 0x0}) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x81, 0x10a40) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000100)={{{@in=@dev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast1}}, &(0x7f0000000200)=0xe8) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0, 0x0}, &(0x7f0000000300)=0xc) write$FUSE_ENTRY(r2, &(0x7f0000000440)={0x90, 0xfffffffffffffff5, 0x2, {0x3, 0x1, 0x10001, 0x5a, 0x2, 0x9, {0x5, 0x8, 0xfffffffffffffe00, 0x17a, 0x1, 0x100, 0xd5, 0x1000, 0x5, 0x9, 0x3, r3, r4, 0x1ff, 0x3}}}, 0x90) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000340), &(0x7f0000000500)=0x4) [ 1170.995388] binder: 9655:9661 ioctl c0306201 200000c0 returned -14 [ 1171.022914] binder_alloc: binder_alloc_mmap_handler: 9655 20ffd000-20ffe000 already mapped failed -16 23:37:17 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x0, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc}}}}}}}, 0x0) 23:37:17 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xfec00000, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1171.068133] binder: BINDER_SET_CONTEXT_MGR already set [ 1171.114307] binder: 9655:9661 ioctl 40046207 0 returned -16 [ 1171.114390] binder: 9655:9672 ioctl c0306201 200000c0 returned -14 [ 1171.190785] binder_alloc: 9655: binder_alloc_buf, no vma [ 1171.205700] binder: release 9655:9661 transaction 1772 out, still active [ 1171.213363] binder: 9655:9667 transaction failed 29189/-3, size 24-8 line 3035 [ 1171.223948] binder: undelivered TRANSACTION_COMPLETE [ 1171.236327] binder: send failed reply for transaction 1772, target dead [ 1171.259628] binder: undelivered TRANSACTION_ERROR: 29189 23:37:17 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:17 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xfe80}}, 0x48) 23:37:17 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x0, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc}}}}}}}, 0x0) 23:37:17 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xff000000, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xdc8c, 0x1) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000100)={0x3e1b, 0x2, 0x6d, 0x101, 0xf, 0x9, 0x7, 0x9, 0x74f, 0x8}) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="593c682723accfa5a19dd21683f41c3e5111708f5617c2087b4752970693b4d0a2ad0db9d536cd3662b9f5e451922749d008c69d3bfaff88ca1e25597459c5b60eb52a39710ebce58ae0b2d30bb48daf21651d77745434703987ffeb06c05086b670f89efac2dad4abe28483a79c1c9734e7fdc22262ac2499362d5b1a26c66d0434f4a12c38d45cce3b537d5abf16d03829a19d7fdfa455f700c1d4c0ca5ddaaa943bed89d3bec3e58a9630331f96c6b66ce70d6250e4c62656462d17760374515efbee9dcdf2d91b4badea6f2fef6ffcd7373f22819ad6151ee18203c2d2d47bfb95f8cf6705dd8a09c1834e4292271a36901a9ef31ccd989b8d76168af14d2e2571ccc95da1e994c08a3859d32b6163f5630af328188f8916ce636d0174e0e66d7a941120b799bf"], 0x0, 0x0, 0x0}) ioctl$GIO_CMAP(r2, 0x4b70, &(0x7f0000000300)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1171.441207] binder: 9686:9695 unknown command 661142617 [ 1171.446627] binder: 9686:9695 ioctl c0306201 200000c0 returned -22 [ 1171.505576] binder_alloc: 9686: binder_alloc_buf, no vma [ 1171.519029] binder: 9686:9703 transaction failed 29189/-3, size 24-8 line 3035 [ 1171.536970] binder: undelivered TRANSACTION_ERROR: 29189 23:37:17 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:17 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x0, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc}}}}}}}, 0x0) 23:37:17 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xfc00000000000000, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:17 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xfec0}}, 0x48) 23:37:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socket$pppoe(0x18, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:17 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc}}}}}}}, 0x0) [ 1172.012359] binder_alloc: binder_alloc_mmap_handler: 9710 20ffd000-20ffe000 already mapped failed -16 [ 1172.052128] binder: BINDER_SET_CONTEXT_MGR already set 23:37:18 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xfe80000000000000, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1172.069606] binder: 9710:9715 ioctl 40046207 0 returned -16 [ 1172.069856] binder_alloc: 9710: binder_alloc_buf, no vma [ 1172.113663] binder: release 9710:9715 transaction 1779 out, still active [ 1172.123643] binder: 9710:9727 transaction failed 29189/-3, size 24-8 line 3035 [ 1172.138062] binder: undelivered TRANSACTION_COMPLETE [ 1172.153859] binder: send failed reply for transaction 1779, target dead [ 1172.169508] binder: undelivered TRANSACTION_ERROR: 29189 23:37:18 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0xa7020000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:18 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:18 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xff00}}, 0x48) 23:37:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSBRK(r2, 0x5427) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x100, 0x0) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r3, 0x12, 0x2, &(0x7f0000000100)=""/60, &(0x7f0000000140)=0x3c) fcntl$notify(r0, 0x402, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000180)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000001c0)={r4}) 23:37:18 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xfec0000000000000, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1172.355767] binder_alloc: binder_alloc_mmap_handler: 9741 20ffd000-20ffe000 already mapped failed -16 [ 1172.396273] binder: BINDER_SET_CONTEXT_MGR already set [ 1172.415354] binder: 9741:9746 ioctl 40046207 0 returned -16 [ 1172.441815] binder_alloc: 9741: binder_alloc_buf, no vma [ 1172.447512] binder: 9741:9750 transaction failed 29189/-3, size 24-8 line 3035 [ 1172.462681] binder: release 9741:9746 transaction 1784 out, still active [ 1172.473200] binder: undelivered TRANSACTION_COMPLETE [ 1172.489568] binder: undelivered TRANSACTION_ERROR: 29189 [ 1172.507131] binder: send failed reply for transaction 1784, target dead 23:37:18 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x9}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:18 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xfc000000}}, 0x48) 23:37:18 executing program 5 (fault-call:0 fault-nth:0): syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:18 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0xff00000000000000, 0x0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup3(r1, r0, 0x80000) connect$llc(r2, &(0x7f0000000000)={0x1a, 0x309, 0x100000001, 0x40, 0x2, 0x3144, @remote}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1172.673501] binder: 9761:9763 got transaction to context manager from process owning it [ 1172.690435] FAULT_INJECTION: forcing a failure. [ 1172.690435] name failslab, interval 1, probability 0, space 0, times 0 [ 1172.702065] CPU: 1 PID: 9769 Comm: syz-executor.5 Not tainted 5.0.0-rc8+ #3 [ 1172.709181] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1172.718551] Call Trace: [ 1172.721168] dump_stack+0x172/0x1f0 [ 1172.724830] should_fail.cold+0xa/0x1b [ 1172.724855] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1172.724880] ? __mutex_lock+0x3cd/0x1310 [ 1172.733898] __should_failslab+0x121/0x190 [ 1172.733919] should_failslab+0x9/0x14 [ 1172.733935] kmem_cache_alloc+0x47/0x6f0 [ 1172.750085] ? __lock_acquire+0x53b/0x4700 [ 1172.754345] ? __lock_acquire+0x53b/0x4700 [ 1172.758609] __build_skb+0x3e/0x310 [ 1172.762265] __napi_alloc_skb+0x1d2/0x300 [ 1172.766442] napi_get_frags+0x65/0x140 [ 1172.770352] tun_get_user+0x1681/0x3dd0 [ 1172.774348] ? mark_held_locks+0x100/0x100 [ 1172.778617] ? tun_build_skb.isra.0+0x1150/0x1150 [ 1172.783479] ? tun_get+0x171/0x290 [ 1172.787045] ? lock_downgrade+0x810/0x810 [ 1172.791221] ? kasan_check_read+0x11/0x20 [ 1172.795397] tun_chr_write_iter+0xbd/0x160 [ 1172.799657] do_iter_readv_writev+0x5e0/0x8e0 [ 1172.804178] ? vfs_dedupe_file_range+0x780/0x780 [ 1172.808954] ? rw_copy_check_uvector+0x2a6/0x330 [ 1172.813756] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1172.819314] ? rw_verify_area+0x118/0x360 [ 1172.823489] do_iter_write+0x184/0x610 [ 1172.827397] ? dup_iter+0x260/0x260 [ 1172.831055] vfs_writev+0x1b3/0x2f0 [ 1172.834703] ? vfs_iter_write+0xb0/0xb0 [ 1172.838717] ? kasan_check_read+0x11/0x20 [ 1172.842927] ? iterate_fd+0x360/0x360 [ 1172.846768] ? check_preemption_disabled+0x48/0x290 [ 1172.851810] ? wait_for_completion+0x440/0x440 [ 1172.856420] ? __fget_light+0x1a9/0x230 [ 1172.860417] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1172.865973] do_writev+0xf6/0x290 [ 1172.865993] ? vfs_writev+0x2f0/0x2f0 [ 1172.866013] ? do_syscall_64+0x26/0x610 [ 1172.866029] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1172.866053] ? do_syscall_64+0x26/0x610 [ 1172.886626] __x64_sys_writev+0x75/0xb0 [ 1172.890620] do_syscall_64+0x103/0x610 [ 1172.894545] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1172.899771] RIP: 0033:0x457ce1 [ 1172.902987] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 e4 b9 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 23:37:18 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xfc, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:18 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x80fe, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1172.922394] RSP: 002b:00007f607ae7bba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 1172.930208] RAX: ffffffffffffffda RBX: 000000000000004a RCX: 0000000000457ce1 [ 1172.937491] RDX: 0000000000000001 RSI: 00007f607ae7bbf0 RDI: 00000000000000f0 [ 1172.944788] RBP: 0000000020000000 R08: 00000000000000f0 R09: 0000000000000000 [ 1172.952072] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f607ae7c6d4 [ 1172.959354] R13: 00000000004c64e1 R14: 00000000004db9c0 R15: 0000000000000003 [ 1172.974692] binder: 9761:9763 transaction failed 29201/-22, size 24-8 line 2887 [ 1173.004666] binder_alloc: binder_alloc_mmap_handler: 9761 20ffd000-20ffe000 already mapped failed -16 [ 1173.028822] binder: BINDER_SET_CONTEXT_MGR already set [ 1173.037307] binder: 9761:9763 ioctl 40046207 0 returned -16 [ 1173.049282] binder: undelivered TRANSACTION_ERROR: 29201 23:37:19 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x1000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:19 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xfe800000}}, 0x48) 23:37:19 executing program 5 (fault-call:0 fault-nth:1): syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:19 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.stat\x00', 0x0, 0x0) vmsplice(r0, &(0x7f0000000840)=[{&(0x7f0000000500)="64edd03d50de29f9c9fede5993e53f24f8467c61459a220b7a441179780cae874a572f3138c372152802b63f70a0573a56c30e782f4998ef899a4c272f667264bdf39bf02a74ca7b73ec3d9db3c4d0a0c557cb7bde965c5a51dcafff1e90bc80e68774e96576af6c21606a5e5a5896d12554a0d7ccef166349e77903ce403a3ffa71e1c184234aebc3d3ec8f56bb01501f38416b3ac2c4a36631848300efa5b425cf846e6f7c730759b47b1b5be23ed7b3c4f621a51a8d5c61c1f6a884e06be2b6c74ead22b56e0b2c6362fb249db7dbf861f4a6252d0871cb65670e831d97331e2fa94dba", 0xe5}, {&(0x7f0000000300)='G', 0x1}, {&(0x7f0000000600)="bcef02a5a67c4b3ebdc0b9ee719d060f88145ef7c2aa99546dca42af5345cb91bce99de5a99e28ad56f2e261240e3b6d6542e0068790e64a35ee4b6b22fbeb311637bb586dcfd81c5a2d81f98b0e3ff9976a66fbc3e995c710845727d978ac5e8adf9d041ad47c", 0x67}, {&(0x7f0000000680)="49272d94abc50d9c6a99c266869565c06f03ecebb065b6a5193eef4e615db2e663c4988d1247d10a1829ac7eed23b94f91a44e20311a4edcb700c37597e13aa19b488b9393d744abd36eac6c2768cbbddc6230e4b63e2a62f4aa254d6225a2e008dba25008f62723460f2948febe1dd2d359377073684a284e66adee5a23c9e807752e5d183368b533b7c390705507d32f3002254cc72a2274034a8b2a44da54bc976b42aad4e6ea721d811d1ac39def8334cbb3e7a1a34c633812f1d9144049e12e92f24b633b80885e9324e719b5a906f45735de57af44fc905b9a48ec35810b505c1958c6c3ec7d6bed5915ab", 0xee}, {&(0x7f0000000780)="381efbb758109b45b221f2178318ddc16379e6c96b9487c501f2ea12cceb3fe812260ced3eab4dc162df3fc7cc2f87cce948fe642971642c64961e7f9a2125fc8bc74ecd82e829456fedbaf71c6c513e1b3f9a486181c04175f35f66c256041c0f35c831469c154c98c577e805fe28182e3fdfe3d5cee6e2db319937c79b524d2a3b0daf624fbef56c63c920caae34351d40", 0x92}], 0x5, 0xf) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f00000001c0)={0x0, 0x7, "521312f511d01c"}, &(0x7f0000000200)=0xf) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000440)={r1, @in={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}}, 0xffffffffffffffe1, 0xfffffffffffffb8e}, &(0x7f0000000240)=0x90) r2 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x1, 0x0) write$P9_RWALK(r4, &(0x7f0000000100)={0x71, 0x6f, 0x2, {0x8, [{0xe1d48414e0cf7bea, 0x2, 0x7}, {0x4, 0x1, 0x5}, {0x42, 0x4}, {0x2}, {0x10, 0x2, 0x4}, {0x57, 0x1, 0x3}, {0x2, 0x1}, {0x0, 0x2, 0x1}]}}, 0x71) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:19 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xc0fe, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1173.388207] FAULT_INJECTION: forcing a failure. [ 1173.388207] name failslab, interval 1, probability 0, space 0, times 0 [ 1173.396253] binder_alloc: binder_alloc_mmap_handler: 9796 20ffd000-20ffe000 already mapped failed -16 [ 1173.399527] CPU: 0 PID: 9795 Comm: syz-executor.5 Not tainted 5.0.0-rc8+ #3 [ 1173.410240] binder: BINDER_SET_CONTEXT_MGR already set [ 1173.415970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1173.415976] Call Trace: [ 1173.416001] dump_stack+0x172/0x1f0 [ 1173.416022] should_fail.cold+0xa/0x1b [ 1173.422241] binder: 9796:9797 ioctl 40046207 0 returned -16 [ 1173.430661] ? __nf_conntrack_find_get+0xe45/0x1960 [ 1173.430682] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1173.430698] ? __nf_conntrack_find_get+0xe45/0x1960 [ 1173.430749] __should_failslab+0x121/0x190 [ 1173.430770] should_failslab+0x9/0x14 [ 1173.433662] binder: release 9796:9797 transaction 1793 out, still active [ 1173.436985] kmem_cache_alloc+0x47/0x6f0 [ 1173.437007] ? __nf_conntrack_find_get+0xe6c/0x1960 [ 1173.437027] __nf_conntrack_alloc+0xdb/0x680 [ 1173.437055] init_conntrack.isra.0+0xe3a/0x1180 [ 1173.441695] binder: undelivered TRANSACTION_COMPLETE [ 1173.446655] ? nf_conntrack_alloc+0x50/0x50 [ 1173.446685] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 1173.446710] nf_conntrack_in+0xa68/0x1070 [ 1173.452023] binder: send failed reply for transaction 1793, target dead [ 1173.456890] ? nf_conntrack_update+0x990/0x990 [ 1173.456909] ? ip6t_error+0x40/0x40 [ 1173.456949] ipv6_conntrack_in+0x1e/0x30 [ 1173.532938] nf_hook_slow+0xbf/0x1f0 [ 1173.536669] ipv6_rcv+0x25d/0x420 [ 1173.540140] ? ip6_rcv_core.isra.0+0x1c00/0x1c00 [ 1173.544911] ? ip6_rcv_finish_core.isra.0+0x590/0x590 [ 1173.550117] ? ip6_rcv_core.isra.0+0x1c00/0x1c00 [ 1173.554888] __netif_receive_skb_one_core+0x115/0x1a0 [ 1173.560090] ? __netif_receive_skb_core+0x3010/0x3010 [ 1173.565293] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1173.570844] ? check_preemption_disabled+0x48/0x290 [ 1173.575872] ? lock_acquire+0x16f/0x3f0 [ 1173.579864] __netif_receive_skb+0x2c/0x1c0 [ 1173.584201] netif_receive_skb_internal+0x117/0x660 [ 1173.589226] ? dev_cpu_dead+0x920/0x920 [ 1173.593212] ? eth_gro_receive+0x890/0x890 [ 1173.597466] napi_gro_frags+0xade/0xd10 [ 1173.601514] tun_get_user+0x2c0e/0x3dd0 [ 1173.605518] ? tun_build_skb.isra.0+0x1150/0x1150 [ 1173.610369] ? tun_get+0x171/0x290 [ 1173.613929] ? lock_downgrade+0x810/0x810 [ 1173.618090] ? kasan_check_read+0x11/0x20 [ 1173.622258] tun_chr_write_iter+0xbd/0x160 [ 1173.626510] do_iter_readv_writev+0x5e0/0x8e0 [ 1173.631025] ? vfs_dedupe_file_range+0x780/0x780 [ 1173.635797] ? rw_copy_check_uvector+0x2a6/0x330 [ 1173.640566] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1173.646119] ? rw_verify_area+0x118/0x360 [ 1173.650282] do_iter_write+0x184/0x610 [ 1173.654184] ? dup_iter+0x260/0x260 [ 1173.657833] vfs_writev+0x1b3/0x2f0 [ 1173.661475] ? vfs_iter_write+0xb0/0xb0 [ 1173.665464] ? kasan_check_read+0x11/0x20 [ 1173.669635] ? iterate_fd+0x360/0x360 [ 1173.673446] ? check_preemption_disabled+0x48/0x290 [ 1173.678474] ? wait_for_completion+0x440/0x440 [ 1173.683073] ? __fget_light+0x1a9/0x230 [ 1173.687067] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1173.692622] do_writev+0xf6/0x290 [ 1173.696093] ? vfs_writev+0x2f0/0x2f0 [ 1173.699907] ? do_syscall_64+0x26/0x610 [ 1173.703893] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1173.709317] ? do_syscall_64+0x26/0x610 [ 1173.713314] __x64_sys_writev+0x75/0xb0 [ 1173.717300] do_syscall_64+0x103/0x610 [ 1173.721204] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1173.726404] RIP: 0033:0x457ce1 [ 1173.729607] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 e4 b9 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 1173.748560] RSP: 002b:00007f607ae7bba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 1173.756280] RAX: ffffffffffffffda RBX: 000000000000004a RCX: 0000000000457ce1 [ 1173.763556] RDX: 0000000000000001 RSI: 00007f607ae7bbf0 RDI: 00000000000000f0 [ 1173.770836] RBP: 0000000020000000 R08: 00000000000000f0 R09: 0000000000000000 [ 1173.778356] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f607ae7c6d4 [ 1173.785635] R13: 00000000004c64e1 R14: 00000000004db9c0 R15: 0000000000000003 23:37:19 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0xa}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:19 executing program 5 (fault-call:0 fault-nth:2): syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:19 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xfc00, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000000100), 0x8) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) arch_prctl$ARCH_SET_GS(0x1001, 0x6) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="42fd1e40"], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000008, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x31, 0x0, &(0x7f0000000440)=[@dead_binder_done={0x40086310, 0x2}, @acquire={0x40046305, 0x1}, @reply_sg={0x40486312, {{0x4, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@ptr={0x70742a85, 0x1, &(0x7f0000000140), 0x0, 0x1, 0x17}, @fda={0x66646185, 0x4, 0x1, 0x30}, @flat={0x73622a85, 0x1, r2}], &(0x7f0000000200)=[0x30, 0x20, 0x0, 0x28, 0x78]}, 0x8}}, @clear_death={0x400c630f, 0x1}, @request_death={0x400c630e, 0x3, 0x4}, @enter_looper, @request_death={0x400c630e, 0x2, 0x2}], 0xffffffffffffffe7, 0x0, 0x0}) prctl$PR_SET_DUMPABLE(0x4, 0x3) r3 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0) ioctl$FS_IOC_SETVERSION(r3, 0x40087602, &(0x7f0000000040)=0x40) 23:37:19 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xfec00000}}, 0x48) [ 1173.981950] FAULT_INJECTION: forcing a failure. [ 1173.981950] name failslab, interval 1, probability 0, space 0, times 0 [ 1173.993272] CPU: 1 PID: 9817 Comm: syz-executor.5 Not tainted 5.0.0-rc8+ #3 [ 1174.000452] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1174.009880] Call Trace: [ 1174.012497] dump_stack+0x172/0x1f0 [ 1174.016149] should_fail.cold+0xa/0x1b [ 1174.020051] ? mark_held_locks+0x100/0x100 [ 1174.024316] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1174.029469] ? perf_trace_lock_acquire+0xf5/0x580 [ 1174.034330] ? __nf_conntrack_find_get+0xe45/0x1960 [ 1174.039378] __should_failslab+0x121/0x190 [ 1174.043638] should_failslab+0x9/0x14 [ 1174.047455] __kmalloc_track_caller+0x6d/0x740 [ 1174.052055] ? lock_downgrade+0x810/0x810 [ 1174.056228] ? nf_ct_ext_add+0x2a9/0x640 [ 1174.060309] __krealloc+0x71/0xc0 [ 1174.063809] nf_ct_ext_add+0x2a9/0x640 [ 1174.067723] init_conntrack.isra.0+0x447/0x1180 [ 1174.072442] ? nf_conntrack_alloc+0x50/0x50 [ 1174.076806] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 1174.082284] nf_conntrack_in+0xa68/0x1070 [ 1174.086467] ? nf_conntrack_update+0x990/0x990 [ 1174.091070] ? ip6t_error+0x40/0x40 [ 1174.094760] ipv6_conntrack_in+0x1e/0x30 [ 1174.098847] nf_hook_slow+0xbf/0x1f0 [ 1174.102593] ipv6_rcv+0x25d/0x420 [ 1174.106071] ? ip6_rcv_core.isra.0+0x1c00/0x1c00 [ 1174.106097] binder: 9822:9833 unknown command 1075772738 [ 1174.110848] ? ip6_rcv_finish_core.isra.0+0x590/0x590 [ 1174.110872] ? ip6_rcv_core.isra.0+0x1c00/0x1c00 [ 1174.110890] __netif_receive_skb_one_core+0x115/0x1a0 [ 1174.110906] ? __netif_receive_skb_core+0x3010/0x3010 [ 1174.117784] binder: 9822:9833 ioctl c0306201 200000c0 returned -22 [ 1174.121564] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1174.121582] ? check_preemption_disabled+0x48/0x290 [ 1174.121596] ? lock_acquire+0x16f/0x3f0 [ 1174.121617] __netif_receive_skb+0x2c/0x1c0 [ 1174.121635] netif_receive_skb_internal+0x117/0x660 [ 1174.121651] ? dev_cpu_dead+0x920/0x920 [ 1174.121669] ? eth_gro_receive+0x890/0x890 [ 1174.121698] napi_gro_frags+0xade/0xd10 [ 1174.133064] binder: 9822:9833 BC_DEAD_BINDER_DONE 0000000000000002 not found [ 1174.136844] tun_get_user+0x2c0e/0x3dd0 [ 1174.136883] ? tun_build_skb.isra.0+0x1150/0x1150 [ 1174.136898] ? tun_get+0x171/0x290 [ 1174.136923] ? lock_downgrade+0x810/0x810 [ 1174.136942] ? kasan_check_read+0x11/0x20 [ 1174.175124] binder: 9822:9833 Acquire 1 refcount change on invalid ref 1 ret -22 [ 1174.175797] tun_chr_write_iter+0xbd/0x160 [ 1174.175819] do_iter_readv_writev+0x5e0/0x8e0 [ 1174.175840] ? vfs_dedupe_file_range+0x780/0x780 [ 1174.175856] ? rw_copy_check_uvector+0x2a6/0x330 [ 1174.193817] binder: 9822:9833 got reply transaction with no transaction stack [ 1174.195839] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1174.195860] ? rw_verify_area+0x118/0x360 [ 1174.195880] do_iter_write+0x184/0x610 [ 1174.195896] ? dup_iter+0x260/0x260 [ 1174.195923] vfs_writev+0x1b3/0x2f0 [ 1174.195939] ? vfs_iter_write+0xb0/0xb0 [ 1174.210163] binder: 9822:9833 transaction failed 29201/-71, size 0-0 line 2801 [ 1174.215369] ? kasan_check_read+0x11/0x20 [ 1174.215401] ? iterate_fd+0x360/0x360 23:37:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x4001, 0x0) getsockname(r2, &(0x7f0000000100), &(0x7f0000000180)=0x80) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="046304ff28e2124102fd35c3ef7ff4b740"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1174.215418] ? check_preemption_disabled+0x48/0x290 [ 1174.215439] ? wait_for_completion+0x440/0x440 [ 1174.215459] ? __fget_light+0x1a9/0x230 [ 1174.215475] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1174.232496] binder: 9822:9833 ioctl c0306201 200003c0 returned -14 [ 1174.233758] do_writev+0xf6/0x290 [ 1174.233779] ? vfs_writev+0x2f0/0x2f0 [ 1174.233799] ? do_syscall_64+0x26/0x610 [ 1174.233815] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1174.233829] ? do_syscall_64+0x26/0x610 [ 1174.233851] __x64_sys_writev+0x75/0xb0 [ 1174.233868] do_syscall_64+0x103/0x610 [ 1174.327340] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1174.327354] RIP: 0033:0x457ce1 [ 1174.327370] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 e4 b9 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 1174.327380] RSP: 002b:00007f607ae7bba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 1174.327396] RAX: ffffffffffffffda RBX: 000000000000004a RCX: 0000000000457ce1 23:37:20 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xfe80, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1174.327406] RDX: 0000000000000001 RSI: 00007f607ae7bbf0 RDI: 00000000000000f0 [ 1174.327416] RBP: 0000000020000000 R08: 00000000000000f0 R09: 0000000000000000 [ 1174.327425] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f607ae7c6d4 [ 1174.327435] R13: 00000000004c64e1 R14: 00000000004db9c0 R15: 0000000000000003 [ 1174.344827] binder: undelivered TRANSACTION_ERROR: 29201 [ 1174.430559] binder: 9837:9838 unknown command -16489724 [ 1174.443613] binder: 9837:9838 ioctl c0306201 200000c0 returned -22 [ 1174.462133] binder: 9837:9838 got transaction with invalid handle, 0 [ 1174.474907] binder: 9837:9838 transaction failed 29201/-22, size 24-8 line 3126 [ 1174.492989] binder_alloc: binder_alloc_mmap_handler: 9837 20ffd000-20ffe000 already mapped failed -16 [ 1174.518342] binder: BINDER_SET_CONTEXT_MGR already set [ 1174.524329] binder: 9837:9838 ioctl 40046207 0 returned -16 [ 1174.532369] binder: 9837:9846 unknown command -16489724 [ 1174.537887] binder: 9837:9846 ioctl c0306201 200000c0 returned -22 [ 1174.544676] binder_alloc: 9837: binder_alloc_buf, no vma [ 1174.550777] binder: undelivered TRANSACTION_ERROR: 29201 [ 1174.556840] binder: 9837:9838 transaction failed 29189/-3, size 24-8 line 3035 [ 1174.564815] binder: undelivered TRANSACTION_ERROR: 29189 23:37:20 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x40000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:20 executing program 5 (fault-call:0 fault-nth:3): syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:20 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xff000000}}, 0x48) 23:37:20 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xfec0, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1174.710578] FAULT_INJECTION: forcing a failure. [ 1174.710578] name failslab, interval 1, probability 0, space 0, times 0 [ 1174.722204] CPU: 0 PID: 9859 Comm: syz-executor.5 Not tainted 5.0.0-rc8+ #3 [ 1174.729321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1174.738692] Call Trace: [ 1174.741329] dump_stack+0x172/0x1f0 [ 1174.741357] should_fail.cold+0xa/0x1b [ 1174.741379] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1174.741398] ? lock_downgrade+0x810/0x810 [ 1174.741433] __should_failslab+0x121/0x190 [ 1174.741457] should_failslab+0x9/0x14 [ 1174.741475] kmem_cache_alloc_node+0x56/0x710 [ 1174.741507] __alloc_skb+0xd5/0x5e0 [ 1174.749016] ? skb_scrub_packet+0x440/0x440 [ 1174.749041] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1174.749061] ? refcount_sub_and_test_checked+0x161/0x1f0 [ 1174.749079] ? refcount_inc_checked+0x70/0x70 [ 1174.749103] tcp_v6_send_response+0x22e/0x1f70 [ 1174.798992] ? tcp_v6_syn_recv_sock+0x2320/0x2320 [ 1174.803855] ? perf_trace_lock+0x510/0x510 [ 1174.808124] ? __xfrm_route_forward+0x860/0x860 [ 1174.812820] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1174.818373] ? check_preemption_disabled+0x48/0x290 [ 1174.823407] ? lock_acquire+0x16f/0x3f0 [ 1174.827408] tcp_v6_send_reset+0x77a/0xf90 [ 1174.831681] ? tcp_v6_send_response+0x1f70/0x1f70 [ 1174.836545] ? memcpy+0x46/0x50 [ 1174.839845] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1174.845409] tcp_v6_rcv+0x1e2a/0x3530 [ 1174.849257] ? tcp_v6_err+0x1820/0x1820 [ 1174.853264] ip6_protocol_deliver_rcu+0x303/0x16c0 [ 1174.858232] ip6_input_finish+0x84/0x170 [ 1174.862313] ip6_input+0xe4/0x3f0 [ 1174.865789] ? ip6_input_finish+0x170/0x170 [ 1174.870137] ? ip6_protocol_deliver_rcu+0x16c0/0x16c0 [ 1174.875360] ip6_rcv_finish+0x1e7/0x320 [ 1174.879355] ipv6_rcv+0x10e/0x420 [ 1174.882833] ? ip6_rcv_core.isra.0+0x1c00/0x1c00 [ 1174.887611] ? ip6_rcv_finish_core.isra.0+0x590/0x590 [ 1174.892830] ? ip6_rcv_core.isra.0+0x1c00/0x1c00 [ 1174.897605] __netif_receive_skb_one_core+0x115/0x1a0 [ 1174.902814] ? __netif_receive_skb_core+0x3010/0x3010 [ 1174.908243] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1174.913805] ? check_preemption_disabled+0x48/0x290 [ 1174.918837] ? lock_acquire+0x16f/0x3f0 [ 1174.922838] __netif_receive_skb+0x2c/0x1c0 [ 1174.927180] netif_receive_skb_internal+0x117/0x660 [ 1174.932216] ? dev_cpu_dead+0x920/0x920 [ 1174.936217] ? eth_gro_receive+0x890/0x890 [ 1174.940483] napi_gro_frags+0xade/0xd10 [ 1174.944487] tun_get_user+0x2c0e/0x3dd0 [ 1174.948505] ? tun_build_skb.isra.0+0x1150/0x1150 [ 1174.953362] ? tun_get+0x171/0x290 [ 1174.956927] ? lock_downgrade+0x810/0x810 [ 1174.961096] ? kasan_check_read+0x11/0x20 [ 1174.965262] tun_chr_write_iter+0xbd/0x160 [ 1174.969515] do_iter_readv_writev+0x5e0/0x8e0 [ 1174.974719] ? vfs_dedupe_file_range+0x780/0x780 [ 1174.979501] ? rw_copy_check_uvector+0x2a6/0x330 [ 1174.984270] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1174.989830] ? rw_verify_area+0x118/0x360 [ 1174.994008] do_iter_write+0x184/0x610 [ 1174.997912] ? dup_iter+0x260/0x260 [ 1175.001587] vfs_writev+0x1b3/0x2f0 [ 1175.005234] ? vfs_iter_write+0xb0/0xb0 [ 1175.009226] ? kasan_check_read+0x11/0x20 [ 1175.013410] ? iterate_fd+0x360/0x360 [ 1175.017234] ? check_preemption_disabled+0x48/0x290 [ 1175.022266] ? wait_for_completion+0x440/0x440 [ 1175.026859] ? __fget_light+0x1a9/0x230 [ 1175.030845] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1175.036393] do_writev+0xf6/0x290 [ 1175.036748] binder: 9854:9874 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 1175.039861] ? vfs_writev+0x2f0/0x2f0 [ 1175.039882] ? do_syscall_64+0x26/0x610 [ 1175.039898] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1175.039912] ? do_syscall_64+0x26/0x610 [ 1175.039932] __x64_sys_writev+0x75/0xb0 [ 1175.068498] do_syscall_64+0x103/0x610 [ 1175.072395] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1175.077602] RIP: 0033:0x457ce1 [ 1175.080805] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 e4 b9 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 1175.084295] binder: 9854:9875 transaction failed 29189/-22, size 24-8 line 2896 [ 1175.099719] RSP: 002b:00007f607ae7bba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 1175.099743] RAX: ffffffffffffffda RBX: 000000000000004a RCX: 0000000000457ce1 [ 1175.099753] RDX: 0000000000000001 RSI: 00007f607ae7bbf0 RDI: 00000000000000f0 [ 1175.099762] RBP: 0000000020000000 R08: 00000000000000f0 R09: 0000000000000000 [ 1175.099772] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f607ae7c6d4 [ 1175.099782] R13: 00000000004c64e1 R14: 00000000004db9c0 R15: 0000000000000003 23:37:21 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:21 executing program 5 (fault-call:0 fault-nth:4): syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:21 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xfc00000000000000}}, 0x48) [ 1175.239952] FAULT_INJECTION: forcing a failure. [ 1175.239952] name failslab, interval 1, probability 0, space 0, times 0 [ 1175.251228] CPU: 1 PID: 9879 Comm: syz-executor.5 Not tainted 5.0.0-rc8+ #3 [ 1175.258331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1175.258338] Call Trace: [ 1175.258365] dump_stack+0x172/0x1f0 [ 1175.258391] should_fail.cold+0xa/0x1b [ 1175.258417] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1175.258448] ? xfrm_policy_lookup_bytype+0x41f/0x1000 [ 1175.288128] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1175.293675] ? should_fail+0x14d/0x85c [ 1175.297585] __should_failslab+0x121/0x190 [ 1175.301867] should_failslab+0x9/0x14 [ 1175.305703] kmem_cache_alloc_node_trace+0x5a/0x720 [ 1175.310835] ? __alloc_skb+0xd5/0x5e0 [ 1175.314646] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 1175.320127] __kmalloc_node_track_caller+0x3d/0x70 [ 1175.325075] __kmalloc_reserve.isra.0+0x40/0xf0 [ 1175.329771] __alloc_skb+0x10b/0x5e0 [ 1175.333507] ? skb_scrub_packet+0x440/0x440 [ 1175.337841] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1175.343390] ? refcount_sub_and_test_checked+0x161/0x1f0 [ 1175.348867] ? refcount_inc_checked+0x70/0x70 [ 1175.353407] tcp_v6_send_response+0x22e/0x1f70 [ 1175.358015] ? tcp_v6_syn_recv_sock+0x2320/0x2320 [ 1175.362866] ? perf_trace_lock+0x510/0x510 [ 1175.367119] ? __xfrm_route_forward+0x860/0x860 [ 1175.371800] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1175.377343] ? check_preemption_disabled+0x48/0x290 [ 1175.382364] ? lock_acquire+0x16f/0x3f0 [ 1175.386355] tcp_v6_send_reset+0x77a/0xf90 [ 1175.390613] ? tcp_v6_send_response+0x1f70/0x1f70 [ 1175.395464] ? memcpy+0x46/0x50 [ 1175.398760] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1175.404312] tcp_v6_rcv+0x1e2a/0x3530 [ 1175.408146] ? tcp_v6_err+0x1820/0x1820 [ 1175.412139] ip6_protocol_deliver_rcu+0x303/0x16c0 [ 1175.417092] ip6_input_finish+0x84/0x170 [ 1175.421163] ip6_input+0xe4/0x3f0 [ 1175.424641] ? ip6_input_finish+0x170/0x170 [ 1175.428994] ? ip6_protocol_deliver_rcu+0x16c0/0x16c0 [ 1175.434204] ip6_rcv_finish+0x1e7/0x320 [ 1175.438238] ipv6_rcv+0x10e/0x420 [ 1175.441741] ? ip6_rcv_core.isra.0+0x1c00/0x1c00 [ 1175.446509] ? ip6_rcv_finish_core.isra.0+0x590/0x590 [ 1175.451741] ? ip6_rcv_core.isra.0+0x1c00/0x1c00 [ 1175.456553] __netif_receive_skb_one_core+0x115/0x1a0 [ 1175.461761] ? __netif_receive_skb_core+0x3010/0x3010 [ 1175.466959] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1175.472548] ? check_preemption_disabled+0x48/0x290 [ 1175.477600] ? lock_acquire+0x16f/0x3f0 [ 1175.481590] __netif_receive_skb+0x2c/0x1c0 [ 1175.485926] netif_receive_skb_internal+0x117/0x660 [ 1175.490964] ? dev_cpu_dead+0x920/0x920 [ 1175.494947] ? eth_gro_receive+0x890/0x890 [ 1175.499192] napi_gro_frags+0xade/0xd10 [ 1175.503197] tun_get_user+0x2c0e/0x3dd0 [ 1175.507201] ? tun_build_skb.isra.0+0x1150/0x1150 [ 1175.512046] ? tun_get+0x171/0x290 [ 1175.515599] ? lock_downgrade+0x810/0x810 [ 1175.519774] ? kasan_check_read+0x11/0x20 [ 1175.523936] tun_chr_write_iter+0xbd/0x160 [ 1175.528176] do_iter_readv_writev+0x5e0/0x8e0 [ 1175.532695] ? vfs_dedupe_file_range+0x780/0x780 [ 1175.537558] ? rw_copy_check_uvector+0x2a6/0x330 [ 1175.542339] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1175.547908] ? rw_verify_area+0x118/0x360 [ 1175.552069] do_iter_write+0x184/0x610 [ 1175.555962] ? dup_iter+0x260/0x260 [ 1175.559634] vfs_writev+0x1b3/0x2f0 [ 1175.563284] ? vfs_iter_write+0xb0/0xb0 [ 1175.567267] ? kasan_check_read+0x11/0x20 [ 1175.571434] ? iterate_fd+0x360/0x360 [ 1175.575255] ? check_preemption_disabled+0x48/0x290 [ 1175.580283] ? wait_for_completion+0x440/0x440 [ 1175.584878] ? __fget_light+0x1a9/0x230 [ 1175.588865] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1175.594423] do_writev+0xf6/0x290 [ 1175.597884] ? vfs_writev+0x2f0/0x2f0 [ 1175.601692] ? do_syscall_64+0x26/0x610 [ 1175.605699] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1175.611109] ? do_syscall_64+0x26/0x610 [ 1175.615113] __x64_sys_writev+0x75/0xb0 [ 1175.619102] do_syscall_64+0x103/0x610 [ 1175.623004] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1175.628195] RIP: 0033:0x457ce1 [ 1175.631408] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 e4 b9 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 1175.650311] RSP: 002b:00007f607ae7bba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 1175.658022] RAX: ffffffffffffffda RBX: 000000000000004a RCX: 0000000000457ce1 [ 1175.665304] RDX: 0000000000000001 RSI: 00007f607ae7bbf0 RDI: 00000000000000f0 [ 1175.672575] RBP: 0000000020000000 R08: 00000000000000f0 R09: 0000000000000000 [ 1175.679844] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f607ae7c6d4 [ 1175.687206] R13: 00000000004c64e1 R14: 00000000004db9c0 R15: 0000000000000003 23:37:21 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xff00, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:21 executing program 5 (fault-call:0 fault-nth:5): syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1175.731238] binder_alloc: 9854: binder_alloc_buf, no vma [ 1175.760337] binder: 9854:9874 transaction failed 29189/-3, size 24-8 line 3035 [ 1175.772191] binder: undelivered TRANSACTION_ERROR: 29189 23:37:21 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xfe80000000000000}}, 0x48) [ 1175.779452] binder: undelivered TRANSACTION_ERROR: 29189 23:37:21 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1175.841174] FAULT_INJECTION: forcing a failure. [ 1175.841174] name failslab, interval 1, probability 0, space 0, times 0 [ 1175.852801] CPU: 0 PID: 9896 Comm: syz-executor.5 Not tainted 5.0.0-rc8+ #3 [ 1175.852812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1175.852818] Call Trace: [ 1175.852844] dump_stack+0x172/0x1f0 [ 1175.852866] should_fail.cold+0xa/0x1b [ 1175.869306] ? __nf_conntrack_find_get+0xe45/0x1960 [ 1175.869323] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1175.869338] ? __nf_conntrack_find_get+0xe45/0x1960 [ 1175.869365] __should_failslab+0x121/0x190 [ 1175.898719] should_failslab+0x9/0x14 [ 1175.902533] kmem_cache_alloc+0x47/0x6f0 [ 1175.906612] ? __nf_conntrack_find_get+0xe6c/0x1960 [ 1175.911633] __nf_conntrack_alloc+0xdb/0x680 [ 1175.916098] init_conntrack.isra.0+0xe3a/0x1180 [ 1175.920779] ? nf_conntrack_alloc+0x50/0x50 [ 1175.925118] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 1175.930583] nf_conntrack_in+0xa68/0x1070 [ 1175.934756] ? nf_conntrack_update+0x990/0x990 [ 1175.939344] ? ip6t_error+0x40/0x40 [ 1175.942996] ipv6_conntrack_local+0x1e/0x30 [ 1175.947326] nf_hook_slow+0xbf/0x1f0 [ 1175.951065] ip6_xmit+0x11c6/0x20c0 [ 1175.954749] ? ip6_finish_output2+0x2550/0x2550 [ 1175.959444] ? kasan_kmalloc+0x9/0x10 [ 1175.963286] ? __kmalloc_node_track_caller+0x4e/0x70 [ 1175.968397] ? ip6_setup_cork+0x18a0/0x18a0 [ 1175.972747] ? refcount_sub_and_test_checked+0x161/0x1f0 [ 1175.978219] tcp_v6_send_response+0xe50/0x1f70 [ 1175.982861] ? tcp_v6_syn_recv_sock+0x2320/0x2320 [ 1175.987710] ? perf_trace_lock+0x510/0x510 [ 1175.991971] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1175.997518] ? check_preemption_disabled+0x48/0x290 [ 1176.002538] ? lock_acquire+0x16f/0x3f0 [ 1176.006562] tcp_v6_send_reset+0x77a/0xf90 [ 1176.010846] ? tcp_v6_send_response+0x1f70/0x1f70 [ 1176.015696] ? memcpy+0x46/0x50 [ 1176.018986] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1176.024547] tcp_v6_rcv+0x1e2a/0x3530 [ 1176.028376] ? tcp_v6_err+0x1820/0x1820 [ 1176.032384] ip6_protocol_deliver_rcu+0x303/0x16c0 [ 1176.037352] ip6_input_finish+0x84/0x170 [ 1176.041438] ip6_input+0xe4/0x3f0 [ 1176.044919] ? ip6_input_finish+0x170/0x170 [ 1176.049255] ? ip6_protocol_deliver_rcu+0x16c0/0x16c0 [ 1176.054482] ip6_rcv_finish+0x1e7/0x320 [ 1176.058469] ipv6_rcv+0x10e/0x420 [ 1176.061932] ? ip6_rcv_core.isra.0+0x1c00/0x1c00 [ 1176.066720] ? ip6_rcv_finish_core.isra.0+0x590/0x590 [ 1176.071940] ? ip6_rcv_core.isra.0+0x1c00/0x1c00 [ 1176.076711] __netif_receive_skb_one_core+0x115/0x1a0 [ 1176.081967] ? __netif_receive_skb_core+0x3010/0x3010 [ 1176.087162] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1176.092705] ? check_preemption_disabled+0x48/0x290 [ 1176.097746] ? lock_acquire+0x16f/0x3f0 [ 1176.101748] __netif_receive_skb+0x2c/0x1c0 [ 1176.106085] netif_receive_skb_internal+0x117/0x660 [ 1176.111115] ? dev_cpu_dead+0x920/0x920 [ 1176.115128] ? eth_gro_receive+0x890/0x890 [ 1176.119381] napi_gro_frags+0xade/0xd10 [ 1176.123430] tun_get_user+0x2c0e/0x3dd0 [ 1176.127439] ? tun_build_skb.isra.0+0x1150/0x1150 [ 1176.132288] ? tun_get+0x171/0x290 [ 1176.135845] ? lock_downgrade+0x810/0x810 [ 1176.140004] ? kasan_check_read+0x11/0x20 [ 1176.144183] tun_chr_write_iter+0xbd/0x160 [ 1176.148435] do_iter_readv_writev+0x5e0/0x8e0 [ 1176.152960] ? vfs_dedupe_file_range+0x780/0x780 [ 1176.157775] ? rw_copy_check_uvector+0x2a6/0x330 [ 1176.162542] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1176.168086] ? rw_verify_area+0x118/0x360 [ 1176.172251] do_iter_write+0x184/0x610 [ 1176.176142] ? dup_iter+0x260/0x260 [ 1176.179803] vfs_writev+0x1b3/0x2f0 [ 1176.183440] ? vfs_iter_write+0xb0/0xb0 [ 1176.187426] ? kasan_check_read+0x11/0x20 [ 1176.191601] ? iterate_fd+0x360/0x360 [ 1176.195429] ? check_preemption_disabled+0x48/0x290 [ 1176.200465] ? wait_for_completion+0x440/0x440 [ 1176.205064] ? __fget_light+0x1a9/0x230 [ 1176.209058] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1176.214621] do_writev+0xf6/0x290 [ 1176.218085] ? vfs_writev+0x2f0/0x2f0 [ 1176.221928] ? do_syscall_64+0x26/0x610 [ 1176.225910] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1176.231294] ? do_syscall_64+0x26/0x610 [ 1176.235279] __x64_sys_writev+0x75/0xb0 [ 1176.239263] do_syscall_64+0x103/0x610 [ 1176.243161] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1176.248390] RIP: 0033:0x457ce1 [ 1176.251588] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 e4 b9 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 1176.270493] RSP: 002b:00007f607ae7bba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 1176.278206] RAX: ffffffffffffffda RBX: 000000000000004a RCX: 0000000000457ce1 [ 1176.285478] RDX: 0000000000000001 RSI: 00007f607ae7bbf0 RDI: 00000000000000f0 [ 1176.292760] RBP: 0000000020000000 R08: 00000000000000f0 R09: 0000000000000000 [ 1176.300060] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f607ae7c6d4 [ 1176.307363] R13: 00000000004c64e1 R14: 00000000004db9c0 R15: 0000000000000003 23:37:22 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xfc000000, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1176.334202] binder_alloc: 9900: binder_alloc_buf, no vma [ 1176.370396] binder: 9900:9901 transaction failed 29189/-3, size 24-8 line 3035 23:37:22 executing program 5 (fault-call:0 fault-nth:6): syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:22 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xfec0000000000000}}, 0x48) [ 1176.396975] binder: undelivered TRANSACTION_ERROR: 29189 23:37:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1176.458407] FAULT_INJECTION: forcing a failure. [ 1176.458407] name failslab, interval 1, probability 0, space 0, times 0 [ 1176.469715] CPU: 0 PID: 9916 Comm: syz-executor.5 Not tainted 5.0.0-rc8+ #3 [ 1176.476849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1176.486201] Call Trace: [ 1176.488802] dump_stack+0x172/0x1f0 [ 1176.492448] should_fail.cold+0xa/0x1b [ 1176.496385] ? mark_held_locks+0x100/0x100 [ 1176.500638] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1176.500652] ? perf_trace_lock_acquire+0xf5/0x580 [ 1176.500669] ? __nf_conntrack_find_get+0xe45/0x1960 [ 1176.500697] __should_failslab+0x121/0x190 [ 1176.500717] should_failslab+0x9/0x14 [ 1176.500742] __kmalloc_track_caller+0x6d/0x740 [ 1176.500759] ? lock_downgrade+0x810/0x810 [ 1176.519940] ? nf_ct_ext_add+0x2a9/0x640 [ 1176.519958] __krealloc+0x71/0xc0 [ 1176.519972] nf_ct_ext_add+0x2a9/0x640 [ 1176.528375] init_conntrack.isra.0+0x447/0x1180 [ 1176.528397] ? nf_conntrack_alloc+0x50/0x50 [ 1176.528438] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 1176.528460] nf_conntrack_in+0xa68/0x1070 [ 1176.559456] binder: BINDER_SET_CONTEXT_MGR already set [ 1176.562546] ? nf_conntrack_update+0x990/0x990 [ 1176.562566] ? ip6t_error+0x40/0x40 [ 1176.562603] ipv6_conntrack_local+0x1e/0x30 [ 1176.562622] nf_hook_slow+0xbf/0x1f0 [ 1176.562643] ip6_xmit+0x11c6/0x20c0 [ 1176.568370] binder: release 9921:9923 transaction 1809 out, still active [ 1176.572496] ? ip6_finish_output2+0x2550/0x2550 [ 1176.572515] ? kasan_kmalloc+0x9/0x10 [ 1176.572531] ? __kmalloc_node_track_caller+0x4e/0x70 [ 1176.572550] ? ip6_setup_cork+0x18a0/0x18a0 [ 1176.572582] ? refcount_sub_and_test_checked+0x161/0x1f0 [ 1176.572607] tcp_v6_send_response+0xe50/0x1f70 [ 1176.572638] ? tcp_v6_syn_recv_sock+0x2320/0x2320 [ 1176.572649] ? perf_trace_lock+0x510/0x510 [ 1176.572674] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1176.572690] ? check_preemption_disabled+0x48/0x290 [ 1176.572719] ? lock_acquire+0x16f/0x3f0 [ 1176.572752] tcp_v6_send_reset+0x77a/0xf90 [ 1176.572781] ? tcp_v6_send_response+0x1f70/0x1f70 [ 1176.572797] ? memcpy+0x46/0x50 [ 1176.578366] binder: undelivered TRANSACTION_COMPLETE [ 1176.580752] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1176.580774] tcp_v6_rcv+0x1e2a/0x3530 [ 1176.580810] ? tcp_v6_err+0x1820/0x1820 [ 1176.580834] ip6_protocol_deliver_rcu+0x303/0x16c0 [ 1176.584971] binder: 9921:9923 ioctl 40046207 0 returned -16 [ 1176.588162] ip6_input_finish+0x84/0x170 [ 1176.588178] ip6_input+0xe4/0x3f0 [ 1176.588193] ? ip6_input_finish+0x170/0x170 [ 1176.699705] ? ip6_protocol_deliver_rcu+0x16c0/0x16c0 [ 1176.704927] ip6_rcv_finish+0x1e7/0x320 [ 1176.708910] ipv6_rcv+0x10e/0x420 [ 1176.712376] ? ip6_rcv_core.isra.0+0x1c00/0x1c00 [ 1176.717148] ? ip6_rcv_finish_core.isra.0+0x590/0x590 [ 1176.722364] ? ip6_rcv_core.isra.0+0x1c00/0x1c00 [ 1176.727133] __netif_receive_skb_one_core+0x115/0x1a0 [ 1176.732350] ? __netif_receive_skb_core+0x3010/0x3010 [ 1176.737560] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1176.743123] ? check_preemption_disabled+0x48/0x290 [ 1176.748149] ? lock_acquire+0x16f/0x3f0 [ 1176.752151] __netif_receive_skb+0x2c/0x1c0 [ 1176.756499] netif_receive_skb_internal+0x117/0x660 [ 1176.761516] ? dev_cpu_dead+0x920/0x920 [ 1176.761549] ? eth_gro_receive+0x890/0x890 [ 1176.761575] napi_gro_frags+0xade/0xd10 [ 1176.761599] tun_get_user+0x2c0e/0x3dd0 [ 1176.761634] ? tun_build_skb.isra.0+0x1150/0x1150 [ 1176.761647] ? tun_get+0x171/0x290 [ 1176.761668] ? lock_downgrade+0x810/0x810 [ 1176.769864] ? kasan_check_read+0x11/0x20 [ 1176.769889] tun_chr_write_iter+0xbd/0x160 [ 1176.769908] do_iter_readv_writev+0x5e0/0x8e0 [ 1176.769928] ? vfs_dedupe_file_range+0x780/0x780 [ 1176.769944] ? rw_copy_check_uvector+0x2a6/0x330 [ 1176.812746] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1176.818294] ? rw_verify_area+0x118/0x360 [ 1176.822452] do_iter_write+0x184/0x610 [ 1176.826346] ? dup_iter+0x260/0x260 [ 1176.829989] vfs_writev+0x1b3/0x2f0 [ 1176.833627] ? vfs_iter_write+0xb0/0xb0 [ 1176.837606] ? kasan_check_read+0x11/0x20 [ 1176.841782] ? iterate_fd+0x360/0x360 [ 1176.845611] ? check_preemption_disabled+0x48/0x290 [ 1176.850638] ? wait_for_completion+0x440/0x440 [ 1176.855228] ? __fget_light+0x1a9/0x230 [ 1176.859206] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1176.864757] do_writev+0xf6/0x290 [ 1176.868223] ? vfs_writev+0x2f0/0x2f0 [ 1176.872043] ? do_syscall_64+0x26/0x610 [ 1176.876024] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1176.881402] ? do_syscall_64+0x26/0x610 [ 1176.885396] __x64_sys_writev+0x75/0xb0 [ 1176.889379] do_syscall_64+0x103/0x610 [ 1176.893283] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1176.898475] RIP: 0033:0x457ce1 [ 1176.901674] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 e4 b9 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 1176.920681] RSP: 002b:00007f607ae7bba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 1176.928432] RAX: ffffffffffffffda RBX: 000000000000004a RCX: 0000000000457ce1 [ 1176.935746] RDX: 0000000000000001 RSI: 00007f607ae7bbf0 RDI: 00000000000000f0 [ 1176.943368] RBP: 0000000020000000 R08: 00000000000000f0 R09: 0000000000000000 [ 1176.950645] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f607ae7c6d4 [ 1176.957915] R13: 00000000004c64e1 R14: 00000000004db9c0 R15: 0000000000000003 23:37:22 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x2c7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:22 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xfe800000, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:22 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2, 0xff00000000000000}}, 0x48) 23:37:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r2, 0xc0a85320, &(0x7f0000000100)={{0x6, 0x9d0c}, 'port0\x00', 0x40, 0x0, 0x7ff, 0x2, 0x8000, 0x40, 0x4, 0x0, 0x0, 0xff}) 23:37:23 executing program 5 (fault-call:0 fault-nth:7): syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1177.044290] binder: send failed reply for transaction 1809, target dead 23:37:23 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xfec00000, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1177.112857] binder: release 9940:9942 transaction 1813 out, still active [ 1177.122314] binder: 9940:9942 ioctl c0a85320 20000100 returned -22 [ 1177.130227] binder: undelivered TRANSACTION_COMPLETE [ 1177.152409] binder_alloc: binder_alloc_mmap_handler: 9940 20ffd000-20ffe000 already mapped failed -16 [ 1177.173621] binder: BINDER_SET_CONTEXT_MGR already set 23:37:23 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x7) 23:37:23 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1177.196634] binder: 9940:9942 ioctl 40046207 0 returned -16 [ 1177.233304] binder_alloc: 9940: binder_alloc_buf, no vma 23:37:23 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xff000000, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1177.261015] binder: send failed reply for transaction 1813, target dead [ 1177.269819] binder: 9940:9957 transaction failed 29189/-3, size 24-8 line 3035 23:37:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x20000408) 23:37:23 executing program 5: syz_emit_ethernet(0xd, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1177.317161] binder: undelivered TRANSACTION_ERROR: 29189 23:37:23 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x300}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vcs\x00', 0x882, 0x0) ioctl$LOOP_SET_STATUS(r2, 0x4c02, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8, 0xe, 0x1a, 0x10, "246d855ded94ba9187ab951ffc90efc8f4660b16b72d441f6997b58face390c8cec534c9aad32cfc194e6db839cb7cb99d6c9f581a16be2a8899240cdcf69f56", "9ff33e3e5b831d92a0840a11b49d8fd5f207728dc24fc58a80c2db600ed475b5", [0xffffffff, 0x6]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:23 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xfc00000000000000, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:23 executing program 5: syz_emit_ethernet(0x140, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) rt_sigpending(&(0x7f0000000040), 0x8) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:23 executing program 5: syz_emit_ethernet(0xfdef, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1177.823187] binder_alloc: binder_alloc_mmap_handler: 9985 20ffd000-20ffe000 already mapped failed -16 [ 1177.833533] binder: BINDER_SET_CONTEXT_MGR already set [ 1177.839885] binder: release 9985:9990 transaction 1818 out, still active [ 1177.856203] binder: 9985:9990 ioctl 40046207 0 returned -16 [ 1177.863169] binder: undelivered TRANSACTION_COMPLETE [ 1177.874106] binder: send failed reply for transaction 1818, target dead 23:37:24 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:24 executing program 3: r0 = open(&(0x7f0000000200)='./file0\x00', 0x4000, 0x9) times(&(0x7f0000000440)) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000180)) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f}}, 0xffaf) ioctl$SIOCX25SDTEFACILITIES(r0, 0x89eb, &(0x7f0000000100)={0x6, 0x1, 0x80, 0x87, 0x401, 0xa, 0x1c, "a69371d02be8abe5e02f5ab400e9b9d21e08234e", "69707a7e247e841cdd66688252b03085277a5cbd"}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) setsockopt$packet_int(r0, 0x107, 0x1f, &(0x7f0000000400)=0x5e1bb397, 0x4) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0)={0xffffffffffffffff}, 0x0, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040), 0x117}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000540)={0x0, @in6={{0xa, 0x4e22, 0x0, @local, 0x5}}, 0x35, 0x2, 0x71, 0x5, 0xc}, &(0x7f0000000140)=0x98) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000001c0)={r4, 0x7, 0x5, [0x4, 0xf1f6, 0x81, 0x3, 0x3ffc0]}, &(0x7f00000003c0)=0x12) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f00000004c0)={0x3, 0xfffffffffffffd7c, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x4000000000000, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0x2}, r3, 0x4b}}, 0x2) 23:37:24 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xfe80000000000000, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:24 executing program 5: syz_emit_ethernet(0x2000004a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800000000004) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) geteuid() ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="61630440"], 0x3c5, 0x0, 0x0}) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xffff, 0x4000) write$FUSE_POLL(r2, &(0x7f0000000100)={0x18, 0x0, 0x4, {0x88}}, 0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 1178.171182] binder: 10013:10016 unknown command 1074029409 [ 1178.190120] binder: 10013:10016 ioctl c0306201 200000c0 returned -22 23:37:24 executing program 5: syz_emit_ethernet(0x7ffff000, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1178.216960] binder: 10013:10016 got transaction with invalid handle, 0 [ 1178.240294] binder: 10013:10016 transaction failed 29201/-22, size 24-8 line 3126 [ 1178.257143] binder_alloc: binder_alloc_mmap_handler: 10013 20ffd000-20ffe000 already mapped failed -16 [ 1178.267631] binder: BINDER_SET_CONTEXT_MGR already set [ 1178.273371] binder: 10013:10026 ioctl 40046207 0 returned -16 [ 1178.283190] binder: 10013:10016 unknown command 1074029409 [ 1178.300073] binder: 10013:10016 ioctl c0306201 200000c0 returned -22 [ 1178.315857] binder_alloc: 10013: binder_alloc_buf, no vma [ 1178.321954] binder: 10013:10030 transaction failed 29189/-3, size 24-8 line 3035 [ 1178.329893] binder: undelivered TRANSACTION_ERROR: 29201 [ 1178.337358] binder: undelivered TRANSACTION_ERROR: 29189 23:37:24 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x900}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:24 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xfec0000000000000, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:24 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) r3 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x0, 0x2) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000180)={{{@in=@broadcast, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@remote}}, &(0x7f0000000300)=0xe8) getresuid(&(0x7f0000000440), &(0x7f0000000480)=0x0, &(0x7f00000004c0)) ioctl$KVM_TRANSLATE(r3, 0xc018ae85, &(0x7f0000000500)={0x2000, 0x0, 0x200, 0xe9, 0x1ff}) alarm(0x7) setreuid(r4, r5) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:24 executing program 5: syz_emit_ethernet(0xfffffdef, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/capi/capi20\x00', 0x4100c0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r2, 0x111, 0x2, 0x2, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04dd1b40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xfffffffffffffdea, 0x0, &(0x7f0000000280), 0x0, 0x0, 0x0}) open(&(0x7f0000000040)='./file0\x00', 0x8000, 0x0) getxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=@random={'trusted.', '/dev/binder#\x00'}, &(0x7f0000000180)=""/140, 0x8c) flistxattr(r0, &(0x7f0000000280), 0x0) 23:37:24 executing program 5: syz_emit_ethernet(0xfffffffffffffdef, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1178.866442] binder: 10037:10039 unknown command 1075567876 [ 1178.890055] binder: 10037:10039 ioctl c0306201 200000c0 returned -22 [ 1178.912257] binder_alloc: binder_alloc_mmap_handler: 10037 20ffd000-20ffe000 already mapped failed -16 [ 1178.950372] binder: BINDER_SET_CONTEXT_MGR already set [ 1178.955697] binder: 10037:10039 ioctl 40046207 0 returned -16 [ 1178.988169] binder: 10037:10048 unknown command 1075567876 [ 1178.994142] binder: 10037:10048 ioctl c0306201 200000c0 returned -22 23:37:25 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x900000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:25 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xff00000000000000, 0x0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:25 executing program 3: r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000200)={0xffffffffffffffff}, 0x111, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @ib_path={&(0x7f0000000440)=[{0x0, 0x0, [0x0, 0x7fffffff, 0x1, 0x0, 0xe0, 0x0, 0x1a68, 0x9ac, 0x554, 0x2, 0x7fff, 0x8, 0xfffffffffffffc01, 0xfffffffffffffff8, 0x7, 0xfffffffffffffe00]}, {0x8, 0x0, [0xa8, 0x80000001, 0xfff, 0x4, 0x7, 0x8000, 0x80000000, 0x2, 0xc8b, 0x5, 0x6, 0x0, 0x2, 0x4, 0x0, 0x100000001]}, {0x8, 0x0, [0x8, 0x0, 0x6, 0x5, 0x1, 0x72e6, 0x100000001, 0x2, 0x1e15b122, 0x1000, 0x7ff, 0x8, 0x2, 0x8, 0x7]}, {0x15, 0x0, [0x0, 0x8, 0x40, 0x7, 0x7fff, 0xfffffffffffffffb, 0x3, 0x9, 0x80, 0x9b34, 0xffffffffffffe655, 0x3, 0x1, 0x0, 0x2, 0x4]}], r1, 0x1, 0x1, 0x120}}, 0x20) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r3}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r4, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r4}}, 0x48) 23:37:25 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x2, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00000000000045d3"]], 0x0, 0x0, 0x0}) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x7, 0xc000) ioctl$EVIOCGABS3F(r2, 0x8018457f, &(0x7f0000000100)=""/34) getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, &(0x7f0000000300)={'filter\x00', 0x1, "01"}, &(0x7f0000000340)=0x25) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000240)={&(0x7f0000000140), 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r3, 0x22, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3ff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) 23:37:25 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x3, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1179.278630] binder: 10059:10066 got transaction with invalid offset (-3223169958313721856, min 0 max 24) or object. [ 1179.320556] binder: 10059:10066 transaction failed 29201/-22, size 24-8 line 3097 [ 1179.356477] binder_alloc: binder_alloc_mmap_handler: 10059 20ffd000-20ffe000 already mapped failed -16 [ 1179.401365] binder: BINDER_SET_CONTEXT_MGR already set [ 1179.418973] binder: 10059:10066 ioctl 40046207 0 returned -16 [ 1179.423616] binder_alloc: 10059: binder_alloc_buf, no vma [ 1179.444912] binder: undelivered TRANSACTION_ERROR: 29201 [ 1179.453301] binder: 10059:10072 transaction failed 29189/-3, size 24-8 line 3035 [ 1179.461339] binder: undelivered TRANSACTION_ERROR: 29189 23:37:25 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0xa00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:25 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0xfc, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:25 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) r3 = getpgrp(0x0) prlimit64(r3, 0xa, &(0x7f00000000c0)={0x20, 0x6}, &(0x7f0000000180)) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x364) 23:37:25 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x4, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x5, 0x400100) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:25 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x5, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1179.888816] binder_alloc: binder_alloc_mmap_handler: 10084 20ffd000-20ffe000 already mapped failed -16 [ 1179.926560] binder: BINDER_SET_CONTEXT_MGR already set [ 1179.940764] binder_alloc: 10084: binder_alloc_buf, no vma [ 1179.946719] binder: 10084:10093 ioctl 40046207 0 returned -16 [ 1179.969966] binder: 10084:10100 transaction failed 29189/-3, size 24-8 line 3035 [ 1179.978228] binder: release 10084:10090 transaction 1831 out, still active [ 1179.988851] binder: undelivered TRANSACTION_COMPLETE [ 1180.016092] binder: undelivered TRANSACTION_ERROR: 29189 [ 1180.040247] binder: send failed reply for transaction 1831, target dead 23:37:26 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:26 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x80fe, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:26 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) r3 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x7, 0x50200) connect$bt_l2cap(r3, &(0x7f0000000180)={0x1f, 0x0, {0x7ff, 0x75bf, 0x5, 0x80, 0x833, 0x4}, 0x7fff, 0x7f}, 0xe) 23:37:26 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x6, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = getpid() ptrace$pokeuser(0x6, r2, 0x2e9, 0x1000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 23:37:26 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x7, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1180.233052] binder_alloc: binder_alloc_mmap_handler: 10112 20ffd000-20ffe000 already mapped failed -16 [ 1180.275734] binder: BINDER_SET_CONTEXT_MGR already set [ 1180.293662] binder: release 10112:10120 transaction 1836 out, still active [ 1180.301779] binder: 10112:10120 ioctl 40046207 0 returned -16 [ 1180.311090] binder: undelivered TRANSACTION_COMPLETE [ 1180.326450] binder: send failed reply for transaction 1836, target dead 23:37:26 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:26 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0xc0fe, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:26 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x4e20, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x208000, 0x0) sendmsg$unix(r3, &(0x7f0000000300)={&(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001ac0)=[{&(0x7f0000000440)="4fe80e989ed3f06acdc1c69781e5c0843f5a70ad412e85d3b5a14fb7d97ea448208d1d4db8f0d079a5ed088ff7c724b04f3d7c6ed1dc94ad0b4e98872c1c39438ad956a22caf81dea636ed1bd7d8a4aeefce66d07ae5dccfd76a04b085dbce58a84c03662b0999fcb090a891ffbcc7eaffffd1fd4278eca4fd727d255209c927740c260f9fcd0a07447cecd9740466fa73ce249b5525637728eaa5b3552cb6aaf024a433349e1c0ff5", 0xa9}, {&(0x7f0000000500)="9959bf85d50c9560bb0c6eac40fa5078bfc4b61e49c46612902e8bcc1ec10269107974bfd14862d76c14c3d4531c1a6323819361cc5c5b0633b2de0612080baa60d84579ea9fb7f9f7346d458797dc89f307e454786b8bf69421c09a77f60710414d8cd871c31ea1994b2e47b8b35344075fa67f973e0c59250b814c9f9e2f70228c54278a3fd460c4eeed768b83507a13f82ea55ad0ed2eaea759e345a7798a7c0ce0a69141d3f189a4b725903d558f40c79d", 0xb3}, {&(0x7f0000000200)}, {&(0x7f00000005c0)="31e376259eed6b47a80f40b560ce05ac90e290acf25be583207f07f3fcc5b65fedfc13732796e7071aa53edf2bf9e3ab30ae72e797e7a13071d1d44a93bc5012fab6bfb8d7396ea2e3611fc4a64ead3badf6bd339743611280617a4a8beb178555fce02c9cc487f9daac3f76c0e4a08fab3cc4d2dc2968d8158a9933a4b01cf1843840f46ca3f43ab7b9813987df7a5521b8aeb386e51accf6ca9818aef7bb5ba6bf8014d341210fe8ce1aca072726e65ed79e40b1bd03087ea855eaf9dcc4a7bb0be31b8be4cebcf0bc784c94445e93251d0092542e422cfb2a6e46c0190fef714b", 0xe2}, {&(0x7f00000006c0)="8f52f3bc4b416c30078c2eb4381fb8a6a61d9c09b6308f9fda71c4790f84e756d5d774014bddc58438eff3680598177456c7eaebf030cdd3ad86f57d09877db58153aca7d0cf44706a9693f39a08620caec204415d301735cd25932d0f55a9d5b2be79d520c1a2b1643735efc98d2abd87bf4a713b096bc80d79b6d4aaa64ddc29431dd96b61791b882e8f71f9fa52aac11790c301204c9dcf836d99b38041beb69e6d3f10fe685740064255fc612b9920f921f162a9a6ddba14187131ae7d70397e748c7ca0a5ae0fb2c7c953ff7a654b01e5c50717de311ab855712bf660421acd7d7c3e7a9d4cd148d96a905e0036ee08504f5189d4a79b7810712b2f089eff8f1b7274140dfeba11435db7d247af76825ad811c4adf7269cadef4eaf15c0b7e86b28e227f3ad4173bcf3c1c8383a9add361b81e31bd2dd5efb75b4a43746e478533f127a6fa1337275e3f3950acd2f944bdb4d2a9f329e193eedd6dfb0db972bcfe5e7ef72eb2757ca4a539f92ff64f386173f344d517646681866ee2c1828cf6759b2f16a39cdba0a99645698a8c1ac639de15f5d3fd2e81b8c856d22e892c9323602e04b45817ab41c0c9b17295fe60f3f135b9124a85301f814b4386408c2dd82102750f58af5c20f2e6446c1d24cffd506c62b90c59507c4a9809b3fed45db91057ed7c2d2a9649236fdd389abf3e30715711f4e69c2cd12aa84cba32b29c009d18a10b422f199c920deb6eeb9cb85e60a8dc304b915b703ddcca588d1866b28f3dbccd41e0dfb858d8e60d2c4bf67137ecd21cf72e92fc8d7dd531d0957cdf394cd785f307083187647f9658911737dad593b89b123e4c093c6829a202351971cb95ba6beccce760c8f8656f933358515768e4c5cecd1d9cf3af567d6d9f5d1f405b8864069af6eb17d6382df13bb588a7fc418c0c2371420e20c1afc6e54336c26cfc8d665dbb694e779d1aa960a8f671a16196a14a8c371b570cae7d9bb3000b60df55bdd43ca863e72c0245234198c7cef5d6e41ca6cb57c417004f0256b3680e2b3bf550701bffb2a5d577d08dcb1521ba6463f43171278bc89271833f4057dc95f54ab18ca73d61deb9d4c1a22b37768cbc83a63ca789d4ff06d2d570186b03bd3b781de0a025831f189b64c723fd10de68d747e267cedd17ba0413ca58d1b1af3184c53bf27d713412559a61f7c697514d741e2af487fe5f8f5a583e892ba57f59af5809b92da76f81c7afc625cc9b181436cbb1c2521503d3f645c17ad0824d0c019df92a2077590450df576b50fd895e43cdf6412e8c448fb3252ced3f921f88b35a62aa92baf3caf4849a25e0c586ee21452b29644c210fc7a7bf17ed9053e70355ffb6204b4d4be6df1fb644d07833cc4f6a9b9b2579b8f8bace60af6b5bc1879da2fc34e25031d688d06ca94bfb49cdae28c6ee1e3bc2689b40bbdfc979c21fa5b4fb22aa11c703757465096a271b355a32c7eab3a25ae7acf2b49036df2c18b49922fbf5f223c6d035ec8b1410168bf46878a9e981e36644751f01694df90f106b5244f767c6f83485117ac6a83b5e65efe43f27a3f6ae56378aa8c1d9705710b028eff6e9fc47a8b8d7556bf100b51f85e673862477e88a2ef3e289ed08e3ef249ab86f414fda677dae5ced897b9efe1b670f5257ee7120089442e6f0906675455ab0c4e4e596fb0ff270e82d31b6ff639f12cc5cf6000df655bb9b3163bb08a5f421c9bbb4432ff90680d26612a420e2f35586c8aaeb33fe5011cd448eceb32a7271d3536ae4be33666cf0f767f4f8dfa11cf692171719bfa2d9a5d951a77917673e8b28e5231181b25d41602b1c9bdcc0422f589f52b6758fd5d8bfe4ef7202a6bf16c5f78e3935ba73861dc338bf7ff0e712f631262d83adeaa6500576fc00583b5fbef9c3f41f9a30cbdda1ed308192de1d99e95a2784ecfe00cbe2ecdb0d1d460de178b850716f01258e6d2693b84a0deefdccc1c7c113db0297692e95cfbb79929ebfecbfbe1c14c0e2c450d656e377c029456394c05f6ffc1f1e30dae088d84374ad88e317df2ba43464ae8179dd5910543f3dc5742b97e041dc99c0a89136825e24a5d633b2f0d3bf682f7ccb081925ada20a04aac998cdee77b0ad5b036abe8b198a32af5f5d9b2b884cc504590eb6530690019b73087c89aac25793726c00c1869ba13fa0685083fa96d2a27bb36f9af08ce2397f52a12873710c51fd1b9f7b3f7e627cba605e0c7c245a0dadcc28cfceb25c99e525df579550ebaba4e33744ccb9f69a3cf9d5f01db39fb2fe767722278514afff63ba9ded57a22ba43cffd4ad5ede9c8e47251bf14d2fa2f7d0f868d925ab1511a5d0519711bfb6b43ff002c49d07b45c27fb19235d871e7994fb86050461cebf8562b9e1d4bc389beaef972189e8b63b2608277d7410cf2fb08c3a22f3b07dc0a105148b756eba59c4330c9be7e6acc99788f0f6fc1fb72c176b0a46bec4da264cedeca347440773775a75881977b2f7a712398d65dc145a65c29d0c3982d6e2465e2b820d921fb51df39bfa019ff40c5b25be40aa25f6b63ec906c1949206fb4b99c44ef34cc6d4456f13de1075e8ba51c8c3dc94640fb773d43a56737cc28e77a4ecdb3f5ecc7f712f83a47cf5b2f6e61d375c9e309cb8ab755e5be679a963d2c337a796cb06f1799f5c453916d6fd30c3e5aa8924726dd3858f3753c46e7257070a0b735fc6620ea6fff7025b6588a7c3939a5691b09dc7363128f210b59f0287f0901f5def59c943e55a0913fc0f8b5314a722564f16b984c8e1490ec5b43be1fb1458813e152da204f283752f7ee62f623b1f3da8b838c1ffde63b8fa87dc2ef21f9cbbdb20beb61ae6f66ce0eee73fa23d899e377f43a0afd92cd9d712e3c6307a585664ec9dea6025ff516202867ab2ca13777f68d57222d9cf75cb9bfcad02480142b73d388cedac97d854f7defaf1f3bbce44dff9f3111de2bb4f818840308479ff777a660eedc48912dc2019a33d399033b7db35d42613a60868bb736fc809a431a2f8c96d0bf9fd262a01c466bdce7a4936ba51049fe927629639ae693766b6db218e0d4eb50da9c07eced053833e5570fd828ace65a243ac308b57ff68f475f23693d50c02eb2f8c5daf74f295a42fd24c55c0eb7b6a6ea9135fca19406c494e0a8c068e2217cfe58d1cd957e348340b790f1d968b2aad9896d55f47b683fad5e1e8a84b968ce618052272f5424fa6ab35601c44bb2f48b52c7651a12176e9b23a126edac229b1e314fd1b1b43a48b27762578d80d63d66d120307ab063838cdd133abe20e1ab06c4f5324ed93fe57c87ede9832c39c7171fe91e5bbae4947b341cc3a6f7b3a9595b2f6a3b1cda6508e49ed3cf31b27476005127e35353adbaff8d5ced1ce37b3aa04b3e121a0622faae7d1b1c03ea08bf421659b88a5b11b411d8c2974e2a06f102ce7f26235cbcab692a5523795287a7c5ef673bd2eb29d21f07eb21e72d297f69316a89f4bf72502bae2192357e964c8f02062ac9a3c7f26d3c5e52d30b48145a64413afb3d980cbbbde0195b575ec2e67e413e3635697fa6d77a60d9d8d7603113ea8f2d20d15ab63b92ed96488ad9bb707aa738561ad85f50eb4019eb44344c4a7d9664843dd38d8e39727cc1b38879750ef162f9c35b93ca3d77dca80e905ec082279e62575e1761a059bc071c3aaf42b82170d30aa32e93d84b329b9f96250e5d187e927e77f32856cda48a8147ca896ccd42c260cb57ae7c79d190a88a9629b9d310f58a24b18de47f1ab9dbd7f360160e369b1b4e6d8206eaf7cd678e0fbf0609d7c518f6021077f3a92d56bae91a52822e6bfbb4220f8a44ffc2e4b469c68a9a0e6bef644fd3652e83218daf0b216867098f028c7fb845f251d551f9ecab487207b1475b5d124da85166827177f54ad4b067ab4a249b91cc6935f465afd3837a711b8d7858ce8461bafd129b69e793e01e7580f5c4f48b521c49404fb3b2c0a3017a543f9dbc5fa2f7c0d6d56948eb129c29181d7c4df71b94f8bf0b5a470b8c25e6397aec85a4a52a868297fdb4b4fe8fdd0fb67da2e559c28b689d8dd6710c456b3dbef9305723fd2727f25d8b286f30ed2ea218191602ef40a8b2969c3b20088b74d82eaf3bfd4f0ff779abc7a3693794816837eb4c0560c6bf9fcd25aef04d1c17a23b57063323bee487782d1ac0ee6b414c12c5b76fa65386b1ea53566f5d9473e053f5debcf67438e40691a9ddeebc26eff2acc08211fe5c2efb4933826d2c8ab10a9bd449dc5a95930f4663d3cd196558331faa9cd25758843ff71c6e316d1314747abf0a1ff1dcba55170e56669beeac8043f06b8ee37d7ccdd47187a090c5aca3e686c1d1b396cf52badd8a46c96dc17bfc0f32ad3fd53139ab83e74f3435d4db5d675273f2baa6899c8541c28e65e05267e57d7e01e6b4aae843e21f6038c6f10f907ca24c64230e077eaa635f439d0ee471710f425b733cdb218cf36dc1bb30528c92c3a2c82127a48e9e1acbe608a26b2618a65e9f563a2dee41cc8ef299c9d845080c7d006fe285461fc358bf463613a238cec3540a95d54699526ce3357568925cf9289a513b56209831bd60cb8fcf6fb04c9effcf0dc065bad279e0d87cd62bdb3becd64f8e11586a1e897bf7331185cb1743e8a55215503b98e60f6769aa1353c92812429e92794ad92d223523ffbebfcc04a64680dfb21dc255ff3d80e571738d1c93899e353b7b17a31d4564e9d9d79622ac827b9b2ce53c8e24cad4c9a4609930b04c268480344ffb7f5a6f6c2ad08868586a790d16f75c4f07bdafd7c8a07b919d509b3dc86157a056fdba7d61acc6e39c18d6cfab7f25b89ee15a6d876832e517c5bc28edbdb50c8b3d09286e208b83ae23693231b3845445d38d4710519e28f59d0aef2c7e1fdb456f3baf320793751b8d4653928c8a0016b8778e37a05ff6b6b295be447686810efc4f8b6b829ca1da30ee76762924a6958e7acacdbfc04418aa96b0299c4e54e118c4c8dc8ba1fb8ca3753d01a686352bb74f3a44a98afbcb61d36dd63ea7da32212d2119baa650d9fc95f401d7df4d0d752b02bbb53405e8acd82abda0d9e845f1e941678272ea4b8ed3d1b8a8a8a15427e03932b5322cb5bcc9df6efafea2e657ea7f6577b7f2b4f04342f3b2a2620ff4d42f7749c16522ae8188647c924bfc88009f435784f90d6a240dc569f21d4cf9e4403e32605cb2eed2b35af248927a1ade699f34a8071751713f103df2eae0679b707ae113452938bfee74f342ea34983a73c58f5385dc9f864dd14bdf58a2367ecb2cd454f8982995c4fef5ebce9e249de8ff46e2bb6af28db74a38e4473d3f4edb1e2f2465c302d57d1590f40baf38faa1e3731d609b53d885f2f52b41edabf009d1e808a26a6e29bc5cc4fe467c62cbf172136ddf066136190629ab8a0fa88abf7d13e240a21453b68d33943f189c459ab3085333d4f56c3de48f19bac1c1c8141ca36e493ada9f2b3cd63123998838660549f91bd108d2191a06e00d0a4f02fed22fa0c9345283bd8dccdfc49733f493ee444d68aba38d33a626d291887c6e7213d0741782aba05f88dd0c0f62b1e3bd18d5540cdf2d89fe9896806d5d4ee383c9396459533ed6f1735f38724450d4c541034a6bafa346d5e5d1424aa7e36f03134020f0d578dc4eaf29eb35565db4e078f2b7f1106ef9404423ad8ab0f8912451312cfa80261b7b74004470854668bcfca9b3d3882c3506309ae43ade3c7f0bf2819c12", 0x1000}, {&(0x7f00000016c0)="040312d170b0295a2211655d2330b0c2bb48e7c515fff3f00292d20923919c1f7b908caab9865e33f54119b4bd71918bc9dfb1d92ace93671259734d6cde6aa696d9", 0x42}, {&(0x7f0000001740)="d2858aa4a0be9efaecaf18a1d1c20c5ddaaa4c1cac171477b9a475a858c2e1132f37701cb8797f79c6c94784956c1aec3ac336af48224a361483cd4bd3800f178372bdd6f486bbc0a5557d5808307f613643ea15734b010ac8a80df8f9973866c547cd49fb802b194a9780c9a315c1486619804b0f02686d19312baa51771c3ed2a883b25a973a2e5bfa85a2b8a146382f3b9ef212d8fa38434bf1662bb867eb25d720b7e29e0fefdd0c471aa9f9738418d219b0459a450778b184f3144fe36b74a72ff586f7665ef64dc574c0b134b564399cdbf049758d74161f536ab374d4e7f9d53a5224667e77bf470e000000000000000000000000000000", 0xfb}, {&(0x7f0000001840)="bc8962c8354a8576d4e8bfb6f0998c0574d1a6c28f5c8da9600869156c7565d00988c0a5da35907d6e4b26b3be7cd1034df0bbb9f6ed2f9bba218e1980d4b829ac33898628d753623efe25e7ecd4286d02c97f5de9b89c561e2c81c0b2dbed3ad0d94ca7da7963cff59a4580b92e3a5318e96fa9f05f6d66d2129ac227fed9a442b6c746a0789b4a606bcd550e9683da597c5aac6f0ef66b1310a764c2d02409a4bb401a9683cfaebcd9fb590d7fc4b0a8e912f9b6c767e52d986ab2fa127689122b6bbe538c8221e3da8bf1d93076abe6000000", 0xd4}, {&(0x7f0000001940)="ba36dcf18ed3a33d3b19c2d15b0f6d79ae576f654606b8e35fbf655dcbc02d22756f0e9a319bc86af7e45a2e619236fbd73906a3f54d3f3b3e0e9bc6e2d328cc2189d28d01baf4ac5e7625fb01e5a1c2ebcd91b92bd1b45c2be5087cb0a86c079aa000e8452e4e087bbdd44feeaf3806e3582cb31ae35f8592537ac6f192b65d05083489d218", 0x86}], 0x9, &(0x7f0000001b80)=ANY=[@ANYBLOB="1800000000000000e900000001000000998764f4bffd19275bb9ba00005c532f561dbb7ae5443046ebb5464ebe9e47b2c057950ee1b476276d6ed39a3a5681150ad718d21e54f088dc0720e21b572deb82e9118f", @ANYRES32=r0, @ANYBLOB="00d39e855b1773c1bc3d34421bb642fc3c182d32edc7ea796ca5a05a908ecfe5c07fd1f920c7d111284d2286c358d4dbe17d36eef058953504141d37d0a88d70141399d41aa42baa870a1427e4f9947a9cc292e8f9"], 0x15, 0x4000090}, 0x4000000) r4 = fcntl$getown(0xffffffffffffffff, 0x9) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000200)=r4) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:26 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x8, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x100, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000300)={0x1, {{0xa, 0x4e20, 0x100000001, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}}}, 0x88) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3, 0x12, r1, 0x0) getsockopt$inet6_int(r2, 0x29, 0x17, &(0x7f0000000200), &(0x7f0000000240)=0x4) ioctl$KVM_SET_XSAVE(r2, 0x5000aea5, &(0x7f0000000400)={"4cf70357e8040ed98b172ba091b19b3a4ea3499dc681b45ca15866ee98052aeb1d4cdbdafea5237a185ad540c1e60755a19b48068173ecc8e55a873173781ac7d1dbd35b8f6462e0bfb26e24d25724b89651713552e7c24b6819b3245ef3853d296f87b13861c442051c2a7b649e832b7ec73fa708c5b8f38124ad0ab5607de5c55d31edd469dab4141b91b5449796da0e19e5550f0cc09008874d98c968f3de352a71aaac81e6d7e61647e51781140a7677b2f9af3cb510310833b726483fb677f4d75ed403bbe2289f3b445be5a53cf4fb5028177d5d6ce8b71cb74edbae1fafb024076bd80a0fced1cc45a8ea7f0e1faa4fc21757a9dabef396e3ea316598014d394558d5faed13917cf0c79708338bdc4ea3c129907afb5eb45ed397a06737106a59d948650b5cce8cd852858f79034914a47cbdc0be5ad4aaae9925345af80eb9a3b04767767bce17b9b47a22571c50abdb22d6644333c867d70f7ad28316661c6e80431478c79e5a4efbc2d3d144c8bb29f00001eda8842f52dcfa63c9e79fb689b4f0ef52637efe3421f22f424ec646ef8879de0342e869785696fd745b48203e561c7ef42d721201560b04ca623771244cfb95b129c670a1e4613ffcd5864d61427c80bc21cc865fa13c42d766e637c173a6ecece98c1bcb922fc6e75f64b57315398c689c9ef2b412267a95f5d8441b73a297c1fe35831b8f6f685e7080efd701e2b4c71de9042881443088fd1a89cbb4df58e70ecbec601adc3fa70799878ed99d21ecebb328caecf0d486170eedb7a7729440c9d8db24fcf4fe2273ab7c8a1ad2dd727ed0bdbddcdb2bec74c0e5240b920ee7c96269fcc4f65f6f4e20a794df30aff05b5e68f888aab521265f04e2f035a0b6d02d8cf25326aef01e1fa2bacf147a19487ec4f139e34f04642fa537fca0b8d5adebaf72ac3bba011d2122d554eb5a9db5b00c3bd07b4f93c5cd7d72251868e60de09670f5dc492d3aeae8aa85113e9acd5341d440688cbec3152d5627fb7002e1cfd63cc01f22073498d30c2b4d5a01077b416062290ad40144bac580d5ca95efe937bc1d0505afbf6682f09c59797ed7451a9b9da37adfd6237a9f13b7f2e5cf51a02a71c1faa77cd4795dce6fc1808649104746bf1833a358c19e0c37090aa3086a76a59b0f83373b15588fb2816311961d840e7c021dcdc36d94e1c4ac9b6515b4a8ef41732d3aad053efa067f217945523094cd29ea4b9dc469be70aaaa4e10bd3c902912ed3290b9dd2b5540fd845d06de77e39fb23a32c31f7890d3d5eef22d5e166d3e48131ed3557f631634a4c4a564eccf93d751c9fd44acb82f8d661d881bb6a3fe65fae23bfeb63a902f84682e9233c9ae8ef5f614d9aa86ffe71ffda51ecfa331745e7a9ee147174ed381e003f72ff06170ce7b885c850a509ce970f498f65f9d66"}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000e8ffffff0000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="fa885199c8ffffffa1be1a9be0bc50d959634d52a36d1e5baac6f38ab3e8bd328306aa3c557ed008c64600e11509b469eba87b5e5dcfcafc4bf12db57c35409ad764df4c069f4ca13fc7a029657e13286095c446bc20ee01e8bd9ba474298dd34ee7a15165dd813a0659000d71349c698bb4be419bd7830147b3a24f14ca51df595aff49bee7ca0fd6af49cc4407119b7d2bea16f997b06e43"]], 0x0, 0x0, 0x0}) fsetxattr$trusted_overlay_opaque(r1, &(0x7f0000000000)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x1) 23:37:26 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0xa, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1180.998241] binder: binder_mmap: 10135 20ffd000-21000000 bad vm_flags failed -1 [ 1181.033966] binder_alloc: 10135: binder_alloc_buf, no vma [ 1181.039581] binder: 10135:10138 transaction failed 29189/-3, size 24-8 line 3035 23:37:27 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) [ 1181.086712] binder: binder_mmap: 10135 20ffd000-21000000 bad vm_flags failed -1 [ 1181.107207] binder: BINDER_SET_CONTEXT_MGR already set [ 1181.120556] binder: 10135:10138 ioctl 40046207 0 returned -16 23:37:27 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0xfc00, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:27 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x40, 0x1) getdents64(r3, &(0x7f0000000440)=""/4096, 0x1000) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1181.139556] binder_alloc: 10135: binder_alloc_buf, no vma [ 1181.160891] binder: undelivered TRANSACTION_ERROR: 29189 [ 1181.168853] binder: 10135:10152 transaction failed 29189/-3, size 24-8 line 3035 23:37:27 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0xd, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1181.190786] binder: undelivered TRANSACTION_ERROR: 29189 23:37:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'crc32c-intel\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x0) splice(r2, 0x0, r5, 0x0, 0x20000000003, 0x0) write$binfmt_elf32(r3, &(0x7f0000000100)=ANY=[], 0x1c0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000100)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x5c, 0x0, &(0x7f0000000200)=[@clear_death={0x400c630f, 0x4, 0x3}, @transaction_sg={0x40486311, {{0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x58, 0x30, &(0x7f0000000140)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x0, 0x17}, @flat={0x0, 0xa, r6, 0x2}], &(0x7f00000001c0)=[0x78, 0x38, 0x28, 0x0, 0x40, 0x30]}}}], 0xc0, 0x0, &(0x7f0000000440)="950ad5608102d27606135db6bddef1550252a6acb009394259b208f843dfe88d4be0960dc1695b4c3ee1f7f95edc755ba88aeccf1510c66bc425c5fec52b3456f0615c105a82b8e2b9ccad98b0e3ed25a04766e4eede011ea896a403b19b8100edfbbe3152b033e9f17f92f050dc48dfa7064df5abc41346f363349a93a7294ae4d7d79e72e169114e0a52cedb10e12bccd8f6861d27678a9b6464927babb78b9755e38892726189bbcefa61c0c23a5fbb62264f0277cc81e1a7bb531e4cada2"}) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:27 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0xfe80, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1181.387078] binder: 10179:10181 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 [ 1181.397377] binder: 10179:10181 got transaction to invalid handle [ 1181.409693] binder: 10179:10181 transaction failed 29201/-22, size 88-48 line 2896 [ 1181.474648] binder: BINDER_SET_CONTEXT_MGR already set [ 1181.480346] binder: 10179:10181 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 [ 1181.495452] binder: 10179:10185 ioctl 40046207 0 returned -16 [ 1181.502518] binder: release 10179:10181 transaction 1844 out, still active [ 1181.520762] binder_alloc: 10179: binder_alloc_buf, no vma [ 1181.524646] binder: 10179:10181 got transaction to invalid handle [ 1181.529955] binder: undelivered TRANSACTION_COMPLETE [ 1181.546449] binder: send failed reply for transaction 1844, target dead [ 1181.552554] binder: 10179:10181 transaction failed 29201/-22, size 88-48 line 2896 [ 1181.561161] binder: 10179:10188 transaction failed 29189/-3, size 24-8 line 3035 [ 1181.561249] binder: undelivered TRANSACTION_ERROR: 29189 23:37:27 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x4000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:27 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) r3 = syz_open_dev$midi(&(0x7f0000001500)='/dev/midi#\x00', 0xff, 0x149800) ioctl$sock_inet_tcp_SIOCINQ(r3, 0x541b, &(0x7f0000001540)) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:27 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0xe, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:27 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0xfec0, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000000)={r0, 0x0, 0x4, 0x2c8c, 0x81e}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 23:37:27 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0xff00, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1181.838640] binder_alloc: binder_alloc_mmap_handler: 10190 20ffd000-20ffe000 already mapped failed -16 [ 1181.863395] binder: BINDER_SET_CONTEXT_MGR already set [ 1181.888238] binder: 10190:10203 ioctl 40046207 0 returned -16 [ 1181.909533] binder_alloc: 10190: binder_alloc_buf, no vma [ 1181.919328] binder: 10190:10198 transaction failed 29189/-3, size 24-8 line 3035 [ 1181.947606] binder: release 10190:10198 transaction 1850 out, still active [ 1182.000167] binder: undelivered TRANSACTION_COMPLETE [ 1182.017304] binder: undelivered TRANSACTION_ERROR: 29189 [ 1182.040177] binder: send failed reply for transaction 1850, target dead 23:37:28 executing program 3: r0 = dup(0xffffffffffffffff) ioctl$KVM_GET_XCRS(r0, 0x8188aea6, &(0x7f0000000100)={0x1, 0x8, [{0x83, 0x0, 0x5}]}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x20000015, 0x101000) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f00000001c0)={0xa, [0x10000, 0xb9, 0x100000000, 0x8d6, 0x80000001, 0x2, 0xc4, 0x3, 0x7, 0x4]}, 0x18) ioctl$VIDIOC_QUERYSTD(r3, 0x8008563f, &(0x7f0000000180)) syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x5a, 0x400) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) dup(r0) 23:37:28 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x11, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:28 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) 23:37:28 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0xfc000000, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000100)={r2}) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x200000000812, r1, 0xfffffffffffffffb) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006300000000000000000000001a008d540000000000000000000003000000000000000000000010000000000000000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000000100d12146"]], 0x0, 0x0, 0x0}) [ 1182.151626] binder: 10219:10222 unknown command 25344 [ 1182.156855] binder: 10219:10222 ioctl c0306201 200003c0 returned -22 23:37:28 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x28, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1182.235849] binder: BINDER_SET_CONTEXT_MGR already set [ 1182.246113] binder: 10219:10222 ioctl 40046207 0 returned -16 23:37:28 executing program 0: syz_open_dev$vbi(0x0, 0x3, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) bind$isdn(r2, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, 0x0, 0x0) 23:37:28 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0xfe800000, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:28 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000180)={0x0, 0x8}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r3, 0x84, 0x23, &(0x7f0000000200)={r4, 0x80000000}, 0x8) 23:37:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0x0, 0x0) getsockopt$netlink(r2, 0x10e, 0xf, &(0x7f0000000440)=""/4096, &(0x7f0000000180)=0x1000) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x100000000000009c, 0x10000) r4 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r3, 0x4c80, r4) 23:37:28 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x3c, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:28 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0x60, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 23:37:28 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x8, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f}}, 0x427fa26b5d87268c) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) pwrite64(r0, &(0x7f0000000180)="def56b9fff43be0921f6bd648c327adfc368a4ecf762e6e6f9452e6dd0adce0f53b0e8fe33b6d65d8e1ae093c3ae74dd1833846428dffbdacb56041095a504ff0742c01597ffaf180c3fc76bcb347e48d18a5d56d87970565be195d936b0ff01c1d41747946e10358702fab469d6b939d813c886a4c9a397e2cefb962c68680c6cabe77fac1e210ba4aa440f3470f663b2765d6c0728601edabdab08b3b7d3239157c08492dbd4f15bfcdfaf4531d634d47c17908ea34cbae207de25af9607263397aa6f2a7f268e10144d", 0xcb, 0x0) [ 1182.991660] binder: BINDER_SET_CONTEXT_MGR already set 23:37:28 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0xfec00000, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:29 executing program 4: getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x8000000) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9, 0x0, 0x0, 0x0, 0x0, 0xa702000000000000}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, 0x0, 0x0) [ 1183.029577] binder: 10242:10245 ioctl 40046207 0 returned -16 [ 1183.030443] binder_alloc: 10242: binder_alloc_buf, no vma 23:37:29 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, [], {@ipv6={0x86dd, {0xf0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 1183.122647] binder: send failed reply for transaction 1858 to 10242:10245 [ 1183.133417] binder: undelivered TRANSACTION_COMPLETE [ 1183.140137] binder: 10242:10258 transaction failed 29189/-3, size 24-8 line 3035 [ 1183.145605] binder: undelivered TRANSACTION_ERROR: 29189 [ 1183.174996] binder: undelivered TRANSACTION_ERROR: 29189 23:37:29 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0xff000000, 0xfc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) 23:37:29 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f00000000c0)={0x7, 0x8, 0xfa00, {r1, 0x2}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, r2}}, 0x48) [ 1183.324120] ================================================================== [ 1183.331774] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe6/0xf5 [ 1183.338793] Read of size 8 at addr ffff888098a1ae60 by task syz-executor.3/10284 [ 1183.346317] [ 1183.347949] CPU: 0 PID: 10284 Comm: syz-executor.3 Not tainted 5.0.0-rc8+ #3 [ 1183.355171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1183.364546] Call Trace: [ 1183.367166] dump_stack+0x172/0x1f0 [ 1183.370815] ? __list_del_entry_valid+0xe6/0xf5 [ 1183.375505] print_address_description.cold+0x7c/0x20d [ 1183.380785] ? __list_del_entry_valid+0xe6/0xf5 [ 1183.385458] ? __list_del_entry_valid+0xe6/0xf5 [ 1183.390199] kasan_report.cold+0x1b/0x40 [ 1183.394270] ? __list_del_entry_valid+0xe6/0xf5 [ 1183.398952] __asan_report_load8_noabort+0x14/0x20 [ 1183.403903] __list_del_entry_valid+0xe6/0xf5 [ 1183.408409] cma_cancel_operation+0x2d7/0xa10 [ 1183.412914] rdma_destroy_id+0x8d/0xab0 [ 1183.416897] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 1183.422009] ? complete+0x61/0x80 [ 1183.425480] ucma_close+0x115/0x320 [ 1183.429128] ? ucma_free_ctx+0xb90/0xb90 [ 1183.433197] __fput+0x2df/0x8d0 [ 1183.436497] ____fput+0x16/0x20 [ 1183.439807] task_work_run+0x14a/0x1c0 [ 1183.443738] exit_to_usermode_loop+0x273/0x2c0 [ 1183.448334] do_syscall_64+0x52d/0x610 [ 1183.452238] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1183.457429] RIP: 0033:0x411d31 [ 1183.460634] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 94 19 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 1183.479533] RSP: 002b:00007fff74f67f30 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 1183.487246] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000411d31 [ 1183.494531] RDX: 0000000000000000 RSI: 00000000007413a8 RDI: 0000000000000004 [ 1183.501800] RBP: 0000000000000000 R08: 0000000000120e2c R09: 0000000000120e2c [ 1183.509068] R10: 00007fff74f67e60 R11: 0000000000000293 R12: 0000000000000000 [ 1183.516337] R13: 0000000000000001 R14: 000000000000053d R15: 0000000000000003 [ 1183.523624] [ 1183.525270] Allocated by task 10286: [ 1183.529032] save_stack+0x45/0xd0 [ 1183.532488] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 1183.537417] kasan_kmalloc+0x9/0x10 [ 1183.541052] kmem_cache_alloc_trace+0x151/0x760 [ 1183.545730] __rdma_create_id+0x5f/0x4e0 [ 1183.549793] ucma_create_id+0x1de/0x640 [ 1183.553790] ucma_write+0x2da/0x3c0 [ 1183.557433] __vfs_write+0x116/0x8e0 [ 1183.561157] vfs_write+0x20c/0x580 [ 1183.564696] ksys_write+0xea/0x1f0 [ 1183.568242] __x64_sys_write+0x73/0xb0 [ 1183.572136] do_syscall_64+0x103/0x610 [ 1183.576025] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1183.581211] [ 1183.582838] Freed by task 10284: [ 1183.586209] save_stack+0x45/0xd0 [ 1183.589663] __kasan_slab_free+0x102/0x150 [ 1183.593896] kasan_slab_free+0xe/0x10 [ 1183.597695] kfree+0xcf/0x230 [ 1183.600822] rdma_destroy_id+0x723/0xab0 [ 1183.604908] ucma_close+0x115/0x320 [ 1183.608566] __fput+0x2df/0x8d0 [ 1183.611849] ____fput+0x16/0x20 [ 1183.615171] task_work_run+0x14a/0x1c0 [ 1183.619100] exit_to_usermode_loop+0x273/0x2c0 [ 1183.623685] do_syscall_64+0x52d/0x610 [ 1183.627621] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1183.632802] [ 1183.634428] The buggy address belongs to the object at ffff888098a1ac80 [ 1183.634428] which belongs to the cache kmalloc-2k of size 2048 [ 1183.647087] The buggy address is located 480 bytes inside of [ 1183.647087] 2048-byte region [ffff888098a1ac80, ffff888098a1b480) [ 1183.659042] The buggy address belongs to the page: [ 1183.663983] page:ffffea0002628680 count:1 mapcount:0 mapping:ffff88812c3f0c40 index:0x0 compound_mapcount: 0 [ 1183.673948] flags: 0x1fffc0000010200(slab|head) [ 1183.678622] raw: 01fffc0000010200 ffffea0002155708 ffffea0002a57308 ffff88812c3f0c40 [ 1183.686546] raw: 0000000000000000 ffff888098a1a400 0000000100000003 0000000000000000 [ 1183.694418] page dumped because: kasan: bad access detected [ 1183.700165] [ 1183.701804] Memory state around the buggy address: [ 1183.706736] ffff888098a1ad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1183.714152] ffff888098a1ad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1183.721521] >ffff888098a1ae00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1183.728925] ^ [ 1183.735417] ffff888098a1ae80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1183.742837] ffff888098a1af00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1183.750182] ================================================================== [ 1183.757556] Disabling lock debugging due to kernel taint [ 1183.776636] Kernel panic - not syncing: panic_on_warn set ... [ 1183.782567] CPU: 0 PID: 10284 Comm: syz-executor.3 Tainted: G B 5.0.0-rc8+ #3 [ 1183.791135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1183.800493] Call Trace: [ 1183.803085] dump_stack+0x172/0x1f0 [ 1183.806727] panic+0x2cb/0x65c [ 1183.809922] ? __warn_printk+0xf3/0xf3 [ 1183.813825] ? __list_del_entry_valid+0xe6/0xf5 [ 1183.818496] ? preempt_schedule+0x4b/0x60 [ 1183.822659] ? ___preempt_schedule+0x16/0x18 [ 1183.827081] ? trace_hardirqs_on+0x5e/0x230 [ 1183.831399] ? __list_del_entry_valid+0xe6/0xf5 [ 1183.836064] end_report+0x47/0x4f [ 1183.839519] ? __list_del_entry_valid+0xe6/0xf5 [ 1183.844189] kasan_report.cold+0xe/0x40 [ 1183.848165] ? __list_del_entry_valid+0xe6/0xf5 [ 1183.852840] __asan_report_load8_noabort+0x14/0x20 [ 1183.857765] __list_del_entry_valid+0xe6/0xf5 [ 1183.862274] cma_cancel_operation+0x2d7/0xa10 [ 1183.866773] rdma_destroy_id+0x8d/0xab0 [ 1183.870757] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 1183.875859] ? complete+0x61/0x80 [ 1183.879317] ucma_close+0x115/0x320 [ 1183.882949] ? ucma_free_ctx+0xb90/0xb90 [ 1183.887009] __fput+0x2df/0x8d0 [ 1183.890314] ____fput+0x16/0x20 [ 1183.893594] task_work_run+0x14a/0x1c0 [ 1183.897501] exit_to_usermode_loop+0x273/0x2c0 [ 1183.902088] do_syscall_64+0x52d/0x610 [ 1183.905985] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1183.911171] RIP: 0033:0x411d31 [ 1183.914378] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 94 19 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 1183.933288] RSP: 002b:00007fff74f67f30 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 1183.940993] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000411d31 [ 1183.948256] RDX: 0000000000000000 RSI: 00000000007413a8 RDI: 0000000000000004 [ 1183.955515] RBP: 0000000000000000 R08: 0000000000120e2c R09: 0000000000120e2c [ 1183.962780] R10: 00007fff74f67e60 R11: 0000000000000293 R12: 0000000000000000 [ 1183.970043] R13: 0000000000000001 R14: 000000000000053d R15: 0000000000000003 [ 1183.978270] Kernel Offset: disabled [ 1183.981892] Rebooting in 86400 seconds..