[?25l[?1c7[ ok 8[?25h[?0c. [ 91.749583] audit: type=1800 audit(1552527071.792:25): pid=10298 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 91.768879] audit: type=1800 audit(1552527071.792:26): pid=10298 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 91.788363] audit: type=1800 audit(1552527071.822:27): pid=10298 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.168' (ECDSA) to the list of known hosts. 2019/03/14 01:31:24 fuzzer started 2019/03/14 01:31:29 dialing manager at 10.128.0.26:37519 2019/03/14 01:31:29 syscalls: 1 2019/03/14 01:31:29 code coverage: enabled 2019/03/14 01:31:29 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/03/14 01:31:29 extra coverage: extra coverage is not supported by the kernel 2019/03/14 01:31:29 setuid sandbox: enabled 2019/03/14 01:31:29 namespace sandbox: enabled 2019/03/14 01:31:29 Android sandbox: /sys/fs/selinux/policy does not exist 2019/03/14 01:31:29 fault injection: enabled 2019/03/14 01:31:29 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/03/14 01:31:29 net packet injection: enabled 2019/03/14 01:31:29 net device setup: enabled 01:34:25 executing program 0: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rfkill\x00', 0x0, 0x0) close(r0) syzkaller login: [ 286.436048] IPVS: ftp: loaded support on port[0] = 21 [ 286.590325] chnl_net:caif_netlink_parms(): no params data found [ 286.675236] bridge0: port 1(bridge_slave_0) entered blocking state [ 286.681968] bridge0: port 1(bridge_slave_0) entered disabled state [ 286.690472] device bridge_slave_0 entered promiscuous mode [ 286.700075] bridge0: port 2(bridge_slave_1) entered blocking state [ 286.706692] bridge0: port 2(bridge_slave_1) entered disabled state [ 286.715023] device bridge_slave_1 entered promiscuous mode [ 286.748983] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 286.760391] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 286.794061] team0: Port device team_slave_0 added [ 286.802964] team0: Port device team_slave_1 added [ 286.998214] device hsr_slave_0 entered promiscuous mode [ 287.252990] device hsr_slave_1 entered promiscuous mode [ 287.534270] bridge0: port 2(bridge_slave_1) entered blocking state [ 287.540838] bridge0: port 2(bridge_slave_1) entered forwarding state [ 287.548108] bridge0: port 1(bridge_slave_0) entered blocking state [ 287.554874] bridge0: port 1(bridge_slave_0) entered forwarding state [ 287.617621] bridge0: port 1(bridge_slave_0) entered disabled state [ 287.627255] bridge0: port 2(bridge_slave_1) entered disabled state [ 287.665813] 8021q: adding VLAN 0 to HW filter on device bond0 [ 287.685647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 287.693387] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 287.707880] 8021q: adding VLAN 0 to HW filter on device team0 [ 287.723610] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 287.732295] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 287.740371] bridge0: port 1(bridge_slave_0) entered blocking state [ 287.746913] bridge0: port 1(bridge_slave_0) entered forwarding state [ 287.765403] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 287.774063] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 287.783794] bridge0: port 2(bridge_slave_1) entered blocking state [ 287.790296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 287.839386] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 287.849226] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 287.863667] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 287.872923] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 287.881999] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 287.890809] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 287.899361] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 287.908170] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 287.919106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 287.927389] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 287.936010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 287.944247] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 287.958810] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 287.966950] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 288.007946] 8021q: adding VLAN 0 to HW filter on device batadv0 01:34:28 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/packet\x00') sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1be, 0x400000000074) 01:34:28 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='personality\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read$FUSE(r0, 0x0, 0x4f) 01:34:28 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000010ff0), 0x10) sendmsg$can_bcm(r0, &(0x7f00000000c0)={&(0x7f0000007ff0)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x3, 0x0, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e15adecfc04aba1"}}, 0xfcd8}}, 0x0) recvmmsg(r2, &(0x7f0000001940)=[{{0x0, 0x0, 0x0}}], 0x500, 0x3665c4, 0x0) 01:34:28 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x4000000000000000, &(0x7f0000000380)={&(0x7f0000000300)={0x2, 0x3, 0x0, 0x9, 0xe, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @mcast1={0x11e, 0x17, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x17}}}]}, 0x70}}, 0x0) 01:34:29 executing program 1: mkdir(0x0, 0x20a0) mkdirat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x10) r0 = open$dir(&(0x7f00004daff8)='./file0\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r1, 0x6, 0xa, &(0x7f0000000000)=0x81, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x8000000004e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, 0x0) mkdirat(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x6) setsockopt$inet6_int(r2, 0x29, 0x31, &(0x7f0000000140)=0x6, 0x4) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, 0x0) ioctl$VT_DISALLOCATE(r2, 0x5608) lsetxattr$security_ima(0x0, 0x0, 0x0, 0x0, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept$packet(r2, &(0x7f0000000240)={0x11, 0x0, 0x0}, &(0x7f0000000100)=0x140) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000480)={@local, @remote, @local, 0x5, 0x1, 0x8000, 0x100, 0x100000001, 0x400001, r3}) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000300)={&(0x7f00000002c0)='./file0\x00', 0x0, 0x8}, 0x10) setsockopt$inet6_opts(r2, 0x29, 0x20003b, &(0x7f00000001c0)=ANY=[@ANYBLOB="3f00000000000000c90200000000000000000000ffff7f000001000000000000"], 0x1) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, 0x0) ioctl$VT_RELDISP(0xffffffffffffffff, 0x5605) r4 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) memfd_create(&(0x7f0000000080)='\x00', 0x0) mmap(&(0x7f0000ff3000/0xb000)=nil, 0xb000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ftruncate(r4, 0x7fff) sendfile(r2, r4, 0x0, 0x8000fffffffe) 01:34:29 executing program 0: mount(&(0x7f0000000340)=ANY=[@ANYBLOB="2f2465762f6e756c0000000000000000ca5bf4a63630ae1c514874b7bae1322a2cf0bc924dfc5c55784f1206f5fd31dde47f85a689deb8f4a44c7533b16ae170bff4cfc1b038c624f80532c0700229c8f9bd164d9df6a67e54ddaaf45d7645ca7c4b87f4c0fe5ccb262c2d2d7471c37dfe2e6dfb43ea3010ccf15c448c1a7ded87e15a2e9144131c902059b62db867603579ac36c8d19a447974284bc85e1156649dfe9fb90bf2425790a9a2f05fbb4486513fe4cccde8dd6068aee645ebf38ceeb520000000000000004398bc7b22a5219919ef096732f4454aff1e6f9288a092154de4fe3885d5ef79dabb7b819fe63af28f69207ab15cbc575fe936bf9d882bad"], &(0x7f0000000100)='./file0/../file0/file0\x00', &(0x7f0000000140)='reiserfs\x00', 0x800000, &(0x7f0000000180)='\rem0vboxnet1,%nodev+GPL\x00') chdir(0x0) symlink(&(0x7f0000000300)='./file0/file0\x00', &(0x7f0000000000)='./file0\x00') rmdir(&(0x7f00000002c0)='./file0/../file0/file0\x00') r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x8000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000480)={0x8, 0x120, 0xfa00, {0x3, {0x2, 0x7, "9216473c4257c3349471896200a58677da4e21a14832becade29fc5e7f33628c276948cad1a53cf8e957a3a4e43864b2f3ca6d4885709a7ab1b940412807648677965bab37e84a798eda3f590904d925e256957a59b0ccc1d598e5d9fcf8f06fc47fb649129c14064415d35df9f8cf66af91edea003dddfc37ef9628ef6114835590c9ab76e60d083d499f1618d9c0e96560118c9cae7dab1f27bd742177d93642b2ca462c002e24ca8156eb4917f0a122a021323d7f83f5755f97a27f757e48635be587c73bbee5070a88bde7b62f5c99ad10bd506004be1e95f96859c9208a3a4b16dfae273ff601ed4c099493b14eda68165582a3a399cd823f188a8877ba", 0x37, 0x1, 0xff, 0x1, 0x5, 0x80, 0x8000}, r1}}, 0x128) r2 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x2, 0x10002) write$sndseq(r2, &(0x7f00000000c0), 0x0) 01:34:29 executing program 0: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000)=0x6) 01:34:30 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = semget(0x1, 0x7, 0x80) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = syz_open_dev$mice(&(0x7f0000000400)='/dev/input/mice\x00', 0x0, 0x0) r6 = syz_open_dev$cec(&(0x7f0000000440)='/dev/cec#\x00', 0x3, 0x2) ioctl$VIDIOC_QUERYBUF(r5, 0xc0585609, &(0x7f00000004c0)={0x1, 0x1, 0x4, 0x4100, {0x0, 0x7530}, {0x4, 0xb, 0x400, 0x1, 0x7, 0x488e, "9ccc6de4"}, 0x1000, 0x6, @planes=&(0x7f0000000480)={0x20, 0x7fffffff, @fd=r6, 0x10001}, 0x4}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@broadcast, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4}, 0x0, @in=@broadcast}}, &(0x7f0000000300)=0xe8) r8 = getgid() semctl$IPC_SET(r2, 0x0, 0x1, &(0x7f0000000380)={{0xcc67, r3, r4, r7, r8, 0xe0, 0x100000001}, 0x9, 0x2, 0x5}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000340)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000000000)={0x0, 0x0, 0xff, 0x0}) [ 290.016607] IPVS: ftp: loaded support on port[0] = 21 [ 290.083396] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. [ 290.208733] chnl_net:caif_netlink_parms(): no params data found [ 290.294457] bridge0: port 1(bridge_slave_0) entered blocking state [ 290.301008] bridge0: port 1(bridge_slave_0) entered disabled state [ 290.309460] device bridge_slave_0 entered promiscuous mode [ 290.320014] bridge0: port 2(bridge_slave_1) entered blocking state [ 290.327201] bridge0: port 2(bridge_slave_1) entered disabled state [ 290.335618] device bridge_slave_1 entered promiscuous mode 01:34:30 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x1a, 0x0, &(0x7f0000000080)) [ 290.379206] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 290.392222] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 290.442735] team0: Port device team_slave_0 added [ 290.451906] team0: Port device team_slave_1 added 01:34:30 executing program 0: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VIDIOC_G_PARM(r0, 0xc0cc5615, &(0x7f0000000240)={0x4000000000008, @output={0x1000, 0x1, {0xfffffffffffffffa, 0x2}, 0x0, 0x900000000}}) ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f0000000040)=0x4) [ 290.539042] device hsr_slave_0 entered promiscuous mode [ 290.573401] device hsr_slave_1 entered promiscuous mode 01:34:30 executing program 0: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x624800, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000000000)=0x100, 0x4) mmap$xdp(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0xa0012, r1, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000140)=ANY=[@ANYBLOB="01003e00e0609a3b1ef9313b5ae839bcf1351c323cefb95d6e04e35857b647981440e9ccbb10c958ed167b1d85bde7ed681a4e6dfd5f2089a34d1baf8d87f1f71267236ab50029a347bbd8421b3048124506f0c0d70e701ef3b421e0b1057f425be743707663bcc074da07ad96d30af464d914b7991c1d0b4de13e7a20b880c6efa14e0b9448bb006f6f9561ec76180899e2b9d8d5c27b39e4599f16e2d5b62072c949f8ee8f064dbf0592ce487d2bcafc7fb4eefdd20b6962265112a346dff71b19e8cc5b7965683e78bd231f1a550b11b46930fb992fcb9120d66071a1"]) ioctl$PPPOEIOCSFWD(r0, 0x4008b100, &(0x7f0000000080)={0x18, 0x0, {0x1, @empty, 'tunl0\x00'}}) [ 290.658081] bridge0: port 2(bridge_slave_1) entered blocking state [ 290.664721] bridge0: port 2(bridge_slave_1) entered forwarding state [ 290.672028] bridge0: port 1(bridge_slave_0) entered blocking state [ 290.678580] bridge0: port 1(bridge_slave_0) entered forwarding state [ 290.816534] 8021q: adding VLAN 0 to HW filter on device bond0 [ 290.843322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 290.852867] bridge0: port 1(bridge_slave_0) entered disabled state 01:34:30 executing program 0: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x624800, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000000000)=0x100, 0x4) mmap$xdp(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0xa0012, r1, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000140)=ANY=[@ANYBLOB="01003e00e0609a3b1ef9313b5ae839bcf1351c323cefb95d6e04e35857b647981440e9ccbb10c958ed167b1d85bde7ed681a4e6dfd5f2089a34d1baf8d87f1f71267236ab50029a347bbd8421b3048124506f0c0d70e701ef3b421e0b1057f425be743707663bcc074da07ad96d30af464d914b7991c1d0b4de13e7a20b880c6efa14e0b9448bb006f6f9561ec76180899e2b9d8d5c27b39e4599f16e2d5b62072c949f8ee8f064dbf0592ce487d2bcafc7fb4eefdd20b6962265112a346dff71b19e8cc5b7965683e78bd231f1a550b11b46930fb992fcb9120d66071a1"]) ioctl$PPPOEIOCSFWD(r0, 0x4008b100, &(0x7f0000000080)={0x18, 0x0, {0x1, @empty, 'tunl0\x00'}}) [ 290.872761] bridge0: port 2(bridge_slave_1) entered disabled state [ 290.902883] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 290.935215] 8021q: adding VLAN 0 to HW filter on device team0 [ 290.974656] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 290.982889] bridge0: port 1(bridge_slave_0) entered blocking state [ 290.989388] bridge0: port 1(bridge_slave_0) entered forwarding state 01:34:31 executing program 0: mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = dup3(r0, r0, 0x80000) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', r1}, 0x10) setxattr$security_evm(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='security.evm\x00', &(0x7f0000000140)=@v1={0x2, "d586670a"}, 0x5, 0x2) lseek(r0, 0x10000000001, 0x1) [ 291.042919] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 291.051104] bridge0: port 2(bridge_slave_1) entered blocking state [ 291.057695] bridge0: port 2(bridge_slave_1) entered forwarding state [ 291.068584] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 291.077700] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 291.086316] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 291.103234] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 291.115053] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 291.144522] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 291.152716] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 01:34:31 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000040)=0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x0, r2}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000140)="693aaacfcdfad8bb2d686473a9f55dc62eda88e823d0d55c2275237b16110b7009f0d36e1b44e05dce52e782fc7fd6e4897e6309ca63d7cb288bc6a330", 0x3d, r0}, 0x68) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f00000000c0)={0x3, 0x600000074000000, [0xda0], [0xc2]}) r4 = dup2(r0, r3) ioctl$sock_bt_cmtp_CMTPCONNDEL(r4, 0x400443c9, &(0x7f0000000200)={{0x7, 0x2, 0x1, 0x5, 0x100000001, 0x6}, 0x10000}) [ 291.206460] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 291.371444] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 01:34:31 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000040)=0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x0, r2}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000140)="693aaacfcdfad8bb2d686473a9f55dc62eda88e823d0d55c2275237b16110b7009f0d36e1b44e05dce52e782fc7fd6e4897e6309ca63d7cb288bc6a330", 0x3d, r0}, 0x68) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f00000000c0)={0x3, 0x600000074000000, [0xda0], [0xc2]}) r4 = dup2(r0, r3) ioctl$sock_bt_cmtp_CMTPCONNDEL(r4, 0x400443c9, &(0x7f0000000200)={{0x7, 0x2, 0x1, 0x5, 0x100000001, 0x6}, 0x10000}) [ 291.503660] hrtimer: interrupt took 33372 ns 01:34:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000028912, &(0x7f0000000040)="2af71f12d6123fd0dbbfb9") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'morus640\x00'}, 0x58) close(r1) r2 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x3, 0x2) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000080)={0x0, 0x2}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000180)={r3, @in={{0x2, 0x4e20, @broadcast}}, 0x0, 0x3, 0x2, 0x1000, 0x1}, 0x98) 01:34:31 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0xfffffffefffffffe, 0x428001) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x9) openat$vfio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vfio/vfio\x00', 0x410a00, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x28, 0x6, &(0x7f0000002f18)={{{@in, @in6=@mcast2}}}, &(0x7f0000000040)=0xfffffffffffffe2d) 01:34:31 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r4, 0x506, 0x70bd25, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x10) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f00000002c0)={&(0x7f0000000200), 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r4, 0x800, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000801}, 0x801) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000a40)={"3bf0118e41413d7b93bddd66174db180694614f460d87088dc211f94d0fe5a67aab8e7f38c5ddffb294557c474b78bce39fd4b73a709ca37d9b928f6fd421f6cf694323ba3ed5cf2f63cd97825771571144f456beebaf2fb700bc693e7b00ab451e81ba60902c59fc8a120a489980894419199b3512542ba4907b54a5f88e8349a742c6faa92a8890e0175fcfd20908ba7e6b235c76341b40908eff19254ed2a74edf660fb06de10c1ce531461e288f20beb6628f22def61b5f147944d67e4032cc98976a4c346d0b30e0f8b42725e34ba3c40deb42a560c4475531900789d233ab1ed4d0a8ff53b6cd37fa69a7f1fa51506cce2cd239f34cf251c92dd2ca4247897af0d48c7c8b6ac9064c234803d2c2db0b404bcbced05e168230a33aee2387ee6d583e057546ba1a28b1d8ca40dfae12ae372e020f4ae0d036e6a8f045b5aadc9740ed5e173eedccd7d0bd1566f2257feef8be2cabe68089765e2f7cf338979fe5b83b0474abe6a9f11d09f052e285b131a1324d441ba2e380597e05e555fb5583a8e031cb4f91aabe3fb8759309d6bae77d2a3b6c33b11b7666b855eda9ff016588cead67df4c07002dfab2ac8ff2c5857a4681d598cae872980cd3fd8a2714b73392742e09ed6886916f48e38efb9070acb2328cdfb60822d3ea52eb98e2c5426051608c1300732794e8341c1e6d9d52c511b3c5b7ee73eabcc3a6f544dbdf44d4d107bf8b1d5e54858600c1dccf781bc46fef9a95bc8e0560a4999b8158a16ae220d6b99faeddbaca14183df9b9488e6672133fda913cb8e4f0091efd7236aedaf4fa580172a63d7e48856d9076da53a49719cf77be9bc72fc6eb52bab13688c30cc20455226e6fd7c30a9509dcf8df2bb5b20d027e08933e2cffa6dd8e04306a77104cf6bff86fc7a4e6c2d8f5d00cce197cd548db343a2e03ea7c527319dea1bc0ffa8ba78eb2f8be39bd0eeee36814747dcd1ee008604ea8fb5de19e848fe60a72dbc222ece2bb218d5d41a340bfec55e6afc2aa58cd3c89fddc3d364e577b55dcbb1dbfcd67f2b5e35ba6075df89ed6857bcca38f6230ca2716c35d4d0352857fa4c1c4d3b530daec3626039241c3f7a00ddada21d7996bf44104a9680f8610945c95c6ad86c987ca7ce7252cbf4634d6478dd6f40f5ac19dea71a4c82d5f0f6166f6a7d927228cf203704def04dbad2eeda4f3d46f5b4112d7a519f1cb383113a53a30b4d7ea67dabe2595cc76c49edba2527ba49f0312b12e1ce84a510d212b08c71c96ca6c087dcf54e03c4b6e7c766b2dd6e6df08c7eaac6da58d20ea1c30bbc305b304e7437aeca1c252028cde67f67b151ddcd275b162449ed49b9318e919b3c8d1257a4efbede3a2c035c2335e8e7eb5a33660c116e3589736e9902e2136417d689875b22cf7b2f82dbb71a6c2007c3936241058a39d4aa"}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x1b25fd3fdb3ddeb9, 0x4, 0x0, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000000)) 01:34:32 executing program 1: r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x8000000000000000, 0x224600) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x0, [], [{0x4, 0x2, 0x1f, 0x7b03, 0x9, 0xca0}, {0x3d, 0x8, 0x5, 0x7, 0x3, 0x5}], [[], [], []]}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000440)=""/246) ioctl$PPPIOCSNPMODE(r1, 0x4008744b, &(0x7f0000000000)={0x283}) 01:34:32 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-generic\x00'}, 0x58) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x311000, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, &(0x7f0000000040)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 01:34:32 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) msync(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x4, @link_local, 'bond0\x00'}}, 0x1e) r1 = socket$can_raw(0x1d, 0x3, 0x1) getpeername(r0, &(0x7f0000001640)=@can={0x1d, 0x0}, &(0x7f00000016c0)=0x80) bind$can_raw(r1, &(0x7f0000001700)={0x1d, r2}, 0x10) 01:34:32 executing program 0: mkdir(&(0x7f00000001c0)='./file0/bus\x00', 0x0) mount(&(0x7f0000018000), &(0x7f0000027000)='./file0\x00', &(0x7f0000000100)='sysfs\x00', 0x0, &(0x7f000000a000)) r0 = open(&(0x7f00000017c0)='./file0/bus\x00', 0x6c0, 0x0) mount(&(0x7f0000000000)=@sr0='/dev/sr0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='hugetlbfs\x00', 0xfffffffffffffffe, &(0x7f00000000c0)='sysfs\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000240)={{{@in=@dev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@empty}}, &(0x7f0000000340)=0xe8) fstat(r0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000480)={{{@in=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@empty}}, &(0x7f0000000580)=0xe8) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='fuse\x00', 0x80, &(0x7f00000005c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xc00}}, {@default_permissions='default_permissions'}, {@default_permissions='default_permissions'}, {@max_read={'max_read', 0x3d, 0x49348e1e}}, {@default_permissions='default_permissions'}, {@max_read={'max_read'}}, {@max_read={'max_read', 0x3d, 0x10000}}], [{@hash='hash'}, {@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@dont_hash='dont_hash'}, {@fowner_eq={'fowner', 0x3d, r3}}, {@dont_appraise='dont_appraise'}, {@euid_gt={'euid>', r4}}]}}) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000800)={0x43, 0x6, 0x0, {0x0, 0x5, 0x1a, 0x0, 'self\'^\xfeprocuser+mime_type#'}}, 0x43) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000780)=[@in6={0xa, 0x4e20, 0xffffffffffff8000, @mcast2, 0x1}, @in6={0xa, 0x4e22, 0xfff, @ipv4={[], [], @rand_addr=0x7}, 0xd07}, @in={0x2, 0x4e22, @broadcast}, @in6={0xa, 0x4e21, 0x53, @mcast2, 0x9}, @in6={0xa, 0x4e23, 0x1, @dev={0xfe, 0x80, [], 0x2a}, 0x10001}], 0x80) umount2(&(0x7f0000000140)='./file0/bus\x00', 0x4) 01:34:32 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20010001, &(0x7f0000000280)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) arch_prctl$ARCH_SET_CPUID(0x1012, 0x95d3) 01:34:32 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000000)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) dup3(r1, r0, 0x3) syz_open_dev$video4linux(&(0x7f0000000040)='/dev/v4l-subdev#\x00', 0x2, 0x40000) 01:34:32 executing program 0: r0 = epoll_create1(0x0) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0xfffffffffffffffb) r1 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000005000)={{}, {0x0, 0x989680}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0xffffffff80000009}) 01:34:33 executing program 1: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) mmap(&(0x7f0000ff9000/0x7000)=nil, 0x7000, 0x0, 0x12, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0xc) 01:34:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r3, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000700)=[@free_buffer], 0x0, 0x0, 0x0}) [ 293.479610] binder: 10579:10581 ERROR: BC_REGISTER_LOOPER called without request [ 293.511235] binder: 10579:10581 BC_FREE_BUFFER u0000000000000000 no match 01:34:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r3, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000700)=[@free_buffer], 0x0, 0x0, 0x0}) [ 293.570365] binder: send failed reply for transaction 2 to 10579:10581 [ 293.578261] binder: undelivered TRANSACTION_COMPLETE [ 293.583733] binder: undelivered TRANSACTION_ERROR: 29189 [ 293.664548] binder: 10584:10587 ERROR: BC_REGISTER_LOOPER called without request [ 293.689744] binder: 10584:10587 BC_FREE_BUFFER u0000000000000000 no match [ 293.706101] binder: release 10584:10587 transaction 4 out, still active 01:34:33 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip_vs\x00') lseek(r0, 0x800000000000063, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0xc916) signalfd4(r0, &(0x7f0000000000)={0x81}, 0x8, 0x80000) [ 293.713090] binder: undelivered TRANSACTION_COMPLETE 01:34:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r3, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000700)=[@free_buffer], 0x0, 0x0, 0x0}) [ 293.803992] binder: send failed reply for transaction 4, target dead 01:34:33 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = socket$kcm(0x29, 0x5, 0x0) sendmmsg(r1, &(0x7f0000005680)=[{{&(0x7f0000000100)=@rc={0x1f, {0x6, 0x9, 0x6, 0x4, 0x9, 0xfffffffffffffffd}, 0x72cb}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)="cb6a66db9364436946dece89cd47b2ee07c3872b2c5b0eebf32acc13352308e8f5d24d84db6989a79ce512282472ffbb60cfacd589422012daf6760ab8f3068ad457c48926ff5f149cb86616998c2da2fb95d226f4d028f6f65343a63dabc9e2b8a6f94c491d798e8739a8083dfc25939c1a1d3c26221b507c8c728e9f7bf744858cc40aad46c3f533209f3fa801a740c4134bceeeccdc8fcd0e7f055dae600c947d04d85aba4d49a3eb1cf1482d6ebb58dc6781884c58ff4f98553e6701dd9fd82df2c7b619468529e596916fff52cf1828e79264a7957fa60a1b127d75c6cfc140a161ca63f9d1fd3d00e123402b6852", 0xf1}, {&(0x7f0000000280)="e7e479123c80c73b40941748dcd3c46be0b5a505da56db011c4df63bd8a932657837da64bb405dc4a33ccbd4e52337bb5fb60b96dceed21a798e93e2abf7b618679e1315d1122218a96a7b2150591d8474ce4b98bfaa05ed293ff8b6f70926cb4f04306f7f03ede1dc88c514c965f1cfeb574a98cee9176c60292e8bc443186b68fe2adfd4b7b421", 0x88}, {&(0x7f0000000340)="214a03d3d0c108be1577eb5746e4d6b9c40b3d2851fc25141c0d30933cf75dff10485bc544b0b2057409150ce3b6aaf9094017883d81c80b808fb47d8d7ba6f5be4f3ded854cebb7295d7f92deef", 0x4e}, {&(0x7f00000003c0)="77f189fbdb267588a9b02469ab67e66f9040d634c73c1873655a97eb83aeedb8b59ddd90a32e7f480f5ceb723396f4ba393626a6a845857bf384973649f4942b90259522b3ac778a91bb8987ebc7de2dc42a9cd874751f8f79e8c4d229af9e1f13a1e7bc286e38841b5a8b80172fde2eb165870575fe4c909594ddc0655ba4c41508c2059a041be4ed65b7617d6931c3205de4ba2f936d774e4e8dba298f76ccd750901e2bf9423dc39bfd4c8f6912235d11c7f4d5f1a5c7c5e6dfd894ac45aef1f7d95c12e11b990ceef50f3aea608d", 0xd0}], 0x4, &(0x7f0000000500)=[{0x110, 0x10f, 0xa1, "a51b81ba14d8a9fcc84cbc498f7f8db2af3a64d25bfb5693ba37bdbb8aa03991d86c7914a8673c33b6d00d3259e67ddd5d3cfb36419f1ba8a849f0cc6b52a7aa83dc0ec400a3cce582e45ff49ae3ba8136b975374bf07822342c4e339fa2524c97a0b8aef30144d41449c2ff3826946d5882ed4c3bf931a070274df8863e96f655acbc008009f4c59a94fa4147ef7f5f60b403b11f224036c11b3cafc0429831bfd9ed6ee9ee1188115cd01d557ca48097d974a2bb400af53ac966d4af74a4096c53c35cf109f829b8ab1231f7f5635cef0f0cefd536901e2c95b576da234bbe1b142a2e92e90777d9e8ff89430fcd96070f7c4d2b5e79da4311dc"}, {0x28, 0x0, 0x2, "5382cabab4c35623b58d39c96097ea6d115e7178e5dfb9"}, {0x98, 0x1, 0x4000000000000000, "da2b4a6e596a45d8c18495ab3d3a1c667db31e0d16f10912ab881b858df75c55bc29d93b85e82a6a62f0064920be760518d5fb8ec8159f94edfa99bff6f600577107d7b1bac9da9460a2898426049aaa2ba153a627b23890f70b5ee27ec872b182db519491f8606cae27362be0843d987d5a20327f7eef35a834fc3e45a6e09f6b4f93ad8d"}, {0x18, 0x10f, 0x8, "0ca99319"}, {0x1010, 0x110, 0x8, "33cb9bb1c351529b8ea16934092c37d1119971117c7e3ce0951576fed7cc345e0dbaab79b816cca6b952fd24a319a02dde799c0cb6a864e4e7d3e39fca14175146426740fa73598881f5c1b57bfccaaac0f91909417e7fb32c5a101af0b51566539c3413e22b498686e26863bcbc7bbe774c9f122947ed178b87b37c6e08501c38ff89a1141d51dc69a0c758e2d4de539706919d21684e0d2b65070c880335972002e021b7d857942c469d34fd9152f157ea2b3e946c456a1326380e0399ce6cd6dde17160d98099b56e55475919bf678e592a244261fc4a0817310345efe127097eff3e7f271a61aab7deee7276919758c29f7ce2e12d12970193711f947398f8437d4ecfa8cb40a65600b79279372180d43bc2febcd7913285f615f00aac41c6d734060cbdc62c60f5762b0188ec579e447cc7b667d70f3eeb11d61111038e3e668bf9dcd3fde188686bbc136dd0575b3c7d31a6ce23cd2d8b621579d7eed4a2eab2c51c72757516884a2026df8a4cf772c8c9c859066cd145fd7c8eeb4e64c5ee258711b38afde5218ec2f8bb33ae9512429b7d336d837dc1370af3f927601e52ba54f4451edc46f4c69ff6f514940898e7bfdbd44c169f7e3b65daca62d7cc82349a98ffb11d2c97bbe44c3db634e98afbef8852e293443e89dad551751524b83366aa2a8c66adf81d7a240466e640de798e0795c6ae4fa4519de56876e8085f9a5037abbbc273398b1897242f1dc39a97247581e05b37b2b4e2355bece8a35b25d054f71d433f5abc21f6744745bf20f767868aadfcd494f2b470a7698cc2eed82a5526ac8c0c0f52f756a8c673f84373348cf5e5e789bd0e98b83bbc0323f6ed4182f96ab16f97bf6b41b0a9006e14fc2e4358530b8a8d8621ed5b3e9807a2ec80e095ffc0bece69a0962e182dde62fadb30769871d1c8c159d7100d7af1fc523d0fd7bbee793f77b207bea4e85a375bfbd374f84a36570fb6550c5c68303dabcaeb245ad2f807e2f8215688d9246c945ee185163da4df142aec9c59ee34732b0f0cd92e4c330c966bafb4a50d1bb55654cff838b7ccb505a57d5a9b86e9200030675e2af3f4ecd94e2f375acdd2349e2fbc7c16cee8ac488eb2669006fba40cf7fef61b96c98cfa0efbf5c37a42ce8068315041255b705e0111d79c51c4bf5f778ea0ec57b3b382642b013fc14f616aba0b8238448da081728cc940bfb6769143dc58368c3d8a74a112ef5c3cd85eb9ecfd5a8a9d3765acb075edf270d7a31a08ec0a84b30100b888aad9b2dcdd846aa2e7b7a53dabd0a57bb29abd5794695cd6af2e5720da3c84d4c6a76868b66e2ef90c32a4e979db54f08af69247d20cfc776d49e90ed381783696e05953dbf9067424f2912c17f58470e370ba4ec849f4a6126b83fb5f33a10de6204bef00760fa9437a5dab0e6a178a65d615c35fd50a4a99eed47fac9254fb9a92eea31ed0e0dc05b374c9723052b419910e265007ce362e6e9a4266a49095cb689a7990f7939549e0895fd45367d060710be73275342a93bdb7ee1e78eb830577bedd303d4d660c544e3bfc055167cda1e94721e9b2a166c645ac7e19b81997bce703594d9b07c5bdb46d3ef26ca9fcfed7ff98fd2e0de31b9ecaf7f387a325bd33b191cf0aa0939a075947f3b5282f136575cab5aebfc89443b14dfec8fb23790db69a089de9cc9515e0dde8d43c0f82ab8b5fa3afb0f376e41380384795a134f7015bce3b40d0c054739b5aa26592d47961f6c77ae70a23b24ffb81961a9ffb9e98b0c225251caadd54c3208c781df39a3cec53b41e80fe68d6ea851d1e4909bf6ffbbbd1ddbe92380bd6bb49a908f6fa1fe0ca9bcb005f856dd15428740aa16b3393e565b0bc45ac3f217bce7c322556ceedbc07a06f782cbd6c6bbe1784057f279d88ca0422cb7584a4231d69dda1fea7fe316eb4c536484327d653809f276fbc7cc0186e1e7c952d58c7a76a7f27c2e2a8664599fde0537dfa3800689ec07919ce1866605d2540f93b56f4987bc10ef771f14698407ff1bb0dca58e02a6fd5b4d63570b94201d9d151ce7155c56438c32c2c4b7a410221536a528ae72b6cbf83ea1990ad0a7e131c792de8bd8394a4cfa475d7274b5573567454e24c3f44b056e5606a629eaf615e20a0fc49b45c5332020d99d45373cab89148f55320855c50aa1a4dc05125e7e2b23e76a715dc50917cf8323e26a7a00c8d4ff2df89624ad518e73ebfbd918c9d6255c50ce4c5f0337c878b771b40410b72c388b49c7d155645fc654a1acd233a2883f623ed99c8dffca8d364f2f74a2117f81fb8fbcb441c78de0d73673affba737a8a6d12ae4ebfc34bf647ddb8befcd2e85d73d31aa152d93cfc8f7a873f28d1620860daaaa7ac8e0242f91e15145f7126d9fa10399f3f35be5752ed8fbbeec05f32258114b7f69e88d7d68087ad58ea0ae70811ad679211c8331038f5705f45d7fb87e5026c5781192673c8a8480b0f01d00d7ab646369eae166ac152aebb4a297d1260a5ba7a0c932033f6e160af5de99c20c2c112ed3aa0f6666a6854a8a1658405d5cc11bcf45acb40363639681afad418db0cddab60b73902ff7b1a3c662fb484b303c3409d92ce49e270e1871ef96f6408825ea1f5a2aca721f994052cff3ba5a837b901aaf91ae64883a30ec045a23f2dac09c49ace8591f62b0321dd60a228aff5ea25e713aa0ed3eda7d00e9cee950f7de1e1a428fbb38d89f7e077a1658f9829e88e0fe0dc6b07a745ac938f798d6559d14534590765c59399b8828f8fb69b0ee19d70a4731d8935d3e3c414e0d14df1d033b6b6f7f55215b5051f91756730d38f10f9576231f08c736b9845409a475e1c3a6fe879849809a28361049a4bcf89adb727e54757eab30dbc86a209a781355991af7c4d6335d0b3b27dce3e6284fa853f1a851b38688bbbbffa2b4cb072954ffbd58407d6bf4a52b39503b757ac80dc812138de845773d28f90497cf4c96459a9a107f46cf844ce02281b4324c05bb560ae8f77ff1becb1254d22525c2b0487641cf8ba6b0b3065564c37edb81b7e3e85bccd0cac3897379070cf402c8af9cb030d25d2679f5f8b0a26d3a8d25bffb15d682fa017f3ce956aa3ff56020cae802e8b742af7382be16d2f89b367272e38ceed08bdf95d10b5b0b0a2478b82e02b597c7e18db5889f0465d4f81f27f9bb0937eadfed5ad111188ee7d044881d226694cf5e6dcb930b444cda1a61a44ef0aab3db2e19899ac6813aa3afeaa856ec9e2767f3735e6a5a1cd1cb8c88bbc382cf8198752cdebe2289dbc65d74f0fec8d97074e95532dd9eb0197f6b232b3deecd114fbf8d07f075561b46510320ef3b67a3037a3a0d7062e1cb80d5bdd9983df663dc13aeb4e59f32bebc43b05e6d349ef00a5f5e1687095528bd22828283cc07cbee738f0a245988050214fc8c5f8299f3cf5d00c2853d39ec02553f32f4e3a6896dc6eb5d881e6a9049538b055b9a0a60015d7c21088d3c269dfa4fe39c6af2a28a65b737bdc39a2b3d2c8e11430f2d39c7399b4256031921153caf7816d06126d268cebc9ff5afee34be59070607c55bc79618b5fa5f18829530c9d716961364a2961ee83fedc48d4472e0c7416343f044417a72b3365eba23af09ab9660c3987e99cc16bb98866e1fc8a157c8c6ce3ae117ca5e2a0e8482f31cc08239efc86ee697f86e0a1458347d791f991cf185cb98e8091d9218bb6654eb1e0bcbcaadd5f788f8d53e4c3b5bfc2b5dd12f3148fe28a246fbc010b71fa2927bf006b1263751cdd5e6c2430907ed8839abd78379500c5bef73bf4f82e830879fc49a17a4bd71b7a277ffae264e73c1a1d5889f7db708b4967faa6830fc447b9f80b0a1a4f357714f3aec2ae21e5bc3bcf02c02acb22e21167a4e13386d9a08ae45f52b6aea0a91fd14b5cf1a262517f54f14c7013383f8e2c4b540a80d28c1d408f21bee4855d905459f50f95877f55194bf198ecab75209a1a656c0cd188ae553aade42247c23e75b7e0e3168deac5737be5c088b79fc5f44a5b00e5b563ef09b02d20ea90ade62ab7f429d7c534794dda4a08487bd54639b694e51225edf2d6e99b7a550e9b261a3e413435f164f9374f859f205c97ae7633f5b2df6d884d71163eeb2e1635580f52e59fc7d7d17936ac8d0319b10b6f0a375825c787300b3679aa4a4c91f9953dff9055ac94943b87efff1caa837bbc512eae179b724319b3a038ef349dab7797c0eed26ed3004d9fcb54fa1bf42b587d63441539f40de5640cc33ce8b35bd3b4ac3d6183a8296950dc89f2f3a470b548251ffbb1c8b645aea22bb507f0a7f566ad32fd0f150a3c73f930c8bef95c1fa1dd2db779742c7d8edffb1cc19206e89c7653071fde9a69c2862d808095e07663d5e973f46957e146e081f82dae448a8ef4a45ae4309af35f6a2c82dd64f13846cfa87c522bd2d1ebb73b805271dcc4c93792ddba5a53fa66ec1edb7f9a2642524da32cd76fe1ffb39d5bbf260af9581930bc5b94dbf89dcafe82219a3f92da3bb03b2ecef9a4d99cd5a814f28331914fac7ddc6d9f182a9c06910604db128a6f5f8a47bbfb4574f7449add7c2312091035f263d65d27212ca6b4c7d1bfc11b3399cc60cc98fbbf4e0bdeb86f37d189c5a193d4931277a8a2dd43593dae71530fa8a46be58c2125b3f156d4ca0f1e9834420884e3eee3d39d3899072692390ef00d3141c256cf03487d137ffe360e50ce648b4f9c36b0fc804f09c63ea4a46d8c7daadae1c0697ec8153ddc2029b5b2c2c0c78cd545e9acd3935195306d3c70d6e2ff252c704eda83812911073af546923bde3e04d280eb1ddc50282bc79277de2ea39eaf4208a93513d0402341d89bfa3331b9bac135557a985de377c5d0eda37430a110f7cb024ef71f6cb24726bc912fd913f40273f2b3e7ddf08fc7c96a47e49190015b91ef133881e7159f012cc8b194c03820f57cc47de3ba3a13d1883c05e8d1d05eaa99376b91e3dd0617d16e183894379d11316bdc0ff7697aa7dcc11dc75b5bc31dae214c2790eb3643af539ffe51ff79c7a915b20d015845cb6fc7e25aa3f626089673d527cea4d109d1cfdedf9f15c2a46fcf9d782f73298e8cb31279c543aa1b1508448cf17a9a78581acadf2e820a2ab95b5207318091defdd8e1bb78558b8a974efe485885d862a31e08e00e3a37adc1d4b349e70b645a9623c0f358b331500fca18f811ba32b02eee3236c37d49abcb30629451d504b83c71e3a6262311a37b35fb918a92bb505ee248cf15d2abea2b6c7b79fcd0a47f6d8c3aac2c3ec6d45ea9ef6730626c8c92a1d9c14cea5455f8dc321300823ce2547a6bde6b301a1fa91a1f3c09c5336ceab8f8617cadc9fc7498b98d2c2270e15282aa47078ddc77ad0614f0017b9a0cf7883ef935fa74eeb9b5b3532b6bfdc1b30edee7b94d45eebfedaf9089256b4edba5b94530001e47353c289df88d66ec3c6a9b3eab381082f27aad55e76645b2542e47e70dd7bb53bef24c9dca9febee8700be35c4baa330ddabb227d1409e291340e0659e67385f28cfe8066eeabee752b04f49a3640a3bf53fe832481d1ab429faaf0f908e632ed05fd3df37b65f9f3dac980c1784e7c874e06e3fb57a8ab77afc38707c6c0cbd760e8690c1f8cf2b2641e16dfc8521856dac958d8137c5ea12a86a78b1febfb1f23afa1793f8f4e46ac14578718ef3fe8a0cac7237425ad8dd87ab25982d656f9a417803b4cf9521105fe99a717479cb4b6bb7254073"}, {0x10, 0x88, 0x8}], 0x1208}}, {{&(0x7f0000001740)=@caif=@rfm={0x25, 0x2, "8c6302f1369b69cb6d298964a29f1fda"}, 0x80, &(0x7f0000001ac0)=[{&(0x7f00000017c0)="6aca9df6f48be18d8b168faab77ea1ce0b7affa4385b55a32f76494941eece8aa5bf620d217472f5a242d1f56a740b19dd8801e39b4127ff10343e814d4690b9b37f170b0ef1f59a835cc570ced2fef7b7aa40f38fb6318fef5f6508790a93b717a671aca6683c7474533aa9793615ecc559d22eb7ba078bc68e22afa124c7e89fbf4658888f5bb7b1c508f7a40c7557de15995b72492e22efa83333e35a20f67d98e5925c0ed29bc32ce24ecf7c0a330cd2c5a823d29df809f5bb3abe2feda0fd473bfa9649c02ed248a9d0e1a496d203", 0xd1}, {&(0x7f00000018c0)="f403582eff6d1d5ea437c7e5b4f6e4f3b6b9ad2e88fb01de5f781bfc1467ed", 0x1f}, {&(0x7f0000001900)="2d9d66b84fe6853f3405371da6adc1a3f4420ecf39faecdcd279da30fe0ae1ad84420a38df8c1f4f382efa2eebe0f7ba059cabbd52c1f64802be8b205a6e05a9b26c2b9db6bfae1f285e444986c296a91f0eb95e7a2d413af52143d8eb66e7b3aa3bcb837a0da50bfb9bf044112d30fa526f3a276fe8fbf4b7e89f7eeb2401d4af23814c0f8e676b83b2b66545c0b6b8783c508031538d4cd6eebadf5e706cc86fc15619fe67", 0xa6}, {&(0x7f00000019c0)="7bc6c9d481ad229978c554b26e292342533f9bb29abb57bee22b5190111f2e50ea6bc23165e5d06aa9108ddd83af9f9d2c5578d2f275928231aa3e546747f02b2794fb659b4535e5c62b858ea3cc50cd5466ecbccf055f2426e087bbb3d09972328f0c5cd1c099eca50ef5ab4e7091eca63c7a787e8a494f1adb3b35a9942e54d62da9c5201b40971eb47eb2aad88b075d6f6e7819537a17c2d8b5be21ec8b2d073f54655fc1e1c38066bb2a1ac1a056c4c80fb6af4bfb4cbe2e93a13ce07d0b60ece1cfdff1c94135525b2e318c46da0616efe94a88869e82e68470b1d6c97e5da8018c0c9973ca5266534179037284603bb748e1", 0xf5}], 0x4, &(0x7f0000001b00)=[{0x1010, 0x11, 0x2, "6ed1eb6d616163f31d1b89cd3a1e6bac2606bd6337dfb188d72b5d2b79bcda59fab0485902f7cc333566fb0947341a15443df1e91fed5c3137323d7ea876883cec9cd15a81d14a34f7b335f874bc470a3d2e56d7e57457d46e5eb871fded474bed4c7e18ded8fae752c3d68a30dbcd7f0455b580a35d91f59bc92f6a7d5e32eaee77750fc84b772162850c174e2a01586c9dc9b923736f968cd1dd56e29f70bc5453612ed200a89fbed9931d990787426f2caa3d05ef7f2a39b6a1b05af6a58ee16ebd7853403e5a8e688d8d19b2f7e690eaecb08c750c4c6e31e84e81c475d53501d0e1048d23493f384567fad988097d027091b64bdff5f01c12f0992bd1c9aac179df8b21ec70e8ecbc43b98f3f49635938d3200b9d2e7797282ed835b95bf13834ed5e8a4fecaf4613582031a57ad7e5d5492db11a4e7f45f46374cbe7d17a8afea7a1982aacb26986cacb7e64431b4a0c3d23f192a04ef51b556c69380ed311af04f97eec1d2920cde1943f4186e7a0e639709cba2639e2d4f5b980c6384236bb9b500e07a183784ddf0a1b8a8862c16aeaa24b7d2260b6ec530779519553d1380eef093a9a1b1a74a9a7b0f4d7a81023678df72689267a8d64b70c3a174ecbfd6ad6f2948d1fe5051242469ce2095aec48c1a35a1995c41122bc6d892590560a07f12494c0cb20dcc0d98922e443ad1a235b1b50fbfefe5a32f227e1c75ee36132727acc46b01b37d490f0ef9ad96071c5dbd7e01a0489289cc1c5f02b2a3239299c6241ef8aa5c9b475b33ccf4ada82bc74fc0c357120f8ea219e8e4d7c64f26ebcf70480a1c1bef8d6f92c2288c36b008559229c3bb4e820e8d108d31407b86e9e87e5b0bcd7c25574d7155e149075e7e3ab07c348864c469d6f993b372ff9e8313ccff08d35ec1c2ad4960a76331fda88ad3f3ed4c1f7f55593577725331cecbbec7f74d696ae60104f838fc4a9a81e8347dda8f9d38c7197eefbe1232629014088de794cfc04bd3f848b3f6d044ca1c868e830574f50837074318b597e69b49439c4bc9ea1db5f4dbdc5f5c25a102e7b61ba2092a876bf604a457637a5dbed2404bb0fd5921bf33a7a6950f308206721f1a506fd52cb91ca367fd10897d9c50519326e829217414fb9ac801617e2c69fa8afb02072f34b79ea8871d11bbb864a97454c6eb687f2c3a9a70b4fecf5a9ba9becf49db4b15823a8c2d6e302a3f62172c90a88f8f8a2af271b6b2c4ddad97a3bb55c47e5069b8a2d330797497ed3713298b60a5bde6c7743e971200d79269a4c8b4f35829860e711a5109574dbc073b25af1a85b8bc274bad673c2327040dd4e8dcd6af1eb1bca485d56a074aea29c6f6406c9c7b521b1d875e3810a609a9efbaf185c20f2bd3e06bdcd75289f9db0cf0a6ca8a52e5b9efbfd934dc3690b00115b24738bf5e2d89f5319c6fb69ff37b5fcd63b07521e6f5421ee875b0c69e44b8de28962f6d2ff7591b81cf172f659b67fc4ec02640dd86718882bf5df9b686033c83293b4d3afd8de3dd7211ed4ea34697ad1fd33cdd49bcecc1eec3f17a29b93444bc8e97919a57006efb01f672387e19d10d589424813429c3755c77ece028ccd94b095ba679f53459d6576773bbb2b400211997b4ec7fd7ee11905f2d07e6809d70345ff0a059066d5137c351e9ecd2c10f47a6f5a14342dd40074611a964e96a6907b73937d8deb7a7aa00fc7c3fe4aa52c4660f3e0a772e7155b914da333ac8d150d53904a13ad137bf292d76eeb3c4d483c1c91d41033019403274aef0ede2d9f9b84eef57222c769af24f87f8631ba22ec05315c2e18c36e19ec47155df5aac779e90c6b354515b15c4cf2c3c4d9df8e2036578bb4febc69923a5f42e6d7133c85d58209f3720695aa74d42d1dd16a0ef3029175cea197e74f9935a455fc2348bc94171a120671f9d9631b5eab68d666bc23f482f6640e0f184059c88ddfefdb675479c7e54a33111acd9700700f60abf2e4731420695c802b1620eb6c4cb3f65c1366d738ce999da0508a16cbd6bf5ef509a9b211e052cabc37d10b936ae1c24c9e171ceb173077f795d3e3a0d78e9f332a9baee8ba3855531a4b7d1f462facc8d18d26e73ebb65e9cdc4e55a3e086b8285967abb34ba8ca28cde62bd21bfe5a8242e36e5a5a7dd5576daa4e1b639b862103fc468345438a98d73864df023a63db64e8eb2cf8c7110b65cab1c26bd5fe92ac2824eb74f754bfb47a1db21fad14b5e3c15592a275b06430a69ae8e7c429723d17f9d40366fa1aa853052905c5ff0cba1e48e949c00e6874f317a900375662ce8390899617d63beafa84035cbcd39bb98853b1255800671f6d88d7ae154e93fbb924f113f13ac822dcac8a3a3147fa1bd5151f78a7b54154a89653d49e7c331ae34a356bad8b442ec1d5a169fa8d80eae1ab901907132e0beb3a8a3406a0595b159b9226cf7f5c59860b1348823599bcaeef4861faecd8fd676bd2157c82717988aa4c857c158ba4b2dee31414d6b8d8b27e1904736c2c02bab8ece16395502396264b9a61c3e6f0c293a8847b42cf58dcdafe3aff547705071d0f31c69073096f50099e4e8035e598f58a93ccab27a75d52f61324107226933de286936eedd334d485abf2a8351331848db2e18c6861943a265aae69499290b620db248652227d0fc5203b6ec2d9dad2724587d5f73971e7e1e4bbeca558174811fc3ec0491474d84f77ce8bb65b3ddb0a1b6672a6b49af0456a6ea8781af4a9c32b1961710178bf3e8deda1589ba9f868885067bdb4cc03b1450943ccfa19786317c5bcccc91a57ec710a9b28ba94c92987fa7be7e5c97a4ec3386c48dc6096f11e07a08cdafeb5851074bc5ed7a43c27117b3dc8eeed1593d66f711e2d01704ae903657153f9d07335b036e94cbbe166f9063d86c1f247a94309db11153ad00c9287adfc8a47687e839020f93ed70b7ff9fe53b94567d34bbffceb5c844b4ce6015be5049f53009eaeed4cee68527559d0e115b1d1418f3f03715a15ef514ce81949028064a8278f79d5374071f77fb85b4f0ffb3b0da9f88c3136c48d9b9d3e48441a821f5e6d5ce9496b912f75c957cf10f4b41a6a077ab53822bc5cf616c2de34e8bfbebe7f03ac647940cb101dbf992a262b9f5a6208fe8c56264bb34308afeec326314555a9c92b352eb78e1cc52feb6176552ccb7d348171aa96436c674ed68e67a10aca8e4ffe009f1578fac1226601cc61f00e3e3cd5c600f77df800c58dae58ac3922713151a3afd002b2da3576945062ff99e98a58ee42c47746156da95f88ac6d846e78c25634a7205e288ec8215aab699fda7970691e609ab910ec8c7fcd41ffb468c7c578801f532e50fae804bdc70d6c15120b094f99114f56bd76314948078d1990c7685ae87309d1636c186b5d3fa6627ece5c4c579f06b18efbb2095a9b1748471c672c6d8316310af36bc1df7254807109cb92346d585feb2e0ec7e8eeffb36d5d6d35edd173d9a45aad4a43e8e4c9a205be1bd18140e8d42f7c48a89f1f82346d5f3ff11e25989075e5fca829373a55b5d09d35ffa01903e03475fb2d7c433bb047cce8614d77ddb17d3302914034ece8761b93cf3c25ea93d71345112e9c2bee2e51baffd680612d3b5314bfea777a851eadc95875caaff2436d7abadc0af41581a8d79da0de0fd981455216bc57a6e50b22a53e117c303f54fc5960feb04f25cf30b29cc1ca8c2a455eba57838ac838e395918f9e1764605958b7a770a1d558e4460b8a78486cfafd034b8fa0d0137be88d95b88fac59016892b2b5be29f2afc78b23531ef0afe2b4f7713dd6d7353278fb67aa69278ce0080b14e010f36dcde823e4b9b7393100efd009682df334b7734c973ac99d22b6eb01f26b785eaed946301351499c37d41ab7565297abb36b21ecdb9e5c7ddcab08055b05761073c156f0030f476f39f8944eeff298217b6e7c94b30f341bbcb6612bf17194fc996629412ba17ed54010bf666da71a2d2882047a150df8766f24437ca86a59b3a2bfa3d62bd62d95b60168989a4638108c65b027ec43f4efa49e4122401c950c55b77420ab9fff43e2320bb6fc579f2b860536b6aebaad87583a72f197ecc8c4ec7be8c3a84469d39e08c0cc584180fb0ab39bb8cd519fe5e1bc73a960cffe199279b08fade3d10e647a6c140c5280279a5bce3825dc63fb7d1fb006f725a69e9cadb2984e960b640f91adcf087105330e771d8135340074af724a37e79681beba9d025bcfa11c2d093b22384198cdf72cfb159dcf1a02d897e9ed65426d9adeb82a978f6ff1cf5761487cd777af85f71a3f539b5d5b5f329d48b07d3ddfb6058ee8a46a7626d8d8765a00a514e64b36f247720ac26c9a52f4cc5958057d295e8a87c205884a9698fc4520eb95df94bf79734ce9d5dbff2175ea8763b6068973d0c422a88939bbd2a121d153c3905181f4cbc307efe7c5e9d7c94540c81af3cb09b466e1b6854b0ea4939d97a17254434a0b29a21c2e0f09c5d1664b87245c75008c5c73466e2fafcf6301c5b02d27a50eadac55bdbf60014db976b574fb12df5d598c80c4e7a6f025c27e6a5e7ab06ed780435427ecad6fd468ea55667912da8bf2cd190bbd7c7d6fac7585b78876a53aa31a98044f4d653e61cde4fdffc2b0a6f47648e0de1ab2bb4cd16ea32934d0113115ff29d9195c47694381c79892f3b502534845149490337d28c9e55bd2eaccf2353b953fc3fb9f516bf3109d34fa104877956c1c08c2370f73bfaaad28ecc9bc649d93e4b87343f44a7bf11be00870c0635ff91d3b391a1a3977565e2804d24d68e5a7bd557889024dc2d5588ceaf82e0cfeb96ebd160a873fa2e7e2481c4d0e2e7befbf0baa32f80035f20b3606f2fde1558839b3c51b3e69f091bf44d8dac0a438b74b5dc43e109541e255297d5c72ce57f5bcf352434960631d1416a8e494103b3b726eff3aa8b40657274faceac043fb9881b04b78a52542a6f7741d8e27ab8a6aaba35e39d355e655b5a2091eeb22b88be55db1ef9a85ca378e276d1c652cac1554d987d26b43d88449c7d17dd3c96485254d18edf5384bf2cccb917ad283987c458934028da50050670a8d77df4df4ecb16ccd36b199ad9bee9461e535e646af7ef490ac1474c61d457be107513bd48f634c19cbb0dbc21b87030a47d45bc0bb485fc871da8767470c63b6ed86a7ef1c8095cbc299b762a9109f8f326a28cf6b53b1a1d253ef45201130c2940f03b6b68647f7ff63e3a61586baaf7a4fe7b721876b39bf929220072b3315ad0d793d72731dfef60f6458e233e72e391f8abe3fbba6cb1b888a387e00df205d4b85d6c076711382c8305588bb7a99a814726019a78b861cdef0bc66f36c74a9da9af1f89a5b62c13ba906037d5aa0b6cb40e077fbf69b7b56500ac54a6d84c6a8e5e183cc550f4a40d5a24344b8af51c127e14132952181d85a9ec51597478437fb9f55e8b2f8e078136c88c70c4530827742442a169b2ef49697ad6eaf3b566b7ed724ba21afed8d7317ef52159d122d4065bd98bf93830f32936abe8ac80c9b1c90d54fd883459aa47cb319f720a922b24d2ed08c352d2e8cd80fee1aafd7a9ff94eb6425e8b1561389e258fdfa8f089ca79b6f098bfc49dfd4c2059f3b7fed9fd0d45cb07543e909f88e2f20156315f310fac7eba70143d239a16f2edf4c360e342cfcd1a1525b3b722ab62d2c2e8bc77585cc20b40b930e2250beb27d878969fa99cd6c96c486df826babdc474"}, {0xf0, 0x11, 0x80000001, "b6b3cfaa7238513469d6b4e39d4dbb96d1edbe34228e6d42163e2bb8fa80e573cc992e1a36fa5bcb063018e0dd6b71af1863933156f3fc2663af946eccc365e79123ad02b30634af33791dc0625b4cede25d4cbbb907307842bfe41f41b21560761b7338360db81d59b0ab19d88bb5b3550265ff59a803398e65e83eb10eaaaf4d3cda76f0ff7179efe8b9db2f6b6dc28b6945fffd5bdf0af03d004d20d261c30df6e3a055bbadd2c0ae788c53cc81bfb6bd50fe70fcbae4b292415325fdb405104f1d61d9c0af51fa19093be30b8a68b5a40fe51497505799"}, {0x48, 0x0, 0x8, "b88c12b32328e0bddc42017ff4913b91b6e2cbd7f408b81f5072c3956a6d6adaec18954be9b85c55b455498d7af5fcf425b23c6be335"}, {0xf0, 0x198, 0x43d, "ebd94a7e5064e57d853efe8442c99b7d205d657fe879aecc76381f4f2bdece00a21baf0865c0828754c61f67ceb96f67143b2ff2e2d476c75bf84288359825476648b5080fd9c44f0d3a95c1a56955488ccd318202c4365d34a204ae77dd42d862f8981a9476453245733cbe002d7f177496bc91516ccb79d5e798755cfa66b54851559358fe25f804e0b82e4fb5c22ac208ac4ba7b0bd47f5b76a9e69d0c722c6c739b01b75adcf448036afc128f304e5823f03dd5b0dcbd80a66964f0c5fb4909e0edbdc75ffa18cb72b4716607c9c7e9ddfd0569b079f7d40"}], 0x1238}, 0x4}, {{&(0x7f0000002d40)=@generic={0x1, "5435f3505cdb4249f57df965da0f256986b1140cefe21a759d4f2604fd3e588c4fdd14efd9b1a2acc55244360c89911e1560ab49e9ab1a42311dcaf93c4955c11cc49df3dc14a033af35c6f115f1fcf5ea600b7aee1240f1c09c7e12e4d58022315e2ce601bc572793897c87e0c00a59aac2dad3c3dcdc63b01393fd4963"}, 0x80, &(0x7f00000043c0)=[{&(0x7f0000002dc0)="0697dfced03ffec5a72c89613aab19d696eac0b333b3c7a70fda52b4c71866b745e4311502962e8b113ab39ab13b587afb2b6785c37b481bb858657f3b72fa4bbacf9ec379cb5c542d21eecc84", 0x4d}, {&(0x7f0000002e40)="bc1126b227657ed56af8df0cc77b8e6473ac964d673ebe81db0e28fd47616499ad0ee76b1c296f3e4b575caa67885e33fd0293f56a9b8a879390d74da2655946426ebeb403f94678136e15f330f3ee66b91bd4f6b1c5f4e8a4eee77eaca556954aa865c456d0ed3202124f8b1012a79c3c00cc76f1363ad5ea4aae0cea2c8a2f77dff4aaec1d67911ba66a3a8a6fe05dffa0", 0x92}, {&(0x7f0000002f00)="d5f5cca2564b72a71475d50cc6c5c532126dd3fad745a588dee8c15e158d775a830d7912e6c312aca5e02b9c3175aece735badce0cec0be98e72383e64a32f1b48eff699f2afc87c2310a93f7a7d575d69dfe393211377eabf76ed3ca195bcce4f48799ebb1c9bdc7015fef931ade19cdbc3f46fc19834ffc9cabc50bc3fa5c99bfb3b67bc65ab859c6326dad0a7fc02b0901414340d4ef54c411dc7fcc3aa95df321b89f20819f15d40c9", 0xab}, {&(0x7f0000002fc0)="5b173062c337ae05851de7e590f50497b1b9e87b857bf0c923bf09fe55fd082834aa416402c38063e720385d81dd6109e160d46dcc0258ad562a8e535932c16dad1bc637885911ef5f60201fdb8c52213e9f6916cc6b2bcbd3c13b84ec4ce2ba16ebfafbfac9e0aed7c2842865aebd69728a8457a3e0846963bae88a32aa0930cfa9774e07b55c3b852e7142d308b1d2a95d03394cc3bf09e2f54a9aec2750a595f0b7c601da6f73d2fadb4ff6aafcd2a4eae6e667c4532b6c21ac994ab1187ef86de1e246c3029b4b44e9bd1b96d9ff7e209a", 0xd3}, {&(0x7f00000030c0)="f823d2df18a061a6116f735990430b16b9712dc3ec53a80b0be5a993303ba14ec7", 0x21}, {&(0x7f0000003100)="4ec73d482f828626defbea73ef71438ceba8fa99702a4c2673858fe4267b8add9c79a1a11cb6be1738bee67e5bfc919f4d6d720293558f7368c33f11ec7eab4884d20b90c4cc260bcf13b8245e0215df89c1515cc5b6d748a64dcb18315f91c4ba6662494a062437e5e2293b811efcc7b0a23d0821d86bdce0e39fe8b15f5b7d181a730d1481bf4278b6", 0x8a}, {&(0x7f00000031c0)="1079766285c732777f2205e44d3852646826b1b9a0bab2fd5bbec6c59555f22dfa9351d5a7998dc89e516ae683695726e11ae66fb05cbd70c205b758bae13f09f9b34b0a6ef75f3e90d87c7b5bf52d871447f124155a4d0c88cef27b486f770e040c615251dfc54a418abb4887dcfec581ee50d3959323886342137313cfc2613fb87e003c03dfdeec50d66f589aa68f8a4eb3a1e9a22c4651c628e968f4517d5a7a54a759ca5ee0c1805a127325a2e306822d02734742a9905740037dd8731e3a73f78aa19a08536f62053deb9daa2c78f372205294b92f21ce08aa69857a1eb67c79aa4a5c66e0fbc00db36b5e1a05a5dd05c6069f45305582ad40e2a6204b997f93da99f7d416f5e294af45b9b263863a07cabcb789a0249be93d6ca74a41c3c946d1942c0cd33bfa28dd920081bd01bbcfd6c2f47b47de8a4c65e04d4a06fda39f0fd45f1926e24d8a0efb9b66a86db49cd53c1800900e3a50ca831152680c43b933f81e0b1fb5e6d22cc70c2f81f0f957fb3f792f6bdf3241824a624c71987bc9a0ca3f90f62d4e29fadad722edce6165174aee1c5dd65932b9b51b9c41dbcf3871bc807c2bc57161ca5489ec754f3a93f50900dccd531b109d1e89df1411c96e81ab7e53285323887ba4cb9f42dec4c2bec8eac98ada954001285e8c1c7004de1a1aeb04e37c47428d3a4eabf5a99319f24beb781d9f12f8cb99e9b91696442a723908339bc0c8eb7080f4929ef7e20465e529bca03d01b2a7676a18b47866c4c91c187d3f786c41370885d8a9d38883ad33de7613f873e00a07cd829fbac86c7113ca1654b3ba6a2f05c8ffa9617abbb982e2739be525c54168b1cb7622e316229d6e9080b2131e9e02d575ba8ebdfd59eeaa1b67dd7cab6781ba39291442cfff95cc41cebc4918c5eba2882d8c7feb79fc88b052fbe4a6e4db1ae11ba1196bd30faa2cad3653d48eafe2a2b189ccf34ecb0a8c04fab7ecaa39cc98f082b18ce5d4cf4a1e580f63977a1c4f6102629d0414ce07b66b66969b4a662ddffa5cc4ffc2a7c8b5dbb104989bceee176b24a5c8bd463256aaa531ab828ccb0670fd3b73bda9cc399df9256bf13ccdbf98c3469eba7cb1c3f201cb6848f312cd12ee6ca5ffed7d2c03423e9d45129690a8eb86165ed5489e0e8017abbc82a48f264c32cd099abe72d405264c6921d2277dbf8f721159fb6bd761fa4dd625149829f55555b156f9697e7ad50bfa1a1551b12aaed2d9260fb41c9b518b454c163984d58f9186fb7e5662065a3e6802783ae5e41891f311141f5808aff81335a985d12c8ebfd916ae93a085f3a27f41c24ecf3eefa7ec0f3a3ae7861d589f014baff54300eb6cd72941eacde3b4b6684d88ead9adcc5e033a2a509a91aefac68de8ddcb026844a5c43404946071736d54fc405f740feddf049f0e0d6abab43810cae6a39562483972f8c70c6f86356f011b4003f3447399772055ad9743f5d150df890744f11c0da404e77a7c7034e836f091d4ac3490c97858c1444366fcd12e07948706a10262b9c4e6510e52f968784e23403e7eb981b75e85ccd1c0352238686ba832c87a45f4bc33c2d17a4269c40b7b2d5b3a7e6ef7366a31223d7512cf8eb875f4caeb576687215ed359101df6eac10883c36ffd0f76c94211620ceaa2320351562b5c0965c8dac337b5c112de0b008de511a24cb294b866c65c544ab8e531e6608c167c90ed4e0524202d15bbda6df29cee96873e07be9634656ef09262cbb9d843999fd1f67468607c5082f41a67c845fff0f4f7bf19aa783c8b5489f616ac3383b9198c3af2e39b199d57ea9a96daf2616cd43d6dafb4b6a852cd6083cdcde9c714bdb7d030b845115f45325241270b59c024c3106b7e16c7d762c7304d56d36fdc597e5309c6dddf35ebe8992b3a4fc3e735b8636918fc90dec56ee84c5eb3fc2886bb5458ab38c3fc03e2d12cb246ed442c09e7bdff2b1a6e5436d6fae8d35b28fc9afb79a8cf674f0ca277793f8c529f33f6740839098fdcb5ad1d36f4d58c5d2e6fe37cf08e7a83df1220f192c4678558753d29d4110edbd6ab080055e297689bb6310e8e71c176699c690fdfb93ab32531ac899f906a6d444e40b0fc8423e914dda10d18d49d68e62b7746e34bcb54adbf2aff246173b1fa07c646f6881e159e8798450c4cf87e4da2593405541f93f45474c1103c3b1ae806dfdd96c55e389616283a93696d119f564a5c7a9a47ca4ee8086ac16740d8ed2d0f1e438f4ffe8458c8a5cbef8a352b5e0890c165c04ee1f88d617481911745b5cf3dc09c98fc5a2e8070d89e32ffe0e1afeb3fa326959fa61002efee2d944ce26cd871a463fae831f0623a6f6003a445c7aba61c6424a0545c3fbd0fcb387e1336fe7fe08fb558f7dcc6168c03f85404d05d75728f0e158cf5af4db0c49cbc487ec8245a3fac7915a8fffb4f53779fe126365b8f610560d1206231cbe6d346f754de03aaa49119ad520b5cf9a187632e104833bff320f98ba7e31f7be1870b182ec99c0fa7d5ba7699ee37d92385900507532c082a6bc83340fe0c69a1423633d43f95926a9b23e2a379e6316a50d6c273d27a855ce5779dd5be6ef8d85da402210434be33e79c455c70ca3db8c2cc0795d764438044f64471721d087adebe2274b4c3441fdada1bea71fd8d1ee901e04ca92f21096d3ac7dd352681f1ff5f63af7dd406b8e44d70d6c948014e73c79e2393e4ca6587bef99c6e780246c2cad5921e7f16f9bda2f45e221c9c45b721173e704e42c8c46ebc61f4c3a66ac9673c502f10719a15c96ae4a0e710acc87f8d74310f119f6bb661d3a72b15bda8ad76db0e09b6b85e9f5b4bc931981af276bd71936b5649d7888eb58c14ecd657358165051ebf1d2190dc07977299ffc09a2b0ac18d0494ff4af79f6eff45b4f93098055d36c370c621f942ce6fcde00bdea042b4f9d04590cdd06c430a509eae9f177270579d6f71c318abee930b60bf881c48044f0012e1a7c64480d23defb2ca924e8c6082591fcb8e8a7ebf1686c88118567a09e2d7142f4eddfbad38a807efe1bde36f8d5a9f836202719e94939155a9c02a171cd106cc55da983088d93ca0d6bd672333c9e9e0879e685d02377121d36554834064dab53055d2a4aeb48a6cf055ff0de63f22f2ee2c3a93f5a64bab17288fd337073abcda6dd48f15a5f8aaeb66e5d6730c889ca6c30e168c1862ee7521822b6ddb58b2fb9b08d9fdd19906adbcf074fa0ba1cf6454cc1818e42a5b05deda77adcd33ae868c55483736bb0818f42e1cccb10e15f3f79abd53bc53db57ce61ed98c9d197425b739956a12602337e465e9d625f3e1fdbc83cacd802ddaf5fa5304abe68fd6bfccb6974936cd7b7e5e514f6d6cd5741b47b59f6c37fb7d2e67a948aee21520c8c96e86158bdfb5658ec0d747efbf6d3c8c42c17897fca63b43768cb73d13d5821716a77f2379377aef5e84b046d4b29c6a5d6e94ba54336ae21aaa378c02e52f9bc70d8e1f69495882999a31b3ef6a0a15360c297b66bb999842016537aead02453bb84f505af5a94fd968b1c55aa93a3b6d6dd886c97cd7f4ab03bfbca8138153c105d4fe3378093a098242b7d4d111eb8a41eb4f2b1441e0a333cbf795e3059177383e24c67ac35ef4c12c3979e93267365f4ffb6487d49043fbb386770e89b23b07bfb6ac9b666d818a5f6682ce30c8c0bb44917e474c7ea9ca775eaedf4acf0b512030d8343b57e654e6c4e4504036f6468352e97e27973eaa9f621c5f7afb4c10eeff418bd2f1c3e0550101a94dafc63c86c375d3d0b51bc53054bcc6216d214cac628963cd40bd5d83d37e9e946b47ccb367b53dc7cfdf6fb2cab3490a999e3c59b153891c20ea403c3434fb8d1b9d2f7a0630fea10910b71b74a8dd39b4f8c09ca8797289c08127bb6d7dcec42c3e74f154aaf6f84ac196791e9aa852bd43faf1929425535a27e7a25db511fa1723f48cf70b79dd517e1fcfee0aea3e4c26658a921e306442bf1725eb2688a6aed0d19cf8d638f3b0826544d80710b68b5880aedaaa1af6320774b43d50e33f6b2afc9dee9dfeb399146f3fea964c8ebe589dd4d4fc4a0643be4a749444e41c0c5099a3d5f13611e2c2c33811bd5d15a4ba69b233e468b1195409bb70b15bc926d077d61ca4be61f1cb407d6e8537607745205ee6f6bdc8469ef1eb2436ba72b537fedcda4d8f5e2045693403aa2e6b4af2910370e3239c290f4ccc883ece90c038fa64552e71e0c56999225164fdc4eb91b2ab49cba67d71d058a6cae1d5697c867158894eb4c6004d4864cf32ffe5dac3ad986a9c25d656cf71ed5dd12712b01bd8a555d5ff176df46f63a532d4bdb114b213f63063fc66ebafc3bf4804ff64585fd0e14da7c8b654244ec48838cde2671021f7ee7f78dd29342a9f81315c13e931176857821f9145b7216c40e236f060ffead156a738cd1b671714bba82808f043ecfff94e2ab9777a421a875a8593348ebe6a40b48516a3fefcb1faefb44bf40a6516cbc90905051780327f3b0e042e903e82b81b2bf37c1aa7003cb5f0313299c1cd3e332c6201164089f371898e06682fa50e78d734852c3e2863ea65518175f3ecef0acacac39eaee8d7a9c9ecd117f9b5d0f163b4a5ceaa33faa2ad8b281876211dac5b993700ad638103428ac922d3e1ed0bf5835dc11be36dc76b3da777055da853e5b5b6724c90a6ebc0a0ec7589f8def21001ae30a39890cff05ad08ec844e4e16d0d2df7147c9c81c9f824e4f85a63d76859ee0f81bc935c550c675874dceee6ba4a63a252b547d3fea01edad3ab9dbadc3778e804e68e3af95ae4fde6f64b2408a6dceb5511fee9e45e6e8ad5fb305d80e9c0ad6568932e095674c18794934475077bf8d6f3d2b17b1cdca2e50f31b1fb0079c944e115bea62900cc7edc816ba43052bbf53d4cbb6458df077ebe173476eabc75ba957e1f7dda27aa3e20db205ba9f7bd4deb75798f1fcb33b9d855a0142ec48f1f6034a0c0aa54b734ae6442e33ef5132d2f7b6b29e2bb770f6cdee5e2ea8b2234d42e03c87a89960d21614b3c4aec91d4b601d9026ddebae7e871347cf4f282fa7b6f47ac09ab50cab87acfb789aad082089655bb820d8bd883fb62533d55c4c1f651f60e40697d6e370f39d7b59252cec4bc792718aa0fc300f2c53d89cc510033ec5a940a78b430a9aab518c0a6ec8d47cb4bfc1e1d08e4175a379ae45690aaad26fe4e4cae4f6c23a2f913d50e1f71fd916110607696b966041c119e4ba68858352ec5544de41b4c81415330c7ab3595c34caf0728eb9dd573ba38cfa769d0b0e574b4649cbc07680c41fdfe54fe8031eff3b2a268e6148ed560470fa8f46f38db39b5832a205a85916ea5293654b19eab42b4ff3a9339ecb990466f49ac1359e56b9c6c7c7d443d9ffb47f400dbac3855a791ded2a94b1b9a488fb1672aca38a0672a93e3c2a7c6f34c0f3083a16bd22529248d119506abb9ee746d4845148cbb33e0d3aa73acf630470b9a4e033843099480d7734d5f5b42f4bd3586ae363c8c27b6de8fbf5d7b54e88ae3fc08e1b71facfb708002bd0fabcab6c7014a852e07bb96ccacd54dd908b734b8eb6b0d373ef0e66321a699dffb0b42f1e48fdc1549f66d77c8eb63a84cce568540ae6bc03c23dee43f119fb8f75d78dc28cc91b3d0bca794051fd1d9097c6105bafc8bcf9ad9d322ef72b737b59d2bceabba67236fe94a2773e07aa7c35a67c2f87ff841ea464692360f3f8c379c6f2", 0x1000}, {&(0x7f00000041c0)="5d74d417bb5bbb96fbb585dc0992b4ee9601559c47b73eb3b5b7216d5f469cb612a57c381b98910ca263bf5e2877eb5063fa23f86f5d79daafd77076ac3cfa311a082f5c3893456337afead1d797075748fe7e526ac5aa9e07bdc133196bc72d75656c20f0a6d706ec0a67f3fa9c75b6448059e85858977a7debfd1dd8d76f68450fecba6a6c15acb37df634451a783531b83b33da4587569394b5bf49a8dad615f3d3d315fe09fdda909c2c0e544b344889e7", 0xb3}, {&(0x7f0000004280)="79bfc667d8a4822d640d2481ac03e47986fcb3a6e102e2fb8a6145d0fccdab49cf9373c009460b79655a9b2cdd91671625ba65a30c96229de2da7f8847059c0ce3d567eb3e4f8b36980c82d60bfaa9486414bb0cd9add36ca2810f913fc5894a1598ee375812d7802fbffced4c9be61278b43379d60153", 0x77}, {&(0x7f0000004300)="d511e0a75ea9f9d9faf8682f58b7bededd17967c2a12622134c5c1c2091287131bce347e50e1c7e42fd0b350c671593cf59fb844193199ee770771407426268ab3d0de8a0e1b3b88c09092630a6c4819404bf30326948213e9b1abf12612ed2d8a97a1348c83bd7f6751643c09ca6bc000e5f6496d817f56b998046e632adb5f07af3ce14b49d4feb20adb70847938aefd0a0454f9ed6c517514ef86e342bc7f", 0xa0}], 0xa, &(0x7f0000004480)=[{0x1010, 0x11f, 0x1f, "54d4c22a39cd8b3b44c38280c2b916583cb56b9aa32f1fef1e822ac31d5934d1a7a3951d540f4413fa3d9b615fa331e4666f5f35bebe1b5cb905da48322985fd696d8649ecb8aa8b7ecade3eec308c4b93ec0f55a2d6d4a6831f9db0a3562f9fe45fdfb742fd827b009f8b055ae5ad8cb4b231c5e588efe5efda0b77c399b5adbce37a5fef3d4b3bfffc58e44fa59975d18710dd382f2f08fa229f28ddec7fefbadbf5bdac1464436260a06f32eb5927582d20430836baf4d9c7d1e7f42f51233bd31021b4be7e38600e181f87137bcb1eda2b5751c574d02c872350c0081afed60cfa2f7c2f57f35cad9167e93c7231c85e53ab018e6bdabcd0209258d4eca49867ea2cd4957df463ae1ecf3241d8bd7efcaf98402ca05f5043cd805a525642679100a0e32c1630e196fcea898531d853d407a342d6bc47f873c49814058534c661fac07b8ebae80803d46dbbf332cc08e2d2e1e519963bf395ef98a3903d236e30ceead52b1ed942900272188e957e2a1bf7ec3919097d2548039fc166be5b5f2155b2d577c7b56f39efa465faf2c7843d123a5cdd8ae72212740d18c87c9bc880b7b0b24a10d767a31b7923d554af487299d49bc3abe06e74c3c2a3f8ac1c306bb5345fd66a3945ba8fb516c4e2a2e9ad2d4d175377c35192a806978e85bb3f4401b50b21a3fede48c3ab10519b7d0843551470c7225a19f12fa4509ae86358da4b803699309f66408ea0f9aa3828ad62d3ab2cba8cc662e52e7589cb464721a8d80fa0ef6981aa9a17cb32642ec6c7e0c9ae9eed316b2ace024d5f9d75b8bc9691872262282053de191b8e8358d2a6be04d7023c18237f81a28191ba2887a1ca0d0cae7054dbff7515b252bae87ad8daca7219f41a3d5c6d531fcc4c603c22c0384cfc7e2d03bbc0aa6343f34b24cabf571370f0d381bb4a8122cdebf75b340b87fff2066809b10050613da5140f87d8d5598686f194f60554bfcf5274380e2729dcd21d3fac7ff97a1ea8518560ce62309abc4fbc59135032524fcb729f85630c1c8b628f76bfaa77f7ab310457434f213ae53a299e207e70a0988f415659fe000228d40b84bbb960618faac24191791e53b6f08e0a67382782d04bcd74fcbe838869abf2edd57a05b589049664224c0029d414c09509cdead8d44c6205d3c21045ddf5e08d18bb36ec89d2cf3d160f4192168d3ce4f0747072f07b28f03a91ead96d7f307cd29e51d5c36978a68450634e394ecfa51fccf57004a8fc4f0bd87aae9f2f25fcd35858dca5fd25b31129647b22b8c626777f58be69c8271186c480d2a22bd9db8490b83c1500b7003e07ec6c1889415b9ea198f4f17bc8833f55c2aa84a5603424f8776c4e64d19f53061463f5dc9b65f483983b8566ade5822314051184042c9303f5974c4193f6dd989e69fa164ab18934b790bf28cccdd7fb00d484f61291413cf79375ed3e89c8f2d39bc6d4b579f97f7c045a3cc7f2ac46ad7e2a2029d3c5f6ed3e47b2eeb621290c9bdbe16f44807d809d440ec0d6a923020b4a77139eddcc79fb2a6fca6b4828d6800d0050fa7f4760878672352817628f772c462da2247f156a1c28a4d5520e3c1793fa4693610013daa009b1994f5c5f033ea2d0793f379827d5336fc430d587189cd09a4fcad6a5b77a1ab6e14aa2b187dd4bd81904919be742c19bcecf8a9c820ebb4e595d271249f73d8759cb4b139adc6c6541d0b453eaaedaf5a15d0ac8db9f9fe2bca1781843b9aea0f3608c5210e222df56269ee6dc2ed08b77a4d93784f6e406c0771425c283449dc7026497906f621ffcb1da96f535d43753a5ad54875a758b089696fbc7e6ea264db1f2cfa5b906803472739d2456df9d9655dce06acde77a3c24f7493d09ba52741a2e4698fe6a582eeef8742cce48650326ca5de7467415341d4e6d128a6bc5236a482bff5518840cb4e0a9f03149b3c6a136b64568ba5094db4c01e5b6e99da194d696a6c286e81b0d66b69cdf366dd4e550853418fe38da472a106d7337384286401a650e7d5eb30b00c22e894a57ccf08c35c7141930c98e75038b636ab1d560ba630a023f3721f7affcd5b36fe40baa2f9a4de9ab11840dc6245893ab2a007ad7b9670bc49bb514fa55bd41de61b21dc40775c8a84857d57e5d4fa556e2123c25abdaafcfc08b502f513bc33a45dbcfeed0af1ab1bebe9e49ce8870fd5777a96757d92cbaa9af010e02492bb88a7a53c556c481546b75b70baf228b03c41fb969e2f2efd2140d401a8e957f9cb02f0cb89740af481ce163a68833559b163dfe269fe2de5905577014e1e2ffc9f48e153de4f1d30a917e8b30e4032df83c5f0d4eb4e166918e168ac88a4997a4a0bfcba171718831ca68988e03fbab9f0d17f7e85bcfac2b9c15a7c0263add3da3806b5cc128655f77ddfa6b8749a1bf726f2e8004610e41bc5448a3df1fb4084003e49dd1f70548d298220b8a9cde650833670a32d8efba2551bca6edfa8b026f5ad601f05537a613668bbab1cfd8f7bfac54cf4be4c0a0c24de870669f104024b29cd9a8b995fe281eb2627948794a941027e389ad1c80f28f73f2347d62659fb4827143f7780e774b281a51bbf8ccabea06a5d538e761aa91149ee8def2177b68f9f1eed8d7f5928b2266dc12da1c64b393a44906a3cf45cdbbfa9bbd078ceebbea53adf95869629ced6cdbc8cd2517a581e4e29df7543f04f128543ae2cb8e913ceeb982c8e0ceb30dd3069403ea19baed113a70dce060b9600cbbd24411a333e255cfa243c15fb96414d2b1a5a3600dc8975c1640ea6c2cbda45cb992548613a5e5c66c1c5fd697a04a88960851a9d5da7a43947eed64dfffd8a869d34c39ee83ec3e4bd627956c7ccc136131c445f69af066ffd296591f674ee93b1a2fc4b0388a9660fef06950c2ebfcca0ac116846c00e3aaf8cd201fcdae372db85d563e3fc13073582d040055984ac7288c66198c3bd94ebb14c48c457dd8939a5a7ec9af0e1b9ee02fb8801071ed8d34d429b78ea4cc9ea79881e2bb74a1a04c1ff833a2645464b7618de3178a820cbb5f049822422ddab4011963aaf0b6078057a06a6bd7a964f263caf710a04ae03ea7ea48fa1fe0a954ddee0ecd9c698530b41925738551e9b8f8c2c460e840106d5a4ea2598138aefb4919d0ce46f7d27a9a31764aad883021d268f75ca2a889b2ceb493625ac62cfdab7561602b93203aa91075764beccbc64856fc6e03d35308e06331d6dfbcea77733d3c2da206f19fd444b1535c19cc5f4a73548aef978afa8c9ef3303ceca5a2ba45b1f3a20ab0d24bc5fa213ef8e9f3cb66422a584a1692c091be4872991f2d7e7fc1a64392d6ca98e63c1a7c9110f5cf7a5046f74db08a5906d398fbf3dc3ea37da1f17611fecd5986c591365e629cd0b6334435bd1aeae12f20172b1170e4aaf001d54c07e4725a13870a6539a5e82b4d417efcacaed32c41a610401090c59cf4de95f87f3df7b910e43ae8f8b79ee6681074aaae44a29567adcabd8cf4b8fec67ebffba6489d5c1539f5077a90175de6073ca90ec4f7913fb35b2d4a808460d75920b1dd8b54415ff1811cdc8f0dcb5e823566bf970a5363fe86b0bbc9ac2702b7092ad61765ac134586a68100acd62ca151ff54ac9400e20d48af7259b6cb7631f9e6a829de80a044d8f6a808047851e6fb7c3813027c209f7465d376d657aa661ad3c11e62ccaf14ab86bd7047c2eafc8dbaa5c49a0f8e812d817c63a64eeee19e2f3267df4f0a3e5d2f5bf1cca8f3408ced411cc0e4ddf3c675e1572fbcef84e17c627577411f6fe1479e6a9ee9aa459920133071d9739fc3e3b4f5baadb893be568f460852f5f1b52bdef1c07e1c044f8385b31220719e8807869f4f20c82484164afb639ac909111e21445646e1dd08410861a7a2f4387b22e12f9230c190f7f3b08e1b97fcab8b05913ce34e57e7fa6b911b323f8a591062c5306cfbda2b1e9eecf04b2379d783d89974c16eec63a0493a4371b44e6dc6be547d4ac5a6fbe848d1ce46c6772cbad1df942c1ec2d2d4a1705bf79314039f9e23a6b47adab1118f9c73bc13f196eb613199bf2c541969ee26cafec6fd85f4677034e385ff189f93ac4499dfc1e1dd474ddbad1aa379d035b92df47e423a7b49d4feac125ae7e3979d136786deff31be5ed42296fe1adc2c92f53509ff67e17b67cce81daa51892cf6dec857168d1c54f3aac434fdfe8a0b061aa00e258eeca8071d943e1f0d7b6181530c98e602d4e769237006530d59413035dc93bae035228e06ee4647b72910267abbba29ff9eb5c8ca5bdf723f8da3a184ba5d3e0ceb9b9556d9d82decdf79a889d54223c542081a6417d50c4fd6cde38e85b3d144940fcd527388ecab5f4692d8a086ed4474414f6bdb30cce3a5f60cc9608679d259055164f40378e384b12cc49c5784961f7c2d317112fd0f18d026a7c720117847a72addc1c1e35d433f058c76110c842c76681c0b10275017f33f40457bec099050a103a6234c9c60795f98ae95c31a312352d977fdf855631cab9f8f872653650434342ccdfc19ed9e4bf5c1e51eaaed9febaf8ed31a370c2ef091ee56d9440f98b79af8b2169c2ebd73e66aaa4d82bd489ad4c5887eacfbbd7d4237ea8cac77b53e99e0608a3589bbb7a876fb029c28d48c2def998ce1d73d4097532e5aece252aa8377137330961deaaad6b04ef438ca8c56d5f6dd7c70652dbaa946e0acccc9a86984e0f9916520c847294fbde262b65423985466f5ed67a7397a95bf69665571e19c9cc1c4d7568528615d3104d7ea4135b24ceb734e16cd5e0427b195f8e5ad9a2d4c3e1cae04c072cb41f89550e11cec4cad2583a77e837740c47ed34380f3b2e2b20b0f98e9c28606bca8a7da70e4cd2169f6203dd0d4562bc29862b954ca065351af0ae5008f68b2811e11b4969ef36180e66607146949bbbe6a12115ed4ce348eebb9cbb8738970af38b68b5c7465b59c2ce6d1e8eb6764ace4c8cb924646e61f6f614498d0e4c816eabe6bd58a602fdf7b67621cb0edb27563e4178fa0744b9aea160dce1c08ee69bc7640d6fc6eb77512fe3c9c388ab9fb3e3a9c40e82194f40459def2b939539048b59335ec1870d7ed53d39655a4dae32ff204f1bc426adf0c900513e163f4a3945d1e2f20cdc10edc4e6878da4086a06a1da06d411b0edf39cbedf69fa2a028ecf39e1249c46f399b15e9919246269c858ca51e338f74385984ca395623fe2d09f31592eccfe2af96b005a5b3220c808f01ac2cd4d9d19a4c7bd26a9571adaf59b8dfe6853b195160c7da0ca85788c4f965b9de7460b545dd2aa50da0df5bc7429688797bdfde5bde03ac0bf9b8045cb8c9072c5f1a8802388c60308099fd28c716ec1e6bbd44df75d37def38606cef694fc39f0ab62e2bf86906ad1172d2d01f5183033e2f4865d2f744fd5f0a5fc8aecb0ef871f521ce1140bbb082a235067efc823714ada912a1ff165b34f024e03cbf6bd1cfcc78fb0d770e8a3fcba0dd8057c6911eacdbf7c0e3cd45aa35914f9076b0c8b297e0343f726c5323b1f0d494a2e72cc31611eb5ca9311ab149e881d4b8bc467ccda469cb0035b1d8bc95e37ee743f942cbe4da2e46eb7173d0b8bd9670498673896ca4736d068bce15803e8567ecee628725bd0d9a92a0c899985f45519d8c80b288586d0ecc9b7e739881594a47d5cbc10edac985a82984e1a4d99b86177c2c5d91ea6a77ec6e910074ad039339ebfa81847f23765c3487ab5c958b80"}, {0xe8, 0x119, 0x2, "0d57ebe18a001ee661936b371591007d6ff6cd303ce231af58d272bd331e9db0b787cfb9987e3928825e26924db4e328a718e74f1acf4a8ec97dfbcd1974e597e740fd070e9ea795f532ffabf3626f94bf77f14103c298e767066946c60dceb1e94e999f4ec5d14dac376a0df3327c0fa4dedcad2f0f31e2d04e580b15453b9bea5405d9313667eea95feca592bc9e968b56b39fc5d583d8ff3bacabf06b3359cdd468734d1ab59f6953349848f3dce5e1cb54b5ea5b25d42e0970675f88fa91324369c18452e364e750f0ec236d56a05fe2a40f"}, {0xa8, 0x11f, 0x5, "befe4d820fadcdb018034b0f0c279b701da0919e8103afb0c00dc5cb1cd0faf5e0f2a5355bb54e6a66f0f23e116fbbc4677c64e0afdbf0bafd5bc149b0153f370d1e4e519573d36bab2a37b1ce9c36cba8a96f8b2c72618665889de728cad91414a940150f1630bc68fa86c2da42edf1d5d047aded715d61479fac602ba45c681ca53249c16054469b25964ece18bd51cb10f4"}, {0x30, 0x11a, 0x8, "34ee2c914713e22b2b9268f77df76aad145b97d0db78e516f0a138bd76d8e7"}], 0x11d0}, 0x3f}], 0x3, 0x40004) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0x203) r2 = openat$cgroup_int(r0, &(0x7f0000000040)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_subtree(r2, 0x0, 0x0) [ 293.918197] binder: 10594:10595 ERROR: BC_REGISTER_LOOPER called without request [ 293.973573] binder: 10594:10595 BC_FREE_BUFFER u0000000000000000 no match [ 293.993082] binder: release 10594:10595 transaction 6 out, still active [ 293.999890] binder: undelivered TRANSACTION_COMPLETE 01:34:34 executing program 0: r0 = epoll_create1(0x0) r1 = dup2(r0, r0) ppoll(&(0x7f0000000000)=[{r1, 0x480}, {r0, 0x3644c7f526a32856}, {r0, 0x20}], 0x3, &(0x7f0000000040), &(0x7f0000000100)={0x5}, 0x8) r2 = epoll_create1(0x0) close(r0) socket$rxrpc(0x21, 0x2, 0x2) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000080)={0x14}) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f0000000140)) poll(&(0x7f00000000c0)=[{r2}], 0x1, 0x0) 01:34:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r3, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000700)=[@free_buffer], 0x0, 0x0, 0x0}) [ 294.103627] binder: send failed reply for transaction 6, target dead [ 294.147569] binder: 10605:10606 ERROR: BC_REGISTER_LOOPER called without request [ 294.158938] binder: 10605:10606 BC_FREE_BUFFER u0000000000000000 no match [ 294.167160] binder: release 10605:10606 transaction 8 out, still active [ 294.174981] binder: undelivered TRANSACTION_COMPLETE 01:34:34 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x3, 0x400) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x2000000000003) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snapshot\x00', 0x10000, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200aa0802000000000000000000000105000600200000000a00000000000000000500e50000070000001f000000000000250000000000000200010000000000000008020000627c05000500000000000a00000000000000ff1700000000000000000000000001170000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x400000000000003, 0x0) getpeername$inet6(r1, &(0x7f0000000340)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000380)=0x1c) write$capi20_data(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="1000fb00008304000800000000000000c100fe2dbb2937ed8f43c2da0ae476bda4dad713736286a392039e6d985482edb66d0952e0ae45e087415727e535a6ed025c954579962eb275ba5be6f24a11df92ac42d7cee28683be852ed51f67f0b8b85e1779de0c20a766ed976bbc22cc4a229e8aa0c698f953b703041b60f3ddb13a8522c79da2b47dd41077b5bd0e279b54ca040de540eb387a6f13a0f0512fa1ffa4a36948555c21fd2bb989ce5a871555ba2e5e2cbb3d5e12df513457f13a855b0817d99a42535a5bbd7f8ac02500a65d7b83c6406afc372b3fcaa792fb491124fdbe"], 0xd3) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r1, 0xc034564b, &(0x7f0000000140)={0x9, 0x3247504d, 0xfffffffffffffffd, 0x6, 0x1, @stepwise={{0x7, 0x61ee}, {0x1, 0xffffffffffffed95}, {0x6, 0x100000000}}}) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000300)=0x1e46, 0x4) 01:34:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r3, 0x0, 0x0) [ 294.253690] binder: send failed reply for transaction 8, target dead [ 294.370969] binder: 10614:10615 ERROR: BC_REGISTER_LOOPER called without request [ 294.393440] binder: release 10614:10615 transaction 10 out, still active [ 294.400425] binder: undelivered TRANSACTION_COMPLETE 01:34:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') read$FUSE(r3, 0x0, 0x0) [ 294.465415] binder: send failed reply for transaction 10, target dead 01:34:34 executing program 0: r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x1ff, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(r0) [ 294.575376] binder: 10623:10624 ERROR: BC_REGISTER_LOOPER called without request 01:34:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') read$FUSE(r3, 0x0, 0x0) [ 294.623709] binder: release 10623:10624 transaction 12 out, still active [ 294.630617] binder: undelivered TRANSACTION_COMPLETE 01:34:34 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000080)={@multicast1, @local}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000000)={@multicast1, @local, 0x0, 0x2, [@initdev={0xac, 0x1e, 0x1, 0x0}, @empty]}, 0x18) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21}, 0x10) openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x80, 0x0) syz_emit_ethernet(0x2a, &(0x7f00003f3fd5)={@broadcast, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) [ 294.741564] binder: BINDER_SET_CONTEXT_MGR already set [ 294.747119] binder: 10631:10632 ioctl 40046207 0 returned -16 01:34:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') read$FUSE(r3, 0x0, 0x0) [ 294.794820] binder: 10631:10632 ERROR: BC_REGISTER_LOOPER called without request [ 294.822392] binder: release 10631:10632 transaction 13 out, still active [ 294.829347] binder: undelivered TRANSACTION_COMPLETE 01:34:35 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000080)={@multicast1, @local}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000000)={@multicast1, @local, 0x0, 0x2, [@initdev={0xac, 0x1e, 0x1, 0x0}, @empty]}, 0x18) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21}, 0x10) openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x80, 0x0) syz_emit_ethernet(0x2a, &(0x7f00003f3fd5)={@broadcast, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) [ 294.943479] binder: BINDER_SET_CONTEXT_MGR already set [ 294.948917] binder: 10638:10639 ioctl 40046207 0 returned -16 [ 294.970683] binder: 10638:10639 ERROR: BC_REGISTER_LOOPER called without request 01:34:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) [ 294.995527] binder: release 10638:10639 transaction 14 out, still active [ 295.002668] binder: undelivered TRANSACTION_COMPLETE 01:34:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') read$FUSE(r3, 0x0, 0x0) [ 295.112547] binder: BINDER_SET_CONTEXT_MGR already set [ 295.117983] binder: 10645:10646 ioctl 40046207 0 returned -16 [ 295.144266] binder: 10645:10646 ERROR: BC_REGISTER_LOOPER called without request [ 295.173408] binder: release 10645:10646 transaction 15 out, still active [ 295.180319] binder: undelivered TRANSACTION_COMPLETE 01:34:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) [ 295.239707] binder: BINDER_SET_CONTEXT_MGR already set [ 295.245191] binder: 10649:10650 ioctl 40046207 0 returned -16 [ 295.284269] binder: 10649:10650 ERROR: BC_REGISTER_LOOPER called without request 01:34:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') read$FUSE(r3, 0x0, 0x0) [ 295.342082] binder: release 10649:10650 transaction 16 out, still active [ 295.349093] binder: undelivered TRANSACTION_COMPLETE [ 295.394701] binder: BINDER_SET_CONTEXT_MGR already set [ 295.400100] binder: 10653:10654 ioctl 40046207 0 returned -16 [ 295.417685] binder: BINDER_SET_CONTEXT_MGR already set [ 295.423212] binder: 10655:10657 ioctl 40046207 0 returned -16 01:34:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') read$FUSE(r3, 0x0, 0x0) [ 295.438466] binder: release 10653:10654 transaction 18 out, still active 01:34:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) [ 295.585530] binder: BINDER_SET_CONTEXT_MGR already set [ 295.590932] binder: 10661:10662 ioctl 40046207 0 returned -16 [ 295.594021] binder: BINDER_SET_CONTEXT_MGR already set [ 295.602335] binder: 10663:10665 ioctl 40046207 0 returned -16 01:34:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r3, 0x0, 0x0) 01:34:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') [ 295.753112] binder: BINDER_SET_CONTEXT_MGR already set [ 295.758490] binder: 10670:10671 ioctl 40046207 0 returned -16 01:34:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 295.803197] binder: BINDER_SET_CONTEXT_MGR already set [ 295.808569] binder: 10673:10674 ioctl 40046207 0 returned -16 01:34:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) [ 295.893328] binder: BINDER_SET_CONTEXT_MGR already set [ 295.898824] binder: 10678:10679 ioctl 40046207 0 returned -16 [ 295.964065] binder: BINDER_SET_CONTEXT_MGR already set [ 295.969549] binder: 10681:10683 ioctl 40046207 0 returned -16 01:34:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 01:34:36 executing program 2: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x12080, 0x0) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000000040)=""/55) ioctl$KVM_ASSIGN_DEV_IRQ(r0, 0x4040ae70, &(0x7f0000000080)={0x0, 0xfffffffeffffffff, 0x8, 0x1}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10) r1 = dup(r0) setxattr$trusted_overlay_upper(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.upper\x00', &(0x7f0000000180)={0x0, 0xfb, 0x4b, 0x4, 0x9, "78228f510f553dbb3382b64dc98b9b5b", "d00c05cd19db80576cacdceb6c02c6e1d41039bfd222f40734a3d12495c3bd0019e3bbd7119e64965553d69951526e55f5c24b9b3ca6"}, 0x4b, 0x1) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000200)={0x9, 0xffffffffffffffc1, 0x5}) getpeername$unix(r1, &(0x7f0000000240)=@abs, &(0x7f00000002c0)=0x6e) r2 = accept(r0, &(0x7f0000000300)=@pppoe={0x18, 0x0, {0x0, @link_local}}, &(0x7f0000000380)=0x80) ioctl$TIOCMSET(r1, 0x5418, &(0x7f00000003c0)=0x5) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000400)=0x2, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000440)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}, &(0x7f0000000480)=0x10) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f00000004c0)={0x3ff, 0x0, 0x10001, 0x7fff}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f0000000500)={0x705b8453, r4}) io_setup(0x2, &(0x7f0000000540)=0x0) io_cancel(r5, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x2, 0x2, r0, &(0x7f0000000580)="ca7ad0bd15f58a0be7a02b7ae48b12e5587697614261b6abe1b9f1f35e5ea1bbc9d1458fb120172007889d0a60711b848cb871f25d8b6c1aa3c21cdf4aa93a0cc6d08f6373ca654614e4e8013f7650fb83eea8140b413c125dc0ba2df998eff3670c36181ed617a199d9d7447c63d28dfc82253a732c7b5b5de9556589bc0805", 0x80, 0x1f, 0x0, 0x1, r1}, &(0x7f0000000640)) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000680)=""/229) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000780)={0x0, @in={{0x2, 0x4e20, @multicast2}}}, &(0x7f0000000840)=0x84) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000880)=@assoc_value={r6, 0x6}, &(0x7f00000008c0)=0x8) truncate(&(0x7f0000000900)='./file0\x00', 0x9) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000940)={0x34, 0x6, 0x0, {0x6, 0x0, 0xb, 0x0, '/dev/audio\x00'}}, 0x34) r7 = syz_genetlink_get_family_id$SEG6(&(0x7f00000009c0)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f0000000ac0)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x64, r7, 0x4, 0x70bd2d, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}, @SEG6_ATTR_ALGID={0x8, 0x6, 0x6}, @SEG6_ATTR_SECRETLEN={0x8}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0xffffffffffffffc0}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x97b9}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x4}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xea}, @SEG6_ATTR_DSTLEN={0x8}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x8}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x3}]}, 0x64}, 0x1, 0x0, 0x0, 0x4}, 0x40000) setsockopt$IP_VS_SO_SET_EDITDEST(r1, 0x0, 0x489, &(0x7f0000000b00)={{0x2, @local, 0x4e24, 0x1, 'dh\x00', 0x28, 0x200, 0x20}, {@dev={0xac, 0x14, 0x14, 0x17}, 0x4e21, 0x3, 0x7fff, 0x1}}, 0x44) ioctl$EXT4_IOC_GROUP_ADD(r2, 0x40286608, &(0x7f0000000b80)={0x5, 0x6, 0x5, 0x0, 0x0, 0x80000000}) openat$cgroup_type(r0, &(0x7f0000000bc0)='cgroup.type\x00', 0x2, 0x0) setsockopt$IP_VS_SO_SET_DEL(r3, 0x0, 0x484, &(0x7f0000000c00)={0x73, @local, 0x4e24, 0x0, 'dh\x00', 0x2, 0x98f9, 0x66}, 0x2c) arch_prctl$ARCH_SET_CPUID(0x1012, 0x1) [ 296.162801] binder: BINDER_SET_CONTEXT_MGR already set [ 296.168226] binder: 10686:10687 ioctl 40046207 0 returned -16 01:34:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) [ 296.337546] binder: BINDER_SET_CONTEXT_MGR already set [ 296.343140] binder: 10688:10689 ioctl 40046207 0 returned -16 01:34:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) [ 296.485235] binder: BINDER_SET_CONTEXT_MGR already set [ 296.490762] binder: 10691:10692 ioctl 40046207 0 returned -16 01:34:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r3, 0x0, 0x0) 01:34:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) [ 296.707030] binder: BINDER_SET_CONTEXT_MGR already set [ 296.712548] binder: 10695:10696 ioctl 40046207 0 returned -16 [ 296.830027] IPVS: ftp: loaded support on port[0] = 21 01:34:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) [ 297.004617] chnl_net:caif_netlink_parms(): no params data found 01:34:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) [ 297.084284] bridge0: port 1(bridge_slave_0) entered blocking state [ 297.090845] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.099237] device bridge_slave_0 entered promiscuous mode [ 297.109146] bridge0: port 2(bridge_slave_1) entered blocking state [ 297.115723] bridge0: port 2(bridge_slave_1) entered disabled state [ 297.124139] device bridge_slave_1 entered promiscuous mode [ 297.184781] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 297.198080] bond0: Enslaving bond_slave_1 as an active interface with an up link 01:34:37 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) [ 297.232871] team0: Port device team_slave_0 added [ 297.241831] team0: Port device team_slave_1 added 01:34:37 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) [ 297.316848] device hsr_slave_0 entered promiscuous mode [ 297.353128] device hsr_slave_1 entered promiscuous mode [ 297.407674] bridge0: port 2(bridge_slave_1) entered blocking state [ 297.414287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 297.421444] bridge0: port 1(bridge_slave_0) entered blocking state [ 297.428079] bridge0: port 1(bridge_slave_0) entered forwarding state 01:34:37 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) 01:34:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r3, 0x0, 0x0) [ 297.609309] 8021q: adding VLAN 0 to HW filter on device bond0 [ 297.647259] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 297.668720] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.704833] bridge0: port 2(bridge_slave_1) entered disabled state [ 297.713471] binder: BINDER_SET_CONTEXT_MGR already set [ 297.718810] binder: 10717:10720 ioctl 40046207 0 returned -16 [ 297.729176] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 297.755935] 8021q: adding VLAN 0 to HW filter on device team0 [ 297.781353] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 297.790892] bridge0: port 1(bridge_slave_0) entered blocking state [ 297.797474] bridge0: port 1(bridge_slave_0) entered forwarding state 01:34:37 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) [ 297.895738] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 297.904068] bridge0: port 2(bridge_slave_1) entered blocking state [ 297.910571] bridge0: port 2(bridge_slave_1) entered forwarding state [ 297.923927] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 297.933187] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 297.941814] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 297.950042] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 297.964190] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 297.980087] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 298.044170] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 298.181207] IPVS: set_ctl: invalid protocol: 115 172.20.20.170:20004 [ 298.198613] IPVS: set_ctl: invalid protocol: 115 172.20.20.170:20004 01:34:38 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) 01:34:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r3, 0x0, 0x0) 01:34:38 executing program 2: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000040)=ANY=[], 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet(0x2, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(r1, 0x0, 0x92) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x4, 0x0) 01:34:38 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) [ 298.691788] binder: BINDER_SET_CONTEXT_MGR already set [ 298.697162] binder: 10733:10735 ioctl 40046207 0 returned -16 [ 298.788651] binder_thread_release: 15 callbacks suppressed [ 298.788678] binder: release 10733:10739 transaction 33 out, still active [ 298.801452] binder_release_work: 16 callbacks suppressed [ 298.801464] binder: undelivered TRANSACTION_COMPLETE 01:34:38 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) 01:34:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:34:39 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) [ 299.051302] binder: BINDER_SET_CONTEXT_MGR already set [ 299.058033] binder: 10750:10751 ioctl 40046207 0 returned -16 [ 299.088508] binder: release 10750:10751 transaction 34 out, still active [ 299.095711] binder: undelivered TRANSACTION_COMPLETE 01:34:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:34:39 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) 01:34:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 299.301090] binder: BINDER_SET_CONTEXT_MGR already set [ 299.307077] binder: 10760:10761 ioctl 40046207 0 returned -16 [ 299.320751] binder: release 10760:10761 transaction 35 out, still active [ 299.327932] binder: undelivered TRANSACTION_COMPLETE 01:34:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) [ 299.391047] binder: 10763:10764 ioctl c0306201 0 returned -14 [ 299.551899] binder: BINDER_SET_CONTEXT_MGR already set [ 299.557329] binder: 10771:10772 ioctl 40046207 0 returned -16 01:34:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 01:34:39 executing program 2: add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) r0 = eventfd(0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'bond0\x00'}, 0x18) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000040)={0x2, 'team_slave_0\x00'}, 0x18) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r2 = dup2(r1, r0) mq_timedreceive(r2, &(0x7f0000000080)=""/88, 0x58, 0x4, &(0x7f0000000100)={0x77359400}) socket(0x0, 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) [ 299.620647] binder: release 10771:10773 transaction 36 out, still active [ 299.627660] binder: undelivered TRANSACTION_COMPLETE 01:34:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) [ 299.733843] binder: 10777:10780 ioctl c0306201 0 returned -14 [ 299.745714] IPVS: stopping backup sync thread 10781 ... 01:34:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 299.839281] IPVS: stopping backup sync thread 10786 ... [ 299.846928] binder: BINDER_SET_CONTEXT_MGR already set [ 299.852911] binder: 10785:10787 ioctl 40046207 0 returned -16 [ 299.882050] binder: release 10785:10787 transaction 37 out, still active [ 299.888996] binder: undelivered TRANSACTION_COMPLETE 01:34:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:34:40 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$packet(0x11, 0x3, 0x300) lsetxattr$security_evm(&(0x7f00000057c0)='./file0\x00', &(0x7f0000005800)='security.evm\x00', &(0x7f0000005840)=@v1={0x2, "c0f25446873392f158fe5ae898dbe2"}, 0x10, 0x3) syz_open_dev$mice(&(0x7f0000005780)='/dev/input/mice\x00', 0x0, 0x4000) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) recvmmsg(r0, &(0x7f0000005540)=[{{&(0x7f0000000100)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, &(0x7f0000001680)=[{&(0x7f0000000080)=""/3, 0x3}, {&(0x7f0000000180)=""/142, 0x8e}, {&(0x7f0000000240)=""/143, 0x8f}, {&(0x7f0000000300)=""/186, 0xba}, {&(0x7f00000003c0)=""/89, 0x59}, {&(0x7f0000000440)=""/206, 0xce}, {&(0x7f0000000540)=""/4096, 0x1000}, {&(0x7f0000001540)=""/26, 0x1a}, {&(0x7f0000001580)=""/14, 0xe}, {&(0x7f00000015c0)=""/138, 0x8a}], 0xa, &(0x7f0000001740)=""/135, 0x87}, 0x9}, {{&(0x7f0000001800)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000001940)=[{&(0x7f0000001880)=""/27, 0x1b}, {&(0x7f00000018c0)=""/124, 0x7c}], 0x2, &(0x7f0000001980)=""/4, 0x4}, 0x9}, {{&(0x7f00000019c0)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000001c80)=[{&(0x7f0000001a40)=""/87, 0x57}, {&(0x7f0000001ac0)=""/241, 0xf1}, {&(0x7f0000001bc0)=""/179, 0xb3}], 0x3, &(0x7f0000001cc0)=""/52, 0x34}, 0x1}, {{&(0x7f0000001d00)=@nl, 0x80, &(0x7f0000002380)=[{&(0x7f0000001d80)=""/225, 0xe1}, {&(0x7f0000001e80)=""/145, 0x91}, {&(0x7f0000001f40)=""/34, 0x22}, {&(0x7f0000001f80)=""/203, 0xcb}, {&(0x7f0000002080)=""/250, 0xfa}, {&(0x7f0000002180)=""/30, 0x1e}, {&(0x7f00000021c0)=""/39, 0x27}, {&(0x7f0000002200)=""/197, 0xc5}, {&(0x7f0000002300)=""/45, 0x2d}, {&(0x7f0000002340)=""/2, 0x2}], 0xa, &(0x7f0000002440)=""/128, 0x80}, 0x6}, {{&(0x7f00000024c0)=@ax25={{0x3, @null}, [@bcast, @netrom, @rose, @bcast, @null, @netrom, @rose, @bcast]}, 0x80, &(0x7f00000039c0)=[{&(0x7f0000002540)=""/38, 0x26}, {&(0x7f0000002580)=""/214, 0xd6}, {&(0x7f0000002680)=""/4096, 0x1000}, {&(0x7f0000003680)=""/117, 0x75}, {&(0x7f0000003700)=""/142, 0x8e}, {&(0x7f00000037c0)=""/106, 0x6a}, {&(0x7f0000003840)=""/138, 0x8a}, {&(0x7f0000003900)=""/135, 0x87}], 0x8, &(0x7f0000003a40)=""/128, 0x80}, 0x10000}, {{&(0x7f0000003ac0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000003c00)=[{&(0x7f0000003b40)=""/166, 0xa6}], 0x1}, 0x3c}, {{&(0x7f0000003c40)=@rc, 0x80, &(0x7f0000003e80)=[{&(0x7f0000003cc0)=""/188, 0xbc}, {&(0x7f0000003d80)=""/240, 0xf0}], 0x2, &(0x7f0000003ec0)=""/135, 0x87}, 0x4}, {{&(0x7f0000003f80)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f0000005180)=[{&(0x7f0000004000)=""/242, 0xf2}, {&(0x7f0000004100)=""/4096, 0x1000}, {&(0x7f0000005100)=""/100, 0x64}], 0x3, &(0x7f00000051c0)=""/212, 0xd4}, 0x80000001}, {{&(0x7f00000052c0)=@isdn, 0x80, &(0x7f0000005440)=[{&(0x7f0000005340)=""/220, 0xdc}], 0x1, &(0x7f0000005480)=""/145, 0x91}, 0x5}], 0x9, 0x10040, 0x0) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000000c0)={r2, 0x3, 0x6, @dev}, 0x10) [ 299.976397] binder: 10791:10792 ioctl c0306201 0 returned -14 [ 300.103188] binder: BINDER_SET_CONTEXT_MGR already set [ 300.108656] binder: 10795:10797 ioctl 40046207 0 returned -16 01:34:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002000)}) [ 300.144031] binder: release 10795:10797 transaction 38 out, still active [ 300.150953] binder: undelivered TRANSACTION_COMPLETE 01:34:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:34:40 executing program 2: r0 = eventfd2(0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000d4a000)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000000)={0x4}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000040)) ppoll(&(0x7f0000000400)=[{r1}], 0x1, 0x0, 0x0, 0x0) getpeername(0xffffffffffffff9c, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, &(0x7f0000000080)=0x80) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000180)={0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000001c0)=0x2c) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000240)={r3, 0xdc, "6fd99c58f1757f3d45f28504ca57aef426c87b401801c4caa1903c653b74b85336d6860b1cddfeabd9db45c39544be0129d7a051daaf526896c6c3f319bff37d064722ed5614f1457499f42e726244c33e5377fb98364039ff30bbec76e97f2c08f8c687cadbe3db10483c6e00be26f416e2a6bfa69b642eec373d28eaf41043deee36009e136534b0e06802f04c00e6635668954b43b5c41e91006e12fa92dedbf2b2face009cbdc0617010d9aa4b09dd247dcc6bd546a810984a1a5b544a17c87badf2810ee6aea22d52ac200ae0725f98b502f335b948033ba8a5"}, &(0x7f0000000340)=0xe4) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0xffffffffffffffff, 0x0) ioctl$VIDIOC_S_AUDIO(r4, 0x40345622, &(0x7f00000000c0)={0x4, "7ac42e0b12a1a8f9ca09a95dc139f150dade8ba34f8793f0860ba7ca98b00dff", 0x1, 0x1}) 01:34:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002000)}) [ 300.364169] binder: BINDER_SET_CONTEXT_MGR already set [ 300.369610] binder: 10804:10806 ioctl 40046207 0 returned -16 [ 300.435205] binder: release 10804:10806 transaction 39 out, still active [ 300.442348] binder: undelivered TRANSACTION_COMPLETE 01:34:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002000)}) 01:34:40 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:34:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000002000)}) [ 300.633973] binder: BINDER_SET_CONTEXT_MGR already set [ 300.639401] binder: 10818:10819 ioctl 40046207 0 returned -16 01:34:40 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:34:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000002000)}) 01:34:41 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:34:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000002000)}) 01:34:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 01:34:41 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 301.224885] binder: release 10840:10842 transaction 40 out, still active [ 301.231956] binder: undelivered TRANSACTION_COMPLETE 01:34:41 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:34:41 executing program 0 (fault-call:1 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 01:34:41 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = dup2(r0, r0) prctl$PR_MCE_KILL_GET(0x22) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0x0, 0x33}, 0x0, @in6=@dev, 0x0, 0x1, 0x0, 0x1}}, 0xe8) flock(r1, 0x2) sendmmsg(r2, &(0x7f0000002000)=[{{&(0x7f0000000740)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x22e5db7, 0x0) [ 301.461101] FAULT_INJECTION: forcing a failure. [ 301.461101] name failslab, interval 1, probability 0, space 0, times 1 [ 301.472786] CPU: 1 PID: 10851 Comm: syz-executor.0 Not tainted 5.0.0+ #12 [ 301.479764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 301.489160] Call Trace: [ 301.491933] dump_stack+0x173/0x1d0 [ 301.495634] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 301.500987] should_fail+0xa19/0xb20 [ 301.504781] __should_failslab+0x278/0x2a0 [ 301.509094] should_failslab+0x29/0x70 [ 301.513051] kmem_cache_alloc_trace+0x125/0xb40 [ 301.517857] ? binder_get_thread+0x406/0xf60 [ 301.522340] binder_get_thread+0x406/0xf60 [ 301.526639] ? binder_poll+0xbd0/0xbd0 [ 301.530609] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 301.535858] ? binder_poll+0xbd0/0xbd0 [ 301.539808] binder_ioctl+0x56d/0x2d20 [ 301.543760] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 301.549189] ? binder_poll+0xbd0/0xbd0 [ 301.553137] ? kmsan_get_shadow_origin_ptr+0x70/0x490 01:34:41 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0x0, 0x680000) ioctl$void(r0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x8000, 0x0) getsockname$netlink(r1, &(0x7f0000000040), &(0x7f0000000080)=0xc) lsetxattr$trusted_overlay_opaque(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.opaque\x00', &(0x7f0000000140)='y\x00', 0x2, 0x2) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000180)={0x0, 0xe5, "7ae70fa0f8d973653f39ed969ddc58ddb315a51c40a15f85d0c9a21859adb4a6f2d64aa12c685eea781eff972b5d224b2adc5b828ee33a1feee789ade5ad7ac8afdf7930fe4fbc2de186a75418c5b283b956e378b6cb61db53ae4cf4ec67e308c08e1207e8a3a3ca024a63c5bd58ae0981e3900ce759015a16314af08a3281502ee8b5ea5ccc54d30c68cbeac7b2319d29313a543d193df30285f23d18fa7c4f7c0c34e2b2e973aa918b75c8b2b41dce32058e049ba2b2f98dd125bccafab384fed87669dad2cf38447d1c51fef310eb53d6acb19c36c4bc23c797fd6c9c85d1e79833f8f7"}, &(0x7f0000000280)=0xed) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f00000002c0)={r2, 0x94}, 0x8) [ 301.558382] ? binder_poll+0xbd0/0xbd0 [ 301.562353] do_vfs_ioctl+0xebd/0x2bf0 [ 301.566318] ? security_file_ioctl+0x92/0x200 [ 301.570877] __se_sys_ioctl+0x1da/0x270 [ 301.574924] __x64_sys_ioctl+0x4a/0x70 [ 301.578934] do_syscall_64+0xbc/0xf0 [ 301.582759] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 301.588001] RIP: 0033:0x457f29 [ 301.591252] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 301.610198] RSP: 002b:00007f8d6f889c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 301.617962] RAX: ffffffffffffffda RBX: 00007f8d6f889c90 RCX: 0000000000457f29 [ 301.625274] RDX: 0000000020007000 RSI: 00000000c0306201 RDI: 0000000000000003 [ 301.632596] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 301.639906] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8d6f88a6d4 [ 301.647217] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000004 [ 301.654840] binder: 10850:10851 ioctl c0306201 20007000 returned -12 01:34:41 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:34:41 executing program 2: r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000200)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000000)={0x0, 0x55595659, 0x0, @stepwise}) ioctl$VIDIOC_OVERLAY(r0, 0x4004560e, &(0x7f0000000040)=0x9) 01:34:41 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:34:41 executing program 0 (fault-call:1 fault-nth:1): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 302.102130] FAULT_INJECTION: forcing a failure. [ 302.102130] name failslab, interval 1, probability 0, space 0, times 0 [ 302.113686] CPU: 0 PID: 10878 Comm: syz-executor.0 Not tainted 5.0.0+ #12 [ 302.120653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 302.130036] Call Trace: [ 302.132701] dump_stack+0x173/0x1d0 [ 302.136405] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 302.141677] should_fail+0xa19/0xb20 [ 302.145470] __should_failslab+0x278/0x2a0 [ 302.149786] should_failslab+0x29/0x70 [ 302.153747] kmem_cache_alloc_trace+0x125/0xb40 [ 302.158491] ? binder_transaction+0x40de/0x13e00 [ 302.163330] binder_transaction+0x40de/0x13e00 [ 302.167977] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 302.173406] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 302.178834] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 302.184104] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 302.189523] ? process_measurement+0x2489/0x2740 [ 302.194373] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 302.199636] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 302.205110] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 302.210376] binder_ioctl_write_read+0x152e/0x1a560 [ 302.215459] ? should_fail+0x191/0xb20 [ 302.219418] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 302.224870] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 302.230415] binder_ioctl+0x759/0x2d20 [ 302.234371] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 302.239807] ? binder_poll+0xbd0/0xbd0 [ 302.243750] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 302.248994] ? binder_poll+0xbd0/0xbd0 01:34:42 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 302.252942] do_vfs_ioctl+0xebd/0x2bf0 [ 302.256905] ? security_file_ioctl+0x92/0x200 [ 302.261465] __se_sys_ioctl+0x1da/0x270 [ 302.265505] __x64_sys_ioctl+0x4a/0x70 [ 302.269452] do_syscall_64+0xbc/0xf0 [ 302.273238] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 302.278483] RIP: 0033:0x457f29 [ 302.281729] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 01:34:42 executing program 2: r0 = gettid() rt_sigprocmask(0x0, &(0x7f0000608ff8)={0xfffffffffffffffe}, 0x0, 0x8) tkill(r0, 0x4000000000012) r1 = epoll_create1(0x0) epoll_pwait(r1, &(0x7f00008c9fc4)=[{}], 0x1, 0xfffffffffffffff7, &(0x7f00009d2000), 0x8) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)={'#! ', './file0', [{0x20, 'wlan1'}, {0x20, 'mime_typeem1selfsystem*uservmnet1security'}, {}, {0x20, 'em1^/!\\md5sum:$'}], 0xa, "0e23796e5f70b100f01fd91f50b0fbf3bcb9869f642db4e0085ba6127cb643c6e3d1d74e75e961c9be192d0a8563f413376e1bce35d24e129ef42080f12845e685dfc91ded4c1854ba6fbf348012f5e66247c33bc25013cfd1de78a438e6fa190d3c6ea4f28b94bfb46eaf"}, 0xb7) [ 302.300689] RSP: 002b:00007f8d6f889c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 302.308482] RAX: ffffffffffffffda RBX: 00007f8d6f889c90 RCX: 0000000000457f29 [ 302.315838] RDX: 0000000020007000 RSI: 00000000c0306201 RDI: 0000000000000003 [ 302.323149] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 302.330462] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8d6f88a6d4 [ 302.337779] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000004 [ 302.345290] binder: 10874:10878 transaction failed 29201/-12, size 0-0 line 2975 01:34:42 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 302.455888] binder: undelivered TRANSACTION_ERROR: 29201 01:34:42 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = dup2(r0, r0) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000040)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009dd81ef7f6fc10554dd2af4c089a33a106c916fbdcb0aba415d154f228c93356115557b9fddeebf664cd4bb006f05dd08013c34572f753436e79b5afe25ae60364131162a74938c2c1e503e5f5176ef4c8c68e05c01ba8c21cf448f0f08a6f092140e3c51c7ba5b9daff6f33ae67adf552b75c0be69a320c8f467f1854ea8acead3567337c149574ba4e8526fbed80da148e9c5a47b83fa15e952860213d521dc37247d3d5f13addb676fca88eae0861d5c740c4b285a9aa7400bf315d36"]) 01:34:42 executing program 0 (fault-call:1 fault-nth:2): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 302.650673] FAULT_INJECTION: forcing a failure. [ 302.650673] name failslab, interval 1, probability 0, space 0, times 0 [ 302.662306] CPU: 0 PID: 10896 Comm: syz-executor.0 Not tainted 5.0.0+ #12 [ 302.669280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 302.678667] Call Trace: [ 302.681332] dump_stack+0x173/0x1d0 [ 302.685023] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 302.690286] should_fail+0xa19/0xb20 [ 302.694076] __should_failslab+0x278/0x2a0 01:34:42 executing program 1: socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r0, 0x0, 0x0) [ 302.698379] should_failslab+0x29/0x70 [ 302.702338] kmem_cache_alloc_trace+0x125/0xb40 [ 302.707078] ? binder_transaction+0x4261/0x13e00 [ 302.711892] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 302.717340] binder_transaction+0x4261/0x13e00 [ 302.721993] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 302.727425] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 302.732887] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 302.738137] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 302.743575] ? process_measurement+0x2489/0x2740 [ 302.748407] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 302.753660] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 302.759118] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 302.764383] binder_ioctl_write_read+0x152e/0x1a560 [ 302.769472] ? should_fail+0x191/0xb20 [ 302.773424] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 302.778869] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 302.784405] binder_ioctl+0x759/0x2d20 [ 302.788351] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 302.793776] ? binder_poll+0xbd0/0xbd0 01:34:42 executing program 2: mmap(&(0x7f0000000000/0xfd4000)=nil, 0xfd4000, 0x0, 0x40000000000031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfc1000)=nil, 0xfc1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fc1000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000fc1ffc)=[@increfs], 0x0, 0x0, 0x0}) [ 302.797714] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 302.802961] ? binder_poll+0xbd0/0xbd0 [ 302.806910] do_vfs_ioctl+0xebd/0x2bf0 [ 302.810872] ? security_file_ioctl+0x92/0x200 [ 302.815445] __se_sys_ioctl+0x1da/0x270 [ 302.819488] __x64_sys_ioctl+0x4a/0x70 [ 302.823439] do_syscall_64+0xbc/0xf0 [ 302.827229] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 302.832467] RIP: 0033:0x457f29 [ 302.835720] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 302.854663] RSP: 002b:00007f8d6f889c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 302.862425] RAX: ffffffffffffffda RBX: 00007f8d6f889c90 RCX: 0000000000457f29 [ 302.869738] RDX: 0000000020007000 RSI: 00000000c0306201 RDI: 0000000000000003 [ 302.877051] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 302.884366] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8d6f88a6d4 [ 302.891678] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000004 [ 302.902407] binder: 10895:10896 transaction failed 29201/-12, size 0-0 line 2986 [ 302.942217] binder: 10901:10902 ioctl c0306201 20000000 returned -14 01:34:43 executing program 1: socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r0, 0x0, 0x0) [ 302.957733] binder: 10901:10904 unknown command 0 [ 302.962836] binder: 10901:10904 ioctl c0306201 20000000 returned -22 [ 302.987251] binder: undelivered TRANSACTION_ERROR: 29201 01:34:43 executing program 0 (fault-call:1 fault-nth:3): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 01:34:43 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x4000010004001) io_setup(0x3, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000003700)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x631}]) clock_gettime(0x7, &(0x7f00000000c0)) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) 01:34:43 executing program 1: socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r0, 0x0, 0x0) [ 303.131330] FAULT_INJECTION: forcing a failure. [ 303.131330] name failslab, interval 1, probability 0, space 0, times 0 [ 303.148778] CPU: 0 PID: 10909 Comm: syz-executor.0 Not tainted 5.0.0+ #12 [ 303.155757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 303.165141] Call Trace: [ 303.167801] dump_stack+0x173/0x1d0 [ 303.171492] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 303.176775] should_fail+0xa19/0xb20 [ 303.180595] __should_failslab+0x278/0x2a0 [ 303.184901] should_failslab+0x29/0x70 [ 303.188866] kmem_cache_alloc_trace+0x125/0xb40 [ 303.193623] ? binder_alloc_new_buf+0x1d92/0x2f70 [ 303.198543] binder_alloc_new_buf+0x1d92/0x2f70 [ 303.203304] binder_transaction+0x5961/0x13e00 [ 303.207952] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 303.213387] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 303.218825] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 303.224246] ? process_measurement+0x2489/0x2740 [ 303.229083] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 303.234527] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 303.239793] binder_ioctl_write_read+0x152e/0x1a560 [ 303.244875] ? should_fail+0x191/0xb20 [ 303.248834] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 303.254286] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 303.259826] binder_ioctl+0x759/0x2d20 [ 303.263777] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 303.269203] ? binder_poll+0xbd0/0xbd0 [ 303.273148] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 303.278394] ? binder_poll+0xbd0/0xbd0 [ 303.282349] do_vfs_ioctl+0xebd/0x2bf0 [ 303.286312] ? security_file_ioctl+0x92/0x200 [ 303.290870] __se_sys_ioctl+0x1da/0x270 [ 303.294916] __x64_sys_ioctl+0x4a/0x70 [ 303.298865] do_syscall_64+0xbc/0xf0 [ 303.302656] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 303.307890] RIP: 0033:0x457f29 [ 303.311140] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 303.330102] RSP: 002b:00007f8d6f889c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 303.337878] RAX: ffffffffffffffda RBX: 00007f8d6f889c90 RCX: 0000000000457f29 [ 303.345196] RDX: 0000000020007000 RSI: 00000000c0306201 RDI: 0000000000000003 [ 303.352518] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 303.359843] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8d6f88a6d4 [ 303.367159] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000004 [ 303.374731] binder_alloc: binder_alloc_new_buf_locked: 10623 failed to alloc new buffer struct [ 303.383671] binder: 10908:10909 transaction failed 29201/-12, size 0-0 line 3035 [ 303.395716] binder: undelivered TRANSACTION_ERROR: 29201 01:34:43 executing program 0 (fault-call:1 fault-nth:4): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 01:34:43 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r0, 0x0, 0x0) 01:34:43 executing program 2: r0 = socket$kcm(0x10, 0x2, 0x10) r1 = syz_open_dev$vcsa(&(0x7f0000000400)='/dev/vcsa#\x00', 0x5, 0x20000) setsockopt$inet_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000080), 0x4) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000440)={@local}, &(0x7f0000000480)=0x14) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="2e0000001d008100100f80ecdb4cb90402c8650407000000000000fb120011010e0005000a0019a9060015000000", 0x2e}], 0x1}, 0x0) 01:34:43 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r0, 0x0, 0x0) 01:34:43 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/nullb0\x00', 0x1000003, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x4, 0x13, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet_mtu(r1, 0x0, 0xa, 0xffffffffffffffff, 0x2) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x40000, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000100)=0x1d) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000001000000000000000000000000000000b233fd36f00382c90b212dd37e145f7407ffb5c45b351b5d7f8bdfb76af4f0e55da2985d3e0498c4141ae858db43611cbabe77a8823f423db6479cf4049500e0ee4a5902dab131d63015465c05453908d5e0e78f5481"]) r3 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x80200000006, 0x0) ioctl$VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000080)={0x1a, 0xa, 0x0, "1760550f2b5c01ecff00"}) [ 303.904471] binder: release 10928:10929 transaction 44 out, still active [ 303.911476] binder: undelivered TRANSACTION_COMPLETE 01:34:44 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r0, 0x0, 0x0) 01:34:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000000)={0x3, 0x8e, "22c10238f83f233fe5cd118bb4b554b5be0e179e7bec991586d9a51d79ddb43152837ee83c21b44f5eeed7cbb42c665159e6fce42ee0634a84fae8ea2e616f752a5f3855bb544835939d5643f9199039d044f715b69fbaa005dcf298c15d173c2741d74dd317755941b74bb35b72052343fae16c6f785e912bc0cf9538b3bca9e328a8e02f2842a46a048a52b71f"}) 01:34:44 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:34:44 executing program 2: perf_event_open(&(0x7f0000000100)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x40000080806, 0x0) utime(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x4, 0x7}) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='westwood\x00', 0x9) [ 304.158813] binder: 10943:10944 ioctl c0046686 20000000 returned -22 [ 304.194520] binder: 10943:10948 ioctl c0046686 20000000 returned -22 [ 304.230532] binder: release 10943:10944 transaction 46 out, still active [ 304.237639] binder: undelivered TRANSACTION_COMPLETE [ 304.242933] binder: release 10943:10944 transaction 45 out, still active [ 304.249810] binder: undelivered TRANSACTION_COMPLETE 01:34:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="00000000215976c5"], 0x0, 0x0, 0x0}) 01:34:44 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 304.411499] binder: release 10954:10955 transaction 47 out, still active [ 304.419311] binder: undelivered TRANSACTION_COMPLETE [ 304.463140] binder: release 10954:10955 transaction 48 out, still active [ 304.470056] binder: undelivered TRANSACTION_COMPLETE 01:34:44 executing program 2: r0 = add_key(&(0x7f0000000000)='pkcs7_test\x00', &(0x7f000046bae7), &(0x7f0000cefffa)="1082", 0x2, 0xfffffffffffffffd) r1 = syz_open_dev$admmidi(&(0x7f0000000180)='/dev/admmidi#\x00', 0x2, 0x10000) setsockopt$inet_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f00000001c0), 0x4) add_key(&(0x7f0000000040)='id_legacy\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)="0435c324304e1b50e2d28c7f6eb940aa5f15b03621bad141565e7964d584578033ef014edb3800491721164c0779afaebe8958d8ab0fee796cf299beaa6da082637fdedc836c63c2e10dc06c36a5be91f6a47232bca03fb737f557fd4d26f7acc16b8a68302ed8e8519d95f6ae739e750de9a9ad95680c10220f9a7271117875876d36a70a02f8a3e5616680f3b18fcbf92ef4a04fe6c429b6ec489d1ce7438ed98d44d91dba79eb2a6e74ff8f6b23a79c1785591d8a11dda5144d", 0xbb, r0) 01:34:44 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:34:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000000)='nbd\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 304.720894] binder: release 10966:10971 transaction 49 out, still active [ 304.727967] binder: undelivered TRANSACTION_COMPLETE [ 304.755060] binder: release 10966:10972 transaction 50 out, still active [ 304.762080] binder: undelivered TRANSACTION_COMPLETE 01:34:44 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:34:44 executing program 2: r0 = add_key(&(0x7f0000000000)='pkcs7_test\x00', &(0x7f000046bae7), &(0x7f0000cefffa)="1082", 0x2, 0xfffffffffffffffd) r1 = syz_open_dev$admmidi(&(0x7f0000000180)='/dev/admmidi#\x00', 0x2, 0x10000) setsockopt$inet_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f00000001c0), 0x4) add_key(&(0x7f0000000040)='id_legacy\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)="0435c324304e1b50e2d28c7f6eb940aa5f15b03621bad141565e7964d584578033ef014edb3800491721164c0779afaebe8958d8ab0fee796cf299beaa6da082637fdedc836c63c2e10dc06c36a5be91f6a47232bca03fb737f557fd4d26f7acc16b8a68302ed8e8519d95f6ae739e750de9a9ad95680c10220f9a7271117875876d36a70a02f8a3e5616680f3b18fcbf92ef4a04fe6c429b6ec489d1ce7438ed98d44d91dba79eb2a6e74ff8f6b23a79c1785591d8a11dda5144d", 0xbb, r0) 01:34:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="00000000000000001d4e11925eff4336f029ad9893e19ba9bdf4cf1a289c8ecd8ee7c551860b9b69576da22ff88e1dc861f190bef66ea3899061332f29b0371be3c4469c7dd63cc4bef871a001123690e979a99aeee5ea26f609af107c8ea15fa0ed4072015c6c5ee4d9ec5c914e267b386bc6745cadb0df02e54e"], 0x0, 0x0, 0x0}) lsetxattr$trusted_overlay_redirect(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f0000000080)='./file0\x00', 0x8, 0x3) 01:34:45 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000100)={r1, 0x1, 0x0, @broadcast}, 0x10) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x24002, 0x0) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000080)={r1, 0x3, 0x6, @dev}, 0x10) close(r0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={r2, 0x28, &(0x7f0000000000)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000180)={r3, 0x4, 0x10}, 0xc) [ 305.005220] binder: 10981:10982 transaction failed 29201/-22, size -3634796153178950467-7609688666898032526 line 3035 [ 305.050892] binder: 10981:10982 transaction failed 29201/-22, size -3634796153178950467-7609688666898032526 line 3035 [ 305.078923] device team0 entered promiscuous mode [ 305.084063] device team_slave_0 entered promiscuous mode [ 305.089877] device team_slave_1 entered promiscuous mode [ 305.115349] binder: undelivered TRANSACTION_ERROR: 29201 [ 305.123818] binder: undelivered TRANSACTION_ERROR: 29201 [ 305.135182] device team0 left promiscuous mode [ 305.139910] device team_slave_0 left promiscuous mode [ 305.145674] device team_slave_1 left promiscuous mode 01:34:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x1, 0x2) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000000140)={0xd3f}, 0x4) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x20000, 0x0) ioctl$KDSKBLED(r2, 0x4b65, 0x7fff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0cc4ff29408547383b7dd0192fff33a3a3b8e45170c72c04eb21f7991cfdb0b8c0f6ca3bc9800ee029e0a5d4211f863883e6624464d99ed5c24f36e547bef5205e90aee9c08607712669a80bf96dc9f2feb44c972ff8a06d8d1858b36e732809df169cabe58799ae65fdc4b0", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$SIOCGIFMTU(r2, 0x8921, &(0x7f00000000c0)) sendmmsg(r1, &(0x7f0000001840)=[{{&(0x7f0000000180)=@pptp={0x18, 0x2, {0x2, @local}}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000340)="fd75117b29d2c1515f9bf3bec572240e96543934e3a068e172a703a4a4ab2c905a12f3979b56b724550d1862a218f6b70085d212a8425fd9823e8c131b21852bce294fdcfa8e2b2aa7c022b7f4cd6b80262c25ab132e136430fd9fd0c4690e33493594f9083c6b1414eaa8cc9f5aef79eb3e44466a6ef18773694056e0ec443023a42ecb8bac68566d55898d33ba64b917cbba9565db9a4cdd64086ae99395b6ad043b00547cdf27454920858ff8ba45448e", 0xb2}, {&(0x7f0000000400)}, {&(0x7f0000000440)="74fe70ea7e45421b4c6ce16a114027161e598b9ec213aa57208ee1d6d9b816ad561f10870b1fedd7de73c7e1df28d555ff19995bbdcc41cb813b2f672479c53a0d3b6e931b5b7e69186ce630b883353369eeae1dd29e9b4a7a96d778559331aabb5759856d625adaeb7d407eb8f5e4e9cf77e912a1df90121a16b295188d6025a5677fb1b61b51b264beff6a4329f1776fe2555702703b2150edc0d378d0b55b58f129e72b2362d16c844a0bd138e23b00b6ff69d2df96a346", 0xb9}, {&(0x7f0000000500)="84cebfed6134a03dbdff51b9c2e404537a48a59f223c4ec11e9bcd2880e3b1d2e73c591ea189e677be2fd5cce09a9e636092d11a1c94f9724579391265569cb04064a4a7d778cc7cc4512402bf50306b22b8818e54f6be3da876e600e7d292b33492eb2d69c545870d5bcce563cc343768b570110db50f3653cfce3cc648994a2098e0061ed13a1eedf931b9ab1567e0d32f87c6e6471b8adc27ff3d8761c42fa031ddd27bb8ddde706d8d67a7e35e316e4dc5f084b50e0d85bf89d2f1e944567474230c2d0419a7f8dbde33f015725449d00f540bd014df2f", 0xd9}, {&(0x7f0000000600)="78c08df5911609417d45b56e7f5e2239966168eaa63a2114f74cb0ef594f32f926a6b82dab3a1a55e3035ba315ff70f1b63afab5303bf215fa79974256b4b6523f94f6ac96d92228ddaf4f6ae3a3c69c51d0c0ab61126701dec341da452aaffbf90546b19174f70217bc65bddb54ac8248fa50a4ecac78b8927f456bd7b3cb0f", 0x80}, {&(0x7f0000000680)="9bda1440f4f8944c9f29eca70aa5169d1d5f9de85982f35379427215e3b01e629a1302014d761520f9cae9857c410149eec600bf264f3e57ca17a73e764829547818d8e9fcc557319ad01f424ba969cbd670c848fc2b06579ff21ac4aef689ba38ea84fb1c10943c192d73966846b9ca237f49ca2325c75fd77339a65f6e207c96cd0e0a1c907a63303aae5ed3ed5ff04679c64a722f2c", 0x97}, {&(0x7f0000000740)="1ba89cd06ddabe7dd7e4dc6b50", 0xd}], 0x7, &(0x7f0000000800)=[{0x1010, 0x10f, 0x8001, "118a0869d013429060987d792a4e5ea7671b113fff3ad68750920a330752da1fc5168912a3387c166ec0f308aa6cfea7fc1b7f431017ea74b0f7b81626389c71f7f2e562d3d472ab99d9ed32bd026a286c8df3445811e480b3633147566a3af71527ed56e8855ab9bb89e2686a11a8173ef57e4f82c32ce41c1ee27088667203fcead2ddb189526ba7979f1bbb1b1b3baafdc67895773199673df28394d911b6202a1e3c1c00685bf5b2c1718d64fabe00287b2ac022ed5a9608d11fcb90e8fcb05cb1df04ebbc604fe8f560e54dd0a5f35274d6004fc655d5f164ac0440573aebe535b18f91775699c62a0c0bd3f59b8250802e9f490b42c86891795e56dcdc861b07bbbe99e5479c50eee7740fd861d9019f7abd19e351e56c6891595a431928dfdb9e349150dfc9ced8c0a186b0fd585b78f2fc4a729d2a650ca3f804bb30a122c23871bc5104ca93fb13ba3c380c63ad2de017030f64c09353857513b6217bac22eaf1eeea07a8911281b13a0e009366f7ae024998c2ba9a4c2343b03c581237fac400143724e634db482d63ba1e8644e422819d35cb243a16e48792cee74bea015d146f8b718e60d23f23bec6b8c0c540bc5a7c9d51b478a514ebd0d710a2b046ddc4d325efa80d1df21995796e78f15efacdcbeb7b879f274d2afdf50e1b3b7bc84e1828af519b499547d4609a86954f0088ff59c052c5cc82acfdeeba4978d93a6689ce065fd8fdce938bc97344ccd4d2de3de2af6ac2174dbee8497fc048211b118b28ee6e76e7ccc29408a1ec153fcce4ae589b51f9fa3b49afa1599928c952b07921577996b6dec04ab8e44e1889e7a9954c75ed976111103de149966b16fdf3599470fc3d0d7dd3d4bb1d3c8ceb2225c7763b99b3c41ad38c59d4171d789be67e5f0782ada3f78f41583874927b0bdbeb88e71c9e4a0181cad5b2116ba6b8f6f448cfa5126dd3e6f1bb3b743e2f596ff8f03fd4bfa728aa5db5dbdfae1c2941b43559da97e1102693e715052000c9a0f1b7410d8b7da5588c9875584bce0f842036931326bbe36846399f0ce1b4104080b290ec441fde6f588b80c5a4d16b01f05b4f7214365ae6a7bbeee2c4a29a5d54e4640e31f8c85e7c887ad0f5acd8be9b9e32986022fd9b8f8e3cd1351e226bd8e1fee0d222ec0d19cef48721c7ce5d5c05f1617c06050f3f4a23aa1956689cbcbceabf0b0f14349d263fff55d347818fdce9c5dc7fd621e89ebb4b36e6d417d7ab7add65cf67d716ede3fd182a20b376a73f09717466a08489b12f900f74e5591b8a6c8f519bfb4b71f95b36cbecc72def537b17b1043db9d7385f3f4bbebb06590963f897e3e79d1237e89729204859ff99d1e7405963b85e4942d75c1f72da77f0f427bb25c063ecf94d00e400ddd8169e76e9d3ab0913ab1eba3d6e50acbaeb5bce290a4275372d858a0d3fc980ccf140f1bf83429c36114b4605612be79e4110c81729212abdb75d9f29a2676d82438d722c23115dd8ea006b2ef07aa3a91625d1bfad4dfb919ea9784dfe6d3a9487329a29686ac16db4548ad6224fceb71c57b62efeb202fef9949c8354bdf26ac21bc2bcd9a3a0fe106b0cd428b285633e47abdd293dbf6a685f036d52f75f40c519f0c43291fbe0b7daf93ce40fce0b11f83804adbd1542de22daf9e3bfee07b19520236d12e5b42fbf11e51d748114a2ddebdc29c2411f036da3763d3f175077564770756bb7a2bb4fc3d3b94ee8be95994d950114e5bc8d7666ba72439dd2e1f99e971e4a66189b608cc80bc0eb66c0323dc0ea5575dec5bc8a61f56544f589916d3bfdf1333173a2c3b967afc1710bc60098e82da05111f1fa632fa3e01cf81ca8aa2850b512d3bc7d9ff3435925c45118f0d27c9df64d434c393d749ada3d294c8ca215933530aa8b2d5e3eedec247476b908d7c24cee79f95b4123402a078e6ced89e559beeddc583f1db111d7cfd14cbb85381f2878e060b9ade64d2396d6a7cedbc5cd4da73a952190bdd0403ea6ec13b040abcad53ffcc10b426bd3fd72753f09bdfd5f66883c31627f7babf170a03038a2af0cf42f15e52d9e035efd68b96ab24aabe0da4ea4894b5416c3ca54bc16d84d82a586b867eef46cc48ffe9f0bc1fba2996e6ebc06762f579cb95d4e89ef321a95d812f79657b5d3eedbb93b49eec5280e4c1625fcd61fb16b9efeec89051ee58f46685b39eddab008c10adcad41f14be6ff9b53c85682a27d570dec4363cfe8b3a10b20bd62a0d01b6fc33a3aec9bdb8f48150880ba8aea2e86350b5357cf184dc1babab8caf6df0bdf2d1533fafca40dd498357f5a8729c2823ad0a6950fb4a3111b8d06fba78b33556441fe70cde2100a29e40e5033519064496895541bd7566bf61f87938eca525873d9d0547e72ad5f1f5f151e11d9fa872bb4a073f10cbbf7f4030c91ee54e93ec6b42d7ad3d8a0bf7700043d97b20242a5a946e3a872b4133fddbcf681aa94dcdcbb19eea8d42e3a7f7ff54cfdc277d58837a3b87f10e5779148b6ea361d5e4e4f7d71f60118cfc59823dcb4cc36e891b8a41872b1074711baba9c39153702e3f4465dff71d6874a962b2ff23bc26e9e5a5872af55d7087375020e3a9920745e51ab8362ae35004f0298e8c9238c36dba101fb254110ba55059f69761fcedfb817a34751480249c0637e731f79b75016a52dae1b279cf61fc59298aefe6846ba9ee27acee6c5c676cd992df93e00b0f8a67c31d0ec6bd95e4d751d4cc5cd2bcd8e95f53869af0c8715814de6d27cb776ccea92d82c40be9cd819bb56425103021698a229594bcaa9d34c422a42002bb910136fb2b2f30019a0d8b9b123e5d699194c7821a875bf5b4dd4ff4cb452ebd382c9cfca2e539e03797b41018e68967548fd76ad767c704b00ce7a1869b2c850bfefaea998b024c3f5ad090953d094e6f9710fcbbd5ce822605e44e78e2cfacc37b05d354df37b0e03fd19235e00526d3d65196d51ef4576307c783d9136dad2acda9ab67d430e124698f09e9c1268f017ebf0c14d4f5dd17a027689288b6cdea4a0a86637d849b21c9c6b4ed082785bf3536fa0670d9c91738de91b507bc053a7e2464ab79967d2978bfcceca59707432e169cdac7cb4ee66ce30a736f45461d9e2edc450b771c642cd4c43c5dd5be58c00e48e7c3a1557d25874437f04d43ed2bc2eb1ddfc5ce636da47e9b5765590fa0e843c95c2fd29fdae29ed02b3491f01aea094f9ffe1b57bd5688e1706aa5fac521d4d3cdcb3bd638e9a52db89efc129e87168b93273644e0c60686d53f08f04ec69818139709bc4f9eba1bc5612398f4055b73d726f27001c55c5912208d788519f05097b2efb8ef84a16e6d6d5dba5e11d987e3667d7bfe667af5bf08429501ed09cce4d09a636234cbcd484a320942f5ea1c99460188b163b8bc12a6e612402a0193cbe22dfde4c8ea7113e21d3b36602c4776f81119381c7823cc5da11fe2b45f480b7e8696a8054205a003511752d06abdd67d1b98ed044507615ac6c04203336c79a78d444b6edc5fb16f401133b1c0c2b7259dae96a0672abc5bf73214d8b1477a3732a7f63d486e9666efc0c2cdf70a76e204a9f1bfaeebb2e81d7b5f6e70a430587f636c8bb3a0acf7d76493f2b4a8efb798cd71ee5dda4df8b0659cb12cbb383db47b19137a269990d01a3749f1c74825210737eaa0f8692ef2b860862fe2dfccdbdfcff6909177df68ba0571cce59a87fa877cff9d97f7d4b1dd91b8e9414ef8267a639ffd16124404319fec7694df311ff543f2da08d696a9d92a3fb1bfdb1b7c076cffdc9b7bbf7a6118238ed0db8cc25ddf770eda764ac5f38cdd353b3bde6b18e0bbf59b9169786ec99e1c3388eca2f025a1ef132c3f04cfd65ef53fa3b384cbc04596ddce3f4510dac876b0e104c9571b004bd487472e85482db8419c703cc67d38657ed6b196655679742adde750ab57c319edf59dba0dd76f98ced5c5d8718d0c331e30f8f5abaa2bb37c1b5ccc9c4820c811866b40a772ecea784a3524be44b6165e2781d5ec2877defc70f6a1121f97aec19bf29080f27b035df71ac50bf9d6badc3d0b2f1da269c5bfd0eb14992648d800fc1dca3debea558ab0c66e3371222d4626f3e75064b8447c68754d17406a26c2552b44530837f49a2bd8fd5f840e1e9f6a0a3fadde75b388d6dd8b7ddcc958fecc0937ff8b08742693cb45a1e280e57c47d3f51405665528a1a94a598f5ba1b4a3e3fe8a5bd35b010413501524f17f376d5e3857b5b07b8e85b53c362f7901a984b441954adc6c32930f02ae1005715fc6947254e564752f39bd9974e2f56c21cc77d17929b5c17fa9648e08b099c8c9f146b50cee321d7f3bf15eb575d213a46907b937beed882d13989107fb14807970c68c745943afa1add7d3cb6ebbd0d2ba1eb3fab4e9cf4933b39ea75f67f645287bc3634ef9858a300bc4c6cba8b26db44a868e7c130e0608404e8124e9f98508c3826e30909335324993d011cefc6b3ee759840181637cba1ce0662aba90b05325358b9d09ff4ccf5cd0354a34f677ce5cc29023fe588345b2ad5b647d5ad0de34b34d7147ee0eae9e42b2a18018ed4109a196dceea7a420d823bdf97c71c408b8159e66d2682a42241894180efa45ce1727629767604699f1cca9360c147d68ff1559b8c9ad47cf656ce2251eefe79a9c87ff322aafa0fd94c68a30e890fd8b44e69b1735e94a6c5c54a3aa9fbce4f906068b6be361c132b0bd1efb1cbfe1d3be288400259e7931dcefbc1836f917b0af5bc4a211854c11eaae50f3c42ab78440841a7429149d30945ef66a6955fbe2d2899ac2e7b86b40087d51d30eb6f366a9f620ba3f9f2952c4dc96b1ed0b7ff0496b054b1b18dd7a6707d886382d13fd14c3820bd08de4636b3f000dd97c2cb2e3a63806a057e6678468da0bf5113372ed6a6509f9be396e6a4bd3944c7e46fe98629f27d6d2aed50cc1b3d4ced64fd1385a164f116b00197def7418103ec6ef4d0b2dc66b7c84033f83aca2269e54400db505e85af03724256fa9629efad08690fea0622ce0410305174f630a8b27bb9fb09d658753515a47fe45e5e2ad44d189cf427e6246fd6dbc61899519c71a43316dcc3be761f7866ef6dc97fcc63496154363607c683178447b0fb18996cfbc32f431391730bef9bb5f91565ff5e72f65c9adc035a8bdf1be9d1f803333473297ef77dce056e45caecde333e6a32ffb1fe1b50e425ca2c1f3dcd7ab42567c467ccdb448eabcb6b55e226684670ad732b11f786bdb29b19802028e67f41ea4987656f5219c2a87f22c5b2472ce62c58df96be68817ffb679bcfb60bd8dd1870a80f6a33fcb1c14e868ece382d12a15272acc5b97b29e252d09d41a2ea8d081ec24c89827b5a83be0d374cdd1a89e5ca102ade8f440de45f9c170d416bd6fc90549ee6fe8503b9edf55c7c8cf8be7dc216d268d8c0d2b74298df5e7b257a6a5fcf7282614d69c9911765089888f5f95216aa40533ac2e0be953182ce8ac7a2f23bb7f0c3d1db43796e526902e9171215c4432366be8c83e53c0458089f74d813c1600d0e3b970051a566237af3d283c5d49235b5b4ea1999519cdb90fe3c886de13a3e1ea9cbb9e8fb1afe51ea45a171ba2416fc5ce36de9153bf263abf1e9f27b6cb83a170685a45f6f86ce7bdfff187221119dce9f77a906f8e2e3329b1c97f741a26162741428b5643ad4db90dc1c0758641be4898867bf041731bafe52729eaacd83c159701805c09d1e3a"}], 0x1010}, 0x70}], 0x1, 0x4000000) write$FUSE_DIRENT(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="98000000000000000e00000000000000050b00000000000040000000000000000700000006000000262f73656c662d000200000000000000f20000000000000000000000b80000000600000000000000ffffffffffffffff09000000ffffffff76626f786e6574312f000000000000000600000000000000090000000000000010000000060000006b657972696e67242dc5732f9466eb5e1319e3448ac583814c20b595f05ff7ca48f9c60f3bde36ad9bc9e581c7bae1e350bf0da41cb1adb54b1c90ed31fb1a672682d3a8cb2cf57fcfb79469db8fa57dafa898743f0f28c8b032825c3ec12b477a0ba1eee3a749899a81bfccbef8a0becb8626d2ca80ab365adb0330b4c7323b0caca55592dbb7fb5f5ff026ccc3ae4fee6925833fb9b831c8d22185923b6578e0932bb06b0b0e01ac39e01b490ba4be1e48584970795a"], 0x98) [ 305.190738] device team0 entered promiscuous mode [ 305.195763] device team_slave_0 entered promiscuous mode [ 305.201573] device team_slave_1 entered promiscuous mode [ 305.237633] device team0 left promiscuous mode [ 305.242428] device team_slave_0 left promiscuous mode [ 305.247975] device team_slave_1 left promiscuous mode [ 305.280587] binder: 10991:10992 unknown command 704627724 [ 305.286393] binder: 10991:10992 ioctl c0306201 20007000 returned -22 [ 305.298289] binder: 10991:10992 unknown command 704627724 [ 305.304183] binder: 10991:10992 ioctl c0306201 20007000 returned -22 01:34:45 executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000100)={'veth0_to_bridge\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r1 = socket(0x11, 0x80002, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x200, 0x0) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETGROUP(r2, 0x400454ce, r3) fchdir(r1) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0x4a2) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000040)=0x80000000000000, 0xffffffffffffff39) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000000)=@req={0x0, 0x40}, 0x378) ioctl$KVM_SET_SIGNAL_MASK(r2, 0x4004ae8b, &(0x7f0000000200)={0xe4, "df1a53d2a227c961ac34dc997406e3ed21063008dee43eb09136d89e79d8aac571425319a0bfa13ddb22e5c832d7afb6106f7853906cb45fc490bdeacb24f6c0db99661b1208d0315d4a0770b1ab1642a82c56d044e72c373c67208f5d5857824da7ddf695ce7bc5e5cef7b3d09a3a642889cfbdd64a887ed3012632fbefff7ee441d9a4d061db93d5ee56ebe197fa7cf1551d8d954b93ce93c24e6c30389968d6916d1e7edf6b9502ac05cd005de06b250a099bbd03299a2ad837dd61714a39c43be4d22ad9ff7a38b93ea10a417e769735218d9c08f39df6b5fe0b4879925a8ffbdc28"}) ioctl$KVM_INTERRUPT(r2, 0x4004ae86, &(0x7f00000001c0)) 01:34:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 305.513744] binder: release 11000:11001 transaction 53 out, still active [ 305.520653] binder: undelivered TRANSACTION_COMPLETE 01:34:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x1050c2, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, &(0x7f0000000280)={0x4, &(0x7f0000000240)=[{}, {}, {}, {0x0}]}) ioctl$DRM_IOCTL_GET_CTX(r1, 0xc0086423, &(0x7f00000002c0)={r2, 0x2}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000080)={{{@in=@empty, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000180)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'ip_vti0\x00', r3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="095046e6177d91646baff10aba1099c87a5cbc9047b8365a1816a9fc89512f2a026e39f92d6608ef71d44e218f21df7f11e95e", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:45 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:34:45 executing program 3: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000040)={0x6, {{0xa, 0x4e23, 0x20, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x200}}}, 0x88) connect$l2tp(r0, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @local}, 0x4, 0x0, 0x2, 0x4}}, 0x2e) ftruncate(r0, 0x980) close(r0) write$binfmt_elf64(r0, &(0x7f0000000140)={{0x7f, 0x45, 0x4c, 0x46, 0x7, 0x2, 0x800, 0x81, 0x80000001, 0x3, 0x6, 0x0, 0x308, 0x40, 0x32e, 0xe4, 0x40, 0x38, 0x1, 0xa25, 0x4, 0x2}, [{0x7474e557, 0x5, 0x8, 0x1f84, 0x8, 0x2, 0x3, 0x100000000}, {0x0, 0xf818, 0x9, 0x6, 0x4, 0xfffffffffffffffc, 0x3f, 0xfff}], "0ff0c04957f2649bfa71354c1af2dea784cf51f5522a69b74b7e0dfedc30a48d0d78ad5385ad86d0adc391cbc48cf75ab3b391520e727aa64251be61f804ee52e4d03df8ac351ff94a091f2371c21547d1c75005dec0479b3598c227f4514a5daa177332039ebe9156bb83e0ee49a0f81dfb3dbbc2a0d0f5c9883d3d3e1c", [[], [], [], [], [], [], [], [], [], []]}, 0xb2e) ioctl$KDSETMODE(r0, 0x4b3a, 0x7ff) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000c80)=0x2) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000cc0)='/dev/zero\x00', 0x200000, 0x0) ftruncate(r0, 0x5) getsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f0000000d00)={@remote}, &(0x7f0000000d40)=0x8) link(&(0x7f0000000d80)='./file0\x00', &(0x7f0000000dc0)='./file0\x00') ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x1) r2 = syz_open_dev$mice(&(0x7f0000000e00)='/dev/input/mice\x00', 0x0, 0x200000) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000e40)=0x1000) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000e80)={r1, 0x0, 0x2, 0x6, 0x3}) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000f40)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000f00)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000f80)={0x10, 0x30, 0xfa00, {&(0x7f0000000ec0), 0x1, {0xa, 0x4e20, 0x1, @ipv4={[], [], @remote}, 0x848e}, r3}}, 0x38) setxattr$trusted_overlay_opaque(&(0x7f0000000fc0)='./file0\x00', &(0x7f0000001000)='trusted.overlay.opaque\x00', &(0x7f0000001040)='y\x00', 0x2, 0x1) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000001080)={'NETMAP\x00'}, &(0x7f00000010c0)=0x1e) ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f0000001100)=r0) ioctl$sock_ifreq(r1, 0x8920, &(0x7f0000001140)={'bpq0\x00', @ifru_names='ip6gre0\x00'}) ppoll(&(0x7f0000001180)=[{r1, 0x2100}, {r1, 0xa021}, {r2, 0x80}, {r1, 0x8050}], 0x4, &(0x7f00000011c0)={0x0, 0x1c9c380}, &(0x7f0000001200)={0x9}, 0x8) setxattr$trusted_overlay_opaque(&(0x7f0000001240)='./file0\x00', &(0x7f0000001280)='trusted.overlay.opaque\x00', &(0x7f00000012c0)='y\x00', 0x2, 0x2) pivot_root(&(0x7f0000001300)='./file1\x00', &(0x7f0000001340)='./file0\x00') ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, &(0x7f0000001380)={'team0\x00', {0x2, 0x4e23}}) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000013c0)={0x3f, 0x6, 0x8000, 0x401}, 0x8) setsockopt$RDS_RECVERR(r1, 0x114, 0x5, &(0x7f0000001400)=0x1, 0x4) ioctl$sock_TIOCOUTQ(r2, 0x5411, &(0x7f0000001440)) [ 305.669651] binder: 11003:11004 ioctl 8933 200001c0 returned -22 01:34:45 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x1, 0x0) io_setup(0x9, &(0x7f00000000c0)=0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000100)={0x0, 0x0, 0x0, 0xc8}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$SG_GET_VERSION_NUM(r2, 0x2282, &(0x7f0000000080)) io_submit(r1, 0x1, &(0x7f00000001c0)=[&(0x7f0000000140)={0xb0c000, 0x0, 0x2, 0x8, 0x0, r0, &(0x7f0000000100), 0x290, 0x0, 0x0, 0x0, r2}]) [ 305.737299] binder: 11003:11004 unknown command -431599607 [ 305.743111] binder: 11003:11004 ioctl c0306201 20007000 returned -22 [ 305.815951] binder: 11003:11010 ioctl 8933 200001c0 returned -22 [ 305.821904] binder: 11003:11011 unknown command -431599607 [ 305.827839] binder: 11003:11011 ioctl c0306201 20007000 returned -22 01:34:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 306.164289] binder: release 11019:11020 transaction 54 out, still active [ 306.171296] binder: undelivered TRANSACTION_COMPLETE 01:34:46 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000380)={{{@in=@broadcast, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x3c}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@loopback, 0x0, 0x33}, 0x0, @in=@remote}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) sendmsg$nl_generic(r1, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000480)={0x11cc, 0x1c, 0xb00, 0x70bd2c, 0x25dfdbfe, {0x1}, [@nested={0x38, 0x3b, [@typed={0x8, 0x93, @u32=0x8}, @typed={0x2c, 0x2d, @binary="fbc288bc56f64cc466733920d224995c451e339af478fd4396f8f76cd37dec870682666fd3"}]}, @generic="e2e18d000406385415bc4a621b2236faf392fce871047e14e77ffb28a60f30cf41d758a3b3db9279eaed4f3d9689cff8446739ad43e2e42abe80d666ea25098dc14b17aee1fe39c767c4f2aa80b6a5f3591f22bba7", @nested={0x10a4, 0x2c, [@typed={0x14, 0x8d, @ipv6=@rand_addr="c85515d8432f4beb4306095e5fda1135"}, @typed={0x8, 0x7d, @ipv4=@rand_addr=0x4}, @generic="343b962dbede375cd0209e5052b2059708976a4624adfafdaa8e6c8bf01e79237bff3b82c07dd0b0693201b46b69a3731af17737b3b05a1763cf83b1683b3e7c03a9aa67e672bf83d8cdd0d81629ef3b82213b1d4f975ca2257c192bdfb0a9c287ff2ba8a423cb57aac31235efe4a4dd47", @generic="3835d28eb9461f5eb53876de4bf9cac197405191c2f104780c7d25fc813d4903c4c45932787430bffec1a455fddf75b76e0f950bd36bf0d1416f9ce4738065c7c02c1e7c3a96b4c5f8e4ffefbae3dfd849c9ebaf083035b66742d6ec595b765534b3f8aafd3c3e2ba52a25117145f180958ec45f844f03e64af3d34c72e7d3f444d831f7f11107673ecaff1c3fcfa916d193b18216be4abf07bd2b31560666702c3816f19b722ae0cec8493ab99634733ac1a4b0fcb6d7e61e4bad7500a3b29de4ca23257837098949176f8ac243afeab992d49bc5176f84e65973d390b1203fe5537d0de1f4c00ebed9ab654c84677bba26e2b184977e9a42e4ac643b291982026a4193348c6483b17f0b7ca18e5dcd8dd3a1a251edf5175f1bdbcfebe0349ebd262d5afb9d964a882cac759577c47fb3320c3cd79d70f248ba189ba1c145e9f08fe1b9a430b00f04dc6415e1b6165dbf2c009c68c19c372b68b8a5290fc6c06549cef2e85d46f200ca5ef922544f09511c24fc291224be27ced134424187c9d93941a0f2fe39f13687895d1c6b2b3a2ef21b14db1bcf873ea5b52425cc90f42e8075b0bcdd260eb1b23de2d74a608692e8e0674e2f1dd8138a1c0196ee98f4a4d7f78682ab6762e3da4f76cb157cf5cd2fb5662b829669645a4da375d5eca9726371b58313d5f3eadccba80f26dedf1d1db04e2e804413c1c371b4fdb7cb8b28b5248c40f1236eb8bc08286477abd9ffd21baac63641cfed54f2266d19c6117de8ea0572d49f5e529d97df7996471a117ca90628cb76ac7478682f97d09513170fd432b9f0c94fa3f27c9f9acd6aea0cbce68b7db7659ff3a9baaca77fb94e9392bbb9e38720526fa246039ef3d15d01b7da90e3ecd6526f26c6e0366b5713cdab4f9d7159d22280cb23ce13b8f8f5d86e44150be2cf7b61d26cfddd8232ec674d6e55aa90e1c76c3d94700704a4dabe19307ee0f1938d51889e973d4d9f94398a92dea48d5ac203399c8e47886e2e8269377cd68692b155b727c25e9e0ac1cefe27a67733e9d53464778c731eebbd3c24e58774cdd3dcb0160e22af75960b18340e4cc0586013db0bfe2a4a312a064dcc65204317d842b9663209cb16158fa323f894e2d0bf8ae75ddfb46a1d0380a35283b01ce25886b7c57027919ad62d6e8e8a8bfae8d935851fddb4b3fe4c4f3af9c159c9378a0b345057b8c8b34f6c544d501b18e23a171eff265b3b054d472235340ca7d99e7f6d4b7132e3d2918f832e11d62e7a375f7f1c9b5c58fbeb0a46dae7263be14c1add9866c58f59a1e984b928e845bbf2d457c5e74eb3f4e0f11867ead61746c70c3024e3bd80cdc50a238c0b18db26e39358b081c1eb8d56f0b15e87bbf0c84b8190d46ddecfce514767c309297a0f77c839de14442d89d938b3e91302c147ba277aea889c5904131a3eb1d4a1659adc858eeef9e56c0ffb29f3f89c5c7bde31749ef80c9518e325cede4453e8ccaa79bb1d09ddfd1e480ce2bf59892316793a24e53401548956c675e4150807c4f2d54362836d7f4e7079f44a1fddb80b3ffb9af9f7d3db6b7f8a74045e85014beda643c83d78bc2f748d4f3f70f8165159b2286b112593740216cb2f0d3aa6e14737f01c052bebc82beda20b2d353aa2a527abd8e74b322ced0e021a1a0ca0160431ef0d59380192f943ada56b44a59fab5be67e12728ecd6d427383d421cd5e389937ae772781b0512bc6c1fe1def05b27853ba1e90b82c43a0239c00fbf814c3eacc4db4a38196c8c329b5acd8150b4a8bd89aa5dbf2c65f754186213fbd93a20f27650f5a90a0fdded1336e2fb493f8282d0d2d8537320ca335b485d740e9d6a035ad3a87531d8711a73715c12a6e5e5ccf7344cb3b9c2809dae1e6ff0157004e6e885cc1747375130399c99d7cd597ce865971a51df5e47b9228596c9d106b53d7a5f7211e0c9685d7416a7fc919233060aafa4643d3440431723704dbe611e499864ac68fb17882ba1db3bd578939cdefb68d2dbc859f585c3095b830227cdaaccab59cfe31783c49fbdb74d6d8a110653f641201b5e26698fbf5865c87dac27ae5a46dae941ab565a9b8e1c8a7fdb7068320a90b5442e0aff4d2d54c693c11f76f557ae8b3184ee6fd832737da60dec764b47a32da37b148e2dd951ed1fe1ee39e81f38fe6a6518ea970f857045baf3f4b48ccdb5e6507025e3f860bda778c80dd8fee70c488fd55933b41c708355831091a1856226ece796b413e3b39e52695ad8788f9c57661bdc4f4e9c1491227c85911f81a78868f51b46e6b0217b11d5d745256122cf10e6e8bc5b5e87b41dff1d0b28d39013264631c95524b7393df4d6988f7648cdf27c38afb5b1b542035c9ce879f4fe577ee66cf26ba81495e7d2f73240d7b2cff93a37b0d4dc46f1e17d4a39e91077dbbed41a881dcc0c37ee4d8a3b72042754231a608f40bd7b63a032e8b0b37e2b0aae6e472e35fc20fdeeed40cae0c723642e4ecdd2a0c77f190e7e9dfba87a7d6c21a680109243e3b0b4feb219db50d2c1de556b3278335ca2de49cf51010c1fd291ad563ca3e568f9d935eb673ca7d2c8a2bc8007b2e8bbd53ca469f6e471bb464ac99568e33568bf301a6e6ac9caf1ee598842544564a86c5bec03b89794f583bb7e8de04b27c6358398dd7b4a199185758c3c0e422fffb40df2b8bf989891ed026c2f462059fbe1c778c2c5706aac013d99c78ddbfc1a9d062529135c3948d96ba08a989fdb21ba28fbd2690fb12c5f97a88306da2901918e4d7a118410360a792bcfce7ab5d30c3f6bccbc5bc9d9e03932fac274af6e3f3de8fd3e9fbf3877a74a3dd0ccff2e99ad38979519be95a326404972f3ae8fcdccea562396b92118f9e1581965a2ff3cc3db29f7bb9b820130b154376dffddf4c718e4f349e6bef93b6e14b39840b108da7c94162bea4dcb28ec38d4492e55447a4167f607f1ec00d39209bd5c798c8ce4a3a9b1a57fa33024ba91c7dc50db669ba665a60df76e7cf2e7b62bb632848a4a85c422f1960f5aaca6059d75cb6d8139784d5a48f00ff2059b60246effd7687c1bdba7a6a4e121b25b9fd352a0ed5174e80a745ad28198f8d45ddb719f9a6d06610da1a2e890aef537efd934a46c4436ae9cf1faa7499544b2ff69c6fba413775592af72b6ef46e161d81b2cf279f10b4c66f58ffbecf0267afc5fe73be8ac3414817cb4e87d3ae3dfe9f392723131e64a21018a181614999342a52b184477a0c41c970b49891a5321923cf5aca4e0aa0e150308337740e54b3962036a37cc4251446707614ae2139bed557113a4513bb33d579456f4fc29600a6ed07a1c4431cb0c58bd2b560a4fa174aa84db928afb829f523c12dbc4e6b4db341bc01190654dc03106e0c94cc26e2a2e5f02d552c419d6d53f11689107f2e2a972eec546b714ef89f22bc8a2be95a3230d2ad5041ce602b01961eb3beb47c48318bb501d6bd342d43f4cc0eb113b38934019fbe6490a199546987c5c2d73283af10ae9efed0429e70b8c3ccf1180c14189b6afb21620152b480493e1b310a7f87518e44169de01d7603c0d2a99fe08d84bf1d8eec16d27ddb5fdb1d8db6e7889dec43c6a3dc8a320c2b677bdbd1caa1cde2cb9c2c51ad5a0b73153f23612e01cf2d8a8d45c76ca60dce213a073e00dbe11619975a53f8fe4164fd8e22c517cba54afad4199c34857062a0a1b4c62e30e1d5047e93e87fe9301de445feba7bada5d84085666157a5aedce240c863aec3933f9b4e8b95a410a27b5e9f4aad721b26f100bafdf683002cf7cdc817d30d72bd7d8233f881f1ae77bee2cac44b8530f9c89b7c9b7c697b82fcca21ff67d1fa0e3f421ebc3d18950dbadb9c3d2d766eec5d494466c1d3d1b2b45f318f223109df65e8c23683a5e62d71b7e325a81a52041512f2bcde1c7bbd02926564d52e3fa99527a592974425cb9f1c4f5fee7d97a77d66edf5fdf0ecac6469cb710cb47ad3e4b086318daba9dc81c4bcc60bc7661187240212857ba5857968835641e3e1d1f6cd9a420c37c5a5cb9e24a2b703ff4f9fa0ddd8a36bc34cc937abcc216550f3c85e1938bbad4d27f2c3e93be8f181e1651d7e8bd4b2ef9ec9af897718dd4b076f274b2647b28828e551f0957cfacefa36bb60739fdc1487b7297fd80983ca2d6137137630cbfc459b47905f187afa7a5e42c550a9477c812d1e87c4dc962d7db3f14a34c5718d3cafb8188c4c1b13b61058497298412803194ea8c31fd05c5e1ab27586042e26c2c93d6fb1bd4dc837cbba5334857b4508eafce2cc7fda4b25b16654c01d091e11dbb5501ae11d60cb5e96fd63c7c5881a98adce631278b298473ccb7e9796445633292ba3a38f638b8283af57732b1c62a04db6d4d21fdf027b82456413d72f25cfb883b460c06a32603be337222aadc8669e47c3824587bf6d2e8df3ab20462328e7c462b4aa023c368f01f5c3edb9788e6d9fba058abe63ac0249cf382ebd63b309d3eba61aac7892fc6d1293eebf564920592e9658dbe514ce15b46c9d1d7884454c45f0d42814273551b0aab53c5ee53dfb568e485bd07fddd5aed092789965721d4140893b06bd3957ac8b6a1f6a1ff0817b3a10ae52525ee4de16a9e3a461b89956353bf74d5ed4af6b0a055a1e8f915542be300a46baffb2d52533f203ebb5c12e52afd414c02d02d02a988c1adbfdb4b8ebdb2c9f0e7c523b7b5cd242f635ebfcd981640fe18ca38d526849f9b565b94ed4ac6ec97344b932fd5a588e1983725fee2524f5156e3f24808e9431b8341d58e3a069ff5905cd7b7c48f64ce5b5fd36411aec05265b238ae398cdab8cf358d1162f7de6edbcc08ea16cca3b3d4a34aa816c9b4688ae14ce4bdeb437cb375f14ce87eca3452d3e794958948bf46dc2103195a77b86f1a7b81f30eae7af30126daa41c7f173406e0c5ef7dc2e21cf78e4470f2ac1edfd68aa60bf314149efea361e8b91aa2e085f9f5e149205bb0f85fe75090ae50db2d283ba2b309acee191a2d9ff685885724ae037064af6651ff16dbcb9ab6989804f5b1ca1b4202272799dc57f2d88060b61c741b7d53cd3f38900d3ff913cf857efeb7ca360eb919ef80acc35df7ec15713a7bb782a12362417769c9ce43a83c7793fad4263438afc50f23a3a4bd55c692e5c2e9ea070e6094eff76436cc8965769944005638efab41910aef3b23342f1d9ba2128ee00d5b896fb607aba00699c1433babdce6a88f41e07ca616e17c9cd1327a57a0383f04eecbfd438ba4cde296561a3f720fa293c314556b95515a914e452d9665312ce7493c618ad7efd80753631fa17706a9bc1897e6f0673d7c336cda1d81d22e54a1cda9050cb0324a79b1bf28d1e6adc25143e1b5650ef1eb323663e21d8a3b4e01a2682760214908ed623f5957464303361767fb618892a465f2e20ee943b1a923fb3ba260186eac15db7ed326122f42c546fc4118151e39adc3506946048c2a42af52e46c3833e5371c31dad1697baa48c67d5a7a7e39e39369c9e72a0464ef84b2ba2a20e4e0b035e3958f5bab97b6d9ac23adaa2e37a44e992e4f1134859c4e5b0f391130294c0e57e2c236b21a4668e076aa8cf432d4523cf118e124be8eefa530d2cee57838508f294b53aabbcb80ea6d0603e381452aca4e2aa994306b02772725f42bf7b70cd9fc8eaa611e0052646aaf595946bba4003d79ec552adb5cf6c0bea0b4cfb86d804187f8c55ee1ca930a8183d6f4951e514644b21aa5f49e82570b1fe", @typed={0x8, 0x2c, @u32=0x9}, @typed={0x8, 0x13, @ipv4=@multicast1}]}, @generic="ffac46be8ee1da7727af098edf1fd585097c76d246b8acb4f321fc1601c566dd04b252e4ce1c665f966d60f031c4fb16a336cccf2eae1b08b19e51fa23f70dfdda95f9238f52106c1e8992b84027c068c072e8f022cf96551764267b10caf78c6ff79b95396cdedbd134d40f8852ffd9f8bdf07c287192c4ecd38d3aa44e7e58c87d05a3078c"]}, 0x11cc}}, 0x4000) [ 306.206106] binder: release 11019:11020 transaction 55 out, still active [ 306.213202] binder: undelivered TRANSACTION_COMPLETE 01:34:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4)=ANY=[], 0x0, 0x0, 0x0}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='attr/fscreate\x00') ioctl$KVM_GET_FPU(r1, 0x81a0ae8c, &(0x7f00000000c0)) getsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000040)=0xffffffffffffff45, &(0x7f0000000080)=0x4) 01:34:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x802) r1 = mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xd, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xc, 0x0, &(0x7f0000005fd4)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) fcntl$lock(r0, 0x26, &(0x7f0000000040)={0x1, 0x3, 0x7688, 0x200005, r2}) r3 = syz_open_dev$sndpcmp(&(0x7f0000000280)='/dev/snd/pcmC#D#p\x00', 0x6d, 0x2000) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010029927000fbdbdf25010000000000000002410000001000137564703a73797a3000ddffff183c49184e8b59edea3cd04890bb02d25fc0fc22fc603d6902ae6546852ed980dba39a146d2ef37de24dc28270124f44a3d48f41ba0b3ec8465a9d95169e94bd7bafba02c52d8e4dd90990330bf3eac96589816db8c6bf88d178ad8bc50398d9520be25e7776fcda019e8a217377b1a02b8a74da84c8a0"], 0x2c}, 0x1, 0x0, 0x0, 0x4001}, 0x40800) [ 306.516646] IPVS: ftp: loaded support on port[0] = 21 01:34:46 executing program 2: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) readv(r0, &(0x7f0000000680)=[{&(0x7f0000000080)=""/126, 0x7e}], 0x1) [ 306.673694] binder: 11033:11034 BC_FREE_BUFFER u0000000000000000 no match 01:34:46 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:34:46 executing program 2: r0 = perf_event_open(&(0x7f0000014f88)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000014f88)={0x2, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) dup2(r0, r1) [ 306.766218] binder: 11033:11037 BC_FREE_BUFFER u0000000000000000 no match 01:34:46 executing program 0: eventfd2(0x9, 0x80000) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="f20b56e65fc56e170e9c7234da35599bc1c97cd2c1403fead61db12f6fad", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 306.879594] chnl_net:caif_netlink_parms(): no params data found 01:34:47 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000240)='/dev/video#\x00', 0xfffffffffffffffe, 0x800002) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x800100a, 0x5, 0x2}) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0xd, 0x1, 0x0, "616052eabcab615670171e305f4522b0d2cae32de2031dbe6cde243bbf3da078"}) [ 307.036215] binder: 11048:11049 unknown command -430568462 [ 307.042214] binder: 11048:11049 ioctl c0306201 20007000 returned -22 [ 307.078577] bridge0: port 1(bridge_slave_0) entered blocking state [ 307.085332] bridge0: port 1(bridge_slave_0) entered disabled state [ 307.093820] device bridge_slave_0 entered promiscuous mode [ 307.105587] binder: 11048:11050 unknown command -430568462 [ 307.111361] binder: 11048:11050 ioctl c0306201 20007000 returned -22 [ 307.138260] bridge0: port 2(bridge_slave_1) entered blocking state [ 307.145059] bridge0: port 2(bridge_slave_1) entered disabled state [ 307.153698] device bridge_slave_1 entered promiscuous mode 01:34:47 executing program 2: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) close(r0) r1 = socket$kcm(0x29, 0x2, 0x0) write$cgroup_int(r0, &(0x7f0000000980), 0xffffff4d) sendmsg(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x8041) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000000)={{{@in6=@ipv4={[], [], @empty}, @in6}}, {{@in6=@ipv4={[], [], @multicast1}}, 0x0, @in=@loopback}}, &(0x7f0000000100)=0xe8) [ 307.252437] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 307.268016] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 307.332291] team0: Port device team_slave_0 added [ 307.341524] team0: Port device team_slave_1 added [ 307.478521] device hsr_slave_0 entered promiscuous mode [ 307.534624] device hsr_slave_1 entered promiscuous mode [ 307.585859] bridge0: port 2(bridge_slave_1) entered blocking state [ 307.592488] bridge0: port 2(bridge_slave_1) entered forwarding state [ 307.599643] bridge0: port 1(bridge_slave_0) entered blocking state [ 307.606300] bridge0: port 1(bridge_slave_0) entered forwarding state [ 307.774725] bridge0: port 1(bridge_slave_0) entered disabled state [ 307.787055] bridge0: port 2(bridge_slave_1) entered disabled state [ 307.818510] 8021q: adding VLAN 0 to HW filter on device bond0 [ 307.846478] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 307.854396] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 307.868324] 8021q: adding VLAN 0 to HW filter on device team0 [ 307.882908] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 307.891455] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 307.899890] bridge0: port 1(bridge_slave_0) entered blocking state [ 307.906476] bridge0: port 1(bridge_slave_0) entered forwarding state [ 307.962868] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 307.973305] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 307.987547] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 307.996221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 308.004447] bridge0: port 2(bridge_slave_1) entered blocking state [ 308.010950] bridge0: port 2(bridge_slave_1) entered forwarding state [ 308.018790] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 308.027965] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 308.037251] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 308.046184] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 308.054876] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 308.064370] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 308.073063] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 308.081412] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 308.090257] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 308.098630] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 308.113727] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 308.121926] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 308.169964] 8021q: adding VLAN 0 to HW filter on device batadv0 01:34:48 executing program 3: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f00000000c0)={@ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x100}}, @rand_addr="894c4a71b62e6c0b25198e7a0187fad9", @mcast1, 0x2, 0x8001, 0xa6bd, 0x400, 0x5, 0x41000001, r1}) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_S_EDID(r2, 0xc0285629, &(0x7f00000001c0)={0x0, 0x20, 0x9, [], &(0x7f0000000180)=0x1}) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x9}, 0x1c) bind$inet6(r0, &(0x7f0000000300)={0xa, 0x0, 0x0, @mcast2}, 0x19) 01:34:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x44, 0x0, &(0x7f00000000c0)=[@reply={0x40406301, {0x4, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x0, 0x10, &(0x7f0000000040), &(0x7f0000000080)=[0x28, 0x0]}}], 0x0, 0x0, 0x0}) geteuid() 01:34:48 executing program 2: r0 = memfd_create(&(0x7f00000001c0)='ppp0+,selfppp0vmnet1proc\']\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000050000)='/dev/snd/seq\x00', 0x0, 0x2) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000300)={0x0, 0x0, 0x0, '\x9e\xdez\x8cZ\xe9^\xc8g,\x934\x0fd:fO\x13\xee\xabe\xc02)\x01\xdck\xd3l\xde,Q\xf0\x1b\x7f\v\x01O\x9f\x91\xee\xb7\xc3|r@\xf4v\xc8\xd7S\xd0\x00\xaa\x8f\xaf\x8f\xb5t\xdb\xcf\xa6\xdcM'}) splice(r0, &(0x7f00000000c0), r2, &(0x7f0000000140)=0x3, 0xffffffff, 0x1) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r2, 0x40bc5311, &(0x7f0000000000)={0x80, 0x1, 'clien\x00\x00\x00\x00\x00\x00\x04\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', 0xffffffff90000004, "7fd82d5e02ca3901", "88e7ed00007fff051eae961ef6c6992b0000000000f9fff77711be18a3d918e0"}) write$sndseq(r0, &(0x7f0000042f70)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @addr}, {0x0, 0x0, 0x0, 0x0, @tick, {0x6}, {}, @addr}], 0xffffffbd) 01:34:48 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, 0x0) exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 308.428300] binder: 11070:11071 got reply transaction with no transaction stack [ 308.436070] binder: 11070:11071 transaction failed 29201/-71, size 0-16 line 2801 [ 308.545511] binder: 11070:11071 got reply transaction with no transaction stack [ 308.553546] binder: 11070:11071 transaction failed 29201/-71, size 0-16 line 2801 01:34:48 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, 0x0) exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:34:48 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000040)={0x7a, 0x0, [0xc0000102, 0x0, 0x40000001], [0xc1]}) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) ioctl$DRM_IOCTL_RM_MAP(r4, 0x4028641b, &(0x7f00000000c0)={&(0x7f0000ffc000/0x1000)=nil, 0x9, 0x4, 0x80, &(0x7f0000ffc000/0x3000)=nil, 0xe3c}) [ 308.588396] binder: undelivered TRANSACTION_ERROR: 29201 [ 308.621015] binder: undelivered TRANSACTION_ERROR: 29201 01:34:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) r1 = dup(r0) mq_getsetattr(r1, &(0x7f0000000040)={0x3, 0x1, 0xfff, 0x6, 0x6, 0x0, 0x100000001, 0x3ff}, &(0x7f0000000080)) [ 308.802340] kvm [11088]: vcpu0, guest rIP: 0xfff0 disabled perfctr wrmsr: 0xc1 data 0x0 01:34:48 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, 0x0) exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 308.933989] binder: release 11094:11095 transaction 58 out, still active [ 308.941014] binder: undelivered TRANSACTION_COMPLETE [ 308.966957] binder: release 11094:11095 transaction 59 out, still active [ 308.975799] binder: undelivered TRANSACTION_COMPLETE 01:34:49 executing program 2: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x400040000000001, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1}, 0x8) listen(r1, 0x0) connect$unix(r0, &(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e) connect(r0, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x101000, 0x0) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f0000000140)={0x30, 0x5, 0x0, {0x0, 0x5, 0x3, 0x3}}, 0x30) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='net/unix\x00') ioctl$DRM_IOCTL_MODE_SETCRTC(r2, 0xc06864a2, &(0x7f00000003c0)={&(0x7f0000000380)=[0x6, 0x75ab5e1f, 0x7, 0x2], 0x4, 0xc48, 0x9, 0x5, 0x8, 0x6, {0x5, 0x7, 0x4, 0x5, 0x0, 0x9b1d, 0x0, 0x5, 0x0, 0x80, 0xfffffffffffffc34, 0xed, 0x6, 0x8, "b20dd06f00f021c9d28c26040d932e3965735fabdfcbeb7317b37ea701334a75"}}) getrandom(&(0x7f00000001c0)=""/7, 0x7, 0x3) fadvise64(r0, 0x0, 0x401, 0x0) bind$unix(r0, &(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x6e) sendfile(r0, r3, 0x0, 0x800000bf) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000200)={{{@in=@remote, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @empty}}, 0x0, @in6=@dev}}, &(0x7f0000000300)=0xe8) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000340)={r4, 0x1, 0x6, @remote}, 0x10) getsockopt$IP_VS_SO_GET_DESTS(r2, 0x0, 0x484, &(0x7f00000004c0)=""/1, &(0x7f0000000480)=0x1) 01:34:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="80489146", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:49 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x88) unshare(0x3fc) setsockopt$inet6_udp_int(r0, 0x11, 0x100000000a, &(0x7f00005b1ffc), 0x4) 01:34:49 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) [ 309.164939] binder: 11101:11105 unknown command 1183926400 [ 309.170680] binder: 11101:11105 ioctl c0306201 20007000 returned -22 01:34:49 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) 01:34:49 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x80200000006, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000040)={0xd356, 0xa, 0x0, "1760550f540400f0eb0300ef1e20000400000000000000000000da00"}) mremap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000ffa000/0x4000)=nil) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000080)={0x1fd, 0x0, &(0x7f0000ffa000/0x3000)=nil}) 01:34:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x8, 0x20000) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x80000, 0x0) renameat(r1, &(0x7f0000000040)='./file0\x00', r2, &(0x7f00000000c0)='./file0\x00') 01:34:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x1, 0x5, 0x2000}, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYRESOCT], 0xfffffccb, 0x0, 0x0}) 01:34:49 executing program 2: ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, &(0x7f00000000c0)={0x100000002, "224947beabed68d95c89490581542234df1a45aefd6974c4854dd587c1890809", 0x4, 0x2, 0x0, 0xfffffffffffffffd, 0x6}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x84, 0x14, &(0x7f0000000000), &(0x7f0000000080)=0x30) [ 309.587945] binder: release 11119:11123 transaction 60 out, still active [ 309.594934] binder: undelivered TRANSACTION_COMPLETE 01:34:49 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) [ 309.650042] binder: release 11119:11123 transaction 61 out, still active [ 309.657214] binder: undelivered TRANSACTION_COMPLETE [ 309.688342] binder: BINDER_SET_CONTEXT_MGR already set [ 309.694040] binder: 11128:11129 ioctl 40046207 0 returned -16 [ 309.714800] binder: release 11128:11129 transaction 62 out, still active [ 309.723535] binder: unexpected work type, 4, not freed [ 309.728849] binder: undelivered TRANSACTION_COMPLETE 01:34:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="484000000000000081fa6b67f5789b8fd2211126740000000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) [ 309.766076] binder: 11128:11134 unknown command 926363952 [ 309.772447] binder: 11128:11134 ioctl c0306201 20000040 returned -22 01:34:49 executing program 2: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r1, 0x4048ae9b, &(0x7f0000000100)={0xf0001}) ioctl$KVM_SET_DEBUGREGS(r1, 0x4080aea2, &(0x7f0000000300)) [ 309.882767] binder: 11137:11140 unknown command 16456 [ 309.888122] binder: 11137:11140 ioctl c0306201 20007000 returned -22 01:34:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r1, 0x7001) 01:34:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x1, 0x5, 0x2000}, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYRESOCT], 0xfffffccb, 0x0, 0x0}) 01:34:50 executing program 1 (fault-call:5 fault-nth:0): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 310.123922] binder: release 11148:11150 transaction 65 out, still active [ 310.131370] binder: undelivered TRANSACTION_COMPLETE [ 310.167171] binder: release 11148:11150 transaction 66 out, still active [ 310.175428] binder: undelivered TRANSACTION_COMPLETE 01:34:50 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip_vs\x00') lseek(r0, 0x800000000000063, 0x0) r1 = gettid() write$P9_RSETATTR(r0, &(0x7f00000000c0)={0x7, 0x1b, 0x2}, 0x7) fcntl$setown(r0, 0x8, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r0, 0xc08c5335, &(0x7f0000000000)={0x3, 0x6, 0x4, 'queue0\x00', 0xa0}) r2 = msgget(0x3, 0x4c) msgrcv(r2, &(0x7f0000000180)={0x0, ""/160}, 0xa8, 0x3, 0x800) 01:34:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xffffffffffffffb7, 0x0, &(0x7f0000000040), 0xfffffffffffffcf8, 0x0, 0x0}) [ 310.263417] binder: BINDER_SET_CONTEXT_MGR already set [ 310.268929] binder: 11153:11154 ioctl 40046207 0 returned -16 [ 310.304370] FAULT_INJECTION: forcing a failure. [ 310.304370] name failslab, interval 1, probability 0, space 0, times 0 [ 310.316107] CPU: 1 PID: 11156 Comm: syz-executor.1 Not tainted 5.0.0+ #12 [ 310.323083] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 310.332647] Call Trace: [ 310.335334] dump_stack+0x173/0x1d0 [ 310.338190] binder: 11158:11161 ioctl c0306201 20000000 returned -14 [ 310.339066] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 310.339120] should_fail+0xa19/0xb20 [ 310.339183] __should_failslab+0x278/0x2a0 [ 310.358871] should_failslab+0x29/0x70 [ 310.362850] __kmalloc_node+0x200/0x1030 [ 310.366992] ? kvmalloc_node+0x19f/0x3d0 [ 310.371138] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 310.376601] kvmalloc_node+0x19f/0x3d0 [ 310.380604] seq_read+0x4aa/0x1d90 [ 310.384214] ? seq_open+0x390/0x390 [ 310.387996] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 310.393239] ? seq_open+0x390/0x390 [ 310.396923] __vfs_read+0x1e5/0xbf0 [ 310.400628] ? security_file_permission+0x521/0x660 [ 310.405716] ? rw_verify_area+0x35e/0x580 [ 310.409933] vfs_read+0x359/0x6f0 [ 310.413460] __se_sys_read+0x17a/0x370 [ 310.417425] __x64_sys_read+0x4a/0x70 [ 310.421291] do_syscall_64+0xbc/0xf0 [ 310.425112] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 310.430346] RIP: 0033:0x457f29 [ 310.433606] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 01:34:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="07f201f6df0051affb9dc13df618939b000022", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 310.452560] RSP: 002b:00007f4d8e022c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 310.460334] RAX: ffffffffffffffda RBX: 00007f4d8e022c90 RCX: 0000000000457f29 [ 310.467643] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 310.474952] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 310.482276] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4d8e0236d4 [ 310.489603] R13: 00000000004c4b4e R14: 00000000004d8568 R15: 0000000000000006 [ 310.507727] binder: release 11153:11163 transaction 67 out, still active [ 310.514704] binder: unexpected work type, 4, not freed [ 310.520014] binder: undelivered TRANSACTION_COMPLETE 01:34:50 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) ioctl$EVIOCSABS2F(0xffffffffffffffff, 0x401845ef, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23}, 0x10) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x8806, 0x0) ioctl$KDGKBDIACR(r1, 0x4b4a, 0x0) write$P9_RATTACH(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5412, 0x3) openat$smack_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) pipe(0x0) io_setup(0x7, 0x0) io_setup(0x0, 0x0) io_submit(0x0, 0xfffffffffffffd48, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0xffffffffffffff9d) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x4) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, 0x0, 0x0) openat$smack_task_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, 0x0) keyctl$clear(0x7, 0xfffffffffffffffc) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) ioctl$KDGKBDIACR(r1, 0x4b4a, 0x0) getpid() recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r0, &(0x7f00000004c0)=ANY=[], 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) [ 310.560471] binder: 11165:11167 unknown command -167644665 [ 310.566530] binder: 11165:11167 ioctl c0306201 20007000 returned -22 [ 310.577112] binder: 11153:11154 unknown command 926363952 [ 310.582866] binder: 11153:11154 ioctl c0306201 20000040 returned -22 01:34:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x40800, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$KVM_SMI(r1, 0xaeb7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x1, 0x5, 0x2000}, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYRESOCT], 0xfffffccb, 0x0, 0x0}) [ 310.806131] Unknown ioctl 44727 [ 310.821472] binder: BINDER_SET_CONTEXT_MGR already set [ 310.827116] binder: 11173:11174 ioctl 40046207 0 returned -16 [ 310.838814] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 310.847677] binder_alloc: allocated: 424 (num: 47 largest: 32), free: 11864 (num: 1 largest: 11864) [ 310.857084] binder: 11175:11176 transaction failed 29201/-28, size 0-0 line 3035 [ 310.869438] binder: 11173:11174 unknown command 926363952 [ 310.875710] binder: 11173:11174 ioctl c0306201 20000040 returned -22 01:34:50 executing program 1 (fault-call:5 fault-nth:1): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 310.904678] binder: release 11173:11178 transaction 71 out, still active [ 310.911577] binder: unexpected work type, 4, not freed [ 310.917048] binder: undelivered TRANSACTION_COMPLETE [ 310.958662] Unknown ioctl 44727 [ 310.992095] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 311.000467] binder_alloc: allocated: 456 (num: 48 largest: 32), free: 11832 (num: 1 largest: 11832) [ 311.010038] binder: 11175:11180 transaction failed 29201/-28, size 0-0 line 3035 01:34:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x1, 0x5, 0x2000}, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYRESOCT], 0xfffffccb, 0x0, 0x0}) [ 311.057973] binder: undelivered TRANSACTION_ERROR: 29201 [ 311.080294] binder: undelivered TRANSACTION_ERROR: 29201 01:34:51 executing program 0: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control\x00', 0x2, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000200)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f0000000140)={0x0, {0x2, 0x4e24, @loopback}, {0x2, 0x4e22, @empty}, {0x2, 0x4e20, @loopback}, 0x140, 0x0, 0x0, 0x0, 0x90000000, &(0x7f0000000040)='veth1\x00', 0x79a5, 0x1000, 0x400}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$media(&(0x7f00000001c0)='/dev/media#\x00', 0x7, 0x88402) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB], 0x0, 0x0, 0x0}) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000000)) [ 311.206542] binder: BINDER_SET_CONTEXT_MGR already set [ 311.213073] binder: 11185:11186 ioctl 40046207 0 returned -16 01:34:51 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r0, 0x0, 0x0) [ 311.248660] binder: release 11185:11186 transaction 75 out, still active [ 311.255859] binder: unexpected work type, 4, not freed [ 311.261186] binder: undelivered TRANSACTION_COMPLETE [ 311.292514] binder: 11185:11186 unknown command 926363952 [ 311.298223] binder: 11185:11186 ioctl c0306201 20000040 returned -22 01:34:51 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="d2"], 0x0, 0x0, 0x0}) syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0x0, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x100, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, r0) 01:34:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x1, 0x5, 0x2000}, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 01:34:51 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000000)={'mangle\x00'}, &(0x7f00000000c0)=0x54) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 311.517524] binder: BINDER_SET_CONTEXT_MGR already set [ 311.523250] binder: 11197:11198 ioctl 40046207 0 returned -16 [ 311.543020] binder: unexpected work type, 4, not freed 01:34:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x40800, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$KVM_SMI(r1, 0xaeb7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0xa7, 0x0, &(0x7f0000005fd4)=ANY=[], 0x2a5ed483990d22fb, 0x0, 0x0}) 01:34:51 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x100000ffffff7, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:34:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x1, 0x5, 0x2000}, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 311.814537] Unknown ioctl 44727 [ 311.833316] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 311.841805] binder_alloc: allocated: 536 (num: 52 largest: 32), free: 11752 (num: 1 largest: 11752) [ 311.851069] binder: 11214:11216 transaction failed 29201/-28, size 0-0 line 3035 [ 311.905336] binder: BINDER_SET_CONTEXT_MGR already set [ 311.910782] binder: 11219:11222 ioctl 40046207 0 returned -16 [ 311.919210] binder: 11218:11220 unknown command 0 [ 311.922797] binder: undelivered TRANSACTION_ERROR: 29201 [ 311.924348] binder: 11218:11220 ioctl c0306201 20007000 returned -22 [ 311.960736] binder: unexpected work type, 4, not freed 01:34:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x40800, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$KVM_SMI(r1, 0xaeb7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:52 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x44001, 0x0) ioctl$VIDIOC_SUBDEV_G_EDID(r0, 0xc0285628, &(0x7f0000000080)={0x0, 0x2, 0x0, [], &(0x7f0000000040)=0x7}) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="13634040", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x1, 0x5, 0x2000}, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 312.136062] Unknown ioctl 44727 [ 312.147241] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 312.155846] binder_alloc: allocated: 568 (num: 53 largest: 32), free: 11720 (num: 1 largest: 11720) [ 312.165225] binder: 11226:11228 transaction failed 29201/-28, size 0-0 line 3035 [ 312.186479] binder: 11227:11229 unknown command 1077961491 [ 312.192445] binder: 11227:11229 ioctl c0306201 20007000 returned -22 01:34:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = accept4$packet(0xffffffffffffff9c, 0x0, &(0x7f0000000000), 0x80000) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000080)={0x5, &(0x7f0000000040)=[{0x9, 0x401, 0x14b6, 0xaef}, {0x2, 0x40, 0x0, 0x4}, {0x7f, 0x3, 0x20000000, 0xffffffffffffff67}, {0x2, 0x9, 0x2}, {0x1000, 0x9, 0x6, 0x3}]}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 312.252455] binder: undelivered TRANSACTION_ERROR: 29201 [ 312.276101] binder: unexpected work type, 4, not freed 01:34:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x40800, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$KVM_SMI(r1, 0xaeb7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 312.495147] Unknown ioctl 44727 [ 312.507735] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 312.516269] binder_alloc: allocated: 616 (num: 56 largest: 32), free: 11672 (num: 1 largest: 11672) [ 312.525673] binder: 11239:11241 transaction failed 29201/-28, size 0-0 line 3035 [ 312.584196] binder: unexpected work type, 4, not freed [ 312.591246] binder: undelivered TRANSACTION_ERROR: 29201 01:34:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x40800, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:52 executing program 0: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x80, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000080)={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x25}}, {0x306, @local}, 0xc, {0x2, 0x4e22, @rand_addr=0x7}, 'syzkaller1\x00'}) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x10000, 0x0) ioctl$NBD_DO_IT(r2, 0xab03) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$NBD_SET_SIZE(r2, 0xab02, 0x2) 01:34:52 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) readv(r1, &(0x7f00000002c0)=[{&(0x7f0000000000)=""/28, 0x1c}, {&(0x7f0000000040)=""/38, 0x26}, {&(0x7f00000000c0)=""/115, 0x73}, {&(0x7f00000001c0)=""/110, 0x6e}, {&(0x7f0000000140)=""/36, 0x24}, {&(0x7f0000000240)=""/29, 0x1d}, {&(0x7f0000000280)=""/52, 0x34}], 0x7) [ 312.797864] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 312.806650] binder_alloc: allocated: 664 (num: 59 largest: 32), free: 11624 (num: 1 largest: 11624) [ 312.813913] binder: 11251:11255 unknown command 0 [ 312.816015] binder: 11249:11250 transaction failed 29201/-28, size 0-0 line 3035 [ 312.820881] binder: 11251:11255 ioctl c0306201 20007000 returned -22 [ 312.863315] binder: unexpected work type, 4, not freed [ 312.935335] binder: undelivered TRANSACTION_ERROR: 29201 01:34:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:53 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') getsockopt$inet_mreq(r2, 0x0, 0x24, &(0x7f0000000000)={@rand_addr, @broadcast}, &(0x7f0000000040)=0x8) ioctl$DRM_IOCTL_AGP_INFO(r2, 0x80386433, &(0x7f00000000c0)=""/165) exit(0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) read$FUSE(r2, 0x0, 0x0) 01:34:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x40800, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000440)='/dev/autofs\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="bc02008004e8d89ecd10950e76dfe6db00ae5f9bbba75ba30e05000000000000004884445eafa32c4eda34481661ad36d911245f0454b6ab53077a50b19119a13262a346f409ffa163c29aba828f1e12b30d1f7e6a0cd5c02835ed376a0245c7a4cacd729ef4dbd3e33df0ce096b4e6774376b563ad25d530144d987c4984915728f66202d2cafee464a9e6756fde484bca1f995a7c8169f19ce744636bd6c6af4038c3ba859139fa577df7f140a6015e808e6b14877811b7d04967a9f638e2250dc71", @ANYRES16=r2, @ANYBLOB="00042abd7000fddbdf25030000004000060004000200040002000400020008000100000000000800010071ee00000400020008000100040000000800010006000000080001000400000004000200240006000400020008000100400000000400020008000100060000000800010089bc7c632c010100240002000800010011000000080004000900000008000300fb000000080002000300000044000400200001000a004e21000000080000000000000000000000000000000005000000200002000a004e2300000002fe8800000000000000000000000001010700000038000400200001000a004e2100000008de3d080d327a4780c99fbff89c25d9ab090000001400020002004e23ac1414aa00000000000000000c0002000800040004000000080003003e0000001000010069623a69705f76746930000038000400200001000a004e230000001ffe880000000000000000000000000101070000001400020002004e20e000000100000000000000002c0004001400010002004e210000000000000000000000001400020002004e237f0000010000000000000000180101001400020008000400000800000800040000f0ffff1400020008000100160000000800010007000000380004001400010002004e23e00000020000000000000000200002000a0002030000021600000000000000000000000000000001060000003c000200080002000400000008000200810a0000080001001100000008000100020000000800010008000000080001001b00000008000400070000002c000200080001001a00000008000400ff00000008000400ff7f0000080001000000000008000200ff010000100001007564703a73797a3200000000100001007564703a73797a32000000002c0004001400010002004e240000000000000000000000001400020002004e21ac1414aa0000000000000000"], 0x2bc}, 0x1, 0x0, 0x0, 0x40080}, 0x8000) [ 313.130378] binder: unexpected work type, 4, not freed 01:34:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:53 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x81, 0x20000) creat(&(0x7f0000000140)='./file0\x00', 0x40) fcntl$dupfd(r1, 0x406, r0) r2 = openat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x20000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400000000005) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r3, 0x0, 0x0) getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$int_in(r0, 0x5473, &(0x7f00000000c0)=0x13a) [ 313.395075] binder: unexpected work type, 4, not freed 01:34:53 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dsp\x00', 0x40, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f00000001c0)={0x3, 0x8}) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0xc0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000140)={r2, 0x1, 0x6, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000080)={0x7, &(0x7f0000000040)=[{0x2, 0xdf, 0x3, 0x20}, {0xec6, 0x4, 0x10000, 0x6dac}, {0x354, 0x2, 0x3d, 0x7f}, {0x9, 0x6, 0x6, 0xd30}, {0x311, 0x6, 0xf6ed, 0x52}, {0xff, 0x5, 0x2, 0x69}, {0x1, 0x1, 0x9, 0xf1}]}, 0x10) r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB='!cH@', @ANYRES64=0x0, @ANYBLOB="000107d3cee32fca"], 0x0, 0x0, 0x0}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f00000000c0)={0x8001009, 0xa225, 0x3}) ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000200)={"c8720151fc28bd632ff4f9655bf412d859c1753739ae6c2fe7cb9dd28a35ae6f59f2442d4dc8059d7d9338ea28a1b8c21671a94cec0cf7a0831933bc2ec17be65a46ac7c24e175ffcba252bb49e0238da2ed63072c9c06c9059090ccf47a2ff83f869c54ed8244a221ab4f5847614faa4725708829ee0c7305b7b20932555092643baf3636ae4cb90734867255f852fd8efabb9aed6788172d060bc7501f3ff4d128f66fffd6a0f45e061f4a2709b8a15d547e22585a8a1d4026dc6ae781a47f89454ec4e33a7c8ac1d5928b97ee5d0610bb9ffe00b4ac6ebf527627635af288cceb66d396196d6a3a32bbd429c8cead485dab8a3349550c359715f6505ebe53f1c173ff4ad05c411e95002b45286435a21195e0cefe740f45e134c65d064da7d5557e56a180a7a8f2fa6978df941f7b518526808a723c7f284deda1992891a47b0c2e9dc26b4e86f790f6c83bc3a0dc2dd0b0540636fcc8e6197c8688b95c2f43a9324043048e8e6d0e67ec0fe40c91b98f26de2ec73398a1f6113c064986ab6c711ac4ef6aa542e65578a548f3cf09d3605ba8d398addd76b40787af073fc037ce78f805fbc5bd05ea2f66e024c1547ca1cef46f4348a81768744d51bbee30db0c6c48cfc60c8b24f751b76ac854c78d8d1a59caa738b16ed168f02312ec39aff79ae808acd4dcb95d6da82f3629d5b797206f01ec8298b7a11dd4bec1bad4c4f77e9a6dd22825afcc2243998c0e7cdd1e5b9808452b11a67c7dff42009ab97fa42dc5d09bc430dea42ef09e165ef2d8ea7e2ccf082e9ebb6d1092a116fdfe12d1585aed8fc1224ca71d2fe2e883d87817c8dca9271842da16c86d69ed22684e2f21ad7dc39a2cbcdf7fd87b9a91b6f1b8e06ceeaf34765a0be1f222bd546683febc73a63364b02bd9e139debe0c9c1c15bd06d1e70b295b1a12a767c4d9294f7fdd808a4898797fc86f5167d394e1ae9bd5a5940bc4ca4e96b723e1101d01da19f6bc76b4e56a5467c0bcafa06635564b949637dc391242d600840cba5ab8033dc45008176140e6f444bde9760f7a346b92884f91c302e2c524bdc76e2afafead072046a1e0e09fd7ec45dd766317284319d6f5f7f0694b8c3709c53e0b97c22be23ed385cfede6390814eda007aa741fa22e7a7c0a848255cb914b909f2bdd3ebe15453c7368d17742395b6fc3465bbd5b8ca3439cf6ba629d6e8ea03c7499eb1712ad066836d8db410d95ce22c57ae410efabf1d3df0ef1a6dddec842660b6f0f82ec96582670c383c0874239a6ebaa7e47e6e3b38dfe187a7a616f6387a94bb380721f6d03b952e24e6a07a006fa00d4e3b686117e93fc4ff80ac403d78ae1dc19aa239932d9b582c608eea1d79000f72483a94c866165a4c605354bd2a7710f8400dc1f2068bb7b4977dcc42e185fe697e9b5f5d8f5ed7cf3c4283747"}) 01:34:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x40800, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 313.583574] binder: 11288:11291 unknown command 1078485793 [ 313.589355] binder: 11288:11291 ioctl c0306201 20007000 returned -22 01:34:53 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) r2 = getuid() getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000540)={0x0, @broadcast}, &(0x7f0000000580)=0xc) setsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f00000005c0)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, r4}, 0x14) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000001c0)={{{@in6=@local, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@dev}}, &(0x7f0000000140)=0xe8) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000004c0), &(0x7f0000000500)=0x14) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0}, &(0x7f0000000300)=0xc) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x1000, &(0x7f0000000340)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xe000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}, {@blksize={'blksize', 0x3d, 0x200}}, {@default_permissions='default_permissions'}, {@allow_other='allow_other'}, {@max_read={'max_read', 0x3d, 0x200}}, {@blksize={'blksize', 0x3d, 0x1e00}}], [{@uid_gt={'uid>', r5}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}, {@appraise_type='appraise_type=imasig'}, {@subj_role={'subj_role', 0x3d, 'io\x00'}}, {@uid_eq={'uid', 0x3d, r6}}]}}) [ 313.655211] binder: 11288:11299 unknown command 1078485793 [ 313.660942] binder: 11288:11299 ioctl c0306201 20007000 returned -22 [ 313.694786] binder: unexpected work type, 4, not freed 01:34:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x40800, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:54 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x100000001, 0x40000) getsockopt$ARPT_SO_GET_INFO(r1, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00'}, &(0x7f0000000140)=0x44) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x0, 0x400800) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) [ 314.002471] binder_thread_release: 19 callbacks suppressed [ 314.002496] binder: release 11311:11312 transaction 117 out, still active [ 314.016074] binder: unexpected work type, 4, not freed [ 314.021408] binder_release_work: 19 callbacks suppressed [ 314.021418] binder: undelivered TRANSACTION_COMPLETE 01:34:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) inotify_init() 01:34:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 314.157906] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 314.166456] binder_alloc: allocated: 864 (num: 69 largest: 32), free: 11424 (num: 1 largest: 11424) [ 314.176026] binder: 11314:11318 transaction failed 29201/-28, size 0-0 line 3035 01:34:54 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x9) exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 314.279409] binder: release 11320:11321 transaction 121 out, still active [ 314.286595] binder: undelivered TRANSACTION_COMPLETE [ 314.298047] binder: undelivered TRANSACTION_ERROR: 29201 01:34:54 executing program 2: bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:54 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.stat\x00', 0x0, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x480400, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400220) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 314.373141] binder: release 11323:11324 transaction 123 out, still active [ 314.380154] binder: unexpected work type, 4, not freed [ 314.385637] binder: undelivered TRANSACTION_COMPLETE [ 314.390835] binder: release 11320:11321 transaction 122 out, still active [ 314.397903] binder: undelivered TRANSACTION_COMPLETE 01:34:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x27, 0x0, &(0x7f00000000c0)=ANY=[@ANYRESOCT, @ANYRES64=0x0, @ANYBLOB="2300020000000000"], 0x0, 0x0, 0x0}) 01:34:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 314.547679] binder: 11335:11337 unknown command 926363952 [ 314.553677] binder: 11335:11337 ioctl c0306201 20000080 returned -22 01:34:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="0100008000000000"], 0x0, 0x0, 0x0}) 01:34:54 executing program 2: bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:54 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getpgrp(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 314.735804] binder: release 11343:11344 transaction 126 out, still active [ 314.743096] binder: unexpected work type, 4, not freed [ 314.748525] binder: undelivered TRANSACTION_COMPLETE [ 314.816897] binder: release 11345:11346 transaction 129 out, still active [ 314.824053] binder: undelivered TRANSACTION_COMPLETE 01:34:54 executing program 2: bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:55 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0xdf, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000200)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000240)='syscall\x00') exit(0x1) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000040)=0x3, 0x4) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000000000)) 01:34:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB='0\x00J@', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 315.062588] binder: 11358:11362 unknown command 1078591536 [ 315.068374] binder: 11358:11362 ioctl c0306201 20007000 returned -22 [ 315.135208] binder: release 11366:11368 transaction 130 out, still active [ 315.142393] binder: unexpected work type, 4, not freed [ 315.147713] binder: undelivered TRANSACTION_COMPLETE 01:34:55 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:55 executing program 0: getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={0x0, 0x5}, &(0x7f00000000c0)=0x8) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x6, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f00000002c0)={{0x1, 0x5, 0x6, 0x6, 'syz0\x00', 0x7fffffff}, 0x1, [0xffffffff80000001, 0x80000001, 0x80, 0x6, 0x7fff, 0x6, 0x3, 0x400, 0x6, 0x6, 0x1, 0x9dd9, 0xff, 0xe3e, 0x4, 0x1, 0xa2e, 0x8, 0x2, 0x9, 0x4, 0x10001, 0xfcee, 0x10000000, 0x2, 0x1, 0x40dd, 0x9, 0x1, 0x5, 0xf5f, 0x9, 0xc3a, 0x2, 0x5e, 0x7, 0x3, 0x5, 0x1, 0x4, 0x6, 0x7fffffff, 0x2, 0x14f0be1, 0x2, 0x7, 0x7, 0x1f, 0x0, 0x3, 0x80, 0x4, 0x9, 0x1, 0x9, 0x4, 0x96d, 0x7, 0xff, 0x8, 0xfff, 0x5f, 0xc1a, 0xe3b, 0x8000, 0x0, 0xffffffffffffffce, 0x4, 0x9, 0x6, 0x5e5e, 0x9, 0x400000, 0x7, 0x1f, 0x5, 0x2, 0x2, 0x0, 0xff, 0x4a, 0x7fff, 0x1ff, 0x7486, 0x915, 0x1, 0x9, 0x200, 0x7, 0x5ef, 0x4, 0x1, 0x0, 0x9, 0x2, 0xffffffff, 0x9, 0x7, 0x5, 0x80000000, 0xffffffffffffffff, 0x4, 0x3, 0x3, 0x8, 0x9f2, 0x4f6e, 0x1, 0xfffffffffffffffb, 0xfffffffffffff001, 0x6, 0xcb4a, 0x6, 0x8, 0x7, 0x20, 0x6, 0x8, 0x6, 0x43, 0x4, 0x4, 0x8, 0x19f, 0x4, 0x0, 0x3aa2, 0x3f], {r2, r3+30000000}}) setsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000100)=@assoc_value={r0, 0x100}, 0x8) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000001c0)=0x14) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000200)={@local, @empty, @rand_addr="a0643fe3c75909e5e31e52f8a247e09d", 0x3, 0x5, 0x8, 0x500, 0x40, 0x4000000, r4}) ioctl$sock_inet6_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000140)) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(0xffffffffffffffff, 0x800455d1, &(0x7f0000000040)) 01:34:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}) 01:34:55 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 315.485231] binder: release 11380:11381 transaction 133 out, still active [ 315.492298] binder: unexpected work type, 4, not freed [ 315.497610] binder: undelivered TRANSACTION_COMPLETE 01:34:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0xe463511bcf22a06b, 0x0) ioctl$KVM_GET_ONE_REG(r1, 0x4010aeab, &(0x7f00000001c0)={0x2, 0x3092fae4}) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_DMA(r1, 0xc0406429, &(0x7f0000000180)={r2, 0x5, &(0x7f0000000080)=[0x3, 0x0, 0x1, 0x7, 0xffffffffffffffde], &(0x7f00000000c0)=[0x9, 0x1], 0x0, 0x6, 0x5, &(0x7f0000000100)=[0x3f, 0x7f, 0x2, 0x11e, 0x2, 0xfffffffffffffffa], &(0x7f0000000140)=[0x100000000, 0x5, 0xf4, 0x0, 0xffffffff, 0x4, 0x7, 0x1000]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000380)={{{@in=@loopback, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@mcast1}}, &(0x7f0000000480)=0xe8) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f00000004c0)={@remote, @rand_addr="d04e0d603dc5d114fa0ae66df4795d48", @loopback, 0x3ff, 0x81, 0xfffffffffffffffd, 0x400, 0x9, 0x40000, r3}) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x10, r0, 0x0) 01:34:55 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 315.756359] binder: release 11389:11390 transaction 136 out, still active [ 315.763862] binder: unexpected work type, 4, not freed [ 315.769180] binder: undelivered TRANSACTION_COMPLETE 01:34:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 315.830223] binder: release 11393:11396 transaction 140 out, still active [ 315.837492] binder: undelivered TRANSACTION_COMPLETE 01:34:56 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) futex(&(0x7f0000000140), 0x81, 0x2, &(0x7f00000001c0)={0x0, 0x1c9c380}, &(0x7f0000000200)=0x2, 0x1) setitimer(0x1, &(0x7f00000000c0)={{r2, r3/1000+30000}, {r4, r5/1000+30000}}, &(0x7f0000000100)) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) io_setup(0xff, &(0x7f0000000240)=0x0) io_submit(r6, 0x2, &(0x7f0000000380)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x6, 0x81, r1, &(0x7f0000000280), 0x0, 0x1, 0x0, 0x3, r0}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x8, 0x3, r0, &(0x7f0000000300)="254c3828c2cbd3b40fc6", 0xa, 0x3, 0x0, 0x1, 0xffffffffffffff9c}]) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r7, 0x0, 0x0) 01:34:56 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685) fcntl$setpipe(r0, 0x407, 0xffffffffffffff80) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x9, 0x0) ioctl$sock_netdev_private(r1, 0x89fd, &(0x7f0000000040)="6b6fe20702eb86ff4d75334f61d0dfedc9ebbe989710779600e561294401a056336169ea040dcd47778e0178434fd5") 01:34:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 316.113979] binder: 11406:11407 ioctl 6685 0 returned -22 [ 316.168970] binder: 11406:11413 ioctl 6685 0 returned -22 01:34:56 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:56 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r1) read$FUSE(r1, 0x0, 0x0) ioctl$PPPIOCSCOMPRESS(r1, 0x4010744d) 01:34:56 executing program 0: modify_ldt$read(0x0, &(0x7f0000000000)=""/36, 0x24) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 01:34:56 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 316.585612] binder: 11429:11435 got new transaction with bad transaction stack, transaction 146 has target 10623:0 [ 316.596354] binder: 11429:11435 transaction failed 29201/-71, size 0-0 line 2946 01:34:56 executing program 3: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:56 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) ioctl$TUNGETVNETHDRSZ(r1, 0x800454d7, &(0x7f0000000000)) [ 316.682408] binder: undelivered TRANSACTION_ERROR: 29201 [ 316.761047] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 316.769499] binder_alloc: allocated: 1112 (num: 85 largest: 32), free: 11176 (num: 1 largest: 11176) [ 316.779013] binder: 11441:11444 transaction failed 29201/-28, size 0-0 line 3035 01:34:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x40, 0x0) ioctl$NBD_DISCONNECT(r1, 0xab08) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="0000000000000000885fd136f63add3d9560cfdfbbba61d1203f8101a0660878da98f619b272a5f2e30c2f5d5ace645f1559e640792a0c65fe334713a89292e4087939c9d18facb7d3131e837ce8f0759d3d25bbd273"], 0x0, 0x0, 0x0}) 01:34:56 executing program 3: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 316.898241] binder: undelivered TRANSACTION_ERROR: 29201 01:34:57 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000000)=0x6) [ 316.992382] binder: 11453:11454 transaction failed 29201/-22, size 8649275921771085600--962236836108396326 line 3035 01:34:57 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 317.076134] binder: undelivered TRANSACTION_ERROR: 29201 01:34:57 executing program 3: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:57 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11e34840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:57 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2205, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000040)) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0xfffffffffffffff8, 0x9, 0x4, 0x9}) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x3, 0x20000) read$FUSE(r1, 0x0, 0x0) [ 317.371957] binder: 11472:11474 unknown command 1078518545 [ 317.377677] binder: 11472:11474 ioctl c0306201 20007000 returned -22 01:34:57 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:34:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 317.459545] binder: 11472:11474 unknown command 1078518545 [ 317.465543] binder: 11472:11474 ioctl c0306201 20007000 returned -22 [ 317.582068] binder: unexpected work type, 4, not freed 01:34:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x40002) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0xf, 0x0, &(0x7f0000005fd4)=[@free_buffer={0x40086303, r1}], 0xffffffffffffffa5, 0x0, 0x0}) r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x1, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000080)=0x24, 0x4) 01:34:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 01:34:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:57 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') getpeername$unix(r1, &(0x7f0000000000)=@abs, &(0x7f0000000140)=0x6e) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00000000c0), &(0x7f0000000180)=0x8) exit(0x0) read$FUSE(r2, 0x0, 0x0) [ 317.757093] binder: 11487:11490 BC_FREE_BUFFER u0000000000000000 no match [ 317.764249] binder: 11487:11490 unknown command 0 [ 317.769701] binder: 11487:11490 ioctl c0306201 20007000 returned -22 [ 317.826904] binder: 11492:11493 ioctl c0306201 0 returned -14 [ 317.867495] binder: unexpected work type, 4, not freed [ 317.878504] binder: 11487:11496 BC_FREE_BUFFER u0000000000000000 no match [ 317.885656] binder: 11487:11496 unknown command 0 [ 317.890572] binder: 11487:11496 ioctl c0306201 20007000 returned -22 01:34:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 01:34:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:58 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) write$binfmt_aout(r0, &(0x7f00000001c0)={{0x108, 0x9, 0x2, 0x10c, 0x124, 0x1ff, 0x352, 0x80000001}, "fd00382a33167f4bc9622aaa0717a39ef72439197274e1fcfa5ae61685d0fd46afe1ffca339516204ad220e55ac862a3de74f2dd909691753b09b72671f4eb52c7de3b468b0d25fabf80e87eb2ad24f0f0d82c723c903cff6d2b0895ecba5be1cc92b212a88ee2a2f4f733bb4946f08e6e4a96db21025311489a734ef3e556fe87142e3d11d9add4608bfcedeceb68ce9df1f8ba9d420b1f61ca0d74d3dd5b8022c6c8a12f34001e2277c4e40941a519933790558cfc8a9360", [[]]}, 0x1d9) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000003c0)={{0x4, 0x107000, 0xf, 0x40, 0xd5c, 0x401, 0xd97b, 0xd93, 0xba70, 0x9, 0x80000001, 0x1}, {0x102000, 0x5000, 0xb, 0x80, 0x9000, 0x7, 0x4, 0x4, 0x6, 0x8, 0x1000, 0x100000000}, {0xd000, 0x16000, 0x3, 0x8, 0x0, 0x3dfb, 0x8, 0x5, 0x6, 0x4b8, 0xfff, 0x6}, {0x1d000, 0x10000, 0x1f, 0x0, 0x9af0, 0x1ff, 0x7, 0x7, 0x80000001, 0x3f, 0x100000001, 0x401}, {0x1000, 0x3000, 0xc, 0xf6, 0x6, 0x6, 0x6, 0x4, 0x9, 0x100000000, 0x40, 0x1}, {0x7000, 0xf000, 0xf, 0x4, 0x5, 0xfffffffffffffff8, 0x0, 0x400, 0x4, 0x8, 0x1, 0x100000000}, {0x6000, 0x6000, 0xf, 0xfffffffffffffeff, 0x0, 0x0, 0x100000000, 0x101, 0x9, 0xa5aa, 0x5d, 0x2}, {0x0, 0x2, 0xc, 0x0, 0x4, 0x7, 0x8, 0x2, 0xfff, 0x200, 0x9, 0x43}, {0x5000, 0x4}, {0x3000, 0x100002}, 0x10, 0x0, 0x100000, 0x400028, 0x2, 0x4800, 0xd005, [0x9, 0x9, 0x1ff, 0x8]}) [ 318.160687] binder: unexpected work type, 4, not freed [ 318.169877] binder: 11505:11507 ioctl c0306201 0 returned -14 01:34:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 01:34:58 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000000)={'yam0\x00', 0x6}) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) [ 318.373211] binder: unexpected work type, 4, not freed 01:34:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xfffffffffffffffc, 0x40000) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000040)=ANY=[@ANYBLOB="000000001800000000000000b18d0000060000000700000004000000ffffffff"]) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="11634840e4178e0818662dc8b2f50065720434ecda31a9", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000080)={0x0, r1, 0x8001, 0xffffffff, 0x4, 0x288}) ioctl(r0, 0x400, &(0x7f0000000100)="8335a60eafe0d7c2579f9e40f3aa1a4b23f062557e397025939a0f416736595e2dc2c2074ca8381bd5598d2e4f58678f5a730fcbb43f733bc3e36c8e5ea85871dc2995df4889f86913685469516694298b2cdbcf408adb795a77de0b22a1e9378f7e60aeb399393234cee1583ca32340a127273c47b0dfee2816aa9ec23163601a198b8c595f30496ed25fc2632064711c7e8e9e044fa62b74918c171f04004fc7347ad918976282b432ed") 01:34:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 318.492206] binder: 11519:11520 ioctl c0306201 0 returned -14 01:34:58 executing program 1: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000024c0)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f0000002680)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000002640)={&(0x7f0000002500)={0x110, r1, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2}]}, @IPVS_CMD_ATTR_SERVICE={0x64, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x9}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x9}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x255c}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x5cb8}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@broadcast}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x2}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0xe84d9f1ab0d45384) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) recvmmsg(r2, &(0x7f0000002340)=[{{&(0x7f0000000000)=@hci, 0x80, &(0x7f00000005c0)=[{&(0x7f00000000c0)=""/86, 0x56}, {&(0x7f00000001c0)=""/160, 0xa0}, {&(0x7f0000000280)=""/213, 0xd5}, {&(0x7f0000000140)=""/43, 0x2b}, {&(0x7f0000000380)}, {&(0x7f00000003c0)=""/114, 0x72}, {&(0x7f0000000440)=""/137, 0x89}, {&(0x7f0000000500)=""/120, 0x78}, {&(0x7f0000000580)=""/21, 0x15}], 0x9, &(0x7f0000000680)=""/81, 0x51}, 0x6}, {{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000700)=""/53, 0x35}, {&(0x7f0000000740)=""/208, 0xd0}, {&(0x7f0000000840)=""/209, 0xd1}], 0x3, &(0x7f0000000980)=""/58, 0x3a}, 0x5}, {{&(0x7f00000009c0)=@rc, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000a40)=""/216, 0xd8}, {&(0x7f0000000b40)=""/154, 0x9a}, {&(0x7f0000000c00)=""/11, 0xb}, {&(0x7f0000000c40)=""/167, 0xa7}, {&(0x7f0000000d00)=""/173, 0xad}], 0x5, &(0x7f0000000e40)=""/207, 0xcf}, 0x278}, {{&(0x7f0000000f40)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f00000020c0)=[{&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000001fc0)=""/219, 0xdb}], 0x2}, 0x3d}, {{&(0x7f0000002100)=@rc, 0x80, &(0x7f0000002300)=[{&(0x7f0000002180)=""/186, 0xba}, {&(0x7f0000002240)=""/191, 0xbf}], 0x2}}], 0x5, 0x2000, &(0x7f0000002480)={0x77359400}) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r4, 0x0, 0x0) [ 318.559657] binder: 11528:11530 got transaction to invalid handle [ 318.566377] binder: 11528:11530 transaction failed 29201/-22, size 0-0 line 2896 [ 318.640697] binder: 11528:11530 ioctl 400 20000100 returned -22 [ 318.644742] binder: unexpected work type, 4, not freed [ 318.672740] binder: undelivered TRANSACTION_ERROR: 29201 01:34:58 executing program 0: r0 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0xffffffffffffffff, 0x80100) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x7, 0x4, r0, 0xbb}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x16}, 0x2c) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x80000, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 01:34:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 318.847964] binder: unexpected work type, 4, not freed 01:34:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 319.089753] binder_thread_release: 13 callbacks suppressed [ 319.089779] binder: release 11552:11554 transaction 169 out, still active [ 319.102739] binder: unexpected work type, 4, not freed [ 319.108053] binder_release_work: 13 callbacks suppressed [ 319.108064] binder: undelivered TRANSACTION_COMPLETE 01:34:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 01:34:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:34:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 319.298825] binder: release 11559:11560 transaction 172 out, still active [ 319.306082] binder: undelivered TRANSACTION_COMPLETE 01:34:59 executing program 0: eventfd2(0x2, 0x80000) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4c, 0x0, &(0x7f0000000140)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x20, &(0x7f0000000080)=[@fda={0x66646185, 0x5, 0x0, 0x10}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}, @flat={0x77622a85, 0xb, r1, 0x1}], &(0x7f0000000100)=[0x18, 0x38, 0x38, 0x68]}, 0x3}}], 0x0, 0x0, 0x0}) [ 319.398105] binder: release 11562:11563 transaction 173 out, still active [ 319.405391] binder: unexpected work type, 4, not freed [ 319.410707] binder: undelivered TRANSACTION_COMPLETE 01:34:59 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x200803fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x8, 0x0) syz_open_pts(r1, 0x20000) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r1, 0xc0305602, &(0x7f0000000040)={0x0, 0x1f, 0x0, 0x1}) read$FUSE(r2, 0x0, 0x0) 01:34:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 319.566745] binder: 11570:11572 got reply transaction with no transaction stack [ 319.574527] binder: 11570:11572 transaction failed 29201/-71, size 80-32 line 2801 01:34:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0], 0x0, 0x0, 0x0}) [ 319.684599] binder: 11570:11572 got reply transaction with no transaction stack [ 319.692382] binder: 11570:11572 transaction failed 29201/-71, size 80-32 line 2801 [ 319.728237] binder: undelivered TRANSACTION_ERROR: 29201 [ 319.738083] binder: undelivered TRANSACTION_ERROR: 29201 [ 319.798687] binder: release 11580:11582 transaction 178 out, still active [ 319.805969] binder: unexpected work type, 4, not freed [ 319.811283] binder: undelivered TRANSACTION_COMPLETE [ 319.814706] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 319.824917] binder_alloc: allocated: 1408 (num: 95 largest: 32), free: 10880 (num: 1 largest: 10880) [ 319.834372] binder: 11579:11581 transaction failed 29201/-28, size 0-0 line 3035 [ 319.962574] binder: undelivered TRANSACTION_ERROR: 29201 [ 320.084809] IPVS: ftp: loaded support on port[0] = 21 [ 320.315982] chnl_net:caif_netlink_parms(): no params data found [ 320.393853] bridge0: port 1(bridge_slave_0) entered blocking state [ 320.400397] bridge0: port 1(bridge_slave_0) entered disabled state [ 320.409001] device bridge_slave_0 entered promiscuous mode [ 320.427803] bridge0: port 2(bridge_slave_1) entered blocking state [ 320.434515] bridge0: port 2(bridge_slave_1) entered disabled state [ 320.443222] device bridge_slave_1 entered promiscuous mode [ 320.479008] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 320.491373] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 320.525376] team0: Port device team_slave_0 added [ 320.535055] team0: Port device team_slave_1 added [ 320.609211] device hsr_slave_0 entered promiscuous mode [ 320.762603] device hsr_slave_1 entered promiscuous mode [ 321.037091] bridge0: port 2(bridge_slave_1) entered blocking state [ 321.043759] bridge0: port 2(bridge_slave_1) entered forwarding state [ 321.050966] bridge0: port 1(bridge_slave_0) entered blocking state [ 321.057670] bridge0: port 1(bridge_slave_0) entered forwarding state [ 321.151240] 8021q: adding VLAN 0 to HW filter on device bond0 [ 321.179337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 321.188428] bridge0: port 1(bridge_slave_0) entered disabled state [ 321.200021] bridge0: port 2(bridge_slave_1) entered disabled state [ 321.211060] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 321.235367] 8021q: adding VLAN 0 to HW filter on device team0 [ 321.253888] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 321.262249] bridge0: port 1(bridge_slave_0) entered blocking state [ 321.268773] bridge0: port 1(bridge_slave_0) entered forwarding state [ 321.318429] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 321.327162] bridge0: port 2(bridge_slave_1) entered blocking state [ 321.333785] bridge0: port 2(bridge_slave_1) entered forwarding state [ 321.343890] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 321.353403] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 321.378122] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 321.387944] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 321.413375] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 321.421911] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 321.430294] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 321.439183] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 321.447529] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 321.471970] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 321.495799] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 321.709488] binder: release 11590:11591 transaction 182 out, still active [ 321.716823] binder: unexpected work type, 4, not freed [ 321.722243] binder: undelivered TRANSACTION_COMPLETE 01:35:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:01 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') r3 = getpgrp(0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) fcntl$getownex(r2, 0x10, &(0x7f0000000140)={0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f0000000200)=0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB="f4010001000000c0000d000800720000000000000000000000000000", @ANYRES32=r3, @ANYBLOB='\b\x00+\x00', @ANYRES32=r4, @ANYBLOB="04003c0008007e00", @ANYRES32=r5, @ANYBLOB="afae659278a6cfc23d1ec3e02d45a89b7277aaf6a1e60e69481670ccbf45b645ff2b5dd9ff4bfdd414ffe7a946163026423794965b3de4de455457e7f8b5a709f26aae10cb704db3d31987b09308f86ce321f92ba5f180a438cff84675554b3956de6281f293c209f92ad9db11d7b814004100fe88000000000000000000000000000108000b00", @ANYRES32=r2, @ANYBLOB='\b\x00v\x00', @ANYRES32=r0, @ANYBLOB="0c00930007000000000000000014012700b038799029f6cdb32906a1f38ad64f053b97bf57c71b9a10d2a57dd8a716f4c9792b781ece224104119f90e1037a45db1709fe7d4eae26cc60ea2cb0245e49b622355b9347b3235513b5d4538654afcb6f6352439cabb186c23ec7dfa2337d8d9d3111a0ffd7bf98164d774f91bc9ef41fc7b7d80541c3baaa5b5445be5b0038e1d62bd8f5fa294c4b8c839d532b9b07d9e59c7626988996422ae93a046218f626bbe40eb44bc62068d1b8526269ac6f1580db7102b2bd67823013aead92011c9048e6412479c10766108ec33d07c357c1924e05190c1bcb188eaebfd9b86c195a2eea48cad0b32dbc7ec5d5329aa4bfbeddd708004300", @ANYRES32=r6, @ANYBLOB="14000c0000000000000000000000000000000001000c003c000600000000000000"], 0x1f4}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004004) exit(0x0) ioctl$KVM_SET_CLOCK(r2, 0x4030ae7b, &(0x7f0000000000)={0x0, 0x2e7}) read$FUSE(r2, 0x0, 0x0) 01:35:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="0092c6d743000000"], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xc4b06db4e90595e6, 0x0) 01:35:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:02 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x5, 0x0) ioctl$VIDIOC_QUERYCAP(r1, 0x80685600, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) [ 321.896219] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 321.904837] binder_alloc: allocated: 1440 (num: 96 largest: 32), free: 10848 (num: 1 largest: 10848) [ 321.915416] binder: 11594:11598 transaction failed 29201/-28, size 0-0 line 3035 [ 321.928448] binder: release 11595:11597 transaction 186 out, still active [ 321.936505] binder: undelivered TRANSACTION_COMPLETE [ 321.964710] binder: release 11596:11601 transaction 188 out, still active [ 321.971913] binder: unexpected work type, 4, not freed [ 321.977230] binder: undelivered TRANSACTION_COMPLETE [ 321.982534] binder: undelivered TRANSACTION_ERROR: 29201 [ 321.988075] binder: release 11595:11597 transaction 187 out, still active [ 321.995649] binder: undelivered TRANSACTION_COMPLETE 01:35:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) 01:35:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 322.105792] binder: release 11602:11605 transaction 191 out, still active [ 322.112932] binder: unexpected work type, 4, not freed [ 322.118256] binder: undelivered TRANSACTION_COMPLETE 01:35:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0xfffffffffffffd82, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) 01:35:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:02 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2500, 0x0) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000040)={0x2e, 0x37, 0x17, 0x1, 0x4, 0x8, 0x4, 0xed}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) [ 322.349427] binder: release 11617:11619 transaction 194 out, still active [ 322.356544] binder: unexpected work type, 4, not freed [ 322.362045] binder: undelivered TRANSACTION_COMPLETE [ 322.400417] binder: unexpected work type, 4, not freed 01:35:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) 01:35:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x800, 0x0) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r1, 0x800455d1, &(0x7f0000000100)) 01:35:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 322.637145] binder: unexpected work type, 4, not freed 01:35:02 executing program 1: socketpair$unix(0x1, 0x404, 0x0, &(0x7f0000000140)) clone(0x200004, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r0, 0x0, 0xfffffffffffffc7c) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000000)=0xffffffff) 01:35:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) 01:35:02 executing program 3: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 322.854981] binder: unexpected work type, 4, not freed 01:35:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="f75f48059bad28c2c354e40475d12e04e275d6cd64c7d8827e694f5a6d21c1ea7ae32af9096631f470a28f061aefdfb9cdc8a4beac7f1b399663abb866dfad171bba0d78c85353edb1597f1f678fa7d7c54d2515ccc8671f76fe38299720de57c14e2f170b76369b3afc61e9332f33bed8797ce85768ef731e13e6239730a4c6d4", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\t'], 0x0, 0x0, 0x0}) read(r0, 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x200400, 0x0) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000040)={0x7af, 0x8001, 0x5, 0x7fffffff, 0x0, 0x4}) 01:35:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 323.042344] binder: 11653:11654 unknown command 88629239 [ 323.048201] binder: 11653:11654 ioctl c0306201 20007000 returned -22 [ 323.089566] binder: 11653:11654 unknown command 88629239 [ 323.095404] binder: 11653:11654 ioctl c0306201 20007000 returned -22 01:35:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 01:35:03 executing program 3: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 323.191253] binder: unexpected work type, 4, not freed 01:35:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) vmsplice(r0, &(0x7f0000000440)=[{&(0x7f0000000000)="ae535c026ded2d7a412b03e6968dfe22660c9685e5a3cd1aa58f3fc32d9e55a28184afc7a052b745fd16cf6e8cb201befd0d40ea010868445da4c8bcae647c24224e2e5c8f1a2b54e765dd06f9d02e09b3db6d61664f362a8d4ab01c58905d44caa825b86b2389701294287ed91f8f813206522e995aa87d9baf6448ea474d4750b2be79568ab5d86d3120b3524103eef20e82db7b18377d4d7c48eda17f639d9ed873ef798976700231b35c2582e2dbb09c2794653033841bd9491b4b22cd18c5636dcdbbef954eaf06ddc5b62037f9204443494a3302aef1a570f4e6b824062af5", 0xe2}, {&(0x7f0000000100)="0b26aa02d103c66fea6b5c9f81aa94d9a29e51a40ea7ae451441c59dc0e32c3c4e14dff619f3a1096b80735e9f62003d0009ec377005c3e7922db38190d278340ad7eeac6b6682c3832dd24118510cc9d5154d72dd722b528872c7c3909f", 0x5e}, {&(0x7f0000000180)="a6dcb4103d931a1ef651f386b7cce3dee7c6cbb6dd6704cd6e06245fa879ccfe3f927b98240d1561100b727919be1480612052a27cd0dd7598ac934dd029f4aa32d8551491557d45c9edb56b77e234178887a15bb3f8ed3e81e34b29f00a33f05179ed6cc4091228413d99aae7b087c77e5819bc8ff33bc41be1546bf75da30bcce0addd9d9e0050979e46ca45e3a388535d2732844715108e59ba0abf2674433c68dfe5151384ecd313e6e3c3775e1db8a5c63b68667128504a0ab79d64a2516bf1a591c0002e647bd16d75863052511bdc47168ff1da3202a051b661b12f550b7f", 0xe2}, {&(0x7f0000000280)="0125d1c65ce63f694cf51d6140de20897969e61b5d7708ed671aaaf800fa4a5b90ba99e44da653af8ba17a0eb22383853b7edc01a4a5508824ba105829f2cf9d74f402efd512bae48e1c9918e521bb5b52ac6b04918f2241b910cbc65e3621110882df3395b9d438d1325cef8f7c1ed13fb9f969ec3ce3c806fd606c70ed7f62adc81b4734bfb88b5659691adfc49d881d99706d0be5bf6353d3103891ec413a6813cb454ee8a79991b74b", 0xab}, {&(0x7f0000000340)="112688e54e97e85105439b6e5861c18f48e5d78918fe80673de63b3eacc089e528d3b792e78a71ec59d33d01d58dbad77a988de9530301e7314b0294d6d687caefad0c23fc7d4134db434120e7a0cbe225db4511112c22e594ffabe43203fc2493c791ba49d8f15196f9c7571bc86411e1e6f964d443bade219dc609b9fc9c0fa2f9a0a5fc5f820d8980ebdab55905", 0x8f}, {&(0x7f0000000400)="8fa6ff4f60440850c624c3fd8f9af793850721b57065e5331998f488c551883d1fd6d93e46", 0x25}], 0x6, 0x2) 01:35:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="230000000000255915d2b4d8390000"], 0x0, 0x0, 0x0}) 01:35:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 01:35:03 executing program 3: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 323.567022] binder: unexpected work type, 4, not freed 01:35:03 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0xa5b) read$FUSE(r1, 0x0, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000000)) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x4, 0x52e, 0x1, 0x0, [0x0]}}, 0x29) 01:35:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="00f2c74a82200000"], 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002980)='/dev/dlm-monitor\x00', 0x0, 0x0) syncfs(r0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f00000029c0), &(0x7f0000002a00)=0x4) 01:35:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 323.962041] binder: unexpected work type, 4, not freed 01:35:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 01:35:04 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:04 executing program 1: socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000240)='\xa1\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x3, &(0x7f0000000300)='io\x00', 0xffffffffffffffff}, 0x30) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000380)={0x0}, &(0x7f00000003c0)=0xc) r3 = syz_open_procfs(r2, &(0x7f00000002c0)='io\x00') exit(0x0) ioctl$EVIOCSMASK(r3, 0x40104593, &(0x7f0000000080)={0x1, 0x6e, &(0x7f0000000400)="03c3a7358b23407c62230fd959f6fdc24618e83e2d0506c7bcfe033551d02b4a20b145aea9d9167722c89473db618196b689577310f1f13e5943e1d0de0920dd5da8f0de33d8808dd9795b421774bb4688d0591f2e57d89cf43ed7e57828cf6a6e2ba85d311d9c3d1200d8462540"}) r4 = msgget$private(0x0, 0x8) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000180)=""/77) getsockopt$inet_sctp_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x1, 0x8, 0xffffffffffffffff, 0x8, 0x7f}, &(0x7f0000000040)=0x14) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f00000000c0)={r5, 0x63, "5501aff86d5834629d0f9f325a9891ba99f2fbecd1e428044326a52f2c94aeb5652c7303a5423d2c6845d84d72acaacf8e6b22e087cd1525738e959a0d3a8cc67fc8873d6dd8ecd56e0227340ad3a99f615abf7707384b62fce9927f1853f16f8de6fa"}, &(0x7f0000000140)=0x6b) read$FUSE(r3, 0x0, 0x0) 01:35:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1163"], 0x0, 0x0, 0x0}) 01:35:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x3, 0x40) connect$pptp(r1, &(0x7f0000000040)={0x18, 0x2, {0x3, @multicast2}}, 0x1e) [ 324.175941] binder: 11700:11701 ioctl c0306201 0 returned -14 01:35:04 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockopt(r0, 0xfffffffffffffff9, 0x7943, &(0x7f00000000c0)=""/206, &(0x7f00000001c0)=0xce) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000240)={'filter\x00', 0x0, 0x0, 0x0, [], 0x6, &(0x7f0000000200)=[{}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}]}, 0xd8) exit(0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000040)=0x6, 0x4) read$FUSE(r1, 0x0, 0x38a) 01:35:04 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 324.403438] binder: 11712:11718 unknown command 25361 [ 324.408805] binder: 11712:11718 ioctl c0306201 20007000 returned -22 [ 324.422864] binder_thread_release: 12 callbacks suppressed [ 324.422889] binder: release 11715:11716 transaction 223 out, still active [ 324.435844] binder_release_work: 14 callbacks suppressed [ 324.435856] binder: undelivered TRANSACTION_COMPLETE 01:35:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000000)={0x0, 0x85, "3f1875aaa22dcfa2270520cdcdf894bad23df691a11b5b07ffc2a99fa016a6b9801b30421f6245f9b856cd7e9cb0ce312937fa3467e5da02a606f136b64e984849b587261483973907fd76424c4ad5e4b64cc28a5c2726f530c75f55f1adfb186abd3d0e1907c53fdb696b0c342777f64ef16e7f1e51d33b5709833c0b02c6b98e439b9366"}, &(0x7f00000000c0)=0x8d) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000100)={r1, 0x20, 0x6}, &(0x7f0000000140)=0x8) [ 324.555656] binder: release 11715:11716 transaction 224 out, still active [ 324.562817] binder: undelivered TRANSACTION_COMPLETE [ 324.654585] binder: 11729:11731 ioctl c0306201 0 returned -14 01:35:04 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x1000001b6) 01:35:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1163"], 0x0, 0x0, 0x0}) [ 324.718561] binder: release 11736:11737 transaction 225 out, still active [ 324.725940] binder: undelivered TRANSACTION_COMPLETE 01:35:04 executing program 4: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 324.777406] binder: release 11736:11737 transaction 226 out, still active [ 324.784697] binder: undelivered TRANSACTION_COMPLETE 01:35:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0xfffffe74, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 324.902905] binder: 11744:11747 unknown command 25361 [ 324.908255] binder: 11744:11747 ioctl c0306201 20007000 returned -22 01:35:05 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@empty}}, &(0x7f0000000040)=0xe8) getgroups(0x1, &(0x7f00000000c0)=[0xee01]) fchownat(r1, &(0x7f0000000000)='./file0\x00', r2, r3, 0x1800) exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 325.014759] binder: 11750:11751 ioctl c0306201 0 returned -14 [ 325.094829] binder: 11755:11756 unknown command 0 [ 325.099907] binder: 11755:11756 ioctl c0306201 20007000 returned -22 01:35:05 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:05 executing program 1: nanosleep(&(0x7f0000000000), &(0x7f0000000040)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:35:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1163"], 0x0, 0x0, 0x0}) [ 325.152797] binder: release 11755:11756 transaction 227 out, still active [ 325.159887] binder: undelivered TRANSACTION_COMPLETE 01:35:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:35:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x7, 0x515002) [ 325.377323] binder: 11764:11769 unknown command 25361 [ 325.382968] binder: 11764:11769 ioctl c0306201 20007000 returned -22 01:35:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="116348"], 0x0, 0x0, 0x0}) 01:35:05 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 325.519891] binder: release 11775:11780 transaction 228 out, still active [ 325.527102] binder: undelivered TRANSACTION_COMPLETE [ 325.550960] binder: release 11775:11780 transaction 229 out, still active [ 325.558177] binder: undelivered TRANSACTION_COMPLETE 01:35:05 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 01:35:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:35:05 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x22047d, 0x0) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000040), &(0x7f00000000c0)=0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) [ 325.755370] binder: 11785:11786 unknown command 4743953 [ 325.760888] binder: 11785:11786 ioctl c0306201 20007000 returned -22 01:35:06 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x0) r1 = getpid() r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000540)='/dev/vsock\x00', 0x8000, 0x0) ioctl$VIDIOC_S_EDID(r2, 0xc0285629, &(0x7f00000005c0)={0x0, 0xec, 0x5, [], &(0x7f0000000580)=0x6}) fcntl$setown(r0, 0x8, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x349, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000280)='/proc/capi/capi20ncci\x00', 0x100, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f00000002c0)={0x5, 0xc, 0x9, 0x5, 0x0}, &(0x7f0000000300)=0x10) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000340)={0x0, 0xffffffffffffff80, 0x7fff, 0x4, 0xfffffffffffffffd, 0x3f, 0x3, 0xb4, {0x0, @in6={{0xa, 0x4e20, 0x40, @ipv4={[], [], @remote}, 0x2}}, 0x390b, 0x0, 0x10001, 0x5, 0x3}}, &(0x7f0000000400)=0xb0) getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000000440)={r4, 0x1, 0xd41b, 0x1, 0x0, 0x619, 0xceb6, 0x7, {r5, @in6={{0xa, 0x4e21, 0x2, @empty, 0x7fffffff}}, 0x6, 0xffffffffffffffc1, 0x6, 0x40, 0x6}}, &(0x7f0000000500)=0xb0) r6 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x8, 0x501080) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r6, 0x4008240b, &(0x7f0000000080)={0x687576f45049fc1f, 0x70, 0x0, 0x4, 0x80000000, 0x1, 0x0, 0x4, 0x800c2, 0xb, 0xff, 0xd6e, 0x6, 0x293d93ee, 0x6, 0x8, 0x5, 0x4, 0x7fffffff, 0xfffffffffffffff7, 0xfff, 0x8, 0x3ff, 0x7, 0x5, 0x5476, 0x1, 0xffffffffffffffc0, 0x0, 0x3de, 0x800, 0x5ef, 0x0, 0x100, 0x3b3, 0x2, 0x7e000000000, 0x4, 0x0, 0xdc9, 0x0, @perf_bp={&(0x7f0000000040)}, 0x10400, 0x8, 0x4, 0xb, 0x8, 0x5, 0x7}) getsockopt$inet6_IPV6_IPSEC_POLICY(r6, 0x29, 0x22, &(0x7f0000000100)={{{@in=@loopback, @in6=@mcast1}}, {{@in6=@empty}, 0x0, @in=@empty}}, &(0x7f0000000200)=0x3fa) 01:35:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:35:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="116348"], 0x0, 0x0, 0x0}) 01:35:06 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x6) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgid(r2) [ 326.132717] Unknown ioctl -1071098327 [ 326.153977] binder: 11801:11810 unknown command 0 [ 326.158981] binder: 11801:11810 ioctl c0306201 20007000 returned -22 [ 326.183037] binder: 11807:11808 unknown command 4743953 [ 326.188610] binder: 11807:11808 ioctl c0306201 20007000 returned -22 [ 326.223931] cgroup: fork rejected by pids controller in /syz1 [ 326.245379] Unknown ioctl -1071098327 01:35:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) 01:35:06 executing program 4: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 326.271163] binder: 11801:11818 unknown command 0 [ 326.276243] binder: 11801:11818 ioctl c0306201 20007000 returned -22 [ 326.276336] binder: release 11801:11810 transaction 230 out, still active [ 326.290051] binder: undelivered TRANSACTION_COMPLETE [ 326.357158] binder: release 11801:11818 transaction 231 out, still active [ 326.364439] binder: undelivered TRANSACTION_COMPLETE 01:35:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="116348"], 0x0, 0x0, 0x0}) 01:35:06 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r0, 0x0, 0xfffffffffffffebb) 01:35:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xc, 0x0, &(0x7f0000005fd4)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) 01:35:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) [ 326.604097] binder: 11928:11930 unknown command 4743953 [ 326.609637] binder: 11928:11930 ioctl c0306201 20007000 returned -22 [ 326.687261] binder: 11932:11933 BC_FREE_BUFFER u0000000000000000 no match 01:35:06 executing program 4: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 326.727952] binder: 11932:11938 BC_FREE_BUFFER u0000000000000000 no match 01:35:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:07 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x1, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x80000001, 0x200) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4004001fd) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'tunl0\x00', 0x0}) connect(r0, &(0x7f0000000200)=@can={0x1d, r3}, 0x80) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r4, 0x0, 0x0) 01:35:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) 01:35:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x24, 0x0, &(0x7f0000000000)=ANY=[@ANYRESDEC=r0, @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:35:07 executing program 4: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 327.143544] binder: release 11962:11965 transaction 232 out, still active [ 327.150710] binder: unexpected work type, 4, not freed [ 327.156312] binder: undelivered TRANSACTION_COMPLETE [ 327.240283] binder: 11976:11977 unknown command 808464432 [ 327.246146] binder: 11976:11977 ioctl c0306201 20007000 returned -22 01:35:07 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_ENUM_FRAMESIZES(r1, 0xc02c564a, &(0x7f0000000100)={0x4, 0x35315241, 0x2, @stepwise={0x6, 0x4, 0x10000, 0x1, 0xf6, 0x7ff}}) socket$inet(0x2, 0xa, 0x5) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f00000001c0)={0x2, &(0x7f0000000140)=[{0x100, 0x3, 0x80000000, 0x6}, {0x81, 0x8001, 0x1, 0x800}]}) ioctl$RTC_WIE_ON(r1, 0x700f) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) write$FUSE_INIT(r2, &(0x7f0000000000)={0x50, 0x0, 0x5, {0x7, 0x1c, 0x239, 0x294, 0x6ce, 0x0, 0xffffffffffff8001, 0xede}}, 0x50) 01:35:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 01:35:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:07 executing program 0: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x3, 0x2) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="afa7c9743a5fa0421c8619ba7399b77b10e5000000c000516e73924111085be8f7febd7c27c2607ad74ebe0088449a857b041b8bb5be6d1b61c1825dbb81f9d7eb04586d27f7eba57b683c1576f04d09fb496264a0028d5bc6263f90e18b09a69c104121f7b39af58728859cf20ed7260005b518a08808ce513c4f5abb5682364b40c34a4cdb3d0a7dde77d10e80feac78e8d01d00b5bb66302f3a536ece57e57dba0b762a4ddbcb0f332f55502a8e45167f78de28d42f64ff51bafce4e2e2ae6e6c906f32ddcdb50186bea831e91af070364e"], 0x0, 0x0, 0x0}) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000000140)) [ 327.514582] binder: unexpected work type, 4, not freed [ 327.606226] binder: 11988:11990 got transaction with invalid offset (0, min 0 max 0) or object. [ 327.615720] binder: 11988:11990 transaction failed 29201/-22, size 0-8 line 3097 01:35:07 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') fcntl$setflags(r1, 0x2, 0x0) exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 327.652016] binder: 11992:11993 ioctl c0306201 0 returned -14 [ 327.678954] binder: undelivered TRANSACTION_ERROR: 29201 [ 327.690962] binder: 11991:11994 transaction failed 29201/-22, size -1703759163822017682-8818261545243770615 line 3035 01:35:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 327.765074] binder: 11991:11998 transaction failed 29201/-22, size -1703759163822017682-8818261545243770615 line 3035 01:35:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:35:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 327.835771] binder: undelivered TRANSACTION_ERROR: 29201 [ 327.841309] binder: undelivered TRANSACTION_ERROR: 29201 [ 327.895622] binder: unexpected work type, 4, not freed 01:35:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348404dad1602da82db7f06c4dc5a69d970e3481d11405960a513239c07ab02c7a8078fcad6a39f622c37b9a2705d5d0b4ae6fd6c5a00570c5304ce5b9e0fef62082ca47a7c3264ccd9b70acd73eb8d7e3d96097e3f3a203ed634430e154422e88074d3b026402a37006460b66fdf2fe7562347486ea9aaf35dfe1f65b88c3e4277ee667220f728f05055838d679ff60c25ac2484000c9a6b0aed1281b3181fdc7f6ac03421df12cd", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:35:08 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') r2 = getuid() getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000040)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000001c0)={{{@in=@empty, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f00000000c0)=0xe8) write$P9_RSTATu(r1, &(0x7f0000000100)={0x5f, 0x7d, 0x2, {{0x0, 0x3a, 0x3ba7463, 0x6, {0xc, 0x2, 0x4}, 0x2000000, 0x81, 0xfffffffffffffffe, 0x6, 0x0, '', 0x1, '.', 0x3, 'io\x00', 0x3, 'io\x00'}, 0x10, '.GPLcgroupsystem', r2, r3, r4}}, 0x5f) exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 328.016728] binder: 12009:12010 ioctl c0306201 0 returned -14 01:35:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 328.157996] binder: 12013:12015 got transaction to invalid handle [ 328.164778] binder: 12013:12015 transaction failed 29201/-22, size 3975661008849390223--1852655801082010951 line 2896 01:35:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 328.211072] binder: unexpected work type, 4, not freed 01:35:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 328.275835] binder: undelivered TRANSACTION_ERROR: 29201 01:35:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 328.338731] binder: 12024:12028 ioctl c0306201 0 returned -14 01:35:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 01:35:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:35:08 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000000)={0x0, 0xe, "47af7ac075980a1a980ba61210af"}, &(0x7f0000000040)=0x16) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f00000000c0)={r2, 0x3b}, 0x8) 01:35:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:35:08 executing program 0: r0 = semget(0x2, 0x1, 0x28) semctl$IPC_STAT(r0, 0x0, 0x2, &(0x7f0000000080)=""/218) semop(r0, &(0x7f0000000040)=[{0x0, 0x63, 0x800}, {0x2, 0x3ff, 0x800}, {0x2, 0x5, 0x1000}, {0x6, 0x1, 0x1000}, {0x6, 0x7f, 0x1800}, {0x4, 0x9, 0x800}], 0x6) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x140) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x16, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="116467f7b59a639e31ddcd129d09418e33", @ANYBLOB="96da0c418e311f18153c30d18fad82cca6a1559c41130f814b54d5701d7d0a9c25e6e1f962f64b7a09005d6773902cf1761b2abc9c80923a4d79280f3fc9a957f940e11578675b919d304d0c4cca134eae991964e470a27939911b54f559ca6a384ab12cef67c30175beb32c25f1c49d7476e04ada824a15a6ad115bab410c48fe5af60b5321de1d3d83706dccedaa3cd9e8c9499701bddd2a1beb4ead5ba73ca70989dade56dfbbc6fd0af251573f4bda73b4fb19886a090976a280538925247d1ab70d82e20518014a34a575292dd41732d26e4eee7d2bd4522070b1deb207", @ANYBLOB="c6edeef43188c735f8c0495c08775527efbf4ee0e299d525c8b8f13bc6871cb33cf26ad0e10617dac16892107d312f89d7a0c9c2099a2ef1f4660f72fc184402b33306a93ba52bf4aae4a992310c8e1ee7f65814740a4a79f5444511529b957cd1a1714d1b10635405fec2e1de13913bb8929369029903a373f64b6735633b265cc0adec450d95d136"], 0x0, 0x0, 0x0}) 01:35:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:35:08 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x0, 0x0) read$FUSE(r1, 0x0, 0x0) [ 328.874185] binder: 12048:12052 unknown command -144219119 [ 328.879992] binder: 12048:12052 ioctl c0306201 20007000 returned -22 [ 328.947851] binder: unexpected work type, 4, not freed 01:35:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) 01:35:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) prctl$PR_SVE_GET_VL(0x33, 0x3b5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 01:35:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:35:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) 01:35:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x6) ioctl$TIOCNOTTY(r0, 0x5422) sysfs$1(0x1, &(0x7f0000000080)='\x00') read$FUSE(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xfffffffffffff000, 0x40) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r1, 0xc0a85322, &(0x7f00000001c0)) openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x4000, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000040)={0x0, 0x1, 0x2, [0x0, 0x400]}, &(0x7f0000000100)=0xc) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000140)={r2, 0x3, 0x2, [0x7, 0xffffffffffffffff]}, &(0x7f0000000280)=0xc) [ 329.353251] binder: unexpected work type, 4, not freed 01:35:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) 01:35:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r1 = socket$inet(0x2, 0x80001, 0x3) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x4, 0x1, [0x1200000000000000]}, &(0x7f0000000040)=0xa) setsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000080)={r2, 0x3, 0x100000001, 0x1, 0x7}, 0x14) 01:35:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) [ 329.705595] binder_thread_release: 14 callbacks suppressed [ 329.705623] binder: release 12091:12095 transaction 263 out, still active [ 329.718560] binder_release_work: 14 callbacks suppressed [ 329.718571] binder: undelivered TRANSACTION_COMPLETE [ 329.797563] binder: release 12093:12094 transaction 264 out, still active [ 329.804841] binder: unexpected work type, 4, not freed [ 329.810158] binder: undelivered TRANSACTION_COMPLETE 01:35:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x3, 0x2) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0x80000000) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:35:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) prctl$PR_SVE_GET_VL(0x33, 0x3b5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 01:35:09 executing program 2: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 330.041608] binder: release 12096:12097 transaction 268 out, still active [ 330.048771] binder: undelivered TRANSACTION_COMPLETE [ 330.054086] binder: release 12096:12097 transaction 267 out, still active [ 330.061062] binder: undelivered TRANSACTION_COMPLETE 01:35:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) [ 330.084629] binder: release 12108:12111 transaction 269 out, still active [ 330.091900] binder: undelivered TRANSACTION_COMPLETE 01:35:10 executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000040)={0x0, {{0xa, 0x4e23, 0x5, @remote, 0x3ff}}, 0x1, 0x8, [{{0xa, 0x4e20, 0x8, @local, 0x9}}, {{0xa, 0x4e20, 0x800, @local, 0x9}}, {{0xa, 0x4e21, 0x6, @local, 0x2}}, {{0xa, 0x4e22, 0x5, @empty, 0x5}}, {{0xa, 0x4e23, 0x2, @loopback, 0xfffffffffffffffe}}, {{0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, [], 0x21}, 0xfffffffffffffffc}}, {{0xa, 0x4e21, 0xcd, @loopback, 0x3}}, {{0xa, 0x4e23, 0x1, @dev={0xfe, 0x80, [], 0x17}, 0x1}}]}, 0x490) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000640)={0x0, 0x0}) r3 = syz_open_dev$sndpcmp(&(0x7f0000000500)='/dev/snd/pcmC#D#p\x00', 0x3f, 0x2000) r4 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x2f, &(0x7f00000005c0)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) write$FUSE_STATFS(r3, &(0x7f0000000540)={0x60, 0x0, 0x7, {{0x5, 0x48c, 0xc286, 0x2, 0x9, 0x6, 0x4, 0xc5}}}, 0x60) tkill(r2, 0x13) 01:35:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/196) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000000c0)={0x1, 0x5, 0x2000}, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 01:35:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4040aea0, &(0x7f0000000040)={0x3, 0x3f, 0x0, 0x0, 0x80, 0x1000, 0x9, 0x5a, 0x4, 0x4, 0x4, 0x9, 0x0, 0x7, 0x101, 0xecc, 0x5, 0x6, 0x3}) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0xfffffffffffffdfc) 01:35:10 executing program 2: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) [ 330.493440] binder: BINDER_SET_CONTEXT_MGR already set [ 330.498810] binder: 12124:12128 ioctl 40046207 0 returned -16 [ 330.565189] binder: release 12124:12136 transaction 270 out, still active [ 330.572330] binder: unexpected work type, 4, not freed [ 330.577640] binder: undelivered TRANSACTION_COMPLETE 01:35:10 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x222000, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0x5) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done={0x40486311}], 0x2b7, 0x0, 0x0}) 01:35:10 executing program 2: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:10 executing program 3 (fault-call:3 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x1000) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/current\x00', 0x2, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vsock\x00', 0x66a200, 0x0) read$FUSE(r1, 0x0, 0x0) setxattr$security_evm(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.evm\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="18130d43"], 0x4, 0x0) [ 330.764369] binder_alloc: 10623: binder_alloc_buf size 207827006000 failed, no address space [ 330.773277] binder_alloc: allocated: 2240 (num: 145 largest: 32), free: 10048 (num: 1 largest: 10048) [ 330.782924] binder: 12140:12142 transaction failed 29201/-28, size 0-0 line 3035 [ 330.790545] binder: 12140:12142 ioctl c0306201 20007000 returned -14 01:35:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 330.894855] FAULT_INJECTION: forcing a failure. [ 330.894855] name failslab, interval 1, probability 0, space 0, times 0 [ 330.906345] CPU: 0 PID: 12147 Comm: syz-executor.3 Not tainted 5.0.0+ #12 [ 330.913322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 330.922717] Call Trace: [ 330.925382] dump_stack+0x173/0x1d0 [ 330.929078] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 330.934336] should_fail+0xa19/0xb20 [ 330.938123] __should_failslab+0x278/0x2a0 [ 330.939341] binder: undelivered TRANSACTION_ERROR: 29201 [ 330.942440] should_failslab+0x29/0x70 [ 330.942498] kmem_cache_alloc_trace+0x125/0xb40 [ 330.942553] ? binder_get_thread+0x406/0xf60 [ 330.942610] binder_get_thread+0x406/0xf60 [ 330.965355] ? binder_poll+0xbd0/0xbd0 [ 330.969315] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 330.974560] ? binder_poll+0xbd0/0xbd0 [ 330.978500] binder_ioctl+0x56d/0x2d20 [ 330.982451] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 330.986691] binder: 12154:12156 got transaction with invalid offset (0, min 0 max 0) or object. [ 330.987888] ? binder_poll+0xbd0/0xbd0 [ 330.987938] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 330.987991] ? binder_poll+0xbd0/0xbd0 [ 330.996976] binder: 12154:12156 transaction failed 29201/-22, size 0-8 line 3097 [ 331.000765] do_vfs_ioctl+0xebd/0x2bf0 [ 331.021297] ? security_file_ioctl+0x92/0x200 [ 331.025852] __se_sys_ioctl+0x1da/0x270 [ 331.029895] __x64_sys_ioctl+0x4a/0x70 [ 331.033848] do_syscall_64+0xbc/0xf0 [ 331.037632] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 331.042885] RIP: 0033:0x457f29 [ 331.046126] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 331.055082] binder: undelivered TRANSACTION_ERROR: 29201 [ 331.065461] RSP: 002b:00007f7d0fec6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 331.065501] RAX: ffffffffffffffda RBX: 00007f7d0fec6c90 RCX: 0000000000457f29 [ 331.065526] RDX: 0000000020000440 RSI: 00000000c0306201 RDI: 0000000000000003 01:35:11 executing program 0: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 331.065549] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 331.065573] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7d0fec76d4 [ 331.065597] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000006 [ 331.065999] binder: 12146:12147 ioctl c0306201 20000440 returned -12 01:35:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:11 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:11 executing program 3 (fault-call:3 fault-nth:1): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 331.312264] binder: release 12159:12161 transaction 275 out, still active [ 331.319435] binder: undelivered TRANSACTION_COMPLETE [ 331.324873] binder: release 12159:12164 transaction 276 out, still active [ 331.332277] binder: undelivered TRANSACTION_COMPLETE [ 331.371829] binder: 12163:12165 got transaction with invalid offset (0, min 0 max 0) or object. [ 331.380917] binder: 12163:12165 transaction failed 29201/-22, size 0-8 line 3097 01:35:11 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="3923f8fa0000001a"], 0x0, 0x0, 0x0}) rt_sigpending(&(0x7f0000000000), 0x8) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000040)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_DROP_MASTER(r1, 0x641f) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000100)="01d3aa1399f7af4320a2c7026233f700ea3ecb4005da873ca0b32a3cd8801b3c5ebe1980dda8683f825903c41b2f20c75ec0875e9107dcd93a7b5a3ea05e7c8b8bb6b6ee24c8b1c0519317483862f096af3642338d448f2e7e569eaca26c28227a08a39bf5c10fd60b5a1a67a2e4874921ba17ab4a37664e5006b13e37fdfe17ea1f4039be15d620457298d2c3829d297ed206f4b66d83d1f5a45342edfd2b40f74f8b3de81f6e71263930bb08b329124fde73bb963df3af39452d14398a091116c8e00acf75473221bb5f13b1b611bcb5f9b1bb22fcab50881ba657ccdf646a61d7dc95ae19346d5fb141808dc2c15769f776bdaefbbe889536dd14d71247a5") [ 331.471495] binder: undelivered TRANSACTION_ERROR: 29201 [ 331.526531] FAULT_INJECTION: forcing a failure. [ 331.526531] name failslab, interval 1, probability 0, space 0, times 0 [ 331.538122] CPU: 0 PID: 12170 Comm: syz-executor.3 Not tainted 5.0.0+ #12 [ 331.545096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 331.554490] Call Trace: [ 331.557150] dump_stack+0x173/0x1d0 [ 331.560839] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 331.566092] should_fail+0xa19/0xb20 [ 331.569882] __should_failslab+0x278/0x2a0 [ 331.574182] should_failslab+0x29/0x70 [ 331.578143] kmem_cache_alloc_trace+0x125/0xb40 [ 331.582880] ? binder_transaction+0x40de/0x13e00 [ 331.587726] binder_transaction+0x40de/0x13e00 [ 331.592483] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 331.598240] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 331.603707] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 331.608965] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 331.614758] ? process_measurement+0x2489/0x2740 [ 331.619624] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 331.631529] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 331.636815] binder_ioctl_write_read+0x1648/0x1a560 [ 331.642162] ? should_fail+0x191/0xb20 [ 331.646125] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 331.655073] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 331.664188] binder_ioctl+0x759/0x2d20 [ 331.668624] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 331.676095] ? binder_poll+0xbd0/0xbd0 [ 331.680142] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 331.687747] ? binder_poll+0xbd0/0xbd0 [ 331.691730] do_vfs_ioctl+0xebd/0x2bf0 [ 331.695784] ? security_file_ioctl+0x92/0x200 01:35:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 331.706445] __se_sys_ioctl+0x1da/0x270 [ 331.730176] __x64_sys_ioctl+0x4a/0x70 [ 331.734136] do_syscall_64+0xbc/0xf0 [ 331.737932] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 331.743468] RIP: 0033:0x457f29 [ 331.746748] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 331.756491] binder: 12175:12178 ioctl 41009432 20000100 returned -22 01:35:11 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 331.765723] RSP: 002b:00007f7d0fec6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 331.765765] RAX: ffffffffffffffda RBX: 00007f7d0fec6c90 RCX: 0000000000457f29 [ 331.765789] RDX: 0000000020000440 RSI: 00000000c0306201 RDI: 0000000000000003 [ 331.765814] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 331.765839] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7d0fec76d4 [ 331.765861] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000006 [ 331.766318] binder: 12169:12170 transaction failed 29201/-12, size 0-8 line 2975 [ 331.842653] binder: 12177:12186 got transaction with invalid offset (0, min 0 max 0) or object. [ 331.851897] binder: 12177:12186 transaction failed 29201/-22, size 0-8 line 3097 [ 331.879604] binder: undelivered TRANSACTION_ERROR: 29201 [ 331.889981] binder: release 12175:12178 transaction 281 out, still active [ 331.897340] binder: undelivered TRANSACTION_COMPLETE [ 331.902664] binder: release 12175:12178 transaction 279 out, still active [ 331.909641] binder: undelivered TRANSACTION_COMPLETE [ 331.986679] binder: undelivered TRANSACTION_ERROR: 29201 01:35:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 01:35:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:12 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x101000, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x8) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) syz_open_procfs(r2, &(0x7f0000000040)='net/psched\x00') r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x2400, 0xc) exit(0x0) read$FUSE(r3, 0x0, 0x0) 01:35:12 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 332.189433] binder: 12289:12291 got transaction with invalid offset (0, min 0 max 0) or object. [ 332.198632] binder: 12289:12291 transaction failed 29201/-22, size 0-8 line 3097 01:35:12 executing program 5 (fault-call:2 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 332.313241] binder: undelivered TRANSACTION_ERROR: 29201 01:35:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000000), 0x293, 0x0, 0x0}) 01:35:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:12 executing program 3 (fault-call:3 fault-nth:2): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:12 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 332.515731] binder: 12343:12344 unknown command 1986356271 [ 332.521757] binder: 12343:12344 ioctl c0306201 20007000 returned -22 [ 332.587596] binder: 12343:12400 unknown command 1986356271 [ 332.593565] binder: 12343:12400 ioctl c0306201 20007000 returned -22 [ 332.595107] binder: 12361:12392 got transaction with invalid offset (0, min 0 max 0) or object. [ 332.642861] FAULT_INJECTION: forcing a failure. [ 332.642861] name failslab, interval 1, probability 0, space 0, times 0 [ 332.654392] CPU: 0 PID: 12396 Comm: syz-executor.3 Not tainted 5.0.0+ #12 [ 332.661371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 332.670783] Call Trace: [ 332.673461] dump_stack+0x173/0x1d0 [ 332.677156] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 332.682426] should_fail+0xa19/0xb20 [ 332.686233] __should_failslab+0x278/0x2a0 [ 332.690550] should_failslab+0x29/0x70 [ 332.694521] kmem_cache_alloc_trace+0x125/0xb40 [ 332.699261] ? binder_transaction+0x4261/0x13e00 [ 332.704079] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 332.709528] binder_transaction+0x4261/0x13e00 [ 332.714179] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 332.714201] binder: undelivered TRANSACTION_ERROR: 29201 [ 332.719691] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 332.730526] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 332.735791] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 332.741241] ? process_measurement+0x2489/0x2740 [ 332.746079] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 332.751521] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 332.756790] binder_ioctl_write_read+0x1648/0x1a560 [ 332.761970] ? should_fail+0x191/0xb20 [ 332.765931] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 332.771378] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 332.776917] binder_ioctl+0x759/0x2d20 [ 332.780864] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 332.786294] ? binder_poll+0xbd0/0xbd0 [ 332.790239] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 332.795493] ? binder_poll+0xbd0/0xbd0 [ 332.799441] do_vfs_ioctl+0xebd/0x2bf0 [ 332.803405] ? security_file_ioctl+0x92/0x200 [ 332.807969] __se_sys_ioctl+0x1da/0x270 [ 332.812007] __x64_sys_ioctl+0x4a/0x70 [ 332.815943] do_syscall_64+0xbc/0xf0 [ 332.819720] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 332.825055] RIP: 0033:0x457f29 01:35:12 executing program 1: r0 = socket$inet6(0xa, 0x100800000000002, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') sendfile(r0, r1, 0x0, 0x88004) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x6, 0x10000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x10200061ec) read$FUSE(r3, 0x0, 0x0) [ 332.828301] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 332.847255] RSP: 002b:00007f7d0fec6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 332.855027] RAX: ffffffffffffffda RBX: 00007f7d0fec6c90 RCX: 0000000000457f29 [ 332.862338] RDX: 0000000020000440 RSI: 00000000c0306201 RDI: 0000000000000005 [ 332.870163] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 332.877485] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7d0fec76d4 [ 332.884823] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000006 01:35:12 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 332.892563] binder_transaction: 1 callbacks suppressed [ 332.892597] binder: 12370:12396 transaction failed 29201/-12, size 0-8 line 2986 01:35:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:13 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x40000, 0x0) sendmmsg$alg(r0, &(0x7f0000001fc0)=[{0x0, 0x0, &(0x7f0000001100)=[{&(0x7f0000000100)="8917bc22bd9d2415284f7f154b9d709b6e458fbdde088c68bc4c88742e9cc3ae06ca00ebf3340a5fc30c594fa3b05ef3b82aeb3be5f69e9f8c81fac5e05f53446d40e3c3bfcf3d8880b5ef5e5e036b4c833c7a467475f233f5c4449dc874fe30007066c2cc1120b9f27ee877d3bb86fbc534a36dc1d2798d807488ae5b0e0caddebf0c34569486a85e046b653be97ba004e4e8748aa397901b9be7cb8d30583e30308577829d73e06875c168b2404b0eae3fe8d4e03063157acf9077b04fa1aa3712a9e721f44210dd76bf3feb336071d0cc6b76573b82745855f137c08964ae51e4099a006f27a243d14acf3f91d269c9c24c2815306753a0a09cddc9e471582f99966f6924a3c58a1ea38484deffb660076d5ace5f094d37a35823b0405e7f727aa0aa2581ec13b1dd07a02079d429fd57d1b22a2b320876ae2c998862c63413fe9c840ea9793bc90a5401b997ccd71662e53706accd68c877047a9b4723d9bea976aa027d291c4644a3b8595eb2f1df39b594d7059c2aca0847c882a330ce2ee7f0028073898b49356d396a7d0bb7fe66dbb28b2273eb12bfdb47fbea02b00e649529f5176558e784925e893c2b17c6c567628c59b0ba858329215c5fe6bb1825eeec2fc3367379947934bc99114a80bacf386cf5fac43fbb6b00cde1624dd4df49908f2e421449d29063cb62152f02a4bd370a1348295a344d42074baef6ea2fe0183e226235106d3c5288c3d8635f4eb7287e82002f47fec9d10b6d722c6eac22d15c277b008056e304def553c13009b6f4a2a7fc5f9df9bf076bad685cfacb2e61bb013f47ed9e88ec432fd10e386b1f88c5e39de9a80b5aa5bce0c955eed284a2d42bc1f6b8488c50180be3911f4d6754b28ee5e669cfb9d2551c0cb9bce025a9c9e1655f372358eb79e096e9f81a22d6f91e13150d43fb4e98bec278f8e22a9a82c8abf4a0011e3a4b663786ed88ab0a9fe74b5b1d2c225ad3876c2b872d883374ad13a2396efbfddce25aacefbc92b0bfa950b7e80243d443c846ef098dee25cdf29d59c8aa21a6ea49826731bc54d33326bf5db0309e1e9324a1465f881c3fd57df4b09f1c9d0082525a5c35d303c048a238dc05a1e4eda22a6e10760935d91cc093dea5073eb4046bdf42f9d922790ddf9bd355728ea38e42a3a5a539a3b663ca4a4031e8c9ff983e17311e47f443922254e0e7897b51d0b48700a7cedb88ac68a928084b90de83bc962a5d5c2d5301de78f999116b3c91768b550bbff88cd69ea297c4706fda4b294609118d924fd5fce9dc0d63bde04e3f15a9e7959e317f735adc206145b5e56596d8dbdd1931464f30736ba57cb9826e40f52f6332ad87c90391a0c0e57cb986784c653dc2603910d7ddab81377da00db08893e0bf132349359aed553cad514e804556e43f794841deb019a4f21c91edf990cbc7e649ea987fa7e1428f275abe3b680bc7eba89985387934c83df95f680e738224bf33847f15b1707fd6a186b374efca4542a2ce1784d29910070c9666b9b3224269b2a84ff4e5a6e6d55906a471a6496371aecaacf3a4757f2ad04b47340261fe5f3366f458654d24dc0315a918e74f5ff7590aad97f027d11c9c4cf5e805d6802e8a7b7cdef94f7d154932e438bc5ec2b49b33d3fe40908378da87b38541d53fef4d501443d77a96500010204e4d15071e63141d5c02e87b070196aebb85ab6080ee5c0745e9bcf8f595c565005f4397b8e43b6caf6c6159923b99c640352d8ae78c429e6f0f01036cb05e36f7a9a2b6b6b832365f42dde9a4d56c14c67927817ec142f3357fb237df3e83c873e71876d2853136f49dd4049d62afc7eac39594fa5f55ac2872e82fc51adcb915fd2f14d47fddd536feb4b453196acda37d7cb96a0f946c714d7cbbb7f25519cdeb6f77159dd968aca4164404687ea7ead12e66a3462bbe5d92c1127fad22a5a36ad564bea8d59ed05d0732117e2d83b98ef18539141a9e8b3df7658620072b37e1dff9fa3b691750346bde20a48cd58addf6027817657d133028598311189fe5a389ca838170a5f42a61f6e821b59820f61cf08fcbcbbd45644e785a8abe2cd819e1d8b381ccd401dffa2735860c51ba0c1e3c238e83de0373ddd034dd65dfcf51c2c0d9bc882b7a7d73bfe4bbf073e0de3e40e7352b8c137fa4229e893a02eca25641b2c4117367a1242ff161acc3bea34a4b23594e35c7945db98056e928144f0158f4346f2d8ad3f31fad66278d42a8ddef28f8c8126f2454f061a568ea12f961bb33b350731d8bf16fd848df4fa999b355c00036580f8ee6a56c5f27b90ff598190e3ccc6438915bff0cde163019258f95984327eb5041dcddd39831a27384d33327072b9e70254dff721d87c1df5a2349aba28b5dfcf61b41372748fe7bd44167b043c3592288af532ace584da146a2e9fde976c80a424e3dfafdcacd807056134a9a7863ae6c366a15a77fa632af9910622ffeaacd515c0f71676b440d19ced2d75661811e94f656abbc91ea21a590b20d2ad1cb03f514c3c0f5db3ec1f5e65da4fb52888ffbfbab243438f6879702d72f0ecc565c239919c4b6c6ad23013a022f5fc6fea229eef0f5191c295d41dae9e436d2df3c8cd760d00b9d1e36e55e93a75a2f27554d0df8c5cdb92f643a7be07d75a685f2cfc3d0ad5b115236c20f85daf2362af6e39284081b26127da58a937864e9f4d620c12119e8982b2e493a641575185ee904f530f73d65d41fef3e3e43bc749decede105f1c73655ac4ed139e6840a3702123b1faab5ce32cfaa3ae4aedc0121ece39b2e004c74fcb877ab6091d2874726117460bb2781845b71f58f27643804a0a5d2bd8b1dd3b78811a8934bcb464edf392f7db3fd3df522031b47ea3dd474b247ee7a67c45b778eaa6f13337dcfc6f664ebfce4758dfc35dde6752870b997eddd745535e2611110696fb658fbe2cd36564acfa0d00781b9423d5d91b23eca717ff922ce5af9ec7a2001b3a56d624d5daf4bbc1bc07e7dfd752645c9d3e742a7f970ab8200d0a6d1bb7b2da58ee80d2716feb4325a1fcff6800d33de2927febe539d13daf1443a627ffe7ec7e89174c7c9406e874176dad30c38635ddd8888823df457d55f2878ce81ab71f1932f9128dd5cb94ed016e0ee5fa3923a1cdd1ac6e9b8a77ed26fde2768c348217a403ab247e2a70d167d8d22470d43a4b9bed78902ee47f9edc9f5092fa51d965303a92aeea544da12deb211ac5b5436d6294244fa7a66a5fbfcb9c9636acb8aae96f6fd619a1848c011fdbe31936cfdaa46d90845a1e5faaf420e6c8bf13010a1d46704234789fcb48994c1a979d1e556a6b01e9366bc370c14159a881515b4f2345c5f68d6a4de5f451a910bd20fdd7739654371730bb1f6ff3f72e3d2ca411c5c763da2a494e0bbf7573dd392ab3b72e54530c130c36bf90742d130833d93a427ca27ac44922cf71aa17b3c68e2b59ac7ce009f2a10792460acc032a0e0be8c05ddd58f36ba258f8e8cb2496128e798192260ecae09145f234ca3fee47e857046d3fd586dc0c3a5e4ed84b2fb3cad0b6e175b7368fc90a541acd75dac22b9bd17a7db7f33e5845ec2e9e4476de8d90bf1ef960bf3960b11688b00e3e541d8410e2b557f1a251c732ecb64044719a78ccf82da98909b65bdbcca756991243f84f16ceb7ca65d0d7c339d80611a189549a5740dd6e0d3a6cf6c11a6693dc49d2ba585e94d111aba75013618b6cfff528867e6a44de23d6839d7d4c4011f058dad3d2fc92e6e57803ff2341d5859fa3bfab44954b2f7da7742cc07c0ad89eaa61e3f1c9b7b90d193737ac1840e8e14f0d16e994a21ce12ed25e395c17df00d4f18e8247e4c5b45d0f8a15e22e67869b4a5cfacd7453bb8bbf5355f472d7707b7d0a540395fa0e164342f19cdb031c3a8ad6f05279b6c47b107df466c8231c3243e7f36e09be1ef3d068015b810c0090041459ae5d0d60945acd7916a8fb95f7c099c19cdf2c4426722f256eaa475205db65bd4140d2798f78c525634274c6893e8c782cabd409db1e34bde1282ad36ddfe5c7a6fdac49f4ad7713ccd257eb16c99f2d063b21abbe584827ebd01bd749bc76eea7f64b4b616b62ecb9a83825aaee97f64483f662bfd7a369505576e1cb0d38646756b146906c34d5ec00e896a9b0f62b86c9c3bf48f00d68eb1397f6e414dce5eb00237c8dda88815499a234206242ecd0120c5ac72324075a0938cce85897d2b96f1570c3cd0381442f5b1b986101c0c4e7bda1c73b24d7333d9d9b2799d15d50269220bda6b77004950eec567d07797b16b2d993fcca95b82d465e65dec0d80d50aab5b149db3404758f07e95051f1a2a1b8bfc98d33989daccb8a0f7962bfd057cfcd9a28a6f9555cf22fb91a48a592d82ceea3edb79d6083064f97401ff22f533b9d043f38f223bbea567f3f5a638f9a2c048fe0dc056843a0e58bc5d8889dc564926cd4e0f8261a34296b6aaf2c4699a89d12a448192cfe19c2ae77e6c5afdd8dacce8ba45abff977cada1a13f71c31bc821e63a60cdc0da271eb341846f8e4d6fe1c3fb127cf7eefe1d9ae7d3b8acc11cf13ddfdfa0cc199976cb6e0bd31be45e2ee649060476bf99197bc3b847590549d84c2f04556c9befecb43a5971be4656525e40b90d20bdc47fd1b8b9b151923bb67e552cfc0fd865de96d669c1b8807d1abf23616ad872e2b5ff45118bcc31507c53b5fbd527bfc2a52464b2f66066d446f2cd3280b752d36f709dd7655da65d600ed1a43d458792caa800a9b2f499ca7ff21d21e55839f38838f338e0bdd722f7d7c3084832fcc7a5a838908b09d0ab05f5d59e2be53d9a8b625977567ba099b148bfa5fa26d7c3a04d117e07d29032805e7c9ab6ba1c4a2f12ae0036183d768baf3398572eaccd59acfd1caf4c87ba13f857772df33f8c93b7a612e722a90955664679cf7db5639ae409d1531d617832a76caa79244e74485f4bd35312820f5ca91cde0b5be4dc49ed01092db36d6e509b998ec563f6068bfb17f3c60dfa3ae55234ce6b47a02c06cd9f1769b3885b185f076a7696331a6c03c5a46be17d2cef4dff9902fe6540673e7c70a77c233d8c4c8bc93ecad87948b5407100723b8247f93f40665a90044c0d8673d9cf7fb237cc85d2ee8d344cfa9b1f975b1d2233094c9b78a4babd20507546730deb693237958a0450a0237b5cabc853baa794cd44d82e5f79f79ede92228e567dd2787a3b3bb854faca49d25445d86bac89a07b705cd752a2e61f16be3111d1f669d20dba7f3f56d415d313c04f523516510ccfb820b9aefb68029849f1402fee3e6bcfd6a376c8db73c04c1944d6cd3aeda733a27629ff7a5bc0785bc6cba6d02cec4ef816eec8dea2d7927deb2d73cc487b8f558afc674e9f8a14bacd7f8781147cdbfee165b1c65945bdc6eda058c42bcf7a99f73fa7378f30a9e6da0f98bf4f3fac123953030fc2977ebb2af6c4caadc5fc89bb51e136d9bac52e830fb13047c88de087b34d61231e10d505c637c46c0a36318cf982e2c6f313e3d104e04fdb9b3df22cae0551169c721f9686d13f3e3be586ec91602c1063c89fc15dbeb3207bdbbf110baf17cbcb0e4f2ff9f3b32330d8880ce0f59a815d147a55ef8a604653206d8e7dbdabdcd9a84fb269f28ece8cc9e57e888788d1dc78bcf9dfdd3ee6fd11c58dbee49439038efaa26897ab8fd71c17964871efb237609a2bc3de9fcb1f27911e11dfba96a6f08a0ac702be0da378fe2baf45f78b70", 0x1000}], 0x1, &(0x7f0000001140)=[@assoc={0x18, 0x117, 0x4, 0x8}, @assoc={0x18, 0x117, 0x4, 0x2}, @iv={0x40, 0x117, 0x2, 0x2c, "1ecc61e067a92a1dd242445b352e7bbddfa1cfbef37525a3022105a2b8cc8503780832ad62aa425f9b552f18"}, @assoc={0x18, 0x117, 0x4, 0x9}, @op={0x18}, @iv={0x30, 0x117, 0x2, 0x1c, "1698234916442ce046c04576d6bf2a81aee015561e94024f24dd751d"}, @op={0x18}], 0xe8}, {0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000001240)="5f16a9756fc1cd088b8af1c5b004b65704b09c072d4e637cc83112b6cf2b0489ab7ee0335e31eea3c2d4ff527109a7d0171bd5a2d2c233d667a40edfce83cece58af99ec4aa883795d6c0907217868fc2a1d952577ddf701c35f7082d828ab4c3924854c9a85d3b441eaf4ed38dc321796b088f9e569240a1258d0ea433b39848ba672966f683f4790836971b4c5d9ad65219cdbbd6b901b5df73d81835bca9f318191b01e2ecb23bbaf415bfd935d26750f0d90cea515faf475b80d36a8eec8d624789df9e01d5945784b051c148cfd5f3fd4d87d8f979057b244f8f60237871b", 0xe1}], 0x1, &(0x7f0000001380)=[@assoc={0x18, 0x117, 0x4, 0x2}, @op={0x18}, @assoc={0x18, 0x117, 0x4, 0x10001}, @op={0x18}, @iv={0x60, 0x117, 0x2, 0x45, "c61c78dabf15127dcee15bbac7601ad5e02eff48bfc739254135bf017a1bc5def4d5729c35132ea760d2db1460068482f3eda9e6c9b82e8e9263a5fa7c844a884cb49528b8"}], 0xc0, 0x4000}, {0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000001440)="07f49e90c19476e2b229b47a3c2644c06b891a0e583814db1cc0a36665b519dc87b0f0d0afe88b74ecfb814300bb00ae7353f5a30403a84066c5a97cac0999fc931f38c585c5994dffe195fdf7b5bb5fb51f01271d909f81fc178b8f6a8bf85901db7fc50a5538435c2a", 0x6a}, {&(0x7f00000014c0)="052cdde9496e26ef3697eb211878a43c5e7c32128abe29fce8df4f6302e7573cc50044ea648a2bc0b3bb7c886906d6968b320f8f82618aef817269c696d476f1547082501ea2bfe527e2ed0efbf4a77722080e48c4eb7af59835b960e5d0704407febce966bd8eacb303c1c8fae788ec771e9dd04bdd3d54ca107da1d162cbd80af72af82acd98381a892c8afea464518e26a85c99a0a6e0b6e44c951c3a12f7b406f0003feb0da9d775d5f95b9e233c0a2fd04b5c4fca130e8f188bb8c8d1b4c932e10e9967bffcb37237f2cc2edf75ef5ec38372a567adacd3c05c3c687c3ee0df01a1a1fe06485393f1fd98cedf", 0xef}, {&(0x7f00000015c0)="19ccbe26239f858dc99f923d026c628cbcb8715e57eeb5a17267e177fcf4c2b96dc7dd36a603224e2d9baa115e0e60", 0x2f}, {&(0x7f0000001600)="e2750165366d6bf5d69956bf7c0d91c853d63ef19961209e2544c34226a78f06cd04e5e6ba20a3eb5847f3a4bd782b31917a9f52424d58fd1b8cc34d8c1dfd8401d12122e4610cded983ca5161604435346bd9a239b162009cd265188308764f1443d33f8c522c4a3b026338cbd269ca8db4664e075c2441cbcb9c4f8d95a639a160bd1eba75fa5e13ea1c", 0x8b}, {&(0x7f00000016c0)="670ad61f1a0df2973d0e1e9dd3e33d844a952951253daf44a34733199aacc8293966908d5469e27d2a66805e92856f6be20e0bbe5afcd56479dd3e49d0bb0b4ae7f53f32c09bbe36451ab1120a06ea3a9aa3e6cd7e5bb461aa8a42f8a3b8863f146da9410d40792a8d6de92577b7f5712cc1bd813aa9ab63b5f24526", 0x7c}, {&(0x7f0000001740)="5dfbaec4a7fac7fe836c4c8ad3900c7bdbc2b0ca7bf3ce901b5d3829b4af4f3b80a86b86920e3a1efe7ccd4cc736f8d09a6174a0b869d6e92d6f7075bfc921c9bf2f88432bce0a0233c40ec530bf8f51a64ba8bf602c8d5db63acc067369f04a9297f9b09f3355b2f519c31fb1f3b7a84e23876c4c998d31f56a20367342bf589cdd6a241b55555474d6e02f842e236b6d65cdc764ccce10b35f37f5a7894a02da55957367a6f04d", 0xa8}, {&(0x7f0000001800)="aafef2a5a4f221633329c56ef20f08280be5b021ac18c77cafb29f10e022fa9518504084c2fb4b26e14ddc9810932fa0b8d54e1535bb86f7f2b1e08debcded635213ad6cea684daed4693dc0b2b11c5a9cc99a6716b8f49f67252ee67d6bbff25bc1649e47a9ff9dadcbef4e5af080051a6a7a0a", 0x74}, {&(0x7f0000001880)="80d6ed1a795c59bbf0752b2111dcf73919c9de80c4db90665e4548bcf8b13e623fab46bc8c2517c81981d3cd2a89594b11fe459004776d299aa71cef3b9ce26f9f7efd51c6ee7e545f11cab58f98da9964fd9585ee7655e0710a1256b030d480b5010c9fdbdb89f386adf9c0cfdc5620df3b463e3ab66052af63f9d59084b0a29a39a107058072b3fb0a5abf0d52782a69d947a732437a7821760d37be780dbdae189a77cdca17", 0xa7}, {&(0x7f0000001940)="a8353db6525169dd6cd05a86db810e8035bef20029062146fb5ace2f4ea24e3d8cb88c9a7f50b04918ee8fd28e14207cecc0769524cedd3b28d2203edc179db82f4e09d3f8c7005ec121044bf749fd3b2b7d70e92e9f3fd06e66ae84a00a321825716545d6378e4d5549cfda06e3fde818e3a750f065e35bd61efaee69fe4f83bc00b169de001fc1e6f067efda0a0d3f3f3b758885070fb8f90c8f87e4bab46e37296a175e92391a72cce1e24cb67e13c019f010404620f70ccfa3ecf3232d39400b274b9249206d6be288094af96845761a8a8e0cdf640a0951406d7a6e18e022882736cf5862fa652f65bbba3fba6e734b0a", 0xf3}, {&(0x7f0000001a40)="da080c9c5a275d3d98d26ac4df0c9b942afbb227a8c33537864736678eda94bd768533c124ce5dbbb092af582a6066f7ce8512ca6a818e8598f5c7d6ba67ef15c318ef093bbdb803be1e6f916469b78702060197c52f470522826850fa219b7576b2fdd10226458d624e7cb0406c345581", 0x71}], 0xa, &(0x7f0000001b80)=[@assoc={0x18, 0x117, 0x4, 0x1}, @iv={0x50, 0x117, 0x2, 0x3b, "a620ccce2a3f2ee3349cc76935119685ce0f9d9e394c9997d0ac0ac39a181d24166a5e7d6744efcd6dd3aecd65cfa4dd821f8723b4daa847668008"}, @iv={0x38, 0x117, 0x2, 0x1f, "e84265ffbfdf692735eb293a9d3c2ca934d1f6e8495a0ffe78d0ab34525168"}, @op={0x18}, @assoc={0x18, 0x117, 0x4, 0x7}, @op={0x18}], 0xe8, 0x14}, {0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000001c80)="9a0ec8ae97151634cf5e2509a56ed75f4b2b1de30f1950842403e3e5394e6f708dfa13b008ce47ab291bf4b38c5096369a8e0332b6bbe480080544e4fa73f8bdc36d7884210d1eaa683fddda030030708d174add358a90f2b5d429339159ee0abf214db535d979cb552e09712766a09c7ecf62dd801bf9cab8a6074d730452e2835758dda7530d970c6eb16973569b7de77a36c5e4027e4fbff3d526717c17432dbeb5c3b1e7e622d1", 0xa9}, {&(0x7f0000001d40)="dd7bda621fb9d6adc3a87cca6727f70f315edb2866f318651dac08914c14c7b1bfc7f3224157cc068a3a01fa904e873c364e2dbf7004c52f1e9a25448ddc21e64d2db5e61c73be1432a1d52576a6a29a65cd92da5691e6e2aadfa2ba7689292aebe9d6d6b52a95ac694c834e5e3a76849cdf89492c2d0d699a8d2d109e1513242b59467b3f31e707d3350788b6506686fcadbe021923974d2c1e015b9a939450c45f7d020e04dbf2f33aed41338f75ad3265fb969ff2d2041ceff9033ec07514a56c62fba71949aaf3cdace490353aa506516152c42793981407632f3246809c0ae98985a4a726b59958e6bcf036cf186142", 0xf2}], 0x2, &(0x7f0000001e80)=[@iv={0xe0, 0x117, 0x2, 0xc5, "4b7cf746267a5bc53b3594064c697b6dc66f0656b43676d27ae081dcfae4e91db2e52ae41b62499284a711d9fa691a5df27ffb84428c81fc0640549f29b89980474e426835376e530a618d5ba3a5a08d9954acbbc95cebbe8587794e7eed1fc9d8cdbaf3498c100018cd1282a7c46595b00fae4698f9a8b04da0c47f1e1caa9e963e6b6c90c33a36630507be355568aaa6c63762e194fe5d7e3b58be4beb6539593cabfdc172b61458f113e7f921c368b1a75a14fc3f776e6ea1081810d7b372080a6ebd9f"}, @op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x5}, @op={0x18, 0x117, 0x3, 0x1}], 0x128, 0x40810}], 0x4, 0x40000c0) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000000)="7013d901b8f17bf7370c1d2481661ecb150c31cebdcc9cb6aafaf4f2071f1e910e19dc8c8174aa2e86e9942cb8", 0x2d) 01:35:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 333.155991] binder: 12442:12447 ioctl c0306201 0 returned -14 [ 333.198964] binder: 12427:12464 got transaction with invalid offset (0, min 0 max 0) or object. [ 333.208094] binder: 12427:12464 transaction failed 29201/-22, size 0-8 line 3097 [ 333.223674] binder: undelivered TRANSACTION_ERROR: 29201 01:35:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 333.306207] binder: undelivered TRANSACTION_ERROR: 29201 01:35:13 executing program 3 (fault-call:3 fault-nth:3): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 333.410857] binder: 12531:12532 ioctl c0306201 0 returned -14 [ 333.517724] FAULT_INJECTION: forcing a failure. [ 333.517724] name failslab, interval 1, probability 0, space 0, times 0 [ 333.529186] CPU: 0 PID: 12536 Comm: syz-executor.3 Not tainted 5.0.0+ #12 [ 333.536414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 333.545810] Call Trace: [ 333.548500] dump_stack+0x173/0x1d0 [ 333.552213] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 333.557471] should_fail+0xa19/0xb20 [ 333.561265] __should_failslab+0x278/0x2a0 [ 333.565572] should_failslab+0x29/0x70 [ 333.566612] IPVS: ftp: loaded support on port[0] = 21 [ 333.569534] kmem_cache_alloc_trace+0x125/0xb40 [ 333.579441] ? binder_alloc_new_buf+0x1d92/0x2f70 [ 333.584369] binder_alloc_new_buf+0x1d92/0x2f70 [ 333.589121] binder_transaction+0x5961/0x13e00 [ 333.593775] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 333.599212] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 333.604662] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 333.610095] ? process_measurement+0x2489/0x2740 [ 333.614929] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 333.620372] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 333.625632] binder_ioctl_write_read+0x1648/0x1a560 [ 333.630741] ? should_fail+0x191/0xb20 [ 333.634724] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 333.640177] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 333.645732] binder_ioctl+0x759/0x2d20 [ 333.649699] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 333.655126] ? binder_poll+0xbd0/0xbd0 [ 333.659071] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 333.664317] ? binder_poll+0xbd0/0xbd0 [ 333.668266] do_vfs_ioctl+0xebd/0x2bf0 [ 333.672228] ? security_file_ioctl+0x92/0x200 [ 333.676802] __se_sys_ioctl+0x1da/0x270 [ 333.680843] __x64_sys_ioctl+0x4a/0x70 [ 333.684790] do_syscall_64+0xbc/0xf0 [ 333.688843] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 333.694425] RIP: 0033:0x457f29 [ 333.697711] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 333.731778] RSP: 002b:00007f7d0fec6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 333.739548] RAX: ffffffffffffffda RBX: 00007f7d0fec6c90 RCX: 0000000000457f29 [ 333.746883] RDX: 0000000020000440 RSI: 00000000c0306201 RDI: 0000000000000003 [ 333.754219] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 333.761549] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7d0fec76d4 [ 333.768860] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000006 [ 333.785791] binder_alloc: binder_alloc_new_buf_locked: 10623 failed to alloc new buffer struct [ 333.791951] chnl_net:caif_netlink_parms(): no params data found [ 333.794706] binder: 12534:12536 transaction failed 29201/-12, size 0-8 line 3035 [ 333.844565] binder: undelivered TRANSACTION_ERROR: 29201 [ 333.892666] bridge0: port 1(bridge_slave_0) entered blocking state [ 333.899222] bridge0: port 1(bridge_slave_0) entered disabled state [ 333.907780] device bridge_slave_0 entered promiscuous mode [ 333.917119] bridge0: port 2(bridge_slave_1) entered blocking state [ 333.923826] bridge0: port 2(bridge_slave_1) entered disabled state [ 333.932427] device bridge_slave_1 entered promiscuous mode [ 333.974063] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 333.984497] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 334.007870] team0: Port device team_slave_0 added [ 334.015859] team0: Port device team_slave_1 added [ 334.064853] device hsr_slave_0 entered promiscuous mode [ 334.112681] device hsr_slave_1 entered promiscuous mode [ 334.196232] bridge0: port 2(bridge_slave_1) entered blocking state [ 334.202748] bridge0: port 2(bridge_slave_1) entered forwarding state [ 334.209693] bridge0: port 1(bridge_slave_0) entered blocking state [ 334.217514] bridge0: port 1(bridge_slave_0) entered forwarding state [ 334.273578] 8021q: adding VLAN 0 to HW filter on device bond0 [ 334.289765] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 334.298812] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.306839] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.315255] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 334.331415] 8021q: adding VLAN 0 to HW filter on device team0 [ 334.346604] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 334.354975] bridge0: port 1(bridge_slave_0) entered blocking state [ 334.361494] bridge0: port 1(bridge_slave_0) entered forwarding state [ 334.375401] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 334.383494] bridge0: port 2(bridge_slave_1) entered blocking state [ 334.389993] bridge0: port 2(bridge_slave_1) entered forwarding state [ 334.418371] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 334.427768] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 334.454651] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 334.464116] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 334.472391] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 334.486485] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 334.519399] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 334.595375] FAULT_INJECTION: forcing a failure. [ 334.595375] name failslab, interval 1, probability 0, space 0, times 0 [ 334.606998] CPU: 0 PID: 12546 Comm: syz-executor.5 Not tainted 5.0.0+ #12 [ 334.613970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 334.623344] Call Trace: [ 334.625986] dump_stack+0x173/0x1d0 [ 334.629642] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 334.634882] should_fail+0xa19/0xb20 [ 334.638618] __should_failslab+0x278/0x2a0 [ 334.642904] should_failslab+0x29/0x70 [ 334.646830] kmem_cache_alloc_trace+0x125/0xb40 [ 334.651520] ? binder_get_thread+0x406/0xf60 [ 334.655960] binder_get_thread+0x406/0xf60 [ 334.660224] ? binder_poll+0xbd0/0xbd0 [ 334.664155] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 334.669373] ? binder_poll+0xbd0/0xbd0 [ 334.673272] binder_ioctl+0x56d/0x2d20 [ 334.677175] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 334.682596] ? binder_poll+0xbd0/0xbd0 [ 334.686544] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 334.691797] ? binder_poll+0xbd0/0xbd0 [ 334.695732] do_vfs_ioctl+0xebd/0x2bf0 [ 334.699666] ? security_file_ioctl+0x92/0x200 [ 334.704268] __se_sys_ioctl+0x1da/0x270 [ 334.708277] __x64_sys_ioctl+0x4a/0x70 [ 334.712202] do_syscall_64+0xbc/0xf0 [ 334.715998] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 334.721197] RIP: 0033:0x457f29 [ 334.724433] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 334.743361] RSP: 002b:00007f9152bcac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 334.751121] RAX: ffffffffffffffda RBX: 00007f9152bcac90 RCX: 0000000000457f29 [ 334.758410] RDX: 0000000020007000 RSI: 00000000c0306201 RDI: 0000000000000003 [ 334.765730] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 334.773022] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9152bcb6d4 [ 334.780295] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000004 [ 334.788995] binder: 12545:12546 ioctl c0306201 20007000 returned -12 01:35:14 executing program 5 (fault-call:2 fault-nth:1): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0xeb42, 0x80) ioctl$UI_SET_SWBIT(r1, 0x4004556d, 0x5) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x802, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000040)={0x9, 0x40, 0x7f, 0x8859, 0x9}, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="000000000000ecff"], 0x0, 0x0, 0x0}) 01:35:14 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:35:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 01:35:14 executing program 3 (fault-call:3 fault-nth:4): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 334.903313] binder: 12547:12553 ioctl c0306201 0 returned -14 [ 334.931348] binder_thread_release: 4 callbacks suppressed [ 334.931372] binder: release 12554:12558 transaction 291 out, still active [ 334.934126] binder: 12551:12552 got transaction with invalid offset (0, min 0 max 0) or object. [ 334.938443] binder_release_work: 4 callbacks suppressed [ 334.938455] binder: undelivered TRANSACTION_COMPLETE [ 334.944233] binder: 12551:12552 transaction failed 29201/-22, size 0-8 line 3097 [ 334.986944] binder: release 12554:12558 transaction 292 out, still active [ 334.994621] binder: undelivered TRANSACTION_COMPLETE [ 335.002179] binder: 12557:12559 got transaction with invalid offset (0, min 0 max 24) or object. [ 335.011285] binder: 12557:12559 transaction failed 29201/-22, size 24-8 line 3097 [ 335.023767] FAULT_INJECTION: forcing a failure. [ 335.023767] name failslab, interval 1, probability 0, space 0, times 0 [ 335.036239] CPU: 1 PID: 12560 Comm: syz-executor.5 Not tainted 5.0.0+ #12 [ 335.043234] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 335.052646] Call Trace: [ 335.055333] dump_stack+0x173/0x1d0 [ 335.059567] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 335.064862] should_fail+0xa19/0xb20 [ 335.068667] __should_failslab+0x278/0x2a0 [ 335.072976] should_failslab+0x29/0x70 [ 335.076938] kmem_cache_alloc_trace+0x125/0xb40 [ 335.081694] ? binder_transaction+0x40de/0x13e00 [ 335.086547] binder_transaction+0x40de/0x13e00 [ 335.091210] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 335.096651] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 335.097370] binder: undelivered TRANSACTION_ERROR: 29201 [ 335.102092] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 335.102143] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 335.102216] ? process_measurement+0x2489/0x2740 [ 335.114148] binder: undelivered TRANSACTION_ERROR: 29201 [ 335.118692] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 335.118745] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 335.118811] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 335.118874] binder_ioctl_write_read+0x152e/0x1a560 [ 335.149910] ? should_fail+0x191/0xb20 [ 335.153865] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 335.159328] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 335.164880] binder_ioctl+0x759/0x2d20 [ 335.168834] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 335.174271] ? binder_poll+0xbd0/0xbd0 [ 335.178227] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 335.183471] ? binder_poll+0xbd0/0xbd0 [ 335.187420] do_vfs_ioctl+0xebd/0x2bf0 [ 335.191384] ? security_file_ioctl+0x92/0x200 [ 335.195949] __se_sys_ioctl+0x1da/0x270 [ 335.199993] __x64_sys_ioctl+0x4a/0x70 [ 335.203941] do_syscall_64+0xbc/0xf0 [ 335.207734] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 335.212971] RIP: 0033:0x457f29 [ 335.216220] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 335.235350] RSP: 002b:00007f9152bcac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 335.243122] RAX: ffffffffffffffda RBX: 00007f9152bcac90 RCX: 0000000000457f29 01:35:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:15 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000080)=0x4) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) ioctl$VIDIOC_G_CTRL(r2, 0xc008561b, &(0x7f0000000040)={0x5, 0x9}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0xf6, 0x0, 0x0}) 01:35:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:35:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 335.250463] RDX: 0000000020007000 RSI: 00000000c0306201 RDI: 0000000000000003 [ 335.257777] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 335.265086] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9152bcb6d4 [ 335.272395] R13: 00000000004bf25a R14: 00000000004d0c00 R15: 0000000000000004 [ 335.279888] binder: 12550:12560 transaction failed 29201/-12, size 0-0 line 2975 [ 335.412729] binder: 12563:12568 ioctl c0306201 20007000 returned -14 [ 335.435335] binder: 12562:12571 got transaction with invalid offset (0, min 0 max 24) or object. [ 335.444560] binder: 12562:12571 transaction failed 29201/-22, size 24-8 line 3097 [ 335.466309] binder: release 12563:12568 transaction 296 out, still active [ 335.473438] binder: undelivered TRANSACTION_COMPLETE 01:35:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x0, 0x200000) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000040)={0x0, 0x80000000}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000140)={r2, 0x58, &(0x7f00000000c0)=[@in6={0xa, 0x4e23, 0x2, @mcast2, 0x8000}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e20, 0x8001, @rand_addr="54f274cf2670704c7d11331945d109a9", 0x1}, @in={0x2, 0x4e22, @remote}]}, &(0x7f0000000180)=0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="00feffffff000000de717b43381428515b97964d2149dfae6d906453598024e86e7143127ef424cc91bf62aeef9b6c41273ef4d6709cdbe2290bbfbaa6205d2f3c5808df1997bc073ec30b57362e4f048e1625cafa7a0dc47cb7d099156429f12495c62fc17bd52ab540b7c9a9bb3ce37df1724dc89d39b28363d320e971cdf0e1901e"], 0x0, 0x0, 0x0}) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000280)={0x80000000, 0x1, 0xd5b, 0x6d7, 0xd, 0x0, 0xf7c, 0x5, 0x562, 0x0, 0x667, 0x80000001}) socket$inet6_sctp(0xa, 0x1, 0x84) 01:35:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 335.516386] binder: undelivered TRANSACTION_ERROR: 29201 [ 335.546597] binder: 12572:12574 got transaction with invalid offset (0, min 0 max 0) or object. [ 335.555894] binder: 12572:12574 transaction failed 29201/-22, size 0-8 line 3097 [ 335.671002] binder: 12577:12579 transaction failed 29201/-22, size -1719108036609142675--3736592968501202578 line 3035 [ 335.749684] binder: 12577:12584 transaction failed 29201/-22, size -1719108036609142675--3736592968501202578 line 3035 [ 335.792926] binder: undelivered TRANSACTION_ERROR: 29201 [ 335.798548] binder: undelivered TRANSACTION_ERROR: 29201 [ 335.804147] binder: undelivered TRANSACTION_ERROR: 29201 01:35:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x1, 0x0) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f00000000c0)) syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x81, 0x0) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000140)=0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1e7a2c4f"], 0x0, 0x0, 0x0}) 01:35:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:35:15 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = pkey_alloc(0x0, 0x1) pkey_free(r1) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000140)={0x9, 0x4, 0xfff, 0x0, 0x40}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x0, 0x0) write$P9_ROPEN(r4, &(0x7f0000000040)={0x18, 0x71, 0x1, {{0x70, 0x4, 0x3}}}, 0x18) ioctl$VIDIOC_DBG_S_REGISTER(r4, 0x4038564f, &(0x7f0000000180)={{0x0, @addr=0x7}, 0x8, 0x7, 0x8}) inotify_init() getsockopt$inet6_int(r4, 0x29, 0x4b, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000089f29e0002d89de6c285b48482aef70000000008", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000480)={{0x6000, 0x100000, 0x18, 0x9, 0x7, 0x0, 0xffffffffffffffff, 0x3, 0xffffffff, 0x100000001, 0x7, 0xa0}, {0x100000, 0xf001, 0xb, 0x8, 0x9, 0x8, 0xcc2, 0x3, 0x5, 0xfff, 0x5, 0xc693}, {0x2, 0x2, 0x3, 0x2, 0xfffffffffffff000, 0x5e55, 0x1, 0x7, 0x1, 0x3f, 0x5}, {0x0, 0x5000, 0xe, 0x1, 0x3, 0x10000, 0x1, 0x80000001, 0x5, 0x405, 0x2, 0x4}, {0x6000, 0x0, 0x10, 0x100000000, 0xffffffff, 0xff, 0xffffffff, 0x9, 0x3, 0x0, 0x10000, 0x8}, {0x17000, 0xd000, 0xd, 0x5, 0x7, 0x800, 0xfffffffffffffffe, 0x1, 0x3, 0x6, 0x7, 0x200000}, {0xd004, 0x4000, 0xb, 0x5e16, 0x1, 0xa0c0000000000000, 0x4, 0x3, 0xd4, 0x3, 0x80000000, 0x2}, {0x6004, 0x100000, 0xd, 0x7ff, 0x9, 0x401, 0x8, 0x3bf0, 0x5, 0x0, 0x8, 0x3f6}, {0x3000, 0x2}, {0x2, 0x2004}, 0x2, 0x0, 0x5002, 0x280, 0x3, 0x8000, 0xf005, [0x3, 0x0, 0x3f, 0x1]}) 01:35:15 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') connect$netlink(r1, &(0x7f0000000000)=@proc={0x10, 0x0, 0x25dfdbff, 0x8a000000}, 0xc) exit(0x0) read$FUSE(r2, 0x0, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000040)) 01:35:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x3f, 0x48c00) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f00000000c0)={0x4, &(0x7f0000000040)=[{0x0, 0x0, 0x0, @link_local}, {}, {0x0, 0x0, 0x0, @broadcast}, {}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 336.020401] binder: 12590:12593 got transaction with invalid offset (0, min 0 max 24) or object. [ 336.071161] binder: 12595:12601 unknown command 1328314910 [ 336.077071] binder: 12595:12601 ioctl c0306201 20007000 returned -22 01:35:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) [ 336.134318] binder: release 12603:12604 transaction 303 out, still active [ 336.141422] binder: undelivered TRANSACTION_COMPLETE 01:35:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) 01:35:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="117980c4d533206af87405ff43400000133fc76735701aa337c3bc4df6ca24517a87584b77974d09818848d0f709105a5487cfbd4d6d504c69a1ca971ce6b8d54f9524e9e9b20190a3d0d1981496be4775a56a2828152aa3eec356b9518b44460e6f194531d77fd1ae546507f94d3dedef31221d5b7b92093c2c76cc06c186b5fd9d527050b970f4fb60bd9c8bf4fe33462cfcb73ced4af6c419d76ce4345860b86d1ef2f65a", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x383, 0x0, 0x0}) 01:35:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x400000, 0x60) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x2, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000180)={0x0, r1, 0x0, 0x2}, 0x14) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000200)) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000080)={0x22, 0xb1, 0x3, 0x80800, r1}) prctl$PR_CAPBSET_DROP(0x18, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="006340400000000000000000000000000000003ebd212000000000000000000000000000000000000000080000000000000000000000000000000000000000009e581b0dda33b6cb30005b4c7acf9e762d21bb17960d6ddc31bc27090a0ae6514315720abcf03c06123ffe7c5e3e3beb07149186d7e237e4658443f7e894109b24c20a94beb4bb793f9ccee58ecf6d39dd9ab51df636ae2330834b1d3efb9274ca92b13bd89c", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="0064f6"]], 0x0, 0x0, 0x0}) ioctl$KVM_SET_TSC_KHZ(r1, 0xaea2, 0x8) [ 336.322244] binder: 12595:12610 unknown command 1328314910 [ 336.328070] binder: 12595:12610 ioctl c0306201 20007000 returned -22 [ 336.371535] binder: 12611:12614 unknown command -998213359 [ 336.377476] binder: 12611:12614 ioctl c0306201 20007000 returned -22 [ 336.398212] binder: release 12613:12615 transaction 304 out, still active [ 336.405537] binder: undelivered TRANSACTION_COMPLETE 01:35:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) 01:35:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control\x00', 0x202000, 0x0) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) r2 = dup3(r0, r0, 0x80000) getsockopt$inet6_dccp_int(r2, 0x21, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 336.489545] binder_alloc: 10623: binder_alloc_buf size 2251799813685248 failed, no address space [ 336.498899] binder_alloc: allocated: 2360 (num: 158 largest: 32), free: 9928 (num: 1 largest: 9928) 01:35:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x400, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f00000000c0)) 01:35:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) [ 336.684119] binder: release 12623:12625 transaction 306 out, still active [ 336.691223] binder: undelivered TRANSACTION_COMPLETE [ 336.735512] binder: release 12623:12625 transaction 307 out, still active [ 336.756405] binder: undelivered TRANSACTION_COMPLETE [ 336.762909] binder: release 12628:12630 transaction 308 out, still active 01:35:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x400, 0x0) ioctl$TIOCGETD(r2, 0x5424, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 336.766966] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 336.772227] binder: undelivered TRANSACTION_COMPLETE [ 336.800606] binder_alloc: allocated: 2400 (num: 161 largest: 32), free: 9888 (num: 1 largest: 9888) 01:35:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) 01:35:17 executing program 1: socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='ip6erspan0\x00', 0x10) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000000)=0x9, 0x4) 01:35:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0xfffffdc9, 0x0, &(0x7f0000005fd4)=[@enter_looper], 0x0, 0x0, 0x0}) 01:35:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) [ 337.004609] binder: 12694:12719 got transaction with invalid offset (0, min 0 max 0) or object. [ 337.045004] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 337.056052] binder_alloc: allocated: 2400 (num: 161 largest: 32), free: 9888 (num: 1 largest: 9888) [ 337.114569] binder: release 12742:12745 transaction 312 out, still active [ 337.121720] binder: undelivered TRANSACTION_COMPLETE 01:35:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x400080, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000040)={0x1c0000, 0x3, 0x2, 0x4, 0x3ff, 0xdea, 0x1f, 0xfff, 0x0}, &(0x7f0000000080)=0x20) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x68, &(0x7f00000000c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x25}}, @in={0x2, 0x4e24, @multicast1}, @in6={0xa, 0x4e22, 0x7, @mcast2, 0x1}, @in6={0xa, 0x4e21, 0x8, @loopback, 0x3}, @in={0x2, 0x4e21, @remote}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000000380)={r3, 0x7fff, 0x8000, 0xcba, 0x6, 0x56b, 0xfffffffffffffff7, 0x7fff, {r4, @in={{0x2, 0x4e24, @rand_addr=0xf1}}, 0x90ea, 0x9, 0x9, 0x623, 0x7}}, &(0x7f0000000200)=0xb0) [ 337.169455] binder: 12746:12749 unknown command 0 [ 337.174625] binder: 12746:12749 ioctl c0306201 20007000 returned -22 [ 337.206292] binder: 12746:12749 unknown command 0 [ 337.211317] binder: 12746:12749 ioctl c0306201 20007000 returned -22 01:35:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) [ 337.257576] binder: 12752:12754 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) clock_adjtime(0x0, &(0x7f00000000c0)={0x8, 0x3, 0x1, 0x5, 0x5, 0x2, 0x0, 0x80000000, 0x1, 0x4, 0xf779, 0x518bd703, 0x85cb, 0x9, 0xa1, 0x9, 0x3, 0x3, 0xf7e, 0x8, 0x7, 0xdc60, 0x100000000, 0x0, 0x20, 0x9}) semget(0x0, 0x0, 0x10) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f00000001c0)={0x101, 0xffffffff}, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xfffffebc, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x3, 0x2) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f00000000c0)={{0x4, 0x2, 0x0, 0x1, 'syz1\x00', 0x290d}, 0x6, 0x20, 0x800, r2, 0x4, 0x1, 'syz1\x00', &(0x7f0000000080)=['\x00', '\x00', '/dev/binder#\x00', '!\x00'], 0x11, [], [0xab, 0x9, 0x3, 0x8]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="d400000100300000"], 0x0, 0x0, 0x0}) 01:35:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x200000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r2, &(0x7f0000000480)={0x8, 0x120, 0xfa00, {0x1, {0x6, 0x28f0, "5d41ff558195eecc76cb75141d31a4b54395332cf7c8dc6add49dbfb15ab308f3c646ba48f6cf7006d8c7f8930717f80402e57834929cd008609da830341f47cf14739a805f5a949c94b35ed58577935f261ab34fae921c9bc7720905ebff985ac351b2ac9ab25830ce262967de383b7f747ab3ac800354581bca4b192dbfdc5895eb770c3d3e46a1a1f97cf0855a61cb08ef3b3d93a21eca9e4acf2e8b34eed116c8883a4081e0f29cfe718021f61f273be1c90873f943d6a1cd90db0bb0e21291660e647f957603942060c09158fe0373c7a26d4ce5640c64824a2bc606cef7c46b31255e75d25fb3eb8ab1d5276096853555ec78a98d15768296213cce356", 0x3, 0x1, 0xfffffffffffffff8, 0x200000000000000, 0x6, 0x7ff, 0x3}, r3}}, 0x128) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 337.459103] binder: release 12757:12758 transaction 314 out, still active [ 337.466221] binder: undelivered TRANSACTION_COMPLETE [ 337.534334] binder: 12760:12761 got transaction with invalid offset (0, min 0 max 0) or object. [ 337.549070] binder: 12763:12765 unknown command 0 [ 337.554275] binder: 12763:12765 ioctl c0306201 20000280 returned -22 01:35:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) [ 337.616729] binder: 12767:12768 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)="fce365af3ba0c06adf35e7cf4e75527462f6aa027ad3b5285719d7b3e20af067a73bb1045bdc6e9a75e2be69978b0eeb3eb220168e18232152057ace39ebbadf84886be903d64cd4e24fbe17", 0x4c, 0xfffffffffffffffd) keyctl$KEYCTL_PKEY_QUERY(0x18, r1, 0x0, &(0x7f0000000100)='\\mime_type\x00', &(0x7f0000000140)) [ 337.907746] binder_transaction: 9 callbacks suppressed [ 337.907782] binder: 12776:12781 transaction failed 29201/-22, size 0-8 line 3097 [ 337.931948] binder_release_work: 9 callbacks suppressed [ 337.931966] binder: undelivered TRANSACTION_ERROR: 29201 [ 337.991931] binder: undelivered TRANSACTION_ERROR: 29201 01:35:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) 01:35:18 executing program 5: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x42040, 0x0) getpeername$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, &(0x7f0000000180)=0x10) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) uselib(&(0x7f00000001c0)='./file0\x00') bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x3, 0x8000) socket$inet(0x2, 0x4, 0x40) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x4e22, @broadcast}, 0x10) 01:35:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x4040, 0x0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000200)=""/15) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000001000000010000000000000000000000010000000000000000000000000000ff00000008000000000000000000000000000000a057fd374adcaf9883b193a367b91c5a8c61ddad46d35fcb9500a05c1f3c98877d8529c794a4938c81e318ccffcbc342e32539da781b1c8bf031d71a00a3e6e025017e5230e55b20858cddf6f8bd20016eebe86994b7549165a6c5f20c2aa7ff464d5efaf99137a79ef30b0ac692d47ac2da1214ac8ff442b1df93920a13d8b16ff5dfd5de2124dc9c80102e8fa03e1fed561a8bb4ab55e4a02b87faaa19f92527a9d49411ac062e8898b9df38c32c3b6a47b0fcff7ec5485d6abc10f183271c41a324f700805311cee92baf1545dfaa93a240e971625843e584173473c0df423cb2a4fb62750e82319d6e593f3eae0b901be92572f8761b25ceb678997e1b42b76c7c9ad2bb241be932f84df50c3fd5e81d3832d4b11c", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 01:35:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:18 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 01:35:18 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) syz_kvm_setup_cpu$x86(r1, r0, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000000c0)="66430f00d640f42e0f521d5b000000c4e27db8ecc4a37d69d60066b88e008ec8c74424000b000000c7442402186d5ee0c7442406000000000f01142448b898ab4366000000000f23c00f21f83503000a000f23f867420f0135fdff0000f2470f08", 0x61}], 0x1, 0x6, &(0x7f0000000140)=[@cr4], 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x1a9200, 0x0) clone(0x2102005fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0xfffffffffffffffe) getsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000400)=0xfffffffffffffffe, &(0x7f0000000440)=0x2) ioctl$EVIOCGABS20(r1, 0x80184560, &(0x7f0000000300)=""/228) fcntl$notify(r2, 0x402, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000500)={0x0, 0x5a, "ec533b737cc7ab8272e0c82c5efcff42406ee1aa343145f46b9446c8e7fd6112ec5a9beca5016b7b9c30ad0e25379dcc59f7b6c4aa164b2a0aa74cd18b137256707732d4756a22c95c32b90e27d71ff4a5efa2e4a0546feb7307"}, &(0x7f0000000580)=0x62) getsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f00000005c0)={r3, 0x4, 0x8, 0x1, 0x8, 0xfffffffffffffff9}, &(0x7f0000000600)=0x14) ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x4) read$FUSE(r2, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f0000000480)={'security\x00'}, &(0x7f0000000640)=0x54) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000200)={0x0, 0x0, 0x4, [0x0, 0x7ff, 0x2, 0xffffffffffffffe1]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000280)={r4, 0x4, 0xffffffffffffffff, 0x5}, &(0x7f00000002c0)=0x10) [ 338.233656] binder_transaction: 1 callbacks suppressed [ 338.233708] binder: 12893:12895 got transaction with invalid offset (0, min 0 max 0) or object. [ 338.247721] binder: 12892:12897 unknown command 0 [ 338.248202] binder: 12893:12895 transaction failed 29201/-22, size 0-8 line 3097 [ 338.253554] binder: 12892:12897 ioctl c0306201 20007000 returned -22 [ 338.289457] binder_alloc: 10623: binder_alloc_buf size 1095216660488 failed, no address space [ 338.301954] binder_alloc: allocated: 2536 (num: 170 largest: 32), free: 9752 (num: 1 largest: 9752) [ 338.313824] binder: 12894:12899 transaction failed 29201/-28, size 1095216660480-8 line 3035 [ 338.348466] binder: undelivered TRANSACTION_ERROR: 29201 01:35:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x400000, 0x0) bind$rxrpc(r1, &(0x7f0000000040)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e22, 0x2, @remote, 0x2}}, 0x24) syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x2000000000002084) 01:35:18 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000180)={0x2, 0x4e23, @loopback}, 0x10) sendmmsg(r0, &(0x7f0000002040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20000041) 01:35:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 338.549805] binder: 12892:12897 unknown command 0 [ 338.555084] binder: 12892:12897 ioctl c0306201 20007000 returned -22 [ 338.575751] binder: 12966:12979 got transaction with invalid offset (0, min 0 max 0) or object. [ 338.585004] binder: 12966:12979 transaction failed 29201/-22, size 0-8 line 3097 01:35:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 338.598437] binder: undelivered TRANSACTION_ERROR: 29201 [ 338.667757] binder: undelivered TRANSACTION_ERROR: 29201 01:35:18 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x400000, 0x0) unlinkat(r0, &(0x7f00000010c0)='./file0\x00', 0x200) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000001100)='/dev/dlm-monitor\x00', 0x2000020004, 0x0) mincore(&(0x7f0000ffa000/0x4000)=nil, 0x4000, &(0x7f00000000c0)=""/4096) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000001140)=ANY=[@ANYBLOB="116348407c0f7344429c41492ced2f9369f11e794a96385184d79c310d2c517d02bbf8522a4769f2e4349a84194709b7ab19dff2b6ca95b8fb9c563b01feb022720fe01cd9e15774ed196b8c86be545c78dda4a7cb5acd3cb3eefb3c7c67100f7c8b35ad12ebd998fed2b7cb775938b7fe78af9761e1424743"], 0x0, 0x0, 0x0}) 01:35:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 338.756934] binder: 13005:13019 got transaction with invalid offset (0, min 0 max 0) or object. [ 338.766745] binder: 13005:13019 transaction failed 29201/-22, size 0-8 line 3097 01:35:18 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x80000, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x1013fe, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='pids.current\x00', 0x0, 0x0) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vsock\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) ioctl$VIDIOC_G_EDID(r1, 0xc0285628, &(0x7f0000000040)={0x0, 0x8, 0x8, [], &(0x7f0000000000)=0xa3f}) 01:35:18 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x5) ioctl$TIOCSETD(r0, 0x40086602, 0x0) 01:35:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x200, 0x6000) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x47, 0x400000) ioctl$KDENABIO(r1, 0x4b36) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 338.858861] binder: undelivered TRANSACTION_ERROR: 29201 01:35:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x2, 0x0) ioctl$TCSBRK(r1, 0x5409, 0xd891) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r1, 0x800442d4, &(0x7f0000000080)=0xffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 339.018747] binder: 13025:13026 got transaction with invalid offset (0, min 0 max 0) or object. [ 339.027860] binder: 13025:13026 transaction failed 29201/-22, size 0-8 line 3097 [ 339.053286] Unknown ioctl 35090 [ 339.064087] binder: 13024:13030 got transaction to invalid handle [ 339.070409] binder: 13024:13030 transaction failed 29201/-22, size -8891736356365449430--946009171423574247 line 2896 [ 339.111548] binder: undelivered TRANSACTION_ERROR: 29201 01:35:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 339.159700] binder: 13024:13042 got transaction to invalid handle [ 339.166380] binder: 13024:13042 transaction failed 29201/-22, size -8891736356365449430--946009171423574247 line 2896 [ 339.180591] binder: 13040:13041 got transaction with invalid offset (0, min 0 max 0) or object. [ 339.187889] binder: undelivered TRANSACTION_ERROR: 29201 [ 339.189667] binder: 13040:13041 transaction failed 29201/-22, size 0-8 line 3097 01:35:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xa) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x0, 0x240140) ioctl$CAPI_CLR_FLAGS(r1, 0x80044325, &(0x7f0000000040)) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) ioctl$VIDIOC_SUBDEV_S_FMT(r1, 0xc0585605, &(0x7f0000000080)={0x1, 0x0, {0x7, 0xffffffff, 0x201b, 0xb, 0x0, 0x7, 0x1, 0x5}}) [ 339.244973] binder: 13040:13044 got transaction with invalid offset (0, min 0 max 0) or object. [ 339.254229] binder: 13040:13044 transaction failed 29201/-22, size 0-8 line 3097 [ 339.256771] binder: undelivered TRANSACTION_ERROR: 29201 01:35:19 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x80000, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x121000, 0x0) ioctl$VIDIOC_STREAMOFF(r1, 0x40045613, &(0x7f00000000c0)=0x3) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000640)={0x4, 0x0, &(0x7f00000004c0)=ANY=[@ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYRES16=r1, @ANYRES32, @ANYPTR64=&(0x7f0000000180)=ANY=[@ANYBLOB="49768fa9b01ebfa4ce1b78fd52a884b35c7a7cb73daaac689b26ef29425166936f934427e62dda1c977543511a45fc5bd051af5e5bf09147ae7278a7e0af009591ce5a92ac1fa13cbc01ed40ba66c827be11fe427818e592d5a1b0612e9b3951c3e730cd837793e464547d922e42b2d8a21b6605e7deb8c14776281af8f2f1a5bac5de51edb37e148bc567249fe5f02ed06ced3713b327f11dbff27de3d17501d2313d759bdd36ef439a9c940775faa662192a7de5fb199f39ab4ac30ac54ffe9440c494d8e54a60f0ed8769a7e71a9538ab2e98b14db92cfb93", @ANYRESOCT=r1, @ANYRESOCT=r1, @ANYPTR64, @ANYRESOCT=r0, @ANYPTR64], @ANYRESDEC=0x0, @ANYRESOCT=r0, @ANYRESOCT=r0, @ANYRES32=r1, @ANYRESHEX=r0, @ANYRESDEC], @ANYRESHEX=r0, @ANYRESOCT=r1, @ANYPTR64=&(0x7f0000000340)=ANY=[@ANYRES64, @ANYRESDEC=r0, @ANYRESHEX=r1, @ANYRES32=r0, @ANYRES32=r1, @ANYRESOCT=r1, @ANYBLOB="31700f46b99161db4d8bc6d6ff4eee3c9a7b62bba685531ae9637bfcc2e2826c080817622c210d5c8ccb450d4a5020be9eb1e1d668f4ca1fb60d9885025394134585eabdc754752191b31e59646461189f285c060563d473a6362148035539bf21770ef669feaf1e6f0119ff087a9237e06b441e2e5942182f86"], @ANYPTR=&(0x7f0000000580)=ANY=[@ANYRES16=r0, @ANYRES32=r0], @ANYRESHEX=r1, @ANYPTR64, @ANYRESOCT=r0, @ANYPTR=&(0x7f0000000480)=ANY=[@ANYPTR64=&(0x7f0000000440)=ANY=[@ANYRES16=r0], @ANYRES64=r1]], 0xffffffffffffff26, 0x0, 0x0}) [ 339.336592] binder: undelivered TRANSACTION_ERROR: 29201 [ 339.350923] binder: 13046:13048 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 339.488432] binder: 13050:13054 unknown command 536871616 [ 339.494757] binder: 13050:13054 ioctl c0306201 20000640 returned -22 01:35:19 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @broadcast}, 0x10) 01:35:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="118f41b3db8471fb4634d0c9b5e0bd437a429cb0425dd9638f6ba01a0cdc5ac0d842b9c16f18b7c44b3f1c902fd912bb4766694fd088696400000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2002, 0x0) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f00000001c0)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f00000000c0)={[], 0x100000001, 0x7c199f31, 0x1, 0xfff, 0x4, r2}) [ 339.705871] binder: 13066:13067 got transaction with invalid offset (0, min 0 max 24) or object. [ 339.793876] Unknown ioctl 35090 [ 339.909318] binder: 13095:13113 unknown command -1287549167 [ 339.915393] binder: 13095:13113 ioctl c0306201 20007000 returned -22 [ 339.959689] binder: 13095:13113 unknown command -1287549167 [ 339.965851] binder: 13095:13113 ioctl c0306201 20007000 returned -22 01:35:20 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x4, 0x48000) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000040)) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') socket$nl_netfilter(0x10, 0x3, 0xc) exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:35:20 executing program 3: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x7704, 0x0) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) fadvise64(r1, 0x0, 0x28, 0x7) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000480)={{{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@empty}}, &(0x7f0000000380)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000003c0)={@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, r3}, 0xc) 01:35:20 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) sendmmsg$alg(r1, &(0x7f0000002d80)=[{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000000c0)="6137726707ea2498248442bf2efb2ced56e10a766d38f479bc0c04273c5d4a6e93862f3fe9a1a7190104f182f0faad29cd646b779c704a7175e9caf3c7c317474c9032619a2269f775c5a95e61c58d298712511aad360cfe36d641d4b6fb6fe0636ccc5ad3bb9c4ed21287143d3ffd417ce1abdae609a6dcb5004762804b913c34379d9f", 0x84}, {&(0x7f0000000180)="d1ce7788d0a65f46cb06cfea869e49aeafb401d07491b49a34749c6c315fe9c00b40ee98656469ddb9d796f6f2fcf04aaf87c0a59c9299e8a3045bd3768d74f726dec9397f77e1250e889a04a56d0fc93b6ed47156c4d31fde463e4c7c0388a9d53dc896fffbf38ed28e44121e4b2e5c17302577df19760f49d0d49d0ff05a57ef8729a9b060fe6e51239ae3bd2a11af7397b9c5065406e1764d47cf91e0141f0f0ff5b733c0eeab", 0xa8}], 0x2, 0x0, 0x0, 0x4000000}, {0x0, 0x0, &(0x7f0000002440)=[{&(0x7f0000000280)="bd2c2f8c34ee4867584edb93af8c811061a006a0d51022e15ddd824ac8d34d9f8ea0b1582a49ddc59692d1e73ee30cb837e4e2b10d", 0x35}, {&(0x7f00000002c0)="773d5d7ccb31343fb192e01e03e3ba2fb18c27656b48e5f3687cd746b06f872cb897f34425ab3a92344a734ab329cb4fd31e3116a8aca63a7bf90e1ac4", 0x3d}, {&(0x7f0000000300)="e65572d52529087618d8739ab8f87d233fc253bd477112db63a5190900f4b288cb6062d8da61e89d5c00113cd5b0a0468696916da31c2e393d", 0x39}, {&(0x7f0000000340)="d1570aff498a5d7ad546a1d95ca4ea87c4cf394f27d0dfd4ccc16358d49bea8d51299606c7c9cfe3c463617e0ca19ba3f7b6c4c1dfa0edfa9474dac91f0e2caa72b43894fd6227b856c523183921b9970e6b8bd257c75d65790bee0f7a60d109bd46cfd96accaa2e74a46d48a0e7841f140e948419d0448934ed6b7224d060df53563634a7a0093f1f335dc9c53c0c1e0e580c93c4a77d471e724a3644a314d019b10c88931c04c4d6b6b95adc326f9e0ac8b7d3bceaf98d668fa2b057dea8d50f405353622539de4cb4aadd11bccdc4163492d6a6b3b04690c278db89a0edb1dab539fa04eb9d3ac6ed4ec8dcab089a559131e7bf6900baf88333b614e4d1b89b1b7ca715701d2fb752cce23a0dfc652e6b8b7e9bb6bcbc639551e1c7f4094ef1a18810e61dc3dcc41671eb197a377d2639cc9a619a405c58bb8a3f47452012851dc54d5ce3455a0a5eb0499d9164f07d91927fd349de2b40ff9b61e0d020b48b9d3d191669e5a993d5221e35f240ea80cd8f9fae07db9a89cc93f5714998e41d8360b81efd8d6f9be360022be9d7b4e635cd847c7632ea533f426dbe7c6fcc0cb95da822de95e706dba70863732f48bf611965d66eafb35057c61bfbe3d344ae2daa14b03f34c160b42f30510836d21eed06e9e6330d77c2596de2c2f36edb6215710914042f7b77c502296d6abef19495e5ea862c500982abe1b644b3f1b80adcbee97eb3ad256533156801882f84e2676b4fc64787c5dc5e8d47dc4928c117a1a571d40e8ce2e66c0c6aba3b8fc1466ec4c8d339da0a4dd7f1d59133843772d9c298fbc3721abe4059e6405982f5c325634ce3ed51e9763897edd2710a36488790dc0a30c4b471e1d9f805ca57e484c4ed64eaf63eb26bf72ef7ba1f7f911416d356687deba0feea4a9f960dec909be2443f580bf722e475ad8011589349681ecacae7a32e88b077577c8e77147e37978bb46f80440ef2f5eb2268347ded8f8e3b8331819d2457be9f66037f02e75243b1c3e4f5c968aecc265301b1e88a295522ad8aef732caa2022321ece117d346ea936b1914b4eeec2fb46cc813bd7a2a01d79078af126c03c06bde8b352fb81c1b07bd4784014b508e46d46aa5e3fc535bacd75ff25d479863b9e04aa0d3ef5a9784b2584551ca55e47960aa7ec69777f69c9b37074a1f89c9fcd8099ced9c9a3c08202fb7e6b9df2f76ecb11121e113fcd79bc001d093b431bd2faced739a1d4062c93c6ed284ac3c3a0ed0e1949860dd5d382add203c8dce34771f19da6cbe0b135f1a8da435c882a92e4b71f71ad612fa1239e66018195bf4b12764911dbfb9e9d14c5ce6f884bd8384caf2c9f1b75b1a21e5529d7e414142015a91efeba1f2eea8b0d1c27f1eab311b09b64206ab2fccfc17265644c0fcf523cd865cebff6da9f24bcdac76ced8de0af8d9a1e379116cb154778522995ca5ebafbcafa39bb05f4e7b73e417e865701a1bcf801292bd561ba093aa1c8e43835767c7d7d2dcb1fa0018277e82de769fd917285705367b38d505400cce2a787b400c99881fe5c6aeff6047af74cd953e3817152d8b5888c3e35af21e39fb35af8f6fb96f4857c8f93c043c6f967c88af71b2290efdb4746db3a1fa8d494562e7ddc7cd05fb84bd5a80d5cb720dab9b1747af5290f7f8e79acf863c39983b56f6beb67ace39711ad138f7587dc3a198291bd1cac91996cd7a8ced87a40516144de03a494b06409da9b995c0794ce120cce40943a32158d75966777ad1a123b8a4a1e9c2c0003aff255dbb8954adafa90e0aad021ceed89c0c14253458a3ec3691b58c40bd2b6c245864c59566b4814b8339338e85a89753e377585dc96ff1ded5b81a3a34b44daeeba568371e86eef3839e65e07a6d24f79aa9074ae2208501a88cba3efbadefc9d641e9ba2ee8fdeee54363ba03a211cd5727ae72b3a3453973c97d36dd39a650461b676c4d6eb8321a0a3543a5c2a40490493e6174080a3668ea22961869853936b5f8f3c4d32dbed3824c8e647df2114881981fdafbd7987320e48cef3b23f107ba776cf618c7a233b7cfe85bd23648a6a14ac7fc22055eb7d6094564e669f986a6ebc00c404140231ed1ced1abd39dc5c496c5fcf71b1597dc0dd3b0613c6c3663f42ba0aa33dcd6f013e0eda61335015f341ba16df9946a257f4e1fdca8b27d48711c2cdd617fcb6cb84642747676563db76303a7f5c35cddcb136a379b75fca4492accd80b32f9df6e5c40dfd41aab02dbce8bef83d4174124c2dc79cacee9d666b3b1b0f9530c91566c1264bf4c8b2ab97eecc84593da84f0136daf52710bd29b828a9c08c5438f88fd497fe70c6be6af0188dba24b8971d20d168284ae14a870ace4527eaa1f8012899b4ed4ce0e3bf5f5c1ef4ba90ed01bc4ae5a44a100a8d93794a89105c08a36121847c3f7e452bc85a6e14e6731a3713f30b3ab3f84baedaa6e78aaa4d07a0f0833195ac7ad38a1790941a3291deaebd7ba56592e2eab8018c39892326d473eaecbb948c73bbca03dc3ebf13a8b9d6ae22a5eb0f46df8b7a1ef530622a03bf03867b69a133f6ad0152132f1af5ff5a5f34c8312103febfe30bfe4c8c2a756217e44b31ee4ec741f2adbf090bfe4d3a23e5c7bdf0968568c206c2b9891eec45331b1a505d6e31f0acf579de79b1888d213878e9907b150b010336e03c8dd0e0385bbf4f335e8643054f28c7aee7d5dc9bda1971ed2a1d42dcd9867cf25e9ff625c6a4b7a1f472be362dd69541726d9bf1e278b18bb1ff7e624eebfce30ec629a2f66b017abc8bf1b8cead9d204cf3dc1135bbea80a035bcef9f46f13587166f726f1d4c83b78b31c61a278af139ef3101761c842817da63c664c270086bb6a794045bc67a1bfc6cb6b14ab21155351d42dd9efba5081b329a6468b9e34f24b75b6c450a76795b8c0a3d3e4a1bdf8b971552ec1a010ca2b2adc55628324ce21b4879f2020e7e4d6a1fb37cb0a609ea529e1ef811f4558d09fcfc51fcd77a008b48fd47fa0d068ac723d9e65cff2c75e02730e5a67832f543b379cb91db2f7c0df14980e04ff4568b3c3c8292150a698216dbd477affea218f0d3d0dcf64cdebba0a9d85a1c9d57d92b9bd2c4be6770ec24ec6351a63f5bddfa513d6bc60a87d45d182d6c7a3e5d976d2ed2453a8b5dc8607dec931237e5441a618e39f2594483b0a8342bb03f0a26d47d596aaacda53741da97682dce3f96ff0b42112ce93a17cab66468650bd63ac0e4597c00f66d72f179a8a5d785a890e5003a5a0f1af9963ec659de79ea33e48d08794e2dfe8738aa66a6f802c1283633f1c8e99723807b1b46e89895d596b94342e089b910faa097eedf85e4f8364ef7583ca0d67b7dd53e59b38585b02091e63abb64a49050aeadeee85741ed9105e61809488702eb7966a29a87da6fdff695c6a9e587da8adb42ba7aa2e44eb439963a890fbd8a6c8167610cc3c5763f94c5afdcdbda448601a16766c8f1a2061ae0ed545be3aaaca4073e3dc1bfd82f07d37430b61d4f98a90cd501bde78f4a5f9aa40e0fd20a6b95231fcd20f1987beb9343293d20c735e05dc91a2156ce81e7005bfa4cc84ac3cafde592395da08d75c3d6a0838399842bf94267ef1a658a3989ace13c8bc61f10695d7a22626277605e939d5ba703f60bcbf9b0d97fafa72383d3faafd6436df9a7c8b22ab08ef3ee515a7cb922875481f237cb11af70385c1e06b2e8f56fb88ea4f2b45aa0e164edff410b4ef50b98bfb2dd54588da0e2baf54ef49fb4c948ab1af3f85fd09c7a9b4224632527129a01cc53bd9b937c228dbceceedb326af5d25534bc882031b9d3ed13ea2f19a8dd0a9f5f73001953803b9116abb355dbd0cffee96174ce7c692af4c64a5487598bd4d5ece5b5f3b41be3819e050be6995c8af38db551b23e1a869b1d3724193c8c8271f8977c1e94b16bbe631f1f8afe83d589362436bfaea8ad82d220b8b33936e8b661373878b87e87c60041678e0b6de24326afe12e77fcf8675bf11bc7e88e7f8d55f18d5a47a692c2edcc8fb4eb87a6b3ff25611889d57ca0dc3da57d7b7aaed33f31e0f8ef25f2f9936ba8a25c9e1f3856a0301c86abf9417783b2de62e2aa074d988cdf49714aed399c1b68efa2d7860cbcce43c08470c36f9d219d3b01f312c0ecfb20f9d2ad8d0a0dfb48a88eb547b4eb53712a3665cf9c76a8ec2c0a8dc035b9a181577fb12c29b3c1ab967d1c6453e4f8b03ae466764c7b4f44a5897ebde740a26160814f43fd0ed15773d2f2766f74bf24d3abb1a92a848ce570749e446d2f999f6678b0c0242cf4af86bef3e47dbb5cf35d29761b9a3efa6310ff253deffe16d9c6c8889bd72e036360dd3d26f322f611a8c051fcf7b75fb627b57ab845e4977178d6979c766ac426337eb29f5a75e225d63339d5eb2aed57e9cbe470ce217b2f9a71d5d89a2806ef4145789465788e808665e8c89a17ef4127889762a046ba96a7bf34a523b40e79fe724c088270faef57aad0dd8b94431f5efa6dd036e63b7eeae30743be1f73650a35a9bbc4ea9c8a13e7240709c42f829d2a80ed13c59bc3aa87546b81856b18a5baaf7f758f5a82e5447ef23778a9cc435630fab9ab719993f5dab56aec30198c51a371b646113fdcfbc474a72336e3f1749f45340b073c4761679d9806b6f6db43cad301f64fcb583a65c4ab54459d8c905e53587ed5b07399ba8dc64e93d534e0fe0e9f63cd9242f1bc4fe52bb65cee35b32a0ca816aa2c8b41ef01029df812b1a8076d9696d68bfe72b4d39b8401b3b6efaa37d69477d641f19cf50bb5ebdbbe551a9505e129d848f3a8f853dc402529fbdacb9ef147ff0e2ce90a01a5faae09cbbe11827432929f278f973f7cf7087e00a2f90fcb4296e96cbda91b482fa605ae6df698ffc5546683e481639ceedfb908e9eca4e38caf06e0b873b1668c21bc62d78d44e2216ea3c9ccef3464cdfb4fc2fc17026fa4f42f32b88f53e0986e1adc3db688ee311d04b84a528c896c1a7f63645db1670a128989cf82a26cdf71a7bc5331877c3273ac30031341f3e2016804ff8da277a74a09668f776d00dc1ba9f5b137512f0f95da1007081692395fb29ee54e42c52d149234ba5eb6822a2fe1ab229ecbcdea56de356c748ee80e6db1f616370736fd4f3cbf97e1c84a0ac0a69b6d6693c9f2a04d5c8cdbef6ec6eb00fc4419acdea7f260e3cad7fcb63d1e634feefdc2af9907500a23a069b7ccb029c111a2a9f3ed082a3c9efa5c65af75ba1e5a18db35a175d0be58e8967331fa8b767c8f71c89a36293f1e0c8852dd34584e6e617b256af297cf7bcf62f28d14b91e021d48da8ae1a348ec80fdad62404758456d12f1c64ec40dbe4cd2723e92dceb1323f106d91524477769c5f194a1c43b284ffa3c7bf136909293b2250909f294cf19cc4b26b9c718b2897e59989db0e87a8ee8255debc8fc9e07203a43324ba3ae5ca8eac304708f7af3392f1e8b0223542c5f81a229d907dcde959a739ece26e02ea608144bbd7bce732a85c4513785f70c87d38f37b5006beb2765d79b1efaf3ec3b443d8b5bda23da6fc5a3a6ea0e9ba8e63f2199afb0c8f58e58a472d18d5c97136ddc2548400c263e62ca7e58312fa839807feb7bdf0f397e5d196665655531ac530ce3676db3639d824ff050a60b81719ba0e229d23771e9c877062f321a0c53c224791e81da7c745da197e0773084927a6d2a0933df2cfcf4b5e140e95155395488afbb81b6da95011944404ae1ab22", 0x1000}, {&(0x7f0000001340)="9908c9da05b4d04ea9ad28cc3387eb81d1ee0443fa3e46c66bc92214fcedbaca839407e6ed4c54e85fad007cfd8c198d1d808bf2e8b8a85e0e8859364bda07c7", 0x40}, {&(0x7f0000001380)="077da54a9eee668106936a942bb2a8897e4a740c1b5b225767aad87bc17cc18f0f660d862d5636129a842e1d989e4478d8eb03808190cf31441b4bd9179b63e33a6ca8245544cf5ddd6e1453b4cd690e7f78b888861ef32c2865fec3ba5ab5b49b0e4ccf7c756e6837de36cfbbaa12c0d884891dc001d2cbe9fb9ef45a40f348a3d2636e4fed94bfb860198d01c5f3aa342727e6da561e2fdcbcecca758341224434410dcb59f21ada777f839766a72d3b92ac6a70ff9a022d8adbca586e136a4d4dc6fca4babdda5373bdec847fb715512ce2e8299c170fa3f29d7983514dbe6636875300e46ee66aee86cf5d1270150593508c9c40a41a126ec4dbde9adccd5e64274b854a21ac4b3d24ef2c0f3423a7f811460ed916b57c420e5bcabc443c3ba4547dfeaf2b3c24b2d19243da2e4a0d68ffaa3715d0c4fabfe119e6953c4c99122f35cc243e2cda2fde4f49a716571c6a8b33277899fcbd5f103d2dbbaa48a319eb5757acfe22d2307a4980362928df21d39e06016c7bf00a6d6e84bc15fee83e5c243cbaf5be072d382a503564ceb769750a585e883da6f781b23cb18de9388dcc99b868b2b64349981212b5906760a6ffc066fc889a535af66bfe7676e1ac99ab13cfd554ccae8097be31c5227607d09db74c4ac63f4bef139f1557b728ff1aa4e8185cb6246266171698042cc933c4d81f347715f279e55cb0d890f29c12fa4931cc8691f95467f774966051b6625f7e6b8cd02ccdce0197648934d80e285cc95ff0bb02e3e8032d902db9c088367aeb1ae9c7d23f38126c9b15d8e214385abde80ae4154dc287d96f3767212e3452bb8e44547e7577b536a60d04891dd4c2b42a228dfaa08f27f33cf0d5442992182507b2790466ccabab3cc541c5388eeda800f43c1407001e28060cc935edeaebbeddb40ceb3ada520750c6b3199e3b608eca4e28bc66acba4b3580a6c00d61f01552b8ac94da1c410c536cc86a2c76ac767b35d564c0788929b21511374e6636b76b15a2a13ec74d74f1ff250ec6486b3eeda4e10a7e9f647c14650901eb5026007f3e378b92e04e308c9ad92670fe75d2a3782691ef6af969f31780be2e2ebe64b9306788bf842f314fe2aaca9e03295c222549aa80408cee1ce3404a293b0b45f2fc08caa5d6867db1e27a7827bebdceebff57ae3d2ebee1c9ae85ede7a888e65a29afff28bc8762b70913347f935b9d40d96501c9b29ca563b541273116e608c204394376e39e82bef8341180cde69524b7deb628189e3eef16f48cd3a18e98df15c4010fc6e2380e9c4815ce001a218b02f338c669b9a251f8dd0a3608c694b543e82479c5bdf878f02aee64264d486dffb6ce670a978b8c8995f04a4d494a7c7da25154cbe6f7ae6f2b0f1f8cc25af3250a60a86cff78c42663f3c52fbd75974b2d1fb1752016b9c6f3f339781cc0b8e8f1eecfdb796143422b418717fe35389f01c0e54a6164676a8d616bc7dad2338f8533373f1cee62150520d26fa0e1a96dec89f56f542b04739a694943e0f35e4eb22c2c0ced9d15b50e44abec96dd0262144928228a6fb95aa122ffe1f1b9b3e0baa9538fb3fbf9185ac997df11c72a110533cfcb4a002e978d50508edf46f87e061d2c7a112eaf78b9bd48fbb9007eec891eee3a843a54c7f808c42d5e76a2c32b12c496a0517075bd774a20bba865e08068b07b9f5faf5581fbdff8bdf1b7433d89b3a0b9f9e84e3553817c4c54fbe6031c9a13b6d351ce4ece7f37f6493fb991a95173f3ec0477a419fa0b4ba00fff11443afb73503e783f022e25bd88c4bf0793cb6cc15596608600552a8e6f78647ccb0a10e8cccd0bad57b8338d796b0e04c1396f73147a79a1dcc7a17f46e7d530c3fb84b40ded8723cb693dae8e868a786a2859ec69900e7586b970445f3295da450c7b3c7a37efdc7e4220be395528f404b4218b7e863a18cf51be45abea1b687a2e83c002dea3e3f9cdc03c34ec74bb86745bba66e46ee2b78c5bd3d1420049acf3b3f8c2102af0e17b05c9a4ffd59ac64dad1c4ee8d9b4e0b14c14b99f52c353ce4bf9585a83aa3d0ba6befc82cbe14a1b4d200315f17db311c6007ff5f087b46c522278f21d60b6206812710bd99d2c353951a6ea455a226f0dcfd55f03bba07033ab01884d8d7319142dd6a20238d8adf49dc5481c83750bf5ba73cbade4805988643946c04feb27a272fb6e2f33e4d6a29c755563fbf7a5017e0af70e5f598c1f672283a589c1688afb726cf136d930fbfd7934517ae8fa26b345d9b3aa29e04970a62f8301affed630fd472383a92186dc7fbd633163954056f7d957e9d94e1585f3e8149b83972b90793b704fa0b94a712317e3c4b5686ea2e5a2d8fdb1f5c887beda7ed72cfb6c4f3120f52d75b8e1500d771e6e9bcd12e3cb07141fc2e9d71cd6a889fcb4c1a306c8995afb16e38147f270b54d411d1d6de80d88feb116654d4e9ba242cd41f00cf9fefb0eb32e7d80d2f0acdba8b1d968905d95f78b67ba73a56de34e1e4fce8372998a157f3711841b7646c4d793d4bd92b7236be9534d534d1bca18626ec8e671b60936982113824d877c14d06773f76de2724ccdf78c75ed43a3327a2f9c4bbdc389b8b0cc7f0b6b9928bf83cdb42b0b727d3571d4a34b3bf17454a90eb8ae7705e1477595a19f0606b68456d98c45a962c4ee8eba0952aa8b6abbe99722bac105dd182249c129ff6c8af063251671774f6c344a246e585faa3aaf2df316fc286f1a43250be23118cc4f05919c3fcc81c6fa3a3af1f45b88fd539db1bc8c4c38f4fc18d4e37456a310c1594d72074ef0e302d42999a384259653ae1b0259525a5cc90e730dd0cc32bd7d5ace2814c24ffa47a70166273f91fce18d57ae7a7e6866f75b453884095b7f22c3ff6b648723c45cdee3cb3069df9f2184d07e51d03f5e986e86367450683e987e29286f48db613ebda2ea438b746be732353879e503477f9f8107493360329ec5a188fe71aac17f2929e4788194b8269bd897fa8bcd0dab56e3657269945874ea5f9ec82b7a24e962a1fefadbe5c756a1abf94c88b3d895a9c530567ea70e866261ea152cb2d06437a541b0e3ada5f54c59ee2089de688545644521e78cb02523aa54a75cd6dc1944236e7b88619ccdfe0367cd3c14a54aa45cc0ce7419eb2eb732f212832590ded666ea69683fb7ac45f07902818a6033a28e740bc79b095a091789a43ef4335a7a043b948fa6b195a9553b7846e24527bc60e2b734b6b06b7c5b699146857d86ba441c555ab2e57bd685a2712c217dc073c2651223da94ed62a1eeeb3adec75d4985ec84c3eb0b8065bf1a356846d76ff2ec1f6b167b20468fe40fa10a42983f0a073c7aefa14381bd15700b710b35d7ff603a6994f8db7dfe2fad548d42f17995a930b8bf845f70d758278439e2835b8283b581486262db26081ef0ba6a262563a152a644c24b400191fd36d3f03b881503254d1b7dd664791a0e192cfc5c9ef71a08915dd90105cf3162031e62b8248fdac50d828f172024d890ac769fd993d95f6512780084a7174e55add48903a8001f281469d4caa80f6a07eb7ad0f6957ec7fccc6a71d6b988fd2e86cdae0f767f85e66dad5bf5b626469407f90cdd8061ae553e3f310a4d1c38e8b6ca3b82955a9eb973f86b733fc9498df161102352ea0d66e938ba2d430865fb404697a7d6d05656b8b68069664f8ed4dc85628d7f7158135efc125dae9d3d5f8d0a713af384438b45d66ec30681287af82f356814bbca91a34833195f4d7c817e94ecda6000cb1d8121fe1cdd9a00c76f609b2040fd6cc740f5b34a94105f8203f301e9c5a66aeb8506776011e289906fe1956f65b1f97ca6e2d3a3713c101499e739a7b2815c8d7126b64deb646df98e7d434c1bc58ed4a0f34ae5b8cb1d2418604f34825909b6e4b98787e6080264825fa4ed3a4e42cf0cc10eca1601fe8b91c9e3563cf9c3e9e3591b97f963dca48b5da9c8549aee016ece4929f3b98d14d11c9e5782dc227cca582a60c2800f4b6cdc5a1958fc450821b2b017b82f424c0e7cc244c6e05e192d854214375b920a393579f122da0cebe55e671612bb8a061abfca8a4adf54104815ac7ed90a07cfa61387f7f438a198e6f7bcea9a8c2399a619adf5dcd620ddb57ddd217c013c68bb5c5c4924e5ec50e16c2d7f829db43530b6380a122d1cd7ddbc16fada781f018c468b41f4cce2e4da264af81d275395017a166c6fc6eb62109ebe51a2a1e965a2dcd8b33d5bb2154cf5852725448cf23371009ece9e7a0f1d0355260cc0ea0ddf8286749724abb0faa705c88878053838739b2c023e7490eb89987243300f17b78d25824d56015547bd5a20662bc6dfc2ed15ce582e5ffc84fde5694dcb4a3a8a70f53230e14234f5cadcd17710d5bc1ff5df031a77245971f67c582623372dc6df7257c28ddc2a849f5bfb9c348918d7e845ef71a8c1799840541e3c59509100279d4becf835934f7a20f99a12f2bd99e1951d5293f21490516afbb3e31915fbb73dffdfe93d0a166fab2129e1fc7cae5204321a7b3ba50761d593ce117191bb9343b77c6b407bd4f019c59718d8ad0cfd807fc5375827ba48ea517946a14bc537e32b2739578faa44b81d9e1f2268f98eb739b3087933374a1263c1250cfc53ce92419c3a66bb05d04dea366b43ee01e16c4c1b010f30b6720716aa12097419cde300defbba1b73be2d0aaf5445a9fef135d703aae3727bfd0b4685d425555c06393093e60300f0cee39d346bf0629adaa5788b3a9726ee7c51c3da7a75581cc3e31a525c47301b7fc1935a24aec8f6a936ae518576c0839f36555f78d8147581b0998a5fa93048e16a48d8ca6d22ae9f7e1f270e74ffeb7adae37aaa5e5e99f3fbed19979b13c74068232bf5302792bdfb03df3e036a8f5983e27cbbeb36b22744260d266620036f78e84e58188c51861d8d97d07c8891816ef3cf9ee77ec094f575b867cf3e1f763384dd9ddf4864722cbf0248170c0c8865341fdb87dec455d7db1e9f595aa064ca9400765a3cb28bd9a56eb91243771cca2863566dcf348d226019fde6e956016a253dfda80aef303952c6ca5ecbba310fcfab99b9e785d7a47232b6bf30680124308b12c658c75da507cf0ef6200345f4ef5e1e79cfe5214e3c9c36ea92cdf345d93bdfb3adcbb7f0e558c6ed32b9b3f205c46a3c65551b2c830552dbbe7ddec09d8025589b028b4f08c7e95c2d2e2d4ab8142204f892a3d1af006a426ac9c74c52f34f677d5379f715653ef10c0944998f466222f6070415bd90bc688709ea55201606d4c31ef717b5cecea0ff61588db4429fea18b3eed10985cc64cb02b27b0906c15c815f56b24708aa7c608f8a72e668f6b3daffa1710ca93f522d7bb8a98f151b573631c888f1565a4460bc75f798a6720816d0f5435511ae34e63491e162403b0479cdb40de8977125a0324052e46bde496d41d35c618c1e59080f724faeeece01b3753c10577baceaf67b7a64e555970e1a27599e414235c9fbf151302b5ba20c7ab0516d693eac67a104d50aefec4454cd7aaeb8cee113e160f1e7bda1590a133b568bf22f2ee9c556bb88244671a67bb4a13bbbe3efcae94dfc11cb7f2304849ed2381c5de9979031e71a8a26cc69a7834036934972ac6e0c8ccbd7f3b4f42a18a03db36643077dec264040b499ee1b4a44ce90a11578ffe8e0cba0657eb0c198b8320ef917facb4f46dc95f5b3641ff6755a44cbdfa3be43a0f7ad9ddc981e45", 0x1000}, {&(0x7f0000002380)="514aaca9e186ff9a264b01510a5e75ef9518bd7b48d0345e46f0befe599ced83db268d37c667a284b00128b9c50ec329c54f67af451766c52f824b26addf6e925eaaa32a669175a66e8976acc6084d182ff7d4068a5a450e655cb0d4c1a500ff0cfa55794118bc799382c8724007d3b286672496bea26ffb47ed944f44feb4017e9940de9b9201b7683b13f19912fafd25e6ed1a2d58e0b9af5838fe421246438bf1e5eb", 0xa4}], 0x7, &(0x7f00000024c0)=ANY=[@ANYBLOB="18000000000000001701000003000000000000000000000018000000000000001701000003000000010000000000000018000000000000001701000004000000800000000000000088000000000000001701000002000000730000003b311cec0f5fdf28c07ed09c5df05a8034ccc1b9b81fc5fbcbe7ddc1daf1891dd594d7578b71a62d162b84b48783a8543c89e10e635a659517922f89441ae1736f6c6fa90ad0b0c78802000000fe8f254aadb9350eb333b3ccdb20b12c1fc46f01752abe64b8bcdda05de9a0e5dbd7b1486df700a00000000000000017010000020000008b1d0000593a78e3ab8b725daa191bc00a3170ccc73ecf894c2e253625264f507b3b9dfcd1a61f3b04bc00e1adde8f903f6e8a3c35c3ff52ddb4d764c6a4b7e95610bb2f3badd2f91ebacf86423ff515bb4af78dc5c9fff5536726360191175a168d9cf348ee0ee1afa5363cc667d5235278d1d0e395a7bcc60e476753259bb08886c1bbe1dc3ec31b5cccaa1785bc00"], 0x170, 0x840}, {0x0, 0x0, &(0x7f0000002800)=[{&(0x7f0000002640)="5b4d9122f300fefff1c0d0", 0xb}, {&(0x7f0000002680)="2aa6712bb00b26fcefa27d758184ef2d4f6755a62b599177c72275bea33fe2ab", 0x20}, {&(0x7f00000026c0)="217b8c58e7cba6f48b4cafa2", 0xc}, {&(0x7f0000002700)="ec9e22a902b6e25679dd3c935f2d3be92a173063fe13fd3d8ba05af30c90ba9f486a093e9117403763a19da941c36850a7748fe356670f0473da9f170ed85fef91531f745f8cead52e1068357d2628c6447cbd21f3a2c5e846de57a6b9614fbddbeb0b537e26572c068505f75e99ce73d5bd63923ac47c9ef3f5a35057aa1fe3884b50021eda0bb1a6d2dc2fc424d6b24de4e1ffaab8c030c75ada63b44f391ce303cfb4ed534a4dd85a3edbb62122bf1c28f9269bbd83db3afdf998b7569d243eeb1f586eb3f2d7fcb9189d2f7609755aa04b462372993edd8d52d1c7e65b3d970a3eab094ce3ddbdabce613d9f86886697", 0xf2}], 0x4, &(0x7f0000002840)=[@op={0x18}, @iv={0xa8, 0x117, 0x2, 0x93, "3f0d49448d77e19d01117b9fd052b078a369c07b095fda53c6eec64135a19dbb63fb8b2c43ab4bfc25b7cc1c03876b41d1cd6aac2965409d16e9a3b1dd91b7c82df54aebf9fbb019c565ca6a6909f23246981c7ad104c38ce40996bb85f698a2bc712627566ac66bda29b0791bf9aa33c76a8e6f824bed817e3d8a10e9e32663e0fe7fa94a8706d08a446c08f72d6e86fbe21c"}], 0xc0, 0x80}, {0x0, 0x0, &(0x7f0000002d00)=[{&(0x7f0000002900)="d878e5a1667cf24a0cd87333327ae655bd016e79156771d91bc9c19260f45cdd86829b5a91b86bf98686c0dfe27cab78b216e8d0f3b6722524677ee13414b8ab809cc5b80df1979d4077", 0x4a}, {&(0x7f0000002980)="5cb00f8d87cc9b33816d1d9804ffe062fe821db3c152528a274be7eddb8c3369fa23de258ee9a015af9bdaf35b12330e28b4777614fe86df9484741cc89b81cd53c4eeb70206b11bdb8ea2fc57f4b772f9145a4992840b5b6f2135c05354bfd215dd0b187080d09a73d4af570c75870900900bbef5b6b895eb418a0918f4aec542c65f0f98c289f8d0f85b513f86cdc47ed7663c1975edb7c4810ad6d98b897e99be74edb1", 0xa5}, {&(0x7f0000002a40)="26494f261dda6a5c389948e0e397447d5f5bd2aed1ac16c69df82679e8e11b1f8ca5b98e88969527d440ce9c9b59143377b72eb507d41511864c89e40c8893b82a87dece44e9531aa7f94a6ba8ba38279dd655ae6fb881ff0f1f69525279f47d31c749ea2558eb", 0x67}, {&(0x7f0000002ac0)="e1d6e7612f5083bb89019cd4b4ceb648cff50eff2d08ac490b0316d5b2", 0x1d}, {&(0x7f0000002b00)="fe19228882586b4dc019df7a6ba1c21b8c73302c9bb6559efacebc14e1a540ed03cb4554d7790137cb3a0696a0c1bedcf217f560e548fbf5aa9b580cc75cef7f8a197bc21410a7bd183dceee13891b7b2fdb11a52e5cfeacbd9469f24874b4080895b1357dedf35b249ffc8b83f37c4af469c384b6be842e2d343c1a29", 0x7d}, {&(0x7f0000002b80)="70527f694fba5d71344921cef330c10203b2ead5c98b157cd5a4b39438facf33b3ab6f8083d891b3cc0ff84f01705085bae996458ddc9e0526b000f4", 0x3c}, {&(0x7f0000002bc0)="105c72c732eb74b7a93128564bbadd5e140141991741340aba54e250d6c98f505af7e237f4df71707cd4225e598a6649b3dae245617797c15dd653c22e34a82b93cf52916891e674a5d091c4f6b7", 0x4e}, {&(0x7f0000002c40)="301501f27b39ca91712897c0af7f5a6d9c2939e9398d4df2df71ba75b93e554f7a8a98e08859e61fd0d039e7f99e43dc90b36a47ea0d94e2e386278c75c17fcda418031bd7c4ac81b1744f02fd3b3e92f244da9784c3e172c8862febc09c39a2c00a9b6350597b96577c93b4fe7c08d69486eecfe026e0b9ef8088fbec3e7d7355e1d34f04c38e0cc841bea9d7f3c0cdc1f968a26ab5cda085ee9961597bc0", 0x9f}], 0x8, 0x0, 0x0, 0x20000000}], 0x4, 0x80) 01:35:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) [ 340.135501] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 340.143998] binder_alloc: allocated: 2584 (num: 176 largest: 32), free: 9704 (num: 1 largest: 9704) [ 340.166434] binder: 13180:13184 got transaction with invalid offset (0, min 0 max 24) or object. [ 340.206411] binder: 13181:13189 got transaction with invalid offset (0, min 0 max 0) or object. [ 340.228114] binder_thread_release: 13 callbacks suppressed [ 340.228140] binder: release 13190:13191 transaction 346 out, still active [ 340.241005] binder_release_work: 13 callbacks suppressed [ 340.241016] binder: undelivered TRANSACTION_COMPLETE [ 340.255582] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 340.264002] binder_alloc: allocated: 2600 (num: 178 largest: 32), free: 9688 (num: 1 largest: 9688) [ 340.329778] binder: release 13190:13191 transaction 347 out, still active [ 340.337152] binder: undelivered TRANSACTION_COMPLETE 01:35:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:20 executing program 0: r0 = socket$isdn(0x22, 0x3, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff5000/0xa000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000080)="b51b8e9d7e4bf0ba5e733fbc8a35d7d4b3c94aa8b0d2f29badec1eb6edb54ca85d3aca395512805fc69bce6688b2a523e3d0f6d3c5c8aff310ec829f9f9194f18fe1d882eb8daede8a0bc7e54d854aa88a483d7a2157c5387308759f54208358dbd53017fec54aa97d23bee9327756b94f72304723d5cf768e890e28bfcf9d54d219b926e689dc95e0f04e3262", 0x8d, r0}, 0x68) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x1, 0x802) write$P9_RXATTRCREATE(r1, &(0x7f0000000040)={0x7, 0x21, 0x2}, 0x7) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) write$UHID_GET_REPORT_REPLY(r1, &(0x7f00000001c0)={0xa, 0x2, 0xfff, 0xc00000000000000}, 0xa) 01:35:20 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r0, 0x0, 0x0) 01:35:20 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x501000, 0x0) ioctl$VHOST_GET_VRING_BASE(r2, 0xc008af12, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vfio/vfio\x00', 0x280080, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x10002, 0x0, 0x1, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00') r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_ERR(r2, 0x4008af22, &(0x7f0000000100)={0x1, r3}) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 340.578018] binder: release 13200:13203 transaction 350 out, still active [ 340.585093] binder: undelivered TRANSACTION_COMPLETE [ 340.610469] binder: release 13200:13203 transaction 351 out, still active [ 340.617585] binder: undelivered TRANSACTION_COMPLETE 01:35:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="395dd433dc3dacc446d74449f82cd4ca73ccb711634840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:35:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) [ 340.716917] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 340.725464] binder_alloc: allocated: 2616 (num: 180 largest: 32), free: 9672 (num: 1 largest: 9672) [ 340.818064] binder: 13220:13224 unknown command 869555513 [ 340.823962] binder: 13220:13224 ioctl c0306201 20007000 returned -22 [ 340.831009] binder: release 13219:13222 transaction 354 out, still active [ 340.838265] binder: undelivered TRANSACTION_COMPLETE 01:35:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:21 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) 01:35:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x2fc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x20000, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000040)={0x0, 0x1ff, 0x1, 0x1ff}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={r2, 0xb0, &(0x7f00000000c0)=[@in={0x2, 0x4e21, @rand_addr=0x6c8}, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e20, 0x4, @mcast2, 0x2}, @in6={0xa, 0x4e20, 0xffffffffffffffff, @loopback, 0x4}, @in6={0xa, 0x4e22, 0xc398, @loopback, 0x7fffffff}, @in={0x2, 0x4e20, @multicast2}, @in6={0xa, 0x4e23, 0x4, @dev={0xfe, 0x80, [], 0x1b}}, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f00000001c0)=0x10) [ 341.118835] binder: release 13226:13229 transaction 355 out, still active [ 341.126089] binder: undelivered TRANSACTION_COMPLETE [ 341.187324] binder: release 13234:13238 transaction 356 out, still active [ 341.194574] binder: undelivered TRANSACTION_COMPLETE [ 341.210652] binder: release 13234:13238 transaction 357 out, still active [ 341.217886] binder: undelivered TRANSACTION_COMPLETE 01:35:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x7, 0x0) write$FUSE_INTERRUPT(r2, &(0x7f0000000040)={0x10, 0x0, 0x5}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x80000001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 341.271550] binder: release 13237:13240 transaction 358 out, still active [ 341.278838] binder: undelivered TRANSACTION_COMPLETE 01:35:21 executing program 1: socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:35:21 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) 01:35:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) write$binfmt_aout(r0, &(0x7f0000000000)={{0x108, 0x6, 0x7c, 0x135, 0x3b6, 0x800, 0x2b7, 0x80000001}, "5e23f989b0e12e292e0865ebe2b26a8cb1245bad90ca9ba151a988fd98e6625796cf499178d3f8fdfb0000124ae9cf9d3e8557d43e9e388d04ccfcbb3e4d1baabb63b315d55eedfd6430894c5176eb162f40c76c102f5eddd4de78995abd6d482545d92c1e0ffa778ddd05b5349b8f8be2c97db0899634ddcfbab3641b3b92852bf17bcd48b0115fe521e76d8adae92be4a8ed78d8f594275fd97e7e98c7a9f4169069f85a244834c0affa13c42aae468cab6a6fd11677427a7e1bcb0a87c729a7fdfa0e741e7ad1497278f63782bb5620e92ae346fab04985e3a3fa0d9d32ebaefe1257435dee165e7ba2c751cfe99ce2968f660a03c25fe346f147867ca54f39290b42d4dc3443aec96396bad4a4f2d777dc206f39bec30a1f56974d4925c527377a412ea1d9395dad3de06344e7e963e84c512e2631df2633741fce21e56332984be974f479609a3e29d0ee1b8bc8619169bc907d2233d5a97a827926415fe2a1e321db5ad4f0f42e1b442aa35823342e08f42c9fcc9df86c9e85e7100a571208c6fac25fb98cb2abaf2ad0d2d72a1f3c7abc67a5b38f157aed614b5608e8b8a6e2fd25f947481bdd4ecabb63a457169669a262c799864bc04401b5c38cdec5e781af4cf9021c183c3cc844e488db2bc5986fcb3bafdbc9685496afd5b148b5fb44d487b3fa178847f035cd2d00f909fea764acdd70b1f1bb511729effe5a3c1812935cedb7a5ac48c8c5688c40d15373d8620db316bb39056154bc1f65ab4538d24923db34969f20df6e7f906cda99045a816a0b8b4c6686aaeb45a64ba849b1f48bcae38b54128387796d630a9c3f2d49524e4114b8b507392ed78d20e9ec5b1a199ebea7513c3a945d35e4b2f2843e4e73eb76fb26997c2cb42b8cfaeff27dc080c7249dc89ef87fe86fb7ad49dc69dc0598fbedbe58ae66ee78ec7c928dd2524f1a55a217bf9fc73ed8376d38297f12f22d84d61b279476a88728acca9df0c288b25c3e26645075789d454f6ea743980b4581d7d1d7cca15703d76ab4cca792e11fdd9a95fdb1d6de71990096f0a2741dc91cdb5af106c588fc7721168973f60188f4123060ebce1542d8368a06a787e3a9d3303223c713d24d30b6e7cf4e824c8087855f2eb1fb98d7787586956f1c1843d424b979421bed0bb27b1ad8ab5b9ede5822eac7094dfcba2e422d3fd918ff8f8c426e9a03ca0ef513b344c64b701e2f8385c282189ef4037b80f761c87c8a535c81b17192d1e2a65aa9d92aff807c14c5b059d4d65c8ff812765dd83fceeea6f904c3fb13184d09551bdfe1275251f9115c87fd827f550903b4de24f78fe2cd3d8977c03a224164199650d90ca1ed4c0174ca4943d8a14ce04ce0f9a5e4ee287ef9379203d65d88a79d61766e3e5a6bff0d897c87f6712adb0189f04663f987d36cb010ea1321357981b83cd3a099161065f6373fd080eca0ce38adf21659c9217b5df0a5ed84d9ceb6fc718756d4ddabf0486e5f8f58b7d50be1ac68bd4e8730634fc88248ab6d89c12a81d943a4cc3eecad016977e81a0cab8519800f077b4e0913a5192177ecb8897f45516c74ed4732eeb762c9339b35e506b79ead7dd1453ebfc7e36d5a136927c53033129f6587f220d150015172133442dd8480ea88a01217df7ec2a23644bbc00fcdca98d1324d1647838c86b114f15b0d2b79a1930eca118f36b057e32aeda0393e112da0748fc5b255975725170b1a8e287f8d6448270e4675f7032e46cf3e5db925ac13c546982f11ec461436f179cb5273d65658bd6638e3756f5ea76e8f5c43967e4f2aea2b50d829eb59a2b1ab384fc5cd1eed2b8c8baee858a9986a6b286f7bc8b50748e0ae661d8aca283c5e4009929c55b57dc8140fb7932f2189d7883e4add2b22c660009e61b9446d1fb2cdf5f60dc0a798ddb4c6f2735f3c2235f8108298fc8e7f6aff732e635022428f26cd3516481d7955b6ca351663511cb4543aeb2e0557a56d70c37b45d389efbd344d4b56748a416b63ec3e0d03ee2e0dee39225e42aa8ad9202d7a7cd17971fa9927cc5a2514a1e819129181996458b8a67d49a82418d04c2a2d2bb4d363214e69b6c964892226005884373db1cef136190ea4945214a1fbe5a305f016a4a4a87e2ca7cba6178942ab485ff69b3016d2a11ea46de8b2e0bae9b7397f7313859286eb2664bcd9a2ab6672198e04eff38bb7d93d12cf92b875d0634f3438f67863100d5ea346af3edae385c3a632678ab3cd7e64fe9c633ef94f0b81e26e30ab7a1eec38d1b097d3d64b13c09732c6265c856d8f0d1d259ed01d8547de142e74d0280f694bb977ec6f0fedf80831071fb4177da113c13965e7b54622eceb6f33c91c1288735f69a66df0b86ee9ce95b3719778f11894603842d5dbd55919af74478dfe409ead4cbe2ff242a566355af8b74b069cb9a15703584ae3462db67e6b105754fb1bee62d8983098883f1dfb2852817c562fec7c43f75159d5aa51e611cfba9af92d34642b817aa8453b34d165b47549c579fdf42dd0c537ce100a8d8b24fe1bbf377bb3c470f19a0e1ca960b4bfd19719c6d84b9f5401fdc93ea6100a81b33766a25af7a1feebc7677d7b0734d61c36ba72688d476eeccfcbd8dd23e056064054ba5659ca77ddc47ae089ddbf07bdb56a88fb9bc324ae75ff193ae4715eab4a3aadfa49b2297e06ddf1777f9a9d3fa3d71e5301579bd52d77c2316e655fbeaa1af7c83f017af76dd9510d7547bc0866efb39625c9a70c5172b257ee4780678d85b2c02d3eec09c84f35953be46d5710973d2d2cb7bda321a5f58978e91f85811ce5d61aadb92280f9aa7fd332c04a4283017393cf485bacdd5cc80db85d9fcdd2caba2ee8a7e48f66d9987ff30008ddf83cd7be3e4caef52416b5a6cbffdb42a3ea8d9edc47e357b96875634532a248c3e3504c00ee9d1d4ee17fcbaf1d759afca2e9fe4cf7d8383b7b0d9746249058cbb9b6fbf287a2f0b87d221fafb202c4016089f1cff3b74cc56608f3f68274aaae3d6d3714b32e1644edf30f6f46f3e31926619d472996c80403092d702937e85c0a40b2bf828dce3a15e7f0e3abaa9e461ece92dc3b2098d3aa29bb2132dd22a8b65a0739508579504882b8ef65a94137a04a6afb15bbcce9a4787d4bcceef79ba3d75ffd5b7150a764640a0c0c7cc15b50b5199cc7aa9b2ad7fca82c019c2794de1f3c026300456ce519b39c4fd2d2b6e26a1901bf01c995acf17c7e4fd690e6672bf271bd83bae880890cc781ff497ca68895ee318e535c5a70ad5e170578fc444291f6272b29856fe7e0749d869e64b24628e43086265c6bdca81d319acccae91e2df69d51aee38c611f6601be8985001ee27c6d2fe72cec4e88d325fbc73dfe54b7c2952b865cd0f49418f49d33e22af031a7064d3d32ee4ea7ce41de0caaf17200f148266007aa1414af23609d8ab601e2b1ab4af54cb61d1cc6ffe16410afac1601c90bec71b1cd0a12277332ddff10247e16150059d92542c0ad1b13c9333b0d8eaa8bbae62489eadbf61729a595ed8a897c614f421ee3fea74baf53e0af520db471f4225e5b466208ebabb71e5c1e20b6fad0d997795b606fa4b5c2864c0734c10d11737ced9a38fce5dd5c42a69469de7a86d2ef7ebb6d791e919686a9d3405392533449e5d25acde498225ed35fef4a18a724d3044219a0bedf0a9fd74515713fdd638225789506bcff6c96841806d4db2db8877b0b55206fdeb7c55cbf5c2f2b6254fee1931a87af679fb2ca9d31ffa5ece4eed1343ac6ba3c61173277f01f45239b1fb2bafdc544dcdaaf94f0bef8ca8161dc14425a393f7c2c5641b2f369539b02726ed5cccfc8c4e3c59aa17b09b815d1537aa5c38c86d2226f4a3625d8ac2c5aee4de89588b391343a2bd0833725738fbef051fa1312df7433e548ad0c164a9c64290ec6aa52eaf672ae412f48d50ac8cc88176895e50d536d796357713c74202219324bc618e6ed63d1b7034a7cdafb18f46ae605ebdc78ff1a0592c450cb2d365389c87af6e0ede73bc36f08fd2e7d0c468eff5c6a0b2d017d0f62524b5e130aedb7df69739196ec09f146d57309731073a1f7e5dd4de5d3c27689c4579515381188d2d71fb85b5e4ef2ad8ebe7fbfae6f8ff2318c2863e4f45b93592acf7154d5b2a8d74d58a0135d5b5b21a66b8007fc5bd72f5f10a6c4cdc1e65c497864ee3d34a95cf8c9012d74242f61993bc8efc1f6a9f2cb9001e21a516411343f72a1470ebdb829bab44d607cdd2b26ea5f483cf4b7d666bf3c26ad2cc2cb5d857a3ad204011e74b06a2b34c8fa58570b96528146d5c68bb7fba61ec443f853c17b799a9229900918eb537e9ee16d873dcdfa475bf2f8e12cb0209fde45aed537c11fa2df46dc1d14820eeda48e0e269f0d4b1a5231142a49c09d394878e1fc208cd852a996ea07212a891f9dc65c2324f58d654d27841f3518e3f43eb254e7e68560abac9eddc2398f8b682b55034b2a8594f47e02f169b63e05328f453fe2f3c8a480ca5dd6caaf863644e4a6ac004fa27697ef5266b757f7785973cd9bfe0aeea5809162942ecca72adcd495c2890200e0f99354183bb08e5eecd1545ac4ed3aaa83db7e59596a42cc7f4b5009fd192e44d581d477f58ad1e7c4519c224fc20911023abafbb2416ed0166b248c4dbf628f7c2c3e419aa107acde28324df45a7e05284e159e8a6f7c95479acefc0e2414f61f5e1faf622b883689a3768e9ae12b1be3dce4a68a1567dbf122166a2164f5b1719cf258bc914768579ab1a558c203375ae0fc83fe20bc6fdf68914eebc5ed14efbb3e7cf75b8fa3ed760f03d044460ec0b1133f6a0d98e99af8882f2ee2ff7acb91b189b93b38a991faf0a5cf7861d81ebcf8f8d1569d7ac8a197436d5fff0f337f26c7e1f7b00346a637f10a14598f2d7659c5f84d4401699f4840a4711a624677763fe113a069a16699ed579f3b1168cc6a74d0960edc519a6012da839baa3a750c0a81bd4e372813a57bd86f6d03f67e5821d0969e2f422072428ed0c9056dda69190c58063c92fdc76e04b1ad9fc32588360a9bce7cd10d89cb89bc493ffcd140e02e8b5196e6abab033b80c65c04dc17486a1679e8b267cf9c78f92a670f9bb24b66c63c1407b3ee73f09b9ec7b672ba660926bd7b3051f208b1ef14857d30a7883af9c7da342261e40f673f87a7184b4795e3ae0d41cee496409e3f8e6ab2aaf56c1a2e37c8dfa65d66ef01a159116ece9d3c4a264e20081645ddc47b2b4fd0234292f3d7c241839464fa3852b8ca692ee80b81d0a00d035b1600a2bfdd54fa78fb1031393f1bf330262ad1c50ee4543978719f0895f76ae417dc342f8f6abdd32a0f9b416b96da4206a3281c74974cd7b907f4921ccfc0a5ca7be604f349e40f79c80ef7a20fbc714c7c754a97cf6e97e6b383e21128bf51710491a733183dc3e698fabb4d25684db9c467cd1a7a2b9a4a7158d0e237b5a91c69c49cddd9540cd33cfd3d394e891f5e820b2da2ca97658cd497527f2c403b33522b1bf4f4b3550810d39ba4629fe66230f53cd492ce31f7b78e0e74021e6f09245e5ee6c6c8ad731d1938b1b85d7e776bba236a4f59340bd3f61f59de4ac8c25ca0733e4c692a60e5a4a2c0ffc661d949141f5c27d3cf44fe01d240548f6f59510f280df647618a78af6e46af10d49f5d0f6270f194658593facb31c84a221226a49c57c06d0e75b11a3003859c395d78b552ec88638f2ac88964e303da48a205b25b9c9b5e2ecf", [[]]}, 0x1120) 01:35:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x302, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f00000000c0)) ioctl$KDSIGACCEPT(r1, 0x4b4e, 0x29) [ 341.555742] binder: release 13259:13262 transaction 359 out, still active [ 341.563076] binder: undelivered TRANSACTION_COMPLETE 01:35:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) [ 341.664923] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 341.673544] binder_alloc: allocated: 2704 (num: 187 largest: 32), free: 9584 (num: 1 largest: 9584) 01:35:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="e3a3be92112950479b44ede1f2ee407d2abdf1d68ca4a82d2e29a3ac6ff10e1473fcbd494e75ba1f055af0d080623afd0f33c4ec06cc9f8155d678a2d3cabe1d9abffb47e7fed347523a64602357e52cb272511d61d4f3b3077850edce924f03b00dc80bd835f5a2399ed799d9b641583edc4539dba5653285f03d2a475173deeb79151ae6007fb3cbc2abd825b11114bffdadc58f0b4ac07be7ed0a798a6c3aafbd6ed768010b9ce21621f4e0a1bcaba5221d9f4ca566973e42db586a3b8f9a672a138309e26fc229401b29a0b4582606ca4739503aab473caed7cb5ce3e86875c509ee8ef709938a1b768bb42deda0174887c14a3ee5f971e3388ffe3fb44b2cc54fa42d7c09ff8e6104ff4574ecb1690e501a1ddd9465731f4876a3c9574275235110980c497f8925067e411156eb"], 0x0, 0x0, 0x0}) r1 = socket(0x11, 0x4080805, 0x8) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000000)=0x7, 0x4) 01:35:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$setlease(r0, 0x400, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0xfffffffffffffffc, 0x4200) r3 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video1\x00', 0x2, 0x0) ioctl(r1, 0x3, &(0x7f00000000c0)="08d86f664daec3dc91d996221ace71228f70c1a316113200becabb10a4fb") ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0xff) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f0000000200)={{0xffffffffffffffff, 0x3, 0x6, 0x0, 0x6a}, 0x2, 0x7f}) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000040)={0xf765}, 0x1) r4 = mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000140)=[@increfs_done={0x40106308, r4, 0x1}], 0xffffffffffffff42, 0x0, 0x0}) write$binfmt_script(r3, &(0x7f0000000280)={'#! ', './file0', [{0x20, '/dev/admmidi#\x00'}, {0x20, '^)]'}, {0x20, ':'}, {0x20, '/dev/admmidi#\x00'}], 0xa, "52dd4ba4264f94644eafba47eca364d35b965c4c30e0d9fe0b9b9fbc9ee889bef5f0bb938a0b771ed59194c98ad9b7061d717e96b8339a34cdd3941a47ecbd69b5fc908b7167038b788b2470364b91282e8849586c8d53d8ac13e9992f9d0d5a35a13d6bc829fc05718663355e3f4ed03ea15b708d332dda11c5a891cc52e5c6697202157cf28a4684ba3ffd9b89ef4d156bbe4b7f1eb8c6e6a9c9418aaf01677dfb43bb35a8dde51a71faf545db3c494e6593cd459e3765c2943fd64261587365c23bfe231f15f62579828da08f1db4733a789e9553ab735cf15f123135b4a3a7fa7dbbfae4"}, 0x115) 01:35:21 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 341.836304] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 341.844811] binder_alloc: allocated: 2704 (num: 187 largest: 32), free: 9584 (num: 1 largest: 9584) [ 341.875306] binder_alloc: 10623: binder_alloc_buf size 5875000215309253632 failed, no address space [ 341.882533] binder: 13286:13287 BC_INCREFS_DONE u0000000000000000 no match [ 341.884751] binder_alloc: allocated: 2728 (num: 188 largest: 32), free: 9560 (num: 1 largest: 9560) [ 341.891973] binder: 13286:13287 ioctl c0306201 20000100 returned -14 [ 341.955299] binder: 13286:13297 BC_INCREFS_DONE u0000000000000000 no match [ 341.962864] binder: 13286:13297 ioctl c0306201 20000100 returned -14 01:35:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000fffffff30000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) fcntl$setownex(r2, 0xf, &(0x7f00000000c0)={0x2, r3}) 01:35:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x0, 0x0) getsockopt$inet6_dccp_int(r1, 0x21, 0x17, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 01:35:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) [ 342.189994] binder_alloc: 10623: binder_alloc_buf size 34359738368 failed, no address space [ 342.198754] binder_alloc: allocated: 2728 (num: 188 largest: 32), free: 9560 (num: 1 largest: 9560) 01:35:22 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f0000000040)={0x1, 0x6}, 0x2) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) prctl$PR_MCE_KILL_GET(0x22) 01:35:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 01:35:22 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:22 executing program 0: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000100)) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840f5b7e70db287064917efeff0ee639767176d752b2b405108748bf0a323f0e0a034d5f090510365616d6854bfe9bf815b58104e34dabf54d9fdda4b9de85929d2dead2e9d2f0eb99a8125bd38dc7b9238b9eceda6a976c72ec8c19a7fa75a1ae4bc789344", @ANYRES64=0x0, @ANYBLOB='\x00\x00@\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x0, 0x2) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f0000000180)={0x0, 0x0, {0xfff, 0x400204, 0x20, 0x5c1}}) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000001c0)={{{@in=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast2}}, &(0x7f0000000140)=0xe8) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0, 0x0}, &(0x7f0000000300)=0xc) fchown(r2, r3, r4) r5 = epoll_create1(0x80000) r6 = epoll_create1(0x0) close(r5) r7 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r0, &(0x7f0000000780)={0x8000000f}) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) epoll_pwait(r6, &(0x7f0000000100)=[{}], 0x1, 0x0, 0x0, 0x0) accept4$vsock_stream(r0, &(0x7f00000000c0)={0x28, 0x0, 0xffffffff, @my=0x0}, 0x10, 0x80000) setsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000340)=0x9, 0x4) 01:35:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x1000, 0x40) setsockopt$inet_mreqsrc(r2, 0x0, 0x26, &(0x7f0000000040)={@local, @local, @multicast2}, 0xc) 01:35:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) [ 342.606010] binder: 13414:13420 got reply transaction with no transaction stack [ 342.632277] binder: 13419:13422 got transaction to invalid handle [ 342.662278] binder: 13414:13427 got reply transaction with no transaction stack 01:35:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000833dacc920bf377af7561a000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 01:35:22 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 342.703854] binder: 13419:13422 got transaction to invalid handle 01:35:22 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r1 = perf_event_open$cgroup(&(0x7f00000000c0)={0x5, 0x70, 0x803f, 0xff, 0x5, 0x40, 0x0, 0x1, 0x0, 0x8, 0x7fffffff, 0x632, 0x6, 0x400, 0x1, 0x4, 0x100000001, 0x67a, 0xfffffffffffffffe, 0xc9b, 0x3, 0x8000, 0xfffffffffffffffd, 0x7, 0x200, 0x100000001, 0x2, 0x8, 0x1, 0x81, 0x8, 0xffffffffffffffff, 0x1, 0xed7, 0x7ff, 0xffffffffffffffe1, 0x4, 0x7, 0x0, 0xfffffffffffffc00, 0x0, @perf_bp={&(0x7f0000000000), 0x4}, 0x100, 0x500000, 0x400, 0x1, 0x3, 0xdf97, 0x8}, r0, 0xa, 0xffffffffffffff9c, 0xb) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x71c5) 01:35:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="11634840df9d71ca6c7716392d0a5fe0a7ade50b4ac72e4feb918d10ca1108a9ff943456", @ANYRES64=0x0, @ANYBLOB="00000002498b41ed3958b3c9a42f068b16f78ac2ddd3239fbaf077bd94c44955084fb70d66c657fbe8e4d838038e9de3ad8a6047ac15ca91fa941c96e28128844fc551430cfe7c8397545f66b02f76"], 0x0, 0x0, 0x0}) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x7fff, 0x800) openat$cgroup_subtree(r1, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) [ 342.899235] binder_alloc: 10623: binder_alloc_buf size 8643264834984096520 failed, no address space [ 342.908750] binder_alloc: allocated: 2792 (num: 192 largest: 32), free: 9496 (num: 1 largest: 9496) [ 342.918087] binder_transaction: 20 callbacks suppressed [ 342.918125] binder: 13436:13437 transaction failed 29201/-28, size 0-8643264834984096520 line 3035 01:35:23 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 343.035495] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 343.044043] binder_alloc: allocated: 2792 (num: 192 largest: 32), free: 9496 (num: 1 largest: 9496) [ 343.053506] binder: 13444:13445 transaction failed 29201/-28, size 0-0 line 3035 [ 343.091962] binder: 13447:13448 got transaction to invalid handle [ 343.098301] binder: 13447:13448 transaction failed 29201/-22, size 0--1350645267552010240 line 2896 [ 343.113704] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 343.122324] binder_alloc: allocated: 2792 (num: 192 largest: 32), free: 9496 (num: 1 largest: 9496) [ 343.131735] binder: 13444:13445 transaction failed 29201/-28, size 0-0 line 3035 [ 343.174268] binder_release_work: 21 callbacks suppressed [ 343.174284] binder: undelivered TRANSACTION_ERROR: 29201 [ 343.216590] binder: 13447:13448 got transaction to invalid handle [ 343.223060] binder: 13447:13448 transaction failed 29201/-22, size 0--1350645267552010240 line 2896 [ 343.244131] binder: undelivered TRANSACTION_ERROR: 29201 [ 343.250995] binder: undelivered TRANSACTION_ERROR: 29201 [ 343.290234] binder: undelivered TRANSACTION_ERROR: 29201 [ 343.296044] binder: undelivered TRANSACTION_ERROR: 29201 01:35:23 executing program 1: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e23, @broadcast}}}, &(0x7f0000000040)=0x84) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f00000001c0)={r1, 0x40000000}, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@mcast1, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6}}, &(0x7f0000000300)=0xe8) lstat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ENTRY(r0, &(0x7f0000000400)={0x90, 0x75d7d029a57afb77, 0x3, {0x4, 0x0, 0xb7, 0x208c, 0x0, 0x3, {0x4, 0x2, 0x5, 0xfff, 0x800, 0x8, 0xfffffffffffffffc, 0xe6, 0x71a, 0x2, 0x6, r3, r4, 0x100, 0x3}}}, 0x90) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r5, 0x0, 0x0) 01:35:23 executing program 2: r0 = socket$caif_seqpacket(0x25, 0x5, 0x0) recvmmsg(r0, &(0x7f00000025c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x12001, 0x0) 01:35:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/cache_bypass\x00', 0x2, 0x0) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f0000000040)=0x800) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:23 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x480, 0x0) futimesat(r1, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={{0x77359400}, {0x0, 0x7530}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xfffffffffffffffe) r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x2, 0x2) ioctl$KDSETLED(r1, 0x4b32, 0x5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0xa, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000180)=ANY=[@ANYRESOCT=r0, @ANYRES32=r0, @ANYRESDEC=r0, @ANYRESHEX], @ANYRES16=r0], 0xffffffffffffff8e, 0x0, 0x0}) [ 343.570459] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 343.579147] binder_alloc: allocated: 2792 (num: 192 largest: 32), free: 9496 (num: 1 largest: 9496) [ 343.588520] binder: 13565:13566 transaction failed 29201/-28, size 0-0 line 3035 [ 343.607887] binder_transaction: 4 callbacks suppressed [ 343.607919] binder: 13563:13564 got transaction with invalid offset (0, min 0 max 0) or object. [ 343.622619] binder: 13563:13564 transaction failed 29201/-22, size 0-8 line 3097 01:35:23 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_adj\x00') sendfile(r0, r0, 0x0, 0x2) 01:35:23 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 343.687321] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 343.695819] binder_alloc: allocated: 2792 (num: 192 largest: 32), free: 9496 (num: 1 largest: 9496) [ 343.705384] binder: 13565:13577 transaction failed 29201/-28, size 0-0 line 3035 01:35:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0xffffffffffffff7f, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x2000, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r1, 0x54a1) ftruncate(r0, 0x7) [ 343.821185] syz-executor.2 (13585): /proc/13584/oom_adj is deprecated, please use /proc/13584/oom_score_adj instead. [ 343.840177] binder: undelivered TRANSACTION_ERROR: 29201 01:35:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000000)=0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x420000, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f00000000c0)=0xa, 0x4) r3 = syz_open_procfs(r1, &(0x7f0000000040)='net/rpc\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$TIOCMSET(r3, 0x5418, &(0x7f0000000100)=0xfffffffffffffffb) [ 343.889201] binder: undelivered TRANSACTION_ERROR: 29201 [ 343.912536] binder: undelivered TRANSACTION_ERROR: 29201 01:35:24 executing program 2: r0 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/attr/exec\x00', 0x2, 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000300)=ANY=[@ANYBLOB="cc060000000000000000000001000000060000000f0000000500000000000000280f000000000000000000000000000000000000000000000000000000000000000000000000000004180000000000000000000000000000008000000000000009000000000000000002000000000000000000000000000000000000000000000008000000000000000000000000000062f4ffffffffffff001000000000000009000000000091aa44c9000000000000000000000000000000040000000000000000000000000000060000000000000000008001000000000200000000000000000000000000000000000000000000000011000000000000000000000000000001010000000000000700000000000000020000000000000000000200000000000000000000"]) epoll_create1(0x80000) readahead(0xffffffffffffffff, 0x0, 0x1f) bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e20, 0x8ed, @ipv4={[], [], @broadcast}, 0xffffffffffffffe1}, 0x1c) epoll_create(0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) read(r1, &(0x7f0000000200)=""/217, 0xd9) r2 = socket$inet6(0xa, 0x2, 0x0) syslog(0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) pipe2(&(0x7f0000000180), 0x800) close(r2) socket$netlink(0x10, 0x3, 0xa) epoll_create(0x4) r3 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x200004) sendfile(r2, r3, 0x0, 0x8000fffffffe) 01:35:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 344.100285] binder: 13594:13595 got transaction with invalid offset (0, min 0 max 0) or object. [ 344.109482] binder: 13594:13595 transaction failed 29201/-22, size 0-8 line 3097 [ 344.349246] binder: undelivered TRANSACTION_ERROR: 29201 01:35:24 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:35:24 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:24 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000240)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000100)={0x8, 0x120, 0xfa00, {0x4, {0x5, 0x7, "469677b3be235d8e558a2af7851a63043f4debe3b025aae10f34d8605ad54d3de10e15d586e845ebd80cd1497a23d516d00659019dbec6a68abfdf4b13001b6fc1b4a32eab08184248f80b23be41abd9d2a17b9d0c71ec6e5df6093d7f1f06481c9a627404cd277b21ead800403743d69804c5f6bf317c85abe2b44dfa46f69b8c0cb416cf8071e3f2377c51dee0a7e654ab455fbc7231a8b91a37b450cfe198bdb6530fba6c06c39a38ae4d697ef2de3bbcd24f865d9ef3306f309b4cae7a4d76aa7e3a1cb7847e498d35d11aeffd3306e20b34e6bdb1e433ebb5e83dec18d141bc2caee001b31e1ed6f5adcd3c5fcf8ccaab5711db59f389168a9fe6781d98", 0x72, 0x8000, 0x8, 0x7, 0x8, 0xfffffffffffffe01, 0x3}, r1}}, 0x128) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) ioctl$KVM_KVMCLOCK_CTRL(r3, 0xaead) 01:35:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x40, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f00000000c0)={0x7, 0x9, 0x6, 0x5, 0x7, 0x80, 0x8, 0x5, 0x0}, &(0x7f0000000100)=0x20) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000140)={r2}, &(0x7f0000000180)=0x8) 01:35:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x64000, 0x0) ioctl$NBD_SET_SOCK(r2, 0xab00, r2) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000080)=0x14) ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, &(0x7f0000000180)) fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000280)='NET_DM\x00') setsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000480)={{{@in=@loopback, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e21, 0x0, 0x4e21, 0x0, 0xa, 0x80, 0xa0, 0x87, r3, r4}, {0x8, 0xa5c, 0xd74, 0x9, 0x6, 0x9, 0x80000001}, {0x7, 0x10000, 0x7, 0x100000000}, 0x100, 0x6e6bb9, 0x529a23005ec1f2b7, 0x0, 0x3, 0x3}, {{@in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4d4, 0xff}, 0x0, @in6=@local, 0x0, 0x2, 0x0, 0x8, 0xfff, 0x6, 0x81}}, 0xe8) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x10000, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f0000000580)={{{@in=@broadcast, @in6=@initdev}}, {{@in6=@initdev}, 0x0, @in6=@loopback}}, &(0x7f0000000200)=0xe8) [ 344.608276] binder: 13708:13714 got transaction with invalid offset (0, min 0 max 0) or object. [ 344.617636] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 344.626045] binder_alloc: allocated: 2808 (num: 194 largest: 32), free: 9480 (num: 1 largest: 9480) [ 344.635499] binder: 13707:13715 transaction failed 29201/-28, size 0-0 line 3035 01:35:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) timer_create(0x7, &(0x7f0000000000)={0x0, 0x2a, 0x4}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000080)={{0x77359400}, {0x77359400}}, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 01:35:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f00000000c0)=0xef1, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r4 = dup2(r1, r1) ioctl$VIDIOC_TRY_EXT_CTRLS(r4, 0xc0205649, &(0x7f0000000040)={0xa00000, 0x3, 0x6, [], &(0x7f0000000000)={0x9d0b7b, 0xa46c, [], @ptr=0x3}}) 01:35:24 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 344.782940] binder: undelivered TRANSACTION_ERROR: 29201 01:35:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x802) r1 = dup2(r0, r0) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r1, 0x408c5333, &(0x7f0000000000)={0x4, 0x1, 0x1, 'queue1\x00', 0xb83}) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e22, @local}, 0xfffffffffffffe0f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="8e6e85a216a2d26aaa1b7766b3cd17f4e03291cfbcf7fbbbb8cc6b8760f02268384ca3fa6b552f9f5154912ac1155fbebd78c9c20b543eec653c8c86a4fab8febcbc1dafab746aa3064b1f4a32d23325d7a8d26583532b52efbb55e9a9e36c1358ad90b798b66ae362aedb5049d02c298c454ee363e1cde759a0e08a1459818eb8c07f9136fc5322c7ea5ed1087c21454aee1d2587ea835006e9a92b8d75ad389b1eb9e79143c71f99846748d868a29f5c4831260b747c721ce97047c880eb30cf648557435859c1ab6aaa2ed7b2749d0e983c"], 0x0, 0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000300)={0x0, 0x7, 0x5}, &(0x7f0000000340)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000380)={r6, 0x93, "400efc14a98f3d1a5830cc934ffd53ccfd091aa9ffc350f40a1225301a9ef6963abfdcac8f24e4ebd969aebb7ac418d158be0c8b9bc8428ec5cf6b3cc47c3857be61e87d90ee3e6cbcd464f539b4626ae3d1e36bd87a62d20bbebe28dac28248525f3cdb1c8045b766acb980c5b1d0740b2a20fa99e86e6e1a29501555743fa3a87b40c1005e2eaad45e33c9edd8217a72b9a0"}, &(0x7f0000000440)=0x9b) futimesat(r1, &(0x7f00000000c0)='./file0\x00', &(0x7f00000002c0)={{r2, r3/1000+10000}, {r4, r5/1000+10000}}) [ 344.949875] binder: 13725:13728 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:25 executing program 0: socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x4000000000000) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) wait4(0x0, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='reno\x00', 0x5) [ 345.114858] binder: 13736:13737 ioctl 408c5333 20000000 returned -22 [ 345.160662] binder: 13736:13737 unknown command -1568313714 [ 345.166710] binder: 13736:13737 ioctl c0306201 20007000 returned -22 01:35:25 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x0, 0x0) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) ptrace$getregset(0x4204, r1, 0x400000002, &(0x7f0000000040)={&(0x7f00000021c0)=""/4096, 0xfffffffffffffda8}) [ 345.256385] binder: 13736:13743 ioctl 408c5333 20000000 returned -22 [ 345.307977] binder: 13736:13747 unknown command -1568313714 [ 345.313915] binder: 13736:13747 ioctl c0306201 20007000 returned -22 01:35:25 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000000)={0x0, 0x4}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000000c0)={r2, @in6={{0xa, 0x4e20, 0x2, @ipv4={[], [], @remote}, 0x70}}, 0x66c0, 0x5, 0x9, 0x4255513b, 0x18}, &(0x7f00000001c0)=0x98) read$FUSE(r1, 0x0, 0x0) 01:35:25 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x109000, 0x0) write$FUSE_POLL(r0, &(0x7f00000000c0)={0x18, 0x0, 0x5, {0x6}}, 0x18) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x102, 0x0) getsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f0000000040), 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:25 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:25 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) accept(0xffffffffffffff9c, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000140)=0x80) fcntl$dupfd(r1, 0x406, r1) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r1, 0x800443d3, &(0x7f0000000180)={{0x1, 0x8, 0xa392, 0x3, 0x2, 0x2b69}, 0x6, 0xb602, 0x4}) r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x4, 0x101400) fcntl$dupfd(r2, 0x0, r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 345.609852] binder: 13763:13764 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:25 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:25 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000700)=""/80, 0x20d) unlinkat(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:25 executing program 5: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x226801, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r0, 0xc04c5349, &(0x7f00000000c0)={0x8, 0x80000001, 0x3}) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="57d67c11634840f1905c009a2a1bb8e28f066f6f011d4a6b7220427e0085f18bde218fe7b8ce8a5e738d4bfa03ef9d28796266bb5af8b88bf6985e4b570ff74342702be169d70f1a56d6ad21fd2ca5f4ff716c2472154530e53dbf13c083858318250ff8942f015af0f6f5829bff47f733de8e5590bf86a45b165c8be226ef6d0dc4875dc2e6388dac31b6796651f1aea30cb0ffce692f4a59b289f72eb4c19d7b78b908e590d03b0ac85cd4e7430e45be2eb31cd4594fc3a53d497bd969ed02e1485563d7715ee68b6c6f9f4da1cd9a0000005296d4eaf8"], 0x0, 0x0, 0x0}) 01:35:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ifreq(r2, 0x8975, &(0x7f0000000000)={'irlan0\x00', @ifru_names='gre0\x00'}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_ifreq(r1, 0x8925, &(0x7f0000000040)={'bond_slave_1\x00', @ifru_map={0xb5, 0x100, 0x5, 0xd0f6, 0x4, 0x6}}) r3 = getpgrp(0x0) ioprio_set$pid(0x2, r3, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 345.900152] binder: 13779:13781 unknown command 293394007 [ 345.906019] binder: 13779:13781 ioctl c0306201 20007000 returned -22 01:35:26 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000700)=""/80, 0x20d) unlinkat(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:26 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 345.971398] binder: 13779:13784 unknown command 293394007 [ 345.977279] binder: 13779:13784 ioctl c0306201 20007000 returned -22 [ 346.037552] binder: 13783:13785 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x0, 0x0) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) ptrace$getregset(0x4204, r1, 0x400000002, &(0x7f0000000040)={&(0x7f00000021c0)=""/4096, 0xfffffffffffffda8}) 01:35:26 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000100)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000340)='net/sockstat6\x00') exit(0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x7) read$FUSE(r2, 0x0, 0x0) 01:35:26 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x101, 0x0) getsockopt$inet_tcp_int(r1, 0x6, 0xc, &(0x7f0000000040), &(0x7f0000000080)=0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:26 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000700)=""/80, 0x20d) unlinkat(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000100)={0x0, 0x0, 0x5, 0x0, [], [{0x5, 0x7, 0x1c, 0x7ae5e2a3, 0x7, 0x2}, {0x0, 0x7, 0x3, 0x5, 0x100000000}], [[], [], [], [], []]}) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)='\x00'}, 0x30) ioprio_set$pid(0x2, r1, 0x80000001) 01:35:26 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:26 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 346.627808] binder: 13906:13910 ioctl c0c0583b 20000100 returned -22 [ 346.634790] binder: 13907:13908 got transaction with invalid offset (0, min 0 max 0) or object. [ 346.670756] binder: 13906:13910 ioctl c0c0583b 20000100 returned -22 [ 346.678084] binder: 13907:13915 got transaction with invalid offset (0, min 0 max 0) or object. [ 346.690851] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 346.690874] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 346.705820] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 346.705857] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:26 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:26 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x5c, r3, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x48, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x20}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x10001}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffffffffffd}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x10000}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:26 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:27 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:27 executing program 5: fstat(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000000), &(0x7f0000000140), &(0x7f0000000180)=0x0) r2 = syz_open_dev$radio(&(0x7f0000000380)='/dev/radio#\x00', 0x3, 0x2) ioctl$KVM_ASSIGN_SET_MSIX_NR(r2, 0x4008ae73, &(0x7f00000003c0)={0x7f, 0x10001}) r3 = epoll_create1(0x80000) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r3) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000004c0), &(0x7f0000000480), &(0x7f0000000300)=0x0) getgroups(0x4, &(0x7f0000000340)=[r0, r1, r4, r5]) ioctl$IMADDTIMER(r2, 0x80044940, &(0x7f0000000400)) r6 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB=')cH@'], 0x0, 0x0, 0x0}) 01:35:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x0, 0x0) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) ptrace$getregset(0x4204, r1, 0x400000002, &(0x7f0000000040)={&(0x7f00000021c0)=""/4096, 0xfffffffffffffda8}) [ 347.010303] binder: 13929:13930 got transaction with invalid offset (0, min 0 max 0) or object. [ 347.224041] binder: 13933:13937 unknown command 1078485801 [ 347.229852] binder: 13933:13937 ioctl c0306201 20007000 returned -22 [ 347.282055] binder: 13933:13943 unknown command 1078485801 [ 347.287837] binder: 13933:13943 ioctl c0306201 20007000 returned -22 01:35:27 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='limits\x00') getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f0000000040), &(0x7f00000000c0)=0x4) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x0, 0x40) exit(0x0) fadvise64(r1, 0x0, 0x5, 0x0) ioctl$KVM_SET_FPU(r2, 0x41a0ae8d, &(0x7f00000001c0)={[], 0x9, 0x7, 0x4, 0x0, 0x7ff, 0x17004, 0x10000, [], 0x1}) read$FUSE(r1, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r1, 0x80dc5521, &(0x7f0000000380)=""/155) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) 01:35:27 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:27 executing program 3: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f00000000c0)={0x9, {{0xa, 0x4e20, 0x0, @loopback, 0x4}}}, 0x88) openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x80000, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x1, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fe) 01:35:27 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x3, @remote}, 0x29b) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x1, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000000c0)=0xfffffffffffffe00, 0x4) [ 347.576346] binder_alloc: 10623: binder_alloc_buf size 3138655408 failed, no address space [ 347.585124] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:27 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:27 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 347.695073] binder_alloc: 10623: binder_alloc_buf size 3138655408 failed, no address space [ 347.703827] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:27 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$PPPIOCSNPMODE(r1, 0x4008744b, &(0x7f0000000000)={0xc0ff, 0x2}) exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:35:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x40202) ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, &(0x7f0000000040)) 01:35:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="113ec41609dfd315385aa263e78a07282c37d676cb69cea39a175e42d981b7f60995cae91ff50f43ad4e6cb425fb564ceabaf57a71187611eb9d804d57e1b9a8986b5e656c9dc098d044d94bc2774886676c72d5a0f38fea6c67194b5c9c0fd865bae095c4c5798a0f93af94264a5072c89aafaf62e1265bfb37fddcb67ec5d8f5dbb433fb8f8fe569b6ef496c80c4c01b0167303a165d2299604a0240c9d69928f8fab1af0f49276fc57524b6e8d1f660194d52ad37569c846d34a6472d8565419fca8d10e3e9a103970e638bea554734918af9da97d4cb2885d4342a98652b2286f7985c537823530611cb23f62ff4c234309004dc7cd89939bb4de3f20000"], 0x0, 0x0, 0x0}) 01:35:28 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x0, 0x0) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) ptrace$getregset(0x4204, r1, 0x400000002, &(0x7f0000000040)={&(0x7f00000021c0)=""/4096, 0xfffffffffffffda8}) [ 347.975014] binder: 14072:14073 got transaction with invalid offset (0, min 0 max 0) or object. [ 347.984218] binder_transaction: 14 callbacks suppressed [ 347.984253] binder: 14072:14073 transaction failed 29201/-22, size 0-8 line 3097 01:35:28 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 348.120489] binder: 14082:14083 unknown command 381959697 [ 348.126263] binder: 14082:14083 ioctl c0306201 20007000 returned -22 01:35:28 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xffffffffffffff09, 0x0, &(0x7f0000000300)=[@request_death={0x400c630e, 0x3, 0x1}], 0x0, 0x0, 0x0}) [ 348.212139] binder: 14082:14089 unknown command 381959697 [ 348.217874] binder: 14082:14089 ioctl c0306201 20007000 returned -22 [ 348.226110] binder_release_work: 14 callbacks suppressed [ 348.226124] binder: undelivered TRANSACTION_ERROR: 29201 01:35:28 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:28 executing program 2: mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) ioctl$EVIOCGKEY(r1, 0x80404518, &(0x7f00000000c0)=""/18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="116348407edf1242dc65d8231db3fec4454ac394a7572f5dd31f0673663ff0e64539d1c32f9cb8d7bc8b07ee7c1e4508afb60ae3517fea03e4650a0cbd306b09139b9f54604463576be67159f91e6ed967f198d4a64a4bc8e040541003530e02fed7bbcc9dbf9485451e6b69de7aa930f8cb2ee6fcbbabf2c472288b688e836ac5326b25f2ff5ad6fe"], 0x0, 0x0, 0x0}) 01:35:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0xe0) ioctl$KVM_GET_SREGS(r2, 0x8138ae83, &(0x7f0000000040)) [ 348.655297] binder: 14105:14106 got transaction to invalid handle [ 348.661844] binder: 14105:14106 transaction failed 29201/-22, size -1294912724656415697--2086654614458524036 line 2896 [ 348.708167] binder: 14108:14109 got transaction with invalid offset (0, min 0 max 0) or object. [ 348.717424] binder: 14108:14109 transaction failed 29201/-22, size 0-8 line 3097 [ 348.726218] binder: 14105:14126 got transaction to invalid handle [ 348.732840] binder: 14105:14126 transaction failed 29201/-22, size -1294912724656415697--2086654614458524036 line 2896 [ 348.746794] binder: undelivered TRANSACTION_ERROR: 29201 [ 348.756183] binder: undelivered TRANSACTION_ERROR: 29201 [ 348.838583] binder: undelivered TRANSACTION_ERROR: 29201 01:35:29 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:29 executing program 2: mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:29 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xfffffffffffffffd, 0x181080) write$cgroup_int(r1, &(0x7f0000000040), 0x12) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') r3 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r3, 0x0, 0x2000427, 0x40) write(r3, &(0x7f0000002000)='/', 0x1) sendfile(r3, r3, &(0x7f0000001000), 0xfec) write$FUSE_DIRENTPLUS(r3, &(0x7f0000000380)={0x10}, 0x10) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xc, 0x1b, r3, 0x7ffffffffffffffc) llistxattr(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) exit(0x0) read$FUSE(r2, 0x0, 0xfffffffffffffe49) ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000140)={0xf, 0x102, 0x1, {0x100000000000006, 0x9, 0xdd, 0x1}}) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 01:35:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0xffffffffffffffab) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="116348406f16b659b71ba77f2ee67b841cb09c2cfe3f53ef1bcde06f3415fa617081b292422d02928418b820fa68116d125f8a65d03e6efc93d6ff91238260373ce5ac29c8892012cd5dbda8d9281d1daef44741e40c52fc906e4478eaeca4e2fb0870b6b8c4d8cbf00379f5d1a78d0b884dc2bc340ab2c5"], 0x0, 0x0, 0x0}) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x5, 0x8800) getsockname(r1, &(0x7f00000000c0), &(0x7f0000000140)=0x80) 01:35:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="000010"]], 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) 01:35:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x0, 0x0) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 349.037977] binder: 14215:14221 got transaction to invalid handle [ 349.044464] binder: 14215:14221 transaction failed 29201/-22, size 2357661362592820546-7316765077360699642 line 2896 [ 349.056983] binder: 14220:14222 got transaction with invalid offset (1048576, min 0 max 0) or object. [ 349.066964] binder: 14220:14222 transaction failed 29201/-22, size 0-8 line 3097 01:35:29 executing program 2: mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 349.103148] binder: 14215:14229 got transaction to invalid handle [ 349.109476] binder: 14215:14229 transaction failed 29201/-22, size 2357661362592820546-7316765077360699642 line 2896 01:35:29 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 349.193497] binder: undelivered TRANSACTION_ERROR: 29201 [ 349.199070] binder: undelivered TRANSACTION_ERROR: 29201 01:35:29 executing program 2: mkdir(0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x1, 0x0) openat$cgroup(r1, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.swap.current\x00', 0x0, 0x0) setsockopt$inet_int(r3, 0x0, 0x2e, &(0x7f0000000140)=0x2, 0x4) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000100)={0x2, 0x3, 0x6, 0x80, 0xcf, 0x9}) [ 349.419035] binder: undelivered TRANSACTION_ERROR: 29201 01:35:29 executing program 5: r0 = inotify_init1(0x80000) vmsplice(r0, &(0x7f00000013c0)=[{&(0x7f0000001100)="39f85a31266703649b8d84218bedd2f5786776156b02fd94566bc1ac8df61a4b4fde86b1e6f308f8c9c603750e4bad868d4e7bfcf2a346bd2565b06126d662d48a0358d537794bdc1c6913cfcaf2ce962010489f2e4ee307359fa4d7c8cc2351a3ff4221d0b040ab4a8eb09ed674880c6fa676f7d2dfa5df1ddda1e8ef7545d47a7f613962335850a7703ea1671b6a98d8c55078cc5c11e36bd91ac91c4a9fe7d008ef194fb881c2a9c7658433e34f89a33d688aa676b88b3c4fd5db430dc1a977c99b42ca2bb621fd15f0adc6d95260704676d3311a5dfaad7bf1", 0xdb}, {&(0x7f0000001200)="f3fd76b4968b7ca8c45b04040fb398a1b342e5f54573ffcd9ad6eb1dd3f8f5f71db01055ca74df5f17e4cb30c2d467816794a415b42b7a1b7304088fc637a1d0a1168e1c63d7c2249bd2b150ad234e8dcf95384cebb64c38d54019d100f1b89361c4f8fe998e", 0x66}, {&(0x7f0000001280)="1490a846035fe1e57839a8520b62b7864f6ca7cf6c7297517426731e4c5c142a75ed84fe919612a248fdef61f1dd6fa6529bea7e5e2b3cc1accca2ee472b8fdfbbf8bbc8838d6392038329eaa1375be03cc96ff18ae6c595f2e0b65e1f2900001cb6930205083c77e4b654669070c7fb45783cbd5995e3f2505627711f997ca147b245a01e463f6b2095cb76f69c233cffc7f9e081202935d787712d3385f169acae24c6f09a81cf8248435066273328b0ae", 0xb2}, {&(0x7f0000001340)="1de783426bce9903943e5f77055ead8484b9cd2d182c4c2fb1d5ab4d86063e52a0874539e4e0a3920b15427701d95a4e9ee366dbc425395bbdc2a18e4216c8334332f8732c9dd330a077077343c2b01f95d6078ed21dfd5caf3e8744cd", 0x5d}], 0x4, 0x1) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x101000, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000015c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000001680)={&(0x7f0000001580)={0x10, 0x0, 0x0, 0x440}, 0xc, &(0x7f0000001640)={&(0x7f0000001600)={0x24, r3, 0x0, 0x70bd2b, 0x25dfdbfc, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x1}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x4) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) setsockopt(r2, 0x0, 0x0, &(0x7f0000000100)="26fbe965e48378f341e0506669c741ba091f7e287398dee6c6b67636b9dca621147ce6e0527f7a22aabd0fa44ca1cb1ec1c4ee6f549f14b4d42da80a60a20f4c3fa2551819921c261cace5bd59a2a4ea83406713392419ab33bbbbe88c3ec3dc45861b0250a2d13a3a8073c985cae7b09524d61a84c73e02013cbed92f60ce595bc98b974efff3fd1c1e592539b05dcd19fb2aefc58f5e9758b1c436065787c2f05501e1412eb01ef2309b19b5f8d2cbd2de324ba5211bcbdea2b38fd0be603db4206b8a00d590bab14934dcbd13b2eac4078e65f027d36a310a2630e482005c76d9be5e5f3e14fb1b35f6e5e2996c12650a40e505beaa1c5d7b50aa8a4ee54881af03f323eed290f44e589ecff1898b3d7d67cfd73d7d96611a4842fe3d6d8b06d100bf7c839c32f4c8b44df2857a65b699c1054bbb5ef4ccdab5dbd2339d87cab4490897df08a3383ef2da7585950fa615a16fda1c8a90f6be5490fdac7b89524d906791d5e88e5894db6f96b3a190b4dcb12bb7fe28d8620dd6b37b563afe66eedcf1c204f6257d85372049b11261ca8a411a1c66b814f88530c738993ac29e576a26839c8fefbadb12e072eb04b18a7a7513ae9fec58f71a4eb8c8a94013afdf302edc146594b5ca46968bd82e16f5e38babfcecfd9d84f2d6e14f6b379ed0077eb10f62842fe246d84b4ebd500256454fca194d3b8263385212957fc66b51b8f95bb3e62edf31ac19c94a4f27b1398429f9c5cb7bde19411115d2daa44e3d3d956b868e70c277473b369b0384e877462acb6d39aeeae29fda8b8a6832ace81098923249d3d095c15b216f9bc949a558cd2b1cf7684ee83b6e9003bb5fbc0a907b85f25210cb704624bd573e6784a9d17503ff70bbae44cecb944c3cd5b60c9abc03aa3121d39571b122554774fbc2555d3091d6b9cb53258f98c259fd510420a35aac398dd4c0dd428969dc83be02056aa44a9c47c2aa75c39e1f36c84937a57dc5b67fd927d86ae4d383b05ad53786fab4f61b1667d174a376f65a328ae0817bdaabf0ea1abcdd180f91ad38509afaf744406dfadce1a67ddfa3d57f4157572690f8ca6b2eb3fe52070b674b994984049e7cceb10c82e53cea87ab8cdcd1a50f2ace55852d274e1dcf2984c46956cba386925af8a2cc9e7820b99b5ffac235a489098235c91fd884bd25f77a98b629f69e50dd66314ce56be67055e44af9a94cf119ef885c9c40d93e818c479c39726052c26fe971e6b98822fbc4ca6e56a990f2879ba2b077f91cbd1ac6a18b50ce9f08be0926edae4b4c8455f3ce3eb00c5df5109a79f2094500041d5868a467a58f7d7737c98492146e4036e466d60c936cfc7a332ba05785e45a52c1c67c25e9d134c4df583b34af1e5f29bdaec0c31478bcb9ec4194ec0894ed2708bbfd14219c98416404e29feda550a9cb6fd6a704217ae0cf5cb4b7f486f0cba78709bbcd6bd52fe522634801b71bb14b7afb7979b2e1b2e26367d6c87bc8c2b6c282bf5d510c16cbf30a20fe2f6d3a60239570d57db2e8168adae8a5eac6dd099eb54011ffbed64504980272ea1a3dec63cc51b084a9847fbd97de66afb63598071dcf22a211bd95cea29eae56ac1825db85dacfdde6e0323260b921ef24257fad41b48075fe2c358684505184a6254c738a9ce860d25192d9bbaf0a6cbc1f1f3c74967d377aed78e8612d78d504c07c147334e22a82d087023acbb6d2c57e9d690fa782976c6c35e2706e221a30962777d216e2ec7c65e5b3edade6d174a69eb970162144099272b894b97ca05647255abf1db77c48d1ce38c5c0e1770e2d2d8a72dc12a86b172892072a7b93a62693f0bfaf38932154090cfbce2cd53acb0b20b281732ea9fdc94a34db7a3f7122f440a2043a37fcfd00e5b0e8380ec01a73b0bd906819bd20e2f36b8166848d9c5c4af60d67a2f8884273b8965479f6828885ac50564e0178368b3f7d1a503662c274d9c3de4d706642c2f5f0bc7d7f31dd8e31507e556f41d9d5feff3142a8c08579707759097f8061ffa65dd40eaa9e9fe52ab39387b1afb8c326a11bf0dc110369361de36f506a75d585a207b6579008194ee59535edf2b9f9e8f354d9cd8a490cbfb938741f080ee659698adf34f738b3c8a1b6ebab858bd36238f96a276775dc697c731755a40c65c1d9ba81beafb0c9c264ad35f4809a53cbd92e21adf393039605490f229f42c8e98d0fd5e567ec1016a8806d5701ac4541aaed8cfef879cce4c6f92fe8963e5d363d6f68677adef254c4a0d2786002e3859d8d89b78c8a4a58c1b1e2fa8d7d97ab5f08564f34236606c3783cd2deaba5bcb94d6f2b41fd83fe26033701e4db9e6108f8e312ed2444333614eb633c5a4de2f31f29b7df5472ff07ce313d86cbb3bea3e9f71fb25e3bba827617e0c585fa011847ef4b96016b36da383c0b306d50a18c50d2267419213958bff42ce638177433f9b3ce7d6c8df31dc27c161f241ab30ae378ff4d388bc03f2e37a1558f9336abee3104816ac350b102883d3d5f47826ca4b68946a4e973e7b3ee04ce8d6e923aafbf423bc423fea58f2f057c82d41e82acf3a04b5ca2ab189db67b5881b3370ba73f6c0ddfbf27f994fdd23cb49af2277c61339db1e9e2060b03c25b4ed217b3ddc6af8cd49d0f0c40e9a34799c7a366149bb6e416fc266b6a1dfa232084c127f2ae7ce325e2153f579991dceaa773e98e883b3762af057255ac35ca2e1079dc476906072dc7486e6d10e864220a351a01e0442b90110267208b5120793734242876937cfd554821256e9f23383d9155913e71d41caebc8c283ab542bbaccdbcdc8734e8e8f2e418a6305b6fa82d0730b078e4ac0c9ede727332bdeff52219e44d8b3884c6a8021949adb7035435f00bb999d0a4669477e338b338f50085e89d5d81c88db0da065656045879a412109af0074f4a54120993da7c21bf756bc8725c797eea571c5be48dbcbe8a3edb1dc1eadc36a5c0a760dde43f825e0f16d2ec91a3c8a8791b65561e61a7cec00facd1349c755f569602bc4234693e9a65a1d188c18f49e8ad02707a8dbc3deb0911d0fdd81569f33b8a96acae9a3e212c5261758d81b4034776ffa13d427427654de944aee3e4fa828be940e671ea47a7a7c2a3b96dce75e8d3b34a1b19ceb724963c7a78aab7e20419c05ef74c4bc8f5f7dfc5bd7f6e581ad4bfc4291f91e01db4c59fef74582d1c28f8030a6db5bc8b2127596858391e0ca5aca3b1b889a3b3c602dc6d3e97c0812a79312a723dfd554d38fa052fd1109c6eb02044e4a545a211396f83f6e1afe933c64a82ea90911846094ebf84bcd84830cc10f19c45d92876abeb5bc6b676185b8a1b2e114e1e75860cf3ef5da16811596265217de2a5928377a21be96c91ed021944222f343c524a5c9177d73a83553c92ec47b0ec12b8e74dc4290decec94c5a026f5e53ef02215b91069e5f4281a341f937fea4fd81454cec2a82a329de64e8202639990473e192baff33bb882098fcbd2e42d0bb1eb0ebb5e5a9e83cb9c533dd0443e3952784b89ebf75bcf99f843705aefd437f23cde866800f4e21e5d8c2a6bfaf34ea15afafc2fa5f7a120768a9609eb6e90c0f2a623079e93e84b2173c638f4d131c0d8d7ef796fe93bed08a24fe8d14dab7a8fabdf766cd94b7fcc2997ead586a051125eeec0a46cdfd39301d9f7a5f293be9948f782336b915ab6baa3fecde09168f30dc33624e08d5e7832a538d23265830e8140a5c393c435dff491169e167e678e30e0f86aa899479844581e9c9cd3474ded3a63e1c12c4c8ce9170f0d062657da2b43c6431465084778535ce58024190de40095470ea69c89f8195f16defa65aa01e5728b51a44d033d6ce3aa3259a0f4104dc72553924f85c6d1003b23c77052bc977deea38631ce0ccdcb8d822a436449486200604f0b248ff01ef52df564449e5413e9b4f829955c2e68ae6e1bb4ef433eab138af124ab5fcb7c7bd5b63767b44add746c09d11ed5bee152c38856561552672326cc3f06c90047351c16a1716e709cf6da3166548cedc00a6767be06d8fedd34fd99fbfc8c04e3655bae1ee0c0a25fdb6c8a9dff635d55b65684442ff5e93075bba00e89f263cfab0f30bad1477b45d494a461a38f15d5fa435c2079c7a064ef4c57837a5e8fdb092d2eec8d573bf9e89d9a757d58f908ab52e04fce85169f8df98a7d63d193826e339e9aa019d7f0f3e877b7f5ec5e3bdcf8848de921a4015bf8e292501d818f13df6eacea50a1c49f5fd6e78b17b218b028358058a081c18bda8f1af76e33c3b0cb724c581d59b247f58969404423700945050ab81360fd3e1b52de77175f92013eb559cd1af232e7cb0cfbb37731b0a98687a1462313a47bf838a5245ca5031f8b1601a1e00049c3f3c0c5837724f01b6d0e537ff7d67191d8f98ff37ff8e7b45909c2b80307a3d5d61d0f869296ef52f51ba0c504c740f3c4b7ab11c59b5226e8165c1c1e6f591ab0a9a9b1d9da351c568abf65b0bee81f2014708a3a7aeb5c9b956f7e678844d1ce1feb84535634cd9cebc73485da6e6579f750302157c7e93dbbd35c92bc3a7f1b5803af080966b4d3b7ad1be0bf9a83b81d57ac8603fc515a6012bdca1a0fa9f53f7bd6a83b1e2be727bc9925b48286cbac62d1a226bf1fd78010ac9c67c4d5f0e2d7924acb1843d5e5803059b3a0c1ee92136259a4394f04abb00b9e85ec4ee369551be4fb0ac45adfa9691be11886791a92c185776dd371f6da5edda10148012906b2f227338549cf7a4bea4201aa12ffe55474951a1d11d153f1d30bbf2689028eec21e7a656cf0df805f7ae1a2ec6fbc86f520f11c5082c83550fe13cadfc95d680cfa7ed15af3e6d716e869280e7f0af72b2210f5132f7fc2dd64db4c2508669fd78fb8552c4599b477d45bc416aca1c788936bb907cbbcb87d6e5b5daef16f7b38e760e1d6d82eac945c231f62029e2f613d8b476e48e88f49725932f2819c1e6c25cfe3fae7bd9da5d2e0a5b0178b9d96584454c59d3b513d41f9c1f20402abbcaaad212ff264e96c33bf4be606d46a926cc394ce26f859a0849a68838a68700c0948032d39194d1af9fe0e43175b9739d730eea3306cafa0bdf80775c60a5a9739e289609f24e7adf9e2cdbd81c2075e5b5d8fef8962798a49c8af6347c3f2a77e49f5f221c8a6652d14adb796779a54cb3e8e50c29db12f82a95e53ac1ae40a102b8984caa72a668b35c35e5a1ba3326d2c7792bb1e04e71b8498641ac732697a23d7d608677f40448df8cbbe079e8f560b0de5b86119e4f211a935f7a51ae0e7989b0ab1d80cf4f17d87a929b28bc4fe09cf634c99e09389fdde29fc9dbbcd048f40b00a3f439b27f44b34499a4fc61adb999d41dfa4162a100d87bedfd0d2f9a51e13721073aee4384161771704b1391930fced382e053fdbb0f16641d4eb38c800c048f8a6559a2cd5ea68f530e03bde6db92e64e5eecbe49d624ac4c62aebc9ef611efa0efae8d664c24bf3248d033bdff16199eeae1a4741dbdafaf6a40fef9ade478c7814b455e798848de99ceb133a40bd22729eb3e1f2d45ce835da1567843c4b592f6f410b00e00cc8334b70fd62a8e270850486afc5e5eec54ac5a59581148a6fcca9173635b852600e7bcb1c04f4eb3774bffc46e688e4acc9bcf9bb680ec538c094d694fe18f28e9a3bd203e91dc2f728fb18cc4d50f681cf7643df64c35a23b0d90cb1fc4d24f3c8edde09a2703fdd1ca876742953aad961cf7", 0x1000) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000000c0), 0x4) r4 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000001400)={0x0, @in6={{0xa, 0x4e22, 0xc0e, @mcast1, 0x2}}}, &(0x7f00000014c0)=0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000001500)={r5, 0x308000000}, &(0x7f0000001540)=0x8) getsockopt(r4, 0xfffffffffffffff7, 0x2, &(0x7f00000016c0)=""/212, &(0x7f00000017c0)=0xd4) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="ff624840"], 0x0, 0x0, 0x0}) 01:35:29 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:29 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = msgget(0x0, 0x4) msgctl$IPC_RMID(r2, 0x0) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') write$input_event(r3, &(0x7f0000000200)={{0x0, 0x2710}, 0x0, 0xa6e2, 0x5}, 0x18) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r4, 0x400, 0x70bd25, 0x25dfdbfb, {{}, 0x0, 0x410c, 0x0, {0x14, 0x14, 'broadcast-link\x00'}}, ["", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000094}, 0x8000) fcntl$getownex(r0, 0x10, &(0x7f0000000240)) exit(0x1) read$FUSE(r3, 0x0, 0x0) 01:35:29 executing program 2: mkdir(0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 349.675282] binder: 14344:14346 got transaction with invalid offset (0, min 0 max 0) or object. [ 349.684449] binder: 14344:14346 transaction failed 29201/-22, size 0-8 line 3097 [ 349.718765] binder: 14347:14348 unknown command 1078485759 [ 349.724768] binder: 14347:14348 ioctl c0306201 20007000 returned -22 01:35:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x0, 0x0) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:29 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 349.828108] binder: 14347:14361 unknown command 1078485759 [ 349.834214] binder: 14347:14361 ioctl c0306201 20007000 returned -22 01:35:30 executing program 3: mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 349.941429] binder: undelivered TRANSACTION_ERROR: 29201 01:35:30 executing program 2: mkdir(0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000140)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x492af9f3) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r3 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x8, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x1e, &(0x7f00000000c0)=0x7, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x98, r4, 0x800, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_AF={0x8}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1b, 0x2}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}]}, 0x98}, 0x1, 0x0, 0x0, 0x4080}, 0x1) [ 350.064212] binder_alloc: 10623: binder_alloc_buf size 2305845483114856448 failed, no address space [ 350.073782] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 350.083184] binder: 14375:14376 transaction failed 29201/-28, size 0-2305845483114856448 line 3035 01:35:30 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 350.201898] binder: 14382:14384 ioctl 40046205 492af9f3 returned -22 [ 350.231876] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 350.240324] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:30 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 350.249772] binder: 14382:14384 transaction failed 29201/-28, size 0-0 line 3035 01:35:30 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x2, 0x2) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @local}, &(0x7f00000002c0)=0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0xfc, 0x0, &(0x7f0000000480)=[@increfs={0x40046304, 0x2}, @release={0x40046306, 0x3}, @transaction_sg={0x40486311, {{0x4, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000080)=[@ptr={0x70742a85, 0x1, &(0x7f0000000040), 0x1, 0x3, 0x1c}, @fda={0x66646185, 0x0, 0x0, 0x27}, @fda={0x66646185, 0xa, 0x3, 0x38}], &(0x7f0000000100)=[0x18, 0x38, 0x28]}, 0x2}}, @acquire={0x40046305, 0x3}, @reply_sg={0x40486312, {{0x2, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x20, 0x10, &(0x7f0000000140)=[@fda={0x66646185, 0x1, 0x2, 0x1d}], &(0x7f0000000180)=[0x78, 0x0]}, 0x3}}, @reply_sg={0x40486312, {{0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40, 0x30, &(0x7f0000000380)=[@ptr={0x70742a85, 0x0, &(0x7f0000000200), 0x1, 0x1, 0xd}, @fd={0x66642a85, 0x0, r1}], &(0x7f00000003c0)=[0x48, 0x40, 0x30, 0x48, 0x28, 0x30]}, 0x38}}], 0xfa, 0x0, &(0x7f0000000580)="69eff8dd89215223cb686393e6e850d5a25c56bf25c650499db6d2057665cc405cb1984645cc2a8087ec73dcc1b9fdc99ed87c41d3bb9fd0ebaac5244a059ef5dbfb6c279e34687242edad759fe8e9693c4ef2e44c700ef968a5aa91ef5bd6509cf398afa09be1b8720aec4c4eb5b1eae9b8c68bbc0bd9b2c1d1b086a8de9e7bfda993fdbee0744b4d16f04acf481dc2964035c0edef3a6d97a10b2464f4dcd6a44b6f1c6f7a02de146d90b9c6a6ecbfa1688f7795423a7e9ee40afabc0d30843bcea56704d30f42e800ae88000480cc77782bd50f87c66c9527aa9130efd230e6ddd25aa790707664581af3ec2581bd66ca5a6a2127ccd33d67"}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 350.342269] binder: undelivered TRANSACTION_ERROR: 29201 [ 350.411533] binder: 14382:14384 ioctl 40046205 492af9f3 returned -22 [ 350.445309] binder: 14393:14394 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:30 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:30 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 350.460476] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 350.469073] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 350.509813] binder: undelivered TRANSACTION_ERROR: 29201 01:35:30 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x5, 0x20000) ioctl$UI_BEGIN_FF_ERASE(r0, 0xc00c55ca, &(0x7f00000000c0)={0x2, 0x601f, 0xffffffff}) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32=r1], 0x3e2, 0x0, 0x0}) 01:35:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) userfaultfd(0x800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000deffffff00000000000000000000000000000000000000000800000000000000000000000000000098dd053ab269c25fa9627371308d46094d8f75406aef3dd6a08fd16de7f99ba45bf72e33db4221c9cde361536056236f41bda7a8b00b5434e3d4d755c6cb8a6b3ffafa262568f62fa301db04c341a9", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r2 = syz_open_dev$radio(&(0x7f00000000c0)='/dev/radio#\x00', 0x1, 0x2) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000100)={0xfffffffffffffffc, 0x7, 0x8007, 0xcc, 0x5, 0x7, 0x7, 0xffffffff, 0x0}, &(0x7f0000000140)=0x20) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000200)) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000180)={r3, 0x6}, 0x8) 01:35:30 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$midi(&(0x7f0000000240)='/dev/midi#\x00', 0x7, 0x301800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xb2000, 0x64) getsockopt$inet_dccp_buf(r2, 0x21, 0xc0, &(0x7f00000000c0)=""/146, &(0x7f0000000040)=0x92) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') getsockopt$inet6_int(r0, 0x29, 0xd9, &(0x7f00000001c0), &(0x7f0000000200)=0x4) exit(0x0) read$FUSE(r3, 0x0, 0x0) 01:35:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x0, 0x0) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:30 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:30 executing program 4: mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 350.910400] binder_alloc: 10623: binder_alloc_buf size 422661065810116608 failed, no address space [ 350.919803] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:31 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 350.961338] binder: 14512:14517 unknown command 4 [ 350.966947] binder: 14512:14517 ioctl c0306201 20007000 returned -22 01:35:31 executing program 4: mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 351.042110] binder: 14512:14524 unknown command 6 [ 351.047063] binder: 14512:14524 ioctl c0306201 20007000 returned -22 01:35:31 executing program 3: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x2, 0x404080) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000040)={0xff, @dev={0xac, 0x14, 0x14, 0x19}, 0x4e21, 0x2, 'fo\x00', 0x8, 0x4, 0x62}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x68, &(0x7f00000000c0)=[@in6={0xa, 0x4e21, 0x1, @rand_addr="a0cbcaed83fe0e9b6f4768670c2d90e4"}, @in={0x2, 0x4e24, @local}, @in={0x2, 0x4e21, @local}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x26}}, @in6={0xa, 0x4e20, 0x2d, @empty, 0x3}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f00000001c0)={r3, 0x7}, &(0x7f0000000200)=0x8) 01:35:31 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634940"], 0x0, 0x0, 0x0}) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = geteuid() fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ATTR(r2, &(0x7f0000000180)={0x78, 0xfffffffffffffffe, 0x6, {0x8, 0x8c9e, 0x0, {0x1, 0xbd8, 0x4, 0xc3ef, 0x3, 0x3, 0x8000, 0x9, 0x3ead, 0x80000000, 0x7fff, r3, r4, 0x9, 0x2ca}}}, 0x78) ioctl$TIOCMBIS(r1, 0x5416, &(0x7f0000000200)=0x6) [ 351.242421] binder: 14530:14533 got transaction with invalid offset (0, min 0 max 0) or object. [ 351.278426] binder: 14530:14533 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:31 executing program 4: mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0xe42d6a85a51cb7e, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:31 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 351.436496] binder: 14542:14543 unknown command 1078551313 [ 351.442435] binder: 14542:14543 ioctl c0306201 20000000 returned -22 [ 351.487916] binder: 14542:14544 unknown command 1078551313 [ 351.493836] binder: 14542:14544 ioctl c0306201 20000000 returned -22 [ 351.575154] binder: 14546:14551 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) inotify_init1(0x80000) read$FUSE(r1, 0x0, 0x0) 01:35:31 executing program 4: mkdir(0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:31 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(0x0, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x0, 0x0) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000003b87423cf798de19f02f296452c0008000000000000000000000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="000d0000e27a9dc7"]], 0x0, 0x0, 0x0}) 01:35:31 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7fff, 0x20000) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000000c0), 0x4) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) io_setup(0xa5, &(0x7f0000000100)=0x0) io_submit(r2, 0x6, &(0x7f0000001500)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x2, 0x7f, r1, &(0x7f0000000140)="8ece390f571bad8fdf31df94dec503a3c5ffbb20e41bfd97dd30ab2b4396740fabb4be6c08d71a931d0d376ae881cb1a87652002c76fe6d353a022aece02196a29097ddb5fc396e9c93dc71594b3946d36f23017dab9d10ef68d0c45e405ef1445d5ffae7cd7c63e8c955fef70664712a81ed09bec9b87029d1e835924a0617b7fdf82deffaae14ae2ef53b980b8b30441f0f2dcf87b2f8b302d86c328d854b24827acaa0f771f0db7109447", 0xac, 0x0, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x1, r0, &(0x7f0000000240)="c03bfb980b26f034e646e64016", 0xd, 0x400, 0x0, 0x1, r0}, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0xe, 0xa18, r1, &(0x7f00000002c0)="51bdd9fd9e52fd7f4794fe5ab037a5ecf2766b60cdf9d1a6ad4a9a0f895f9299343da7ff3d7c502a5ad9d02d9c42fd9181aa15ad6f139c09f05c7184569010ad4d644670dc61ed11a341cd28fda2f88229d2d531159639d94803bdd0f180e98f161def9acd91d19997a9b709d12b6c54a7a8cae9b39cdcf48f895079e030ecd13856bf9ac8dc9135613e26a3af8326542456f9bdd1a27919922948e6f9714c0fdf50f407221080cfaaa6f7fd0c8758d9e2290b612becbb3845ffbd82bf1469b2bb17e2e5735eb69057b630747c4939db0a41f8682b6f588d453bcbbecee7fa2caf6f2243f144079c365cecf89eca07cbfe1b41f833ba1382afdaaed81361379c0ac8ad566d4f87326bb88e603fa29e18804285278f74723e9fe3c70dab2aa51787b58c1d72996c06b9f025ff98b7c9d78b6c639526d7ec29744b5e3c1c7e9608afd2dfe63bcdeda2aac4b83a7a1a3ea51b1f073d5275680dc34f06d97317069c6e7048886d7c314985d6d2f6e0489c971ff64fcf2eab57d53c5da8722ab5466aec84d87514f63351043b3d0fe6e80807655564f704b05d5c50e9a346a577f20c2877f61b6b9fa49383bc33c5c25934e3f8a98dbc1cb7c3153ce0992815e64029e8d9b718a70ff2ab4c8bd5bc313beb2ff047ad41d4e4c5fda2ffd5001068e5c0dea8607bc15010b908c51a4d9dce91dc77925f76fc72fcbaa1784ddfd4974536572e48c7bb5c926735f8015b8223d957aac1d8429dd4f9af29191dc1da06f3fcc7fae9df56fddaec3074847c3aa1376652824d984463ce524ca0303cb2137649d823bc3d096556fa949af8abcb5fd57b13a68e05a12b60ed65a02cfc6c948f9063f41ca5904ff4b0a2c1aab7101804f913dad016813f23de9320e65c5672e1d0d5c7f58c4b7ed6b1ae0d8a45b52847c81501324888b10023ad76c0949ff695566babc64158f2c1019e1d11a1e99ef91cdffea90bb2a578ec96408c2446abe94b01e8435b4eee505bbff3ea6b53823be8d2b2c36bb4840482349c04b5ed1d0c2386b0e1761e6519263cc9a3858336bd0916d765311d3b69a3e350ac13beeadd712c6c9a81867d41a76198765a662d702860629073b47794d767f27bc06fecd5946f8ca64ba0546450665a8d990a14e2fe3ebf62154eaf8a2028fc33526334cde7d575c53fdc4bff05af3898cf07badf7464191beff71ce806d442720b0c02fbe043c1fcfb54285dcba5f4006b9e0aad10d3e81cab19028d93936acf55e1b6308baea0f843b0ee45dcceb91f7e131f4a6c3d385c1b6338a84afd0c4aa6c44b30f69bf5e86e157653aae766b03aafde9cb07572e818b6c1008551a5f684b9f03b688c27861688e3eefec369376c6de343084150b77206a5c38cb86866142199ec276dab28d762e7d509bd72abea9df5247179eba8e6267cc26a0fe00f48fc7643e5810df3d1d0c2ceed5f17166e6cf3ced51aba28b6384a927e88fbc08b40a7575902187b3783a723e1623cafacfc5a1bc6dc1cce7b30655207503b5a9d01efd4c0a79f3a24655e6992e5424ad120f510457934ebc1b1d906a07efc176d664cf036a3ade1d64c89831dfed69df52ee55aa6a11c039ad04dd787e4c2b5db729207740bbcc772a8f4efbe0818e609f7181d830dfb383da67f40917cfff5d2918a68228ff9756581ba323ce5f5b7150699c7439d29fa89997563b94a14621dcf3f6effa591187867ab71a346fc5c079dbde94f435c3e0756abc1821ea9c58ddf4eb318cf36dc03f0dd57729a42ad1b3c686101299ff3b089620b827f7d074be1324b8f1c402c00d8e87d61872182f9e7f59222e32a19a67649ae652deb3c5c19553ecfbe5e1576a588a552727366130d7c8f290cc5842fbb8729587d67f19dca097ea277be92ede1498c8ed0f4c0ded4bff9eb980cd05860cf024de3915609bcfd673db113b6723ef3816838f4567d9ad67551993321954de161ea1079970de1047ac9324867a3ee359e3de1725bc0ef559146336dd11522331417bb3c6b4a3ec500f2f8d33a1588a585efca15cefc8c70ffcd3cabe96d8269c0077e5801c418027a0a0599254fb1f74109ad4b8001287c5041e7c13d327bf53e050d16513dbdcd4998ef3ba0eef59b888f3c3e28d9ac29baf1502c52403b9827557fe4e971676c5ffcf6110d0927dd0cf3e830b8b62a7de3c1020558e3c2d86dcf067ea53be9225d1e4a6a41a189654771ce6458a93f5c5e801f76d01c1c68155ebad98788adfaa4fcd5349de6169190e7ca29528e93ef7bf78d1fa4b969a4b49b6fe03cbc5417a57af98cdda11a2ebc6164f9ffc3fc8ad382f7d9caeebcd1710964f8809725f130776a146ba43c70c2c326c0269367fdca57e501c39809403def793c105db0c41538e66e9237748cc6f95a050d8c404f0a7927e495ecef8f4503ece18234497da7a37a1d8235f60687bfdd1c4d2faa72a81b270933f69c897e26cb6326f39430f15bfeaf34e6266bb3471ef41f4956da5156942878466d362d048f3211b964154c4aeac692d3fa6ed50d4b37faf00b2fb0fc26f19ba77f8a9757074b4d87f5997c89521b7ec08e337cb4cb638543f9d371a17b8872984d4be8651b94f238f7f3752eb7fc79c1f973dbafa167f5c4f00efccd9cc9e5264922131065d17533c1df7f9738ba207da1e7053bbdf1da23b2e63988a5123254eac994e94ca15619193b5a91e00c506f776223e47dca0c8e13b41b3c3cee43272b66c8402b185df19ce6a0421578eea4e295cf0de3391ae51ca9b0ae45b6c7f20676d9a98ab10eca89a78cbb8dde56d4df70f87ef8425f1c0bbfcf40d79bb3cf1658f0973874292f33253cdb648fac222b3bc7609827231648257624c9d0c557193a826e83893e5e0e56cd492acf3d01ecf226f71a5d2f9e2a64e289f6d333143cbb7554654cfb13f2853ab6954c404c9ec09344a2874c750345db644b904dfab5cd3989ca1da04311426c60dc1c776834d6db24a4436d9e61b2e4c55b093db55921c85a948bd95c314f0bf2dfa9d20c035615fc401d889fb1a4a0829d919de2560eb60cb9632cc446100584f3e6b4bcb9313b634ea54a967678bc7a08b0296cd88dc0debd0452b988b7b1f170d9d55ab8bc4d936a7da6f0e017de2d61ba31584996303eee20f66efcc224a93a2357e221c2d83ea38a740b545d29849557cc13a5517a5c7778da840e3b3639544240f040d91c17575f07912dfe7c22dc2827b562682b409ca985d4db5e5e5d935b073ae3df33dd7491157fad19d0f52dbfbb2c9132f612d99c91791bd2075da678092a1ac37a5270b27ba6869aa161bfc942ddd61ce65fa8c97ae0a5f4a1d914807673656914577eea66f71e629900885562e49e61db6a56b5fdd1b3aefdcf8ceddd38242e2e13918e7be58be24b32e37a5151979aae1c478ea47e392e2ef39d1c512b16d2c2816f3fa62597b7b1800c657f0208a19756f740dd418aeba67376817122dfb33d6245b2c943c884854dba55001f7ccccdb265dfb168cf5faf16e78237d3404ed2ee2fc844a855364ac9bc6c7742abb5ac25dff9a38e47aeef0991e5c74475c936f7278307ed392a777328986a6c5609194730b550a477cd40929acbcd094b31760f7ab78ea27d8b0ca4135b4e0eb0bc88be8e825b9f263ad45dd384939b9d89b0ee5539b99d38eb12def95a4820830b5bb3c79ae2afcbc27506f06ceb6d189d7d7f87ccdfc3061c196aaad9d78fade8d897e0bd48754decacc3cfc6574fd7c559f5c8855327359637f3a2c0011af3998293608da26d6ac698e17e24c7ef112bdf50a49404a8c314937983ea1607f8505c8d9e1082b86803178d9d83cdb3d8e3c53b9964df3ff46eb1017db337cb44a80ed1ed1f0ffb92d47764f78c62047591c80ed0ed7f620c70e14da785648de2f65b8b515b8c8ab85bba3eb070283074e718faca29901a060329f7baba519fd136a7f3fc7a3c90a5ea1be84dfef22228a39d83c5d6a531bc55faa24ccc23169f7c6f652f71268b64a13546c76b3d6fd089fb2b48038eb0fc50be6ab5a09739ed17e528672fbdc8d86e256721394a89f99f22b312ce2c0fae47e4512e17224dd644de1a290ca0bb216479adc5b213ba6ee1c54c28f63cf68e1de1da828bf3e882ced733915afe6ff93df3de6baceb1bde6decf346db3328070c2758aac0019d0cf88a88191f74aa9d64eea7f9f95d7b710ca7da770508a01a0104a0e300686b14b34e1cf1963693eef13d3eee5aec5bfa72bc9f6068049bddde065bdf48def99f23ae109c756bb8913a637e69f9b17b60a578cbcaf78124426adbc7a32f7230d10b3d103ba86b1a06ad779f792bdd31530e98eda6c5bd05152b37d63e4d1d6eeef6560262773e75906c6ce224849f6365716a9f2d741a7bc1af6bf1b33fade9257caeda25ec91d55fec5a504f7ce50c02230f0cab6f1df6f250e24eff8ca5a09212e653686373a4dcefda7e1dfb206d7f4c5359d1b7ae1e472d098d0813c0c477f79f54cf83956231637bb55e1527907133bd2d6c4bf7375a0c1ced38b4cc6e263920b38e288bfeea7d1217c4952e1a3b89781254f9e27ac6b7ce9880d0890b6349a48897bf7a558cc7c5d4673a4f40306ea816a244be6c2926e5e0fef075dff57d061c2c02d56f6176bf857fa637ef257f7452a4a11d2fcc24b4e7688000aacbbc3217dc4db0ea285af8794b70e24b149747d7741be75f89b7aff453b0f721da61e0850db5c050d98d902f62a1519300b70426f0e2da4be572ba13688912815ac0fdbbfbbaffd2d67ced1b62dc7022d03d777804b50797d988e3140aa11cb743aa170b86e8ffc3e10e382f4cf1afce443096ac290e9430f9d792264b4011c0e9efb183caf74213bf7c74d1f94683914d7323e8575d3392b3f0cd3056f54e15a7575b245c2913cfa580733e26833dc60d49ec3382bb383946cfcf402fe6e3055e1aa3a11ef4b403df4065944a938bf8ec2995cc7ed3b608736ea1475f5a22d10f08a13a70a1b4b8a91d04518dea0b534de1714cf85f2add7b88ce6946814443e8b0078d71194bbb94bbcbade0c6fb71b77396a91de4edcaeb2dfadb79b4dcf7fe63b3386eabaed650c6f59d4f3f0bf194960140ee11509e2edfe86f77409bf1b7aec8a19b5c9b6b8649f1230c19057226d38cc8b37cdf413db243904ad50d422d0e4db3216fd00d4550285c40e7d26fc6dc98bdd144ed14ee19e4777d69609dc49a32f9236883259c66bab7abeba47631538edff8e47304c22b6e2810a730a80efb4d49d5e933927e0d401cac3b025139b66406947a20061f88ce72cacb23d0d8f49c5497f65f1529204dec3c4f546351b2737459cd12fb31e9ce6ea80b5803f08c7d65501436e76cef24005d87ea9404cc350d8568d80fc4c60a3d055958328c6e95ff75845d155a8ea093ff749b7fcd60c25b875393127363534b7e6ad15fba5bfc2d68973a7a92b1016216c8f50d66a77a567d2c17d8fc36a7f48ec41f016e9ab32d43c480b214ed656816af30c0702b006c42b98c688f3a3059a40dc3d12e59ea68156367089b352b8e012d2022d975e6c2cf09ce59c4f4457b0d3709acd1a662a5739294c7a27f484718cffc6055c8c123dbfdb4699756792241bd6cff372e0e899af7b74a80b046d10481c900e5867451ffdd800d1b62214bbec8f245fc50c2eaef933d011458b81a64799a67006ea1c6632b2659ecbb47992d4d0f3d5203353e6c9ce0d278a6bac7b42b9ca5761475d5c284a6e9d7391f7af6ac9c92ec5ff1923798377e8f380431", 0x1000, 0xbf0, 0x0, 0x2, r0}, &(0x7f0000001340)={0x0, 0x0, 0x0, 0x3, 0x5, r0, &(0x7f0000001300)="63be8850277a001ea0ad", 0xa, 0x2, 0x0, 0x0, r0}, &(0x7f0000001400)={0x0, 0x0, 0x0, 0x7, 0x8, r0, &(0x7f0000001380)="a1fc3ae357abe95af3197077b972858d7521235ae711209f7e7a45c502074c032e53359610a443dd241f858dae546d7ddf1f20ba9294bb19289d43d2e750b7c430c2a78aefc088b3c0b30e1d695d8076693ab2887a863c463093d2c3f7c1067a38f4fcc44091a612c3f60f333995", 0x6e, 0x5, 0x0, 0x3, r0}, &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x7, 0x9, r0, &(0x7f0000001440)="023367c42fe751c3bfa772f284d1c44191e1e32d22dfa0a3fde7cecb6ee4d3aaa0c45d4bbef61725f61756ccb6f8fdd5495066850c579e57065daacefde412f85a19ce390e1ac2e7c432160b1fce46cbab0de65bae6237885c2046a0aa37", 0x5e, 0x3, 0x0, 0x1, r0}]) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000001540)=0x8, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 352.018630] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 352.031955] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 352.044730] binder_alloc: 10623: binder_alloc_buf size -6709926415499561800 failed, no address space [ 352.059035] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:32 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(0x0, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:32 executing program 4: mkdir(0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v2={0x2000000, [{0x1, 0x1}, {0x9, 0xae}]}, 0x14, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r1, 0x8934, &(0x7f0000000000)={'ip6erspan0\x00', 0x9}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x400000, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x10400, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @broadcast}, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r3, 0x8, 0x70bd29, 0x25dfdbfb, {{}, 0x0, 0x8001, 0x0, {0x8}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x5}, 0x54) openat$userio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/userio\x00', 0x300, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 352.305754] binder: 14684:14687 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:32 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(0x0, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xfffffffbfffffffc) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x100, 0x0) ioctl$PPPIOCDISCONN(r1, 0x7439) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 352.567575] binder_alloc: 10623: binder_alloc_buf size 4294967296 failed, no address space [ 352.577053] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:32 executing program 1: socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x4) read$FUSE(r1, 0x0, 0x0) 01:35:32 executing program 4: mkdir(0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) dup2(r1, r1) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x4000, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x8801, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0xa) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:32 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(0x0, &(0x7f0000000240)='./control\x00') 01:35:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="143fd2e3df233c49"], 0x0, 0x0, 0x0}) 01:35:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 352.939833] binder: 14804:14805 unknown command -472760556 [ 352.945796] binder: 14804:14805 ioctl c0306201 20007000 returned -22 [ 352.998358] binder: 14804:14816 unknown command -472760556 [ 352.999388] binder_transaction: 11 callbacks suppressed [ 352.999424] binder: 14808:14815 transaction failed 29189/-22, size 0-8 line 2896 [ 353.008405] binder: 14804:14816 ioctl c0306201 20007000 returned -22 01:35:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) 01:35:33 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(0x0, &(0x7f0000000240)='./control\x00') 01:35:33 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:33 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0003be127a5d2304c4780f"], 0x0, 0x0, 0x0}) [ 353.510164] binder: 14836:14837 got transaction with invalid offset (0, min 0 max 0) or object. [ 353.519494] binder: 14836:14837 transaction failed 29201/-22, size 0-8 line 3097 [ 353.542534] binder: 14838:14842 unknown command 314442496 [ 353.548373] binder: 14838:14842 ioctl c0306201 20007000 returned -22 [ 353.574700] binder: 14838:14844 unknown command 314442496 [ 353.580536] binder: 14838:14844 ioctl c0306201 20007000 returned -22 [ 353.663480] binder_release_work: 12 callbacks suppressed [ 353.663496] binder: undelivered TRANSACTION_ERROR: 29201 01:35:33 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:33 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x34f, 0xb8}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f00000000c0)={r2, 0x100}, &(0x7f0000000100)=0x8) 01:35:33 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(0x0, &(0x7f0000000240)='./control\x00') 01:35:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x1, 0x5dd042) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r1, 0x80dc5521, &(0x7f00000000c0)=""/162) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="000000001a00"]], 0x0, 0x0, 0x0}) 01:35:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 353.983883] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 353.992317] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 354.001569] binder: 14951:14952 transaction failed 29201/-28, size 0-0 line 3035 [ 354.010489] binder: 14949:14950 got transaction with invalid offset (111669149696, min 0 max 0) or object. [ 354.020702] binder: 14949:14950 transaction failed 29201/-22, size 0-8 line 3097 01:35:34 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 354.132051] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 354.140494] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 354.149929] binder: 14951:14967 transaction failed 29201/-28, size 0-0 line 3035 01:35:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:34 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', 0x0) 01:35:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x200000000000004) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x1, 0x0) mq_getsetattr(r2, &(0x7f0000000040)={0x80000000, 0x3, 0xcd, 0x7ff, 0x40, 0x4, 0x0, 0x7}, &(0x7f0000000080)) connect$vsock_stream(r2, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 354.178253] binder: undelivered TRANSACTION_ERROR: 29201 [ 354.183915] binder: undelivered TRANSACTION_ERROR: 29201 [ 354.205641] binder: undelivered TRANSACTION_ERROR: 29201 01:35:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x16, &(0x7f00000001c0)) ptrace(0x10, 0x0) ptrace$setregs(0xf, 0x0, 0x0, 0x0) 01:35:34 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 354.406948] binder: 14981:14982 transaction failed 29189/-22, size 0-8 line 2896 [ 354.609615] binder: undelivered TRANSACTION_ERROR: 29189 01:35:34 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0xffffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) fsetxattr$security_smack_entry(r0, &(0x7f0000000000)='security.SMACK64\x00', &(0x7f0000000040)='\'}mime_type-*proc!*r\x00', 0x15, 0x1) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:35:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x80040, 0x0) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f00000000c0)=0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:34 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', 0x0) 01:35:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x16, &(0x7f00000001c0)) ptrace(0x10, 0x0) ptrace$setregs(0xf, 0x0, 0x0, 0x0) 01:35:34 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) timer_create(0x5, &(0x7f0000000180)={0x0, 0x2e, 0x0, @thr={&(0x7f0000000000)="a03f0f32c418902eed58748693f54ff2d681d085b09ea7d74030122ef489444da0ce495371e01caa5b56cc11a03e2b243bb242da2a74b1034dc23fe76905d81dd44a3c47f0fbabc023862ee2cd19afb1e454c02efc9ac95e4b0b6c467bb69a14eb2a395a1ad822bdd1ad783202f7c3b887bc412d4cd5b331e46230191ac364a20f802d2b64ad5dedd89a2ce04f44fd4ea4e5db4d9fd2a0a796bae32f3896f95757d601", &(0x7f00000000c0)="c10fa748b4005b9cb2ce541ead51037fbf6587a976ee5553aec1e21b27d7b7fa4fa8d9392553fe77b71dfe7952d5ad6cba2789bd2c5aabcc0a4a5331bb541069751de33019e85535b03f92bd676d51ac018f0f7a1a9549959f4807c150fd1e678d801c3f367c56df767db0d53256222ee00bbb50c404e8b31adba7a9cf3715c2ae443084da2a88574eac4b7a14314caa5a3033da4f3ecfa2f3df581baa394adc9674d1ecae8cc82d7ed1b6d3"}}, &(0x7f0000000200)=0x0) timer_settime(r2, 0x0, &(0x7f0000000280)={{0x0, 0x1c9c380}, {0x0, 0x989680}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x16, &(0x7f00000001c0)) ptrace(0x10, 0x0) ptrace$setregs(0xf, 0x0, 0x0, 0x0) [ 355.008948] binder: 15099:15100 got transaction with invalid offset (0, min 0 max 0) or object. [ 355.018238] binder: 15099:15100 transaction failed 29201/-22, size 0-8 line 3097 01:35:35 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', 0x0) [ 355.051297] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 355.060557] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 355.070075] binder: 15104:15105 transaction failed 29201/-28, size 0-0 line 3035 01:35:35 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 355.236597] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 355.245213] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 355.254645] binder: 15104:15116 transaction failed 29201/-28, size 0-0 line 3035 01:35:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="b19c9246ab222462ff0090c700"]], 0x0, 0x0, 0x0}) r2 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x8000, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000100)={0xfffffffffffffffb}, 0x1) [ 355.301012] binder: undelivered TRANSACTION_ERROR: 29201 [ 355.374394] binder: undelivered TRANSACTION_ERROR: 29201 [ 355.385314] binder: undelivered TRANSACTION_ERROR: 29201 01:35:35 executing program 2: socket$kcm(0x2c, 0x3, 0x0) r0 = socket$kcm(0x2c, 0x3, 0x0) close(r0) [ 355.444081] binder: 15124:15125 got transaction with invalid offset (7071815433897286833, min 0 max 0) or object. [ 355.455851] binder: 15124:15125 transaction failed 29201/-22, size 0-8 line 3097 [ 355.676932] binder: undelivered TRANSACTION_ERROR: 29201 01:35:35 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x101102) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x380, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TUNSETVNETBE(r0, 0x400454de, &(0x7f0000000000)=0x1) socket$inet_udp(0x2, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000100)={r0, r1, 0xd, 0x32d7e911b6149555}, 0x10) 01:35:35 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lremovexattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@random={'security.', '%lo\xe2eth0securitymd5sum\x00'}) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x80, 0x0) setsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f00000000c0)=0x401, 0x2) 01:35:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="f6"], 0x1) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)) 01:35:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0063404000000000000000000000dfffffff0000000000000000000000000000000000000000000000000000080000000000000000000000000000006b5e5a7b485d16925fe200a9d0c4d11f10c60514f06ab3d9d1b2ac9131a667", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="007b00000000000000000000000000000000003e150000a9da45ea30a763170d6d94c441fdc6fc0826f5b221e6a7f4"]], 0x0, 0x0, 0x0}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x0) mmap$perf(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0xc, 0x100870, r2, 0x0) [ 356.007384] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 356.016009] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 356.085588] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 356.094230] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control\x00', 0x10000, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r2, 0x0, 0x489, &(0x7f0000000040)={{0xbf, @empty, 0x4e24, 0x3, 'sh\x00', 0x18, 0x3, 0x6}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e21, 0x2, 0xff, 0x0, 0x4}}, 0x44) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:36 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(0x0) mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 356.129238] binder: undelivered TRANSACTION_ERROR: 29189 01:35:36 executing program 2: r0 = socket(0x40000000015, 0x805, 0x0) getsockopt(r0, 0x114, 0x2716, &(0x7f0000af0fe7)=""/13, &(0x7f0000000000)=0x7ffff000) 01:35:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 356.251614] binder: 15256:15259 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-vsock\x00', 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x40000, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xfffffffffffffffb, 0x101000) ioctl$VIDIOC_ENUMAUDOUT(r1, 0xc0345642, &(0x7f0000000040)={0x3, "b4ccd7539b3b66c9c080652b8218d6c185b4a5e912071dbfbd7f32fb8d3f764b", 0x2, 0x1000000000000001}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="11634840cd4b1b698bc387152175567ad5781db1bf8ca05fd7623b244c177bd94829d874b378f9c370f5bd4b509e165a63ff8d13c4ed63613bcf0a6eadba0f46cce9dc590511186c915500581277dd71e829bd9b3758c8a193820ff61443153d37e4982494e653b45206123f725feb7486df7a32f94f38d693261aad9aebe373486756c2bf04341413d2e1d8c1e4c9b7c52dd70c22d7ed69f97df7cc1d119c1283f3699e136b20c9af41e519e13de53035495bb885764fd02e8dc5592192602233d87345e42f58b01de661fa808e45bb519213a79ba2c52ff40ef3421c1ad4287b7a5f677ebff9cd19350ccd6acd50ba65d400fa03e9069a049abb69b77281496e918dfa54550495e8a6d02bf40fc9f96ff2587d1a383a5fd0339e06f184c40785d71937929971e2af56c82a9e5665b6ca35308e7f344fa545d54e5a09e5a333f408c18418c1430c0b0056a5eaa4322f2736e20ea426029dfdcf301b6a0a9e5d6fc43f0fa601f655f49eacc52577c4129a77f1db56736481706361246384da9f319d341dcef6760cd4d8b43547f9c6173caffad4ac62b508b8bbfe1bb423e1bdfab605beb22b57af3273ccaf126c0fa82b27c48fc688d9489f57289318829e194baeb63fbcba468b3c384f46ddd4ba2ba9ed55eb48c289b52dafee22ab72fe1307a36e01bb7d3addb35135d0cd5ad1905eb793dd6a6a93e81c3c9c6582edfcd2e251e389f7174e60c6022685dd60632d163878555e18f20c181598adab4d9e7fb2abfe1ae157321e53a5a5509c5b20137f015219d70d316e9f00000000000000004e3cb482a0d315c4a53375ef046832150474efea1a58a865e3"], 0x0, 0x0, 0x0}) 01:35:36 executing program 3: r0 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)=0xffffffffffffffff, 0x4) fcntl$setsig(r0, 0xa, 0x2b) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="00000000000000008968327ffd90b23bfdebae604d8a9431c4e45af5818f83637578a2b45c78e3d5dd33d1965f5689464181f4431c2742d076cc75a77f47b10ec00e6193cbd6da0d560fa3050000004aa9e6c7ce335afc86000041283fcc0000"]], 0x0, 0x0, 0x0}) connect(r2, &(0x7f00000000c0)=@isdn={0x22, 0xb0eb, 0x200, 0xfffffffffffffffa, 0x3}, 0x80) [ 356.534585] binder: 15269:15270 got transaction to invalid handle [ 356.549413] binder: 15271:15272 got transaction with invalid offset (0, min 0 max 0) or object. [ 356.573498] binder: 15269:15276 got transaction to invalid handle 01:35:37 executing program 1: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x2bf, 0x400) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000200)=0x101, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000040)={0x0, 0x3}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000280)={r2, @in6={{0xa, 0x4e24, 0x100000000, @rand_addr="36282160e99f77b07a273cbd52c249d6", 0x5}}}, &(0x7f0000000340)=0x84) r3 = syz_open_dev$mouse(&(0x7f0000000140)='/dev/input/mouse#\x00', 0x400, 0x80000) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value, &(0x7f0000000100)=0x8) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0x7, &(0x7f00000001c0)={0x1, 0x1, 0xf8db, 0x10001}, 0x10) exit(0x0) read$FUSE(r4, 0x0, 0x0) 01:35:37 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(0x0, 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:37 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x10, r0) ptrace$setregs(0xf, r0, 0x0, 0x0) 01:35:37 executing program 2: r0 = perf_event_open(&(0x7f0000000300)={0x400000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8090, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f000094f000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x100000073) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) 01:35:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x1) [ 357.137399] binder: 15385:15386 got transaction with invalid offset (0, min 0 max 0) or object. [ 357.176285] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 357.186085] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 357.205058] binder: 15385:15397 got transaction with invalid offset (0, min 0 max 0) or object. [ 357.205755] binder: 15387:15388 ioctl ae45 1 returned -22 [ 357.226174] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 357.234656] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:37 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(0x0, 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 357.300581] binder: 15387:15388 ioctl ae45 1 returned -22 01:35:37 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000)) setsockopt$packet_buf(r1, 0x107, 0x1, &(0x7f00000000c0)="a2ed36acd4eb99a9bb6f0e768737f392b7abb1c9a3558cdc4dea242e5ed8afed3df7e595596eae5c4aafb9003380d1b1619285f3908e1e89c3c43798f1799c6f0829d8c90f20b52332a757cc112b337f59bce83857286da3819bf61ef9d7d6f8a97fb5dce984b1c523e6465f", 0x6c) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000a00)={@initdev, @loopback, 0x0}, &(0x7f0000000a40)=0xc) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000a80)={r3, 0x1, 0x6, @random="794db4279e2b"}, 0x10) read$FUSE(r2, 0x0, 0x0) 01:35:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000000)={r1}) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000040)={0x0, 0xfc, "e7fb3ebb57c878092eeefcb01ef8bc49e02b188c7403a8662507bbac581709943b8cf3393868c0640a39dcb41067e50e770f534bfb50f69206f1e561ad2946f6aa482ac13c20295c8e1a52f36960491c8daba6ba825b49946f9e6954964a1da264d5ed973f53b5fad415d35a4b02b73cd8b50781716e1c11f9a7a65c10795dfdd2449735ee8a8e8c269323561cfc10241f9658b585038fe214001e170864449a8d2a258764c30c7ddaaad56659d95fa843924394cff7b53a65486bdd9ca136043328553ac3238f4d67262ce3356e4c082d7d10a5065d0114f0b21562b838956794a34955a719f766b4becd2e39ce6d5fa6ccedb9c546851c34b038dc"}, &(0x7f0000000180)=0x104) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000200)={r3, 0x9}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000200)='/dev/vbi#\x00', 0x1, 0x2) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_PUBL_GET(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x34, r2, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0x4}, @TIPC_NLA_MEDIA={0x1c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000844}, 0x800) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000000)={0xffffffff00000001, 0x1, 0x10000, 0x2, 0xffffffffffffffff, 0xffffffffffffffff, 0x6, 0x95, 0x0, 0x80000001, 0x8}, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:37 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(0x0, 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 357.525297] binder: 15409:15410 ioctl 89e2 20000000 returned -22 [ 357.560238] binder: 15409:15410 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x200000000001, 0x0, &(0x7f0000000080)) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x208, 0x200000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x101) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 357.717712] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 357.726192] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 357.817249] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 357.825885] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:37 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(0x0, 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:37 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x10, r0) ptrace$setregs(0xf, r0, 0x0, 0x0) 01:35:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x200000, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f0000000140)={'filter\x00', 0x0, 0x4, 0xa0, [], 0x2, &(0x7f0000000100)=[{}, {}], &(0x7f0000000380)=""/160}, &(0x7f0000000200)=0x78) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 358.090166] binder: 15428:15430 got transaction with invalid offset (0, min 0 max 0) or object. [ 358.099324] binder_transaction: 16 callbacks suppressed [ 358.099361] binder: 15428:15430 transaction failed 29201/-22, size 0-8 line 3097 01:35:38 executing program 2: clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x1c9c380}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) 01:35:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xffffffffffffffff) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x40000, 0x0) ioctl$TIOCMBIS(r1, 0x5416, &(0x7f0000000100)=0x2ae1) 01:35:38 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(0x0, 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$video(&(0x7f0000000180)='/dev/video#\x00', 0x48dd69e1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VIDIOC_QUERYCTRL(r2, 0xc0445624, &(0x7f0000000000)={0x40f0effd, 0x0, "225a4374327c2da684f6cae230f674e75e231c017fd2358d10ee4b829b2cee21"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:38 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x8000, 0x0) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f0000000040)={0x4, 0x5, 0x67d}) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:35:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getgid() setregid(r1, r2) 01:35:38 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(0x0, 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x1, 0x0) getsockopt$TIPC_SRC_DROPPABLE(r2, 0x10f, 0x80, &(0x7f0000000040), &(0x7f0000000140)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x14403, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 358.684909] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 358.693549] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 358.703095] binder: 15556:15557 transaction failed 29201/-28, size 0-0 line 3035 [ 358.737943] binder: 15559:15563 got transaction with invalid offset (0, min 0 max 0) or object. [ 358.747036] binder: 15559:15563 transaction failed 29201/-22, size 0-8 line 3097 01:35:38 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x10, r0) ptrace$setregs(0xf, r0, 0x0, 0x0) [ 358.792710] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 358.801138] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 358.810492] binder: 15556:15565 transaction failed 29201/-28, size 0-0 line 3035 01:35:38 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(0x0, 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="000000000001400056f11397302d3e22688e52948dc3a94a60905f52047ab50f51f65c79aefe46986f8d20090000000098a604b925c951328a871ca1363568556d27b9300ab1f242ae461842beef9131eb098da2f2deaab69f0c36af673aeeab892dd8e47a425b2cf645e0869e1208bf8455404620a3619071368611b95e75dcd615a36e7aabb9a62332325c82f5b8e1cadc328d4ea5cc23e73ff948f091ffbbf53d1c6b19b8bc59c83c33d4f04c546b5e081a24e68db4e98fe03f3b4775d37c2888cba4f9a1e9ec4e35c1765d659f982c46a40cf9e965d38adf03dab4f91e721cc41a488bb27c6ca63f9f5e19c98a62a609a4"]], 0x0, 0x0, 0x0}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) [ 358.894475] binder_release_work: 16 callbacks suppressed [ 358.894492] binder: undelivered TRANSACTION_ERROR: 29201 [ 359.010122] binder: undelivered TRANSACTION_ERROR: 29201 [ 359.015826] binder: undelivered TRANSACTION_ERROR: 29201 [ 359.025978] cgroup: fork rejected by pids controller in /syz0 01:35:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r1 = socket$kcm(0x29, 0x7, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'\x00', &(0x7f0000000000)=@ethtool_wolinfo={0x5, 0xfffffffffffffff8, 0x2, "a5e754e1a4c5"}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 359.063400] binder: 15581:15584 got transaction with invalid offset (18015498021109760, min 0 max 0) or object. [ 359.074064] binder: 15581:15584 transaction failed 29201/-22, size 0-8 line 3097 [ 359.165334] binder: 15581:15647 got transaction with invalid offset (18015498021109760, min 0 max 0) or object. [ 359.175998] binder: 15581:15647 transaction failed 29201/-22, size 0-8 line 3097 [ 359.250442] binder: undelivered TRANSACTION_ERROR: 29201 [ 359.258170] binder: undelivered TRANSACTION_ERROR: 29201 [ 359.289513] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 359.299033] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 359.308412] binder: 15660:15688 transaction failed 29201/-28, size 0-0 line 3035 [ 359.409975] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 359.418525] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 359.427963] binder: 15660:15692 transaction failed 29201/-28, size 0-0 line 3035 [ 359.440530] binder: undelivered TRANSACTION_ERROR: 29201 [ 359.456645] binder: undelivered TRANSACTION_ERROR: 29201 01:35:39 executing program 2: r0 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xbf) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x0, &(0x7f00002d6000/0x1000)=nil) creat(0x0, 0x0) syz_open_procfs(0x0, 0x0) write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x0) ioctl$EVIOCGKEY(0xffffffffffffffff, 0x80404518, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) setresuid(r1, 0x0, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc) 01:35:39 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(0x0, 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:39 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x10, r0) ptrace$setregs(0xf, r0, 0x0, 0x0) 01:35:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840a8169e3a906c9979115e0f6c0e91e8118b44a281bfd3912588c24abc"], 0x0, 0x0, 0x0}) 01:35:39 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x8) pipe(&(0x7f0000000000)) read$FUSE(r1, 0x0, 0x0) [ 359.844248] binder: 15698:15708 got transaction to invalid handle [ 359.850710] binder: 15698:15708 transaction failed 29201/-22, size 0-0 line 2896 [ 359.873740] binder: 15701:15702 got transaction with invalid offset (0, min 0 max 0) or object. [ 359.879953] binder: 15698:15713 got transaction to invalid handle [ 359.883025] binder: 15701:15702 transaction failed 29201/-22, size 0-8 line 3097 [ 359.899860] binder: undelivered TRANSACTION_ERROR: 29201 [ 359.908903] binder: undelivered TRANSACTION_ERROR: 29201 01:35:40 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x10, r0) ptrace$setregs(0xf, r0, 0x0, 0x0) 01:35:40 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(0x0, 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x4, 0x301000) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x200}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000140)={r2, 0x7e}, &(0x7f0000000180)=0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000001c0)=0x6) 01:35:40 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000040)={@dev}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x3c) [ 360.010217] binder: 15701:15702 got transaction with invalid offset (0, min 0 max 0) or object. [ 360.040933] binder: undelivered TRANSACTION_ERROR: 29201 01:35:40 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 360.234412] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 360.243152] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 01:35:40 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x10, r0) ptrace$setregs(0xf, r0, 0x0, 0x0) [ 360.306917] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 360.315581] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:40 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 360.457038] binder: 15734:15735 unknown command 2048 [ 360.462385] binder: 15734:15735 ioctl c0306201 20000440 returned -22 01:35:40 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='devpts\x00', 0x0, 0x0) 01:35:40 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x10, r0) ptrace$setregs(0xf, r0, 0x0, 0x0) 01:35:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={r0, 0x28, &(0x7f00000000c0)}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:41 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) r2 = inotify_add_watch(r1, &(0x7f0000000000)='./file0\x00', 0xc0000024) inotify_rm_watch(r1, r2) read$FUSE(r1, 0x0, 0x0) 01:35:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) io_setup(0xc9, &(0x7f0000000000)=0x0) io_pgetevents(r2, 0x1, 0xa, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x989680}, 0x0) 01:35:41 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='ns\x00') futimesat(r0, &(0x7f0000000040)='./file0\x00', 0x0) 01:35:41 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x10, r0) ptrace$setregs(0xf, r0, 0x0, 0x0) 01:35:41 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:41 executing program 5: bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000780)='/proc/capi/capi20ncci\x00', 0x2, 0x0) write$P9_RCLUNK(r0, &(0x7f0000000200)={0x7, 0x79, 0x1}, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x262, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="9a2d00185179046769d93bf96630a9d56d3646a4e8e56c590000000000000000", @ANYRESHEX, @ANYRES16, @ANYRES64, @ANYRES64], 0xfffffffffffffe04, 0x0, 0x0}) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) ioctl$EVIOCGABS20(r1, 0x80184560, &(0x7f00000005c0)=""/178) ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f00000000c0)=""/206) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f00000001c0)=0xf9) [ 361.122911] binder: 15864:15866 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:41 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x0) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x80000) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:41 executing program 2: openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000780)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk(fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xf8A\x06hN\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0x0, 0x300) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x0) close(r0) 01:35:41 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000001c0)) ptrace(0x10, r0) ptrace$setregs(0xf, r0, 0x0, 0x0) 01:35:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000000000)={0x0, 0x521, 0x5, 0x2, 0x100000001, 0x67, 0x6206, 0x5, {0x0, @in={{0x2, 0x4e21, @remote}}, 0x100, 0x1, 0x7, 0x0, 0xffff}}, &(0x7f00000000c0)=0xb0) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0x7, 0x20, 0x2, 0x2000000000000, 0x4, 0x297, 0x8, 0x8000, r2}, 0x20) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x101000, 0x0) ioctl$CAPI_GET_ERRCODE(r3, 0x80024321, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 361.414694] binder: 15880:15884 ioctl 6609 0 returned -22 [ 361.469520] binder: 15880:15889 ioctl 6609 0 returned -22 01:35:41 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x0) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 361.625625] binder: 15894:15896 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:42 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0xffffffffffffff2f) 01:35:42 executing program 2: mkdir(&(0x7f0000000340)='./control\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rename(&(0x7f00000002c0)='./control\x00', &(0x7f0000000300)='./control/file0\x00') 01:35:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r1 = syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x0, 0x2) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000240)={0x1, 0xffffffffffff326b, 0x3, {0xa, @win={{0x4, 0x80000000, 0x6, 0x7fff}, 0xf, 0x5, &(0x7f0000000180)={{0x800, 0x1, 0x80000000, 0x7}, &(0x7f0000000140)={{0x6, 0x4, 0x53a, 0x1}}}, 0x100, &(0x7f00000001c0)="0f7f0baf079ca0d6f9f7d66a83a2d499e450b0ca73b91a45e84ee766eea9a522fa83e8d6dbc556262a00ebd5e14603d6a98c458bbdba4452d5164e3db2c0861f87acc85b8bbe2ac700bce761424bcdacf6d4d42ddc2df29abf06c78cd9b9781e8486cc28e02b", 0x4}}}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2000, 0x0) ioctl$VIDIOC_ENCODER_CMD(r2, 0xc028564d, &(0x7f00000000c0)={0x2, 0x0, [0x3f, 0x81, 0xffff, 0x9ca, 0xffff, 0x2, 0xad, 0x100000000]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0xffffffffffffffff, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000008000000fbffffffffffffff00000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x1, 0x2) ioctl$VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000040)={0x6, 0x50313459, 0x1, @discrete={0x7b24, 0xffffffffffffabff}}) 01:35:42 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x0) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:42 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x81, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) time(&(0x7f0000000040)) r1 = msgget(0x2, 0x400) msgctl$IPC_RMID(r1, 0x0) 01:35:42 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4008af12, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) 01:35:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x4000000000000005, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x40000, 0x0) getpeername$unix(r1, &(0x7f0000000140), &(0x7f00000000c0)=0x6e) setsockopt$packet_buf(r2, 0x107, 0x3, &(0x7f0000000080)="0d9b7195d78e4427061c35c42ebaaf8427e38f1844fc28cce641fd1e56", 0x1d) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="0000000000008aeb045b21cec00000e6294939244dd48f8a8afb05879d74000b4de1d035cb509301bcd08a17efc70748a5"]], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f00000001c0), &(0x7f0000000240)=0x4) syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x3, 0x407e) getsockname$netlink(r2, &(0x7f0000000280), &(0x7f00000002c0)=0xc) ioctl$SIOCGETNODEID(r2, 0x89e1, &(0x7f0000000500)={0x4}) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_PORTS(r2, &(0x7f00000004c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x1c, r3, 0x600, 0x70bd27, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 01:35:42 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 362.420588] binder: 16033:16034 got transaction with invalid offset (-1474365928010416128, min 0 max 0) or object. [ 362.482792] binder: 16033:16034 got transaction with invalid offset (-1474365928010416128, min 0 max 0) or object. 01:35:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) ioctl$TUNSETVNETBE(r1, 0x400454de, &(0x7f00000000c0)) [ 362.682678] binder_alloc_new_buf_locked: 5 callbacks suppressed [ 362.682705] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 362.697393] binder_alloc_new_buf_locked: 5 callbacks suppressed [ 362.697430] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 362.752954] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 362.761385] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) 01:35:43 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7fffffff, 0x1) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f00000001c0)={0x2, 0x0, [{0x8000000f, 0x75, 0x4, 0x6, 0x2, 0x7, 0x3f}, {0x80000003, 0x7, 0x4, 0x7ff, 0x200, 0x9, 0x1bdfffbc}]}) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r2, 0xc08c5336, &(0x7f00000000c0)={0x101, 0xfffffffffffffff3, 0x5, 'queue0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe9\xff\x00', 0xbd}) 01:35:43 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4008af12, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) 01:35:43 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) alarm(0x20b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x20000, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x2, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x200000, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 363.059366] binder: 16157:16158 got transaction with invalid offset (0, min 0 max 0) or object. [ 363.089049] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 363.097531] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 363.107067] binder_transaction: 18 callbacks suppressed [ 363.107109] binder: 16160:16163 transaction failed 29201/-28, size 0-0 line 3035 01:35:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:43 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:43 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='ns\x00') futimesat(r0, 0x0, 0x0) 01:35:43 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = fcntl$getown(r0, 0x9) r3 = syz_open_procfs(r2, &(0x7f0000000000)='io\x00') exit(0x0) read$FUSE(r3, 0x0, 0x0) 01:35:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x200, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x280, 0x0) ioctl$KDENABIO(r2, 0x4b36) socket$bt_rfcomm(0x1f, 0x3, 0x3) sendto$rxrpc(r2, &(0x7f0000000040)="1de6b580792681e47f96e6e3df7e3be455d51e91a994ae2d1615b89d873d5aa9a3ff1e269b1e9fb4fb88ad0d5b46c575027ca9ec490379449a448f4885645941f073355f1cbe7616b488b582c86690d81ee46e9f6e1c13e220a41262e30b14781f28be3e4904fa9112235d1b269c223eb797e443370a0115416d9f6fb7421bfcb4c637dda3ca8dbbdcc102a7086900d7226dcd2390f0cd81730fff8e3e001c483b895f96352c370de1e8e97c1ce0383b83fd139d9e5e7296c8e818572f68fde703c2", 0xc2, 0x40, &(0x7f0000000140)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x1, @mcast1, 0x8}}, 0x24) [ 363.286396] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 363.296184] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 363.305587] binder: 16160:16178 transaction failed 29201/-28, size 0-0 line 3035 01:35:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 363.487574] binder: 16183:16184 got transaction with invalid offset (0, min 0 max 0) or object. [ 363.496822] binder: 16183:16184 transaction failed 29201/-22, size 0-8 line 3097 01:35:43 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000027000)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0/bus\x00', 0x81fe, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000140)={0x0, 0x0, 0x800000000000055, 0x0, 0x0, [{}]}) msync(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) fchdir(r0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) umount2(0x0, 0x0) syz_open_dev$vcsn(0x0, 0x0, 0x80040) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, 0x0) 01:35:43 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, 0x0, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:43 executing program 5: r0 = socket$pptp(0x18, 0x1, 0x2) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000000)) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$RTC_PIE_ON(r2, 0x7005) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="11632e9540"], 0x0, 0x0, 0x0}) 01:35:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x40000, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r2, 0xc0045520, &(0x7f0000000100)=0x40) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="00080000ddffffffaa92bec32bcead53ca363d22ddbfaaaf8ef5f75af46802dc0d82c6b103fbef726bc4818ef24b01bc96dfdb42ba2fda292cbcd27b3207317631ce2966c642df43de7bd9cc9674fc"]], 0x0, 0x0, 0x0}) 01:35:43 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, 0x0, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:44 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4008af25, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) [ 363.892554] binder: 16208:16209 unknown command -1792122095 [ 363.898494] binder: 16208:16209 ioctl c0306201 20007000 returned -22 [ 363.917025] binder: 16207:16211 transaction failed 29201/-22, size 0-8 line 3097 [ 363.979114] binder: 16208:16212 unknown command -1792122095 [ 363.985222] binder: 16208:16212 ioctl c0306201 20007000 returned -22 01:35:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:44 executing program 3: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 364.112927] binder_release_work: 20 callbacks suppressed [ 364.112944] binder: undelivered TRANSACTION_ERROR: 29201 01:35:44 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = dup3(r0, r0, 0x80000) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000440)={0x0, @in={{0x2, 0x4e23, @multicast1}}, 0x3000000000, 0x9}, &(0x7f00000000c0)=0x90) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000500)={r2, 0x8}, 0x8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1405000}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="1d002e0a", @ANYRES16=r3, @ANYBLOB="00012cbd7000fbdbdf25030000000800050005000000d2d862a67b25c584b218b05372304a9003a0d2fdb6fbf101da1c90ca3c3c025f69574f1f40288ff59ae4db56f4ca66d600bc8404677d5cdbfcdbb3fa6cce0455db75c3ff1d281fdd81a684f837d3c6cdd53f34928e3915c8ebf9bc89d1068c7c79f230f47ec49391be54399d55fa929d633540279d80134b80647791dabf4f85b8574975cf8961be7d315802370d0adb9ff4d86ff3a69943d4b2d2cd8a88091f025209792104cfb38221db275b9475fb7688b2bb3d68ef71afb3e9"], 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x20000000) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000280)={0x0, 0x80000, r1}) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f00000002c0)={r4}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000540)) exit(0x4000000000) getsockname(r1, &(0x7f00000001c0)=@x25, &(0x7f0000000240)=0x80) read$FUSE(r1, 0x0, 0x0) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000300)=[0x40, 0xff]) 01:35:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) socket$l2tp(0x18, 0x1, 0x1) r1 = syz_open_dev$dspn(&(0x7f0000001200)='/dev/dsp#\x00', 0xf4, 0x101000) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001240)={0x0, r1, 0xc, 0x2}, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/4\x00') getsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=0x0, &(0x7f0000000140)=0x4) setsockopt$inet_sctp_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f0000000180)={r3, 0xffffffffffff7fff, 0x1000, "85d76cb4f39b35dc5003d289e4e2f3f8c8ee13cb6ebf8dc9e7cdecf05705f59cce5d5da8d25bdbc629445b25af84a57b8b284b4241b1b6f5899e8c9a16354471ad786353683c9f5050fbc982311f73fe83ab00498588766a99af898760b6f87290a1ab7a1a4aa0bced8c15d0ee17882cc1cedcff695e275c9990e34f11d500f1b6e4254252c3639d435bcda382028007a189924af94385b65736b2b7ce54d0da0ee4dd62f825e5e32fb0aab2122c6baafaaa86ab530cb668e9028c724cfb7e0c2040175af232810c4e419464995c337de78e98ec2075198c5b055d97800b7cf1153fe0b37a1b88ea41ae48950a17a046aed5f5270a1f7afff7fe9ad03ba2035c8d2998543d518ba45527672c9c92b9762d59715104a365a8956b49bad8cc49e1a26e110d4e5695698e3ef316f042dad6e3d134073517e698806d96313cfdc1573b1248d3ee0a0c41b3b4668c57fe9786bc7a255a273c697c7d42968989f9ac4db8fcc985d051b15696f3025513355f8450b9ca4ffb9f3d2a93ed058fb1349627d66c7d4c3ad8fef855fc96d8e972d6784a59c2d92fbaa3a743d5f33ecf7f23ece814d9d47e608d9884de089b66e3d1777dfea13e82818e0cc6ebea6be2bccdcdeadb407fe86dc5a6b1a49140f26f243da956165b7e672a1c1aec52ecd9427786fb654ec1121dc6b26f72d6524858c9ebfbf52e36c6920cbe1887a4add9c7f759efebcb637ffbe55ebcd7059dfd23d48dd3c8beddaf259a7d2436bd438dfd425ff3365eb40bc28a1800b7df6c9d247eaeed2a8852e7392c47c10c3a9d00c5b5153eded6e837dc1b4b50425c35aa3aa1d08980d08eaf8cc392d2e65922db4a891d5e292e18f55c18ba7f50cc7b6c7cf1743bcbc738445e1b982382e3595a08d12de1ae629caad766676eee12b41357af224f21afbffdf0ce8796e196ad0e2de483f1aeac2a15cf0af3a30c57255e437da798e85e5f5df4cb26480d6568515f5662192979bc88233e7c99dcbcd8836be88e9bc7daaadd0fca5e3794f4a215f360da22ce99681fe2056e78e790d5ee594919108db0480497d41ee82229a4a71932d8d0d958275cac763b6fc239b6da4572f20375971e6f3664ce61484a52997c2ff4cdea23b0103131e8beb89a579fc07b2aed8b227e2a254fe61d5e4e5f77191593eecdde026e70236ef50aa245b5a10b63eb3306e107b2db124aeb1297d8ad972ef921d40edf3b3118ba3a13f6b494c0b676cf7a33bc5b04ae25c90ba447b55d93e34dd9168fdac7aad61798d49c35deb4ff16b597b3916fe7d5051f4fb1d5aeeb3598f59eca0a32823bfd6eedaba6b3a0fe1608d3677e4b88363996e01e0a9036a3616d2eb10f4b611a4a62799db1e3a71be378755bc64dd1699e6b6e0d1a93bffb19141482db081f5acd6ddd15ec6bab34e5a7c822c28a48436b2660551246312dea622ea9913059fcf1bd90887891b0d67117dba8ebb93c27592e1c73a7125dcd44f47f8c34dd1573f2893cc2bdbad94be346a1183a4d4cd511a473991747768f3c4c359cf1d7bf58f4b197b7400511891d04a4947a2f3bf599b77b0dadfafa4eb69686dcec1198ea508910bbac3a6bf7b8fe84337ab8554f787da0f4f7f4b4ecd58486f6477305660435a8c8c6644bbe6b9fc150bc2189b611b4999a514a1c93d6feed74cfddc029313bca8a53a5376c0626a42a8e9c0568951f4a3734c312ca2d2ffe308038cbd802b4025c107fcc016b9ab28ccca76fe3fea4bc816fdec5557e80234cc12dbcbf7c537ec5bd3ce2e0aad9110550639f01f17a7c0bf9705c5ae010bd972cb62d559a9184a3d3b9de198b49c02374b8796662590ef0dedaaad9502da0fee7675218e432b1885b36ae25a8eed18f569314aa67959e2f2298dda7e44c65841da8c63365e793cde2305703408551cd710fc0e1829958b0ea19d5eae14460500bb69efe2f5092c1809ffe70e6d506bc40bb72e034a2228deaa108551a680fb56563770ee9cf1c617021e23f0f54afab452d9163b464acc2de5a53189c6e0d31732a179358576a3aa6b536509ab7059f4fe228ac3cc9147721829f59401406df5ba6573f7c8cd3dff8eb3ae14561ec59352f5e94e3a6fcb8baa46219db82298d54767e867bd341f16023dedb0a1633b5bca802c2dfcc055474a8727ad548a31b37d29f9c70de2623be9a6e7362b4773ce2b4ec67eb7baf8e34095d4087bafacf6ed6d2c4c9dbf7bfd485f68e52c589664bb8d1f1835240cb1b1a31c839bd71ad9776eee21745aa8a9bceccc34fac6e280e66eb325ac53ca513145e41666e2ee3feca0cb19e1321d1429aef4702bced4c0947def82c4bc339d3dd6d426465613b99562e64697164df48c3edec9cbc814a03b13888b35d6933a8e6b11e8c45f0a083048586144b1cedc8efe3701c40038861af20b04bd4651735a104ece72094f2b0e7cc78354d84c1b28c7a5758c5488097b1f6cfbd1c81cbd3acd80f66cb5733cd3a9563c98c6fc21c0562ceb99cd2e6aedd2d903b156d933c7db7b5daf78a03927dd234fda95658faac1578a17a7231b83d3b35bbba165ae6d0649ca361e5f874ad8def1ceed7c00e000bc8da3947c677deb9d168855d669e9adb750e75124b9407784e440218fd08fefbdca14bc2c1113777df5c9450a3fbf828acd30d439bde3bbb86c3de69105ef22dea8a2692a39c77316e0bad0300aced743f75a3bbd4b45c5fc22aded41f6f8103163136f5b8ceae0095fa08a18777256bd13801409ff3c9e59e70462a4c64ffeaf1a3de1362af43e6081f6dfc07069edac5b47d910e3f00ad4f01dd95e5b73311eac2eeddd5ad22c8011b57da6f62bbe294c0677aade40fc0df9eda7ef1edb5ece86315779d615e9e49c7764e4e1c701dfe3cc6ce4510c67085e7a54f144872ce516ddf96dae5bb290efd112178db9a05558da759ced80f7cb7c28f990e4621b2a9fd8fba1a27d342709618a79264701ae64a04c69b3df56535a4aa77bd8a7d75e58b422acef496c9581a49578da67b79d1244567fa94b0d3e7bd82b70e3d696b8b614b492650caa2a701736d9e19bc32b5a584f501796f3cfa4a026dd886a27bc605ff09068d854de3156aaaef3aa1493cd3a2e38c2ebc9018daa4933c5643e8bb7da72a4e05defb3f64adeb3e60c3415060d2c1112cbbf4841b413e3fa2f6e5dc82a1c99b561df8da9bc41768c3257676502429762cdb8732728037223350a77e5142b17e5f1c98733d080e26d89ed4792d54b5faa2e7e5b295e464163d00e03a3f404f30f53077bc5a4cbd84b64c5fb57201d246c1b1335f5b81d2d40455f25d1bd528f180cfdf3ad4435b6dbb1e30187555c38854bc360bfc05dbc497c73ed3821dea75786a86a04a113db33a423350dd1545bd4cc6cbc70171a25239bbf31a4c97772037d0e68fa2d4dd9edfa2060fec4643bed4ddb9bf96d9337c9f24850defec4b6cdf3340a580a7690b726117893b174a9d0e06d491e62e68b3ee367deb889564f4c3a69becad2a488e347ef0bbc9c142088ac065bf1ecdbd4a318eadcb77f2765e895e2aff311f42ea2c16365b7f3d767df8b6df23b86fe386eac63ba7ac45dcf8242d71813b1308af489e21df8091e1a44844bb08b968547226c290785840b6643d88ef041f92eb6ab418c594b7d14e8e30a380789aef3274b8c73622a44fd780698ab34fb736f0358fe7e9b3c596820c0140ae7d1453344822a806942decf224e6f206fe824b53f834b5c57b9a5163fb3ce9f06e469a2685260893a02f74ef2a7875d5c8d923e97dec3e1180c2a6665030b488a81e3be223bf924c049ea7606a91164d4fd83d6b98ecb90acf11b68788624469e44ff765f489e847a3cc66e63f34d85eeedb3dbb0e2e6707a230ef8ff9a5978e596f643985f8a00a510612e893d32d6866338c6bd706634353506cf3f0cdc55875029ef7c88da7dc3b5a894403034599f58e635e1e2834030e4a90d10bb4b5454b25ce505ef3305a9f86aae0e68344841fb6a5a7b5366713f04b1a52e320320d0b465ed18d619af44836816ca5ac287d1b3cb158f5992e3e8746cdc5035cf0bc25cfee58238636663bf57614e12999b3ec86227a0de7f72234e9e2e6940bcba59be2e66291f914ef05bbea81582cb3a54abb031fdcd286be05a202bbb1dcabd4304aacf7eed2df9c2c56ea97e61f0fee5deb79a89e41f0abc159612fb527c7224a55b302025f2b8d8dedfc2c00f2e9e5b3f68cab9f36bc3824b911233206ffa060607d8ff4c92282543aa80fc6c98b26302d4c021928ffaff6984ad0bc708cecfe3f66080afb8b70323f9cd9d2240d6ad81c6caa6a29a5311853a5275209d7d77f23f6164c54a6208ba4ae8495b150a1f3766d5d84dde3ec2461c9b36aa7e803a3ed73efd843e4338ae3c278db414b323e2a8848fda497f67485acfe645b8b4c368a203843bcd5d5eacc23c5ea30cd72f839d89ea1c2a715e6ccd61b5d26e4a16d54da95a0cf776f7a75a047241dfad0c52ece5116a9bea9a7d60a79b1fbac2b4039ed78d7a409a862557a82243b8ffb8b663be286d5bc9261c2d9f69926ce8c03b020c2cb474884d8ae4c8616a72dc5a495a9ac36b725a727df50f768e9e3572b4e1c12d2a8ca5d6899a83b9ba7dbc8798349fa7b33daa344faa0f83f7b5233446b106fc2ab74034e9ef9b561d2bedcc43caafff5c4065b82e8c7243c178df1b9d0816034527048fd7f39e55b2b67c6b2bdde0445b45c48517a34a82a2c3faa1157b0f35524e735f336495d86970f4f3630594af63b873784f7d6b245a09ac035dd2251d6a581d351fec9af01aaf481da99e93e6077bfe31f7a9e2e7aa0761998c6893691d11d479c91acbc9ea1ab045712fb8fcc08e368ba95c78368572a061623ff5bb2b19e06df2843af25da79c768f192e31205e290ee301b7dde15f8b4cb7abf5f68bc3bf787d8d7ba2032daba12262a2da9c2697c6ebb95e191e24dc9a88af73ba54ba72a631260a8231b8f2d122f6df9e45867d0ff6a545a17477c0c12257a37cc5acf07f92e9286184e69af1fbe14afb1b256365db0ceaedc29f40932783ead5f205194497e15c71725fc41e8467b2197f08a95010ea36beb5bcbc7262f4cd3ce6736b082f98afb71b5536fd85d5ac91b55d4dece3e0606ce13830e8e9d38644682acb97720d1a9d7530a73dda1888c7a7bd79a26f6251bb9d98174a4d1b0369206974b88ceff33dfcb42699006240e1375be41a86644176487a54ef2cb01d3d3b03c6e4b7c0da2c5b38969309f6cfd004aa7138c8c26a80bb127af518929d59fe7dbcc5c11f605aeac87f0eea31860220fd222c35df334e105d4470fedbccbfd2031e4f10e03bafe8cb212f776db0ee464f44e016e8b12a3cf47d067ffa7459ded01ca2579ed7896a74308724e07000c89ed31c9d2252bade6db6d603f80e0f6f9362fe5a936e4550aee999fdc24746484c8797399757db1fa7d288f04594eca614df22eaa4a3f13c623444a6f29c806a90b7aaa22f2c976c4e998dbe8cd1c759058227cc7f368d98cef484a399d2e294cde2ea23e450ec16445c4435f01bcdeebc4d51960db8147219f333182d6f5eaef4fe8c6bc7629601f7553c140f97a33faabb278f2c3caae74d6dc7e4c16f80f5ae8c066212f53436074bf4753f042a3811df911553c2852003201493ac78a4c5ecbfa47fa4071a625c51fb777d9a9323f566fb3701a92d58d0a2c590a7d88d4e088ec79b9926c112992c935f7d28ec0836bd476441db0ec1d97afc1f9e2b94a7f7eef"}, 0x1008) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f00000000c0), 0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, &(0x7f00000011c0)={0x8, 0x1, 0x7ba, 0x2, 'syz0\x00'}) 01:35:44 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000003000), 0x10e6) readv(r0, &(0x7f0000000680)=[{&(0x7f0000000300)=""/72, 0x48}], 0x1) creat(&(0x7f0000000040)='./file0/file0\x00', 0x0) write$FUSE_INIT(r0, &(0x7f00000001c0)={0x50, 0x0, 0x1}, 0x50) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001f916bfdfbc988ae80046070000000000000076656d31000000000000000000f386616a1a0a3c00000000d8d4df6600000000f6619fed3823dad0c82aebd8b511535650f5b7c9c6bd3276ce8c946100000093000000051c0005000000000079737465346a48be1b31486dcc637075736574636772185f426bbb9299b7f5c20a"], 0x90) lstat(&(0x7f0000000100)='./file0/file0\x00', &(0x7f0000000240)) 01:35:44 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, 0x0, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6, 0x100) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r2, 0x28, 0x0, &(0x7f0000000040)=0xffff, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 364.536965] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 364.545414] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 364.554904] binder: 16251:16257 transaction failed 29201/-28, size 0-0 line 3035 01:35:44 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(0x0, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 364.682522] binder_transaction: 1 callbacks suppressed [ 364.682555] binder: 16276:16277 got transaction with invalid offset (0, min 0 max 0) or object. [ 364.690403] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 364.705571] binder_alloc: allocated: 2840 (num: 198 largest: 32), free: 9448 (num: 1 largest: 9448) [ 364.715065] binder: 16251:16257 transaction failed 29201/-28, size 0-0 line 3035 [ 364.715278] binder: 16276:16277 transaction failed 29201/-22, size 0-8 line 3097 01:35:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 364.728600] binder: undelivered TRANSACTION_ERROR: 29201 [ 364.758763] binder: undelivered TRANSACTION_ERROR: 29201 01:35:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x10000, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="ce0000008f4eb11c0a15cf07d979f07ff891dd3282657ab7b15c7bbc135fe137cb06a64ed35160cfdf6bbe7a1b44ef3771f501d374d7d3fa715a91e4a953c9472e203ce88f5525db86ed1ff181ffd5f8877f1a7bdbfcf75bde5039104fd469875c58209b93c369a2f4d2d96896f8609dec296213cce838ebce82a0264cda01f046a578157f4ab19a92cf7f8f6a44d2fcd56f4b31cfb0db4f566a4ad44568b3ee348a5479b5cb0dffa6fb2fb45bb09916e6e569df118f8ffe439b2ca7fc58c64afc9b09ca98458480100779d7cf6757f1f34dd448d7d08e7805fcac5f092fcbd9806735fee5fd4b8117f454c02335b757b1e53532640d4bfafb5bb0702efbdf8e005634348c465c4e689b49f4d41a2eecc84c6a347e387fa6272a5640e3e7d11ecd7bcd9e17e6daa959eab69d26468c6bec1316b1628bbe56824f3487cbb8b817a107a659a9f05b49e0cd70103f718f3fb23b50faf199c336f3f1575a490d54eeaa21d0b5f698db9fb8945ada1659e49753f661a84d9cc63e299415162300751be16bc10a000061eccb3d3537c28b44c50fd6fe1eb5ec8fabfc555d28bb58d82a4bd3c1bf21465b46b3e743eac2df8e667f9b88d1f4b7c7d202008fd38872b88e1baa97f798be168a2a65d81a7831"], 0x0, 0x0, 0x0}) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x0, 0x0) ioctl$PPPIOCCONNECT(r1, 0x4004743a, &(0x7f0000000100)=0x2) fcntl$setflags(r0, 0x2, 0x1) 01:35:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="0000000300000000"]], 0x0, 0x0, 0x0}) [ 364.905598] binder: undelivered TRANSACTION_ERROR: 29201 01:35:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:45 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(0x0, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 365.076323] binder: 16291:16292 unknown command 206 [ 365.081995] binder: 16291:16292 ioctl c0306201 20007000 returned -22 [ 365.122349] binder: 16291:16292 unknown command 206 [ 365.127627] binder: 16291:16292 ioctl c0306201 20007000 returned -22 [ 365.133609] binder: 16289:16293 got transaction with invalid offset (50331648, min 0 max 0) or object. [ 365.144103] binder: 16289:16293 transaction failed 29201/-22, size 0-8 line 3097 [ 365.349870] binder: undelivered TRANSACTION_ERROR: 29201 01:35:45 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x0, 0xffffffff80000001}, 0x8) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f00000000c0)={0x9f0000, 0x1, 0x100000001, [], &(0x7f0000000040)={0xa00904, 0x4, [], @value=0x10001}}) 01:35:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='@\x00\x00\x00'], 0x0, 0x0, 0x0}) 01:35:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x7, 0x1) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000080)='htcp\x00', 0x5) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:45 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(0x0, 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') 01:35:45 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./control\x00') [ 365.596955] binder: 16414:16418 unknown command 64 [ 365.602231] binder: 16414:16418 ioctl c0306201 20007000 returned -22 [ 365.635816] binder: 16414:16424 unknown command 64 01:35:45 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(0x0, &(0x7f0000000240)='./control\x00') [ 365.635916] binder: 16415:16422 got transaction with invalid offset (0, min 0 max 0) or object. [ 365.640977] binder: 16414:16424 ioctl c0306201 20007000 returned -22 [ 365.649926] binder: 16415:16422 transaction failed 29201/-22, size 0-8 line 3097 01:35:45 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001dfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGREP(r0, 0x80084503, 0x0) r1 = dup(r0) ioctl$TUNSETPERSIST(r1, 0x400454cb, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 01:35:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:45 executing program 3: r0 = fanotify_init(0x0, 0x80000) r1 = fcntl$getown(0xffffffffffffffff, 0x9) fcntl$setownex(r0, 0xf, &(0x7f0000000040)={0x2, r1}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) 01:35:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x500, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm-monitor\x00', 0x4000, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100a0}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x100, 0x70bd2b, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0xc000) [ 365.842845] binder: undelivered TRANSACTION_ERROR: 29201 01:35:46 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(0x0, &(0x7f0000000240)='./control\x00') [ 366.067468] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 366.076021] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 366.085422] binder: 16442:16444 transaction failed 29201/-28, size 0-0 line 3035 [ 366.213092] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 366.221502] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 366.298682] binder: undelivered TRANSACTION_ERROR: 29201 [ 366.319754] binder: undelivered TRANSACTION_ERROR: 29201 01:35:46 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x5) read$FUSE(r1, 0x0, 0x0) 01:35:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="f9024b76ce1c0d24ba00940000000000"]], 0x0, 0x0, 0x0}) 01:35:46 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(0x0, &(0x7f0000000240)='./control\x00') 01:35:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000040)=0x5, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x1c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="a82a467d9e7be146aaac8cc3b167cf1593e96fe1e029e6cfe9c8be56f458b4678499e8df638e9faaaf8ab50a0161126745560ef0d460f7ae42be30b61f4c473457"], 0x0, 0x0, 0x0}) [ 366.631712] binder: 16560:16562 unknown command 2101750440 [ 366.637508] binder: 16560:16562 ioctl c0306201 20007000 returned -22 [ 366.645183] binder: 16557:16564 got transaction with invalid offset (2597764233136112377, min 0 max 0) or object. [ 366.671416] binder: 16560:16569 unknown command 2101750440 [ 366.677340] binder: 16560:16569 ioctl c0306201 20007000 returned -22 01:35:46 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', 0x0) 01:35:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 366.901147] binder: undelivered TRANSACTION_ERROR: 29201 01:35:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) pipe(&(0x7f0000000440)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(0xffffffffffffffff, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) 01:35:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/capi/capi20ncci\x00', 0x90000, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000300)={0x0, 0x42, "8c04ff4c93a929b3d563093c54ce7c9e4c66b8304027d8c6f0391192b703d21227c68fc907447871555b6b6d797b2696fc227c3bbc2ff46ebf81cde22d777ad63f9b"}, &(0x7f0000000380)=0x4a) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f00000003c0)={r2, 0x400}, 0x8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40020000}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x128, r3, 0x400, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x24, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6ec7}]}, @IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'gretap0\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bond\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@initdev={0xfe, 0x88, [], 0x0, 0x0}}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7fff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}]}, @IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xba}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xb15}]}, 0x128}, 0x1, 0x0, 0x0, 0x40}, 0xc5) r4 = getuid() setuid(r4) 01:35:49 executing program 3: socket$vsock_stream(0x28, 0x1, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setxattr$security_smack_transmute(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.SMACK64TRANSMUTE\x00', &(0x7f00000000c0)='TRUE', 0x4, 0x2) mkdir(&(0x7f0000000100)='./file0/file0\x00', 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000000)) 01:35:49 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', 0x0) 01:35:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:49 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x100000001, 0x10000) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000100)={0x4, 0x7fffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040)='nbd\x00') sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f00000001c0)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="5c06f132c65d461046afc17b037a5e65000000", @ANYRES16=r3, @ANYBLOB="280925bd7000fcdbdf25030000000c00040004000000000000000c00040005000000000000000c00030004000000000000000c00040002000000000000000c00030008000000000000000c0003000000000000000000"], 0x5c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) read$FUSE(r2, 0x0, 0x0) [ 369.260025] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 369.268527] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 369.278028] binder_transaction: 2 callbacks suppressed [ 369.278064] binder: 16692:16700 transaction failed 29201/-28, size 0-0 line 3035 [ 369.278114] binder: 16696:16697 got transaction with invalid offset (0, min 0 max 0) or object. [ 369.300252] binder: 16696:16697 transaction failed 29201/-22, size 0-8 line 3097 01:35:49 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000340)='./control\x00', 0x0) creat(&(0x7f0000000040)='./control/file0\x00', 0x0) r0 = open(&(0x7f0000000380)='./control\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000700)=""/80, 0x20d) unlinkat(r0, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) rename(&(0x7f00000001c0)='./file0\x00', 0x0) [ 369.362982] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 369.371384] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 369.380792] binder: 16692:16721 transaction failed 29201/-28, size 0-0 line 3035 01:35:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 369.415523] binder: undelivered TRANSACTION_ERROR: 29201 [ 369.424679] binder: undelivered TRANSACTION_ERROR: 29201 [ 369.452753] protocol 88fb is buggy, dev hsr_slave_0 01:35:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x3, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xa9f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340407d95662bbe2c73b9a8430000000000000000000000ffff000000000000000000000000000000000000000000080000000000000000000000000000030d0000000000003c886e65be6315a1b2f7d749cf08f524d9e99abad0187eb34dd1de882df117d07a642eab79175bb5b99de19d6233bf37ba09e0c0bcb79f8385f7aa7c95b540e7b9271f2257d768a2f136a3fa62f81c7c09333f8a6a0e4360a761be651e424ee2d4fff211ae4d97c8dea7486b619ddb651b69ce3a8c9bfd4de301587de51e3c49", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="eeae2cea8e545000000000000000"]], 0x0, 0x0, 0x0}) [ 369.481382] binder: undelivered TRANSACTION_ERROR: 29201 01:35:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000280)='/proc/capi/capi20ncci\x00', 0x40000, 0x0) ioctl$UI_END_FF_ERASE(r1, 0x400c55cb, &(0x7f00000002c0)={0x3, 0x2, 0x6}) utimes(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)={{0x0, 0x2710}, {0x0, 0x7530}}) getsockopt$packet_buf(r1, 0x107, 0xd, &(0x7f0000000380)=""/186, &(0x7f0000000440)=0xba) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r1, 0x80dc5521, &(0x7f0000000300)=""/81) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRESDEC=0x0, @ANYPTR64, @ANYRESHEX, @ANYPTR=&(0x7f0000000480)=ANY=[@ANYPTR64, @ANYRESDEC=r0, @ANYPTR64, @ANYRESHEX=r0, @ANYRES64=r0, @ANYBLOB="7a0b000043a9cf846a75e24e6c8e997dbb97519ed67151fc17cab08dc22372ee04b1977addd5f14e4597cda83211b3be3c5f63a40be1f6f6cab7ca1462739a829fa018fe32a829e5f6a1243b7160d084bfd85e3ee9a189602ff4ba8e5e86a20de59c38af47c1a809aac862d2a35a480da35f5c98c0191c05c8333af742ad826fb85f9bf2b581a9a60ee3f4b77486c8b90f059ded364cb8"], @ANYRES32=r0, @ANYRESOCT=r0]], 0x0, 0x0, 0x0}) 01:35:49 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x7) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000180), 0x0) [ 369.687995] binder: 16732:16733 unknown command 536871360 [ 369.689180] binder: 16728:16731 got transaction to invalid handle [ 369.695502] binder: 16732:16733 ioctl c0306201 20007000 returned -22 [ 369.700280] binder: 16728:16731 transaction failed 29201/-22, size 0-34359738368 line 2896 01:35:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="116348400484c14002968e26b866ab8867bcea8cd9ae3bf766656de1e9c119e6383d6ce1d0c886d1976fad6e120c838e13006de53ac416799f3818c2674cecef78f791c9233f5b53e925f1e03ab13489aa5dbbf08ce176ab0ee23fdba50d3420134c285566f75c1498bdbe9179650c41badfda65ef692ad77e44c49f1bced25f0c118d4a5869a5ca60732ec821c5d2f9ffac6579449af81f4e41ff5ba4de75ec59e9ee7437bb393dc50ce921ec3a3605a52c7e5d7d00bcf816c35c"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x50, 0x0, &(0x7f00000001c0)=[@enter_looper, @transaction_sg={0x40486311, {{0x2, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x38, 0x8, &(0x7f0000000000)=[@fda={0x66646185, 0x4, 0x3, 0x13}, @fd={0x66642a85, 0x0, r0}], &(0x7f0000000040)=[0x30]}, 0xf58}}], 0x47, 0x0, &(0x7f0000000240)="0be2f4adc21b26e17b8567a4921ba398408ed06957d60397f4329040c9df47e1b35f356b97807af56994f41c4689992cfa582b6f49d9a95baaca4e675c6b37d057645b46fe58bd"}) [ 369.835907] binder: undelivered TRANSACTION_ERROR: 29201 01:35:49 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4008af04, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) [ 369.978386] binder: 16746:16749 got transaction to invalid handle [ 369.984987] binder: 16746:16749 transaction failed 29201/-22, size 7975153212989032656--1914874182567261166 line 2896 01:35:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000140)={0xffffffffffffffff}) ioctl$EVIOCGBITSW(r2, 0x80404525, &(0x7f0000000040)=""/143) [ 370.084033] binder: 16746:16759 got transaction to invalid handle [ 370.090444] binder: 16746:16759 transaction failed 29201/-22, size 56-8 line 2896 01:35:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 370.164653] binder: 16762:16763 got transaction with invalid offset (0, min 0 max 0) or object. [ 370.173883] binder: 16762:16763 transaction failed 29201/-22, size 0-8 line 3097 01:35:50 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x7fff) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0x0) [ 370.272481] binder: 16746:16759 got transaction to invalid handle [ 370.278895] binder: 16746:16759 transaction failed 29201/-22, size 7975153212989032656--1914874182567261166 line 2896 [ 370.313016] binder: undelivered TRANSACTION_ERROR: 29201 [ 370.318586] binder: undelivered TRANSACTION_ERROR: 29201 01:35:50 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) poll(&(0x7f0000000000)=[{r0}], 0x1, 0xb1) [ 370.357637] binder: undelivered TRANSACTION_ERROR: 29201 01:35:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400210) r1 = accept4$unix(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x6e, 0x80800) fchmod(r1, 0x4) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, &(0x7f0000000180)) lsetxattr$security_smack_entry(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='security.SMACK64MMAP\x00', &(0x7f0000000140)='/dev/binder#\x00', 0xd, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 370.436033] binder: undelivered TRANSACTION_ERROR: 29201 01:35:50 executing program 2: r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$EVIOCGABS0(0xffffffffffffffff, 0x80184540, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={0x0}}, 0x0) mmap(&(0x7f0000a19000/0x400000)=nil, 0x400000, 0x2, 0x8012, r0, 0x0) [ 370.600634] binder: 16810:16813 got transaction with invalid offset (0, min 0 max 0) or object. [ 370.609923] binder: 16810:16813 transaction failed 29201/-22, size 0-8 line 3097 01:35:50 executing program 5: lstat(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) socket$vsock_stream(0x28, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11134840"], 0x0, 0x0, 0x0}) [ 370.652728] protocol 88fb is buggy, dev hsr_slave_0 [ 370.657666] binder: 16810:16854 got transaction with invalid offset (0, min 0 max 0) or object. [ 370.658517] protocol 88fb is buggy, dev hsr_slave_1 [ 370.667766] binder: 16810:16854 transaction failed 29201/-22, size 0-8 line 3097 [ 370.745143] binder: undelivered TRANSACTION_ERROR: 29201 [ 370.753992] binder: undelivered TRANSACTION_ERROR: 29201 01:35:50 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) readlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000380)=""/96, 0x60) socket$inet6_tcp(0xa, 0x1, 0x0) read$FUSE(r2, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x5c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0f630c4003000000030000000000000012634840040000000000000001000000000000000000000001000000000000000000000000000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB="600a9016c95f46d88d6ee7d86e4e727732d500b5cfdfdba2a95f4801d08375cfda765893cc67e99c622ae0a1f2aa7b2fd051be263b8b3426c109ec4c662d8bda8b9a5f4e0a06c3d5863a4ab4d0561fb3c0e512f68ba7b3edd2903d2a10e4069765298a0db9e5015dfee6b7564d069cde1d50082ef12f0fdcdf1811d23b69daf5e9371d25c81f273ac0668f29aa48056a02ec7678d66f6ecaad54a3e849"], @ANYBLOB="0100000000000000"], 0xdb, 0x0, &(0x7f00000001c0)="a48783dcf5362e977c42993b1149da2e5540ec1c33daaa8a17a44ea09edc2576490c995a836560f5408729221fc3d7dfdb5f4eab11ed6e5357f3e500b3b101167150741fe1666c0eb2a9fadc5e6823175cd8a2307507a9e3efe276997e85d5403b909d731f45e29603535bad529a170b547c31b0f1d6eddcf6032a4cc0baa35af5f099573752a98655aa57360560cb6718c4784ae7c719823b146f42496445fc3d31658515cec4b8fd8de656643ddb6df54f85751a58322832391b13d4d0e047c86c2ff3ccb0e8266fb4c0800dfcae9f222eab342e2035b1caf1e2"}) [ 370.804997] binder: 16883:16884 unknown command 1078465297 [ 370.810778] binder: 16883:16884 ioctl c0306201 20007000 returned -22 [ 370.866933] binder: 16883:16888 unknown command 1078465297 [ 370.872840] binder: 16883:16888 ioctl c0306201 20007000 returned -22 01:35:50 executing program 3: socketpair$tipc(0x1e, 0x100000002, 0x0, &(0x7f0000000040)) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) get_mempolicy(&(0x7f0000000080), &(0x7f00000000c0), 0x3, &(0x7f0000ff9000/0x4000)=nil, 0x4) 01:35:51 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000040)={@dev}, 0x20) 01:35:51 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = gettid() r3 = syz_open_dev$amidi(0x0, 0x101, 0x16001) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, 0x0) ioctl$DRM_IOCTL_NEW_CTX(r3, 0x40086425, 0x0) r4 = syz_open_dev$usbmon(0x0, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x2000000000000015) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$FS_IOC_ENABLE_VERITY(0xffffffffffffffff, 0x6685) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="ba4300b00bee660f3a172e0010000f32652e0f0866b83c4a00000f23c80f21f866350c0030000f23f83e0b450eb804010f00d00f01f60f3800210f01cf", 0x3d}], 0x1, 0x0, 0x0, 0x0) stat(0x0, 0x0) fstat(r1, 0x0) geteuid() stat(&(0x7f0000001300)='./file0\x00', &(0x7f0000001340)) getuid() getgid() lstat(&(0x7f0000001800)='./file0\x00', &(0x7f0000001840)) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000018c0)={{{@in6=@ipv4={[], [], @initdev}, @in6=@empty}}, {{@in=@initdev}, 0x0, @in6=@empty}}, 0x0) getgroups(0x3, &(0x7f0000001a00)=[0xee00, 0xee01, 0xee00]) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, 0x0, &(0x7f0000001b40)) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000001b80), &(0x7f0000001bc0)=0xc) lstat(&(0x7f0000003140)='./file0\x00', &(0x7f0000003180)) getgid() getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, 0x0, 0x0) getresuid(&(0x7f0000007bc0), &(0x7f0000007c80), &(0x7f0000007c40)) getegid() gettid() getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000006500)={{{@in=@empty, @in=@initdev}}, {{@in6=@loopback}, 0x0, @in6=@empty}}, &(0x7f0000006600)=0xe8) sendmmsg$unix(r4, &(0x7f00000079c0)=[{0x0, 0x0, &(0x7f0000007940)=[{&(0x7f0000007880)="e8fe8b4fdc6254520ca496a15bce3765a3c3a9470b17d320bce04fa5b0de57443ae4fe822e8357a1f8104c65425fcd89710e0c05b5c3acacf9b39998668a3603f3767303fce848e7889796d14b5d70e48dc782d46714ea0bd10ddb9327df971f8bdfc3dd34887b125e4d9a48d68d3343c20e6ff291c5cf8f5be664d3f90a579579bcfff8b5941a41539717728cbb2e0e2beabe", 0x93}], 0x1, 0x0, 0x0, 0x40}], 0x1, 0x10) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f0000000180)) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 01:35:51 executing program 5: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000340)='/proc/capi/capi20ncci\x00', 0x400000, 0x0) ioctl$RTC_UIE_OFF(r0, 0x7004) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000380)=0x20) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x408000, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) utimensat(r2, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={{r3, r4/1000+10000}, {0x77359400}}, 0x100) umount2(&(0x7f0000000040)='./file0\x00', 0x4) openat$cgroup_subtree(r2, &(0x7f0000000180)='cgroup.subtree_control\x00', 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) sendto(r2, &(0x7f0000000240)="b12cf50eeb6ccf54a03912a956d1542b6a1f2cc04aa34b2de7da4a8319fdbfae79607b2efd1515083ee7c42c50f63597f4cbda4afcbac65ea9bdad1bacd27d0174c9122cfd42c85c9e155b6844f3fc3ca8439157135c228e4fbb3110c9e93647a888c91c1e5d091a9744bd61cf8e9d8b28582221d2f0b8ec5cb2db31b5181a0b4496a47fc63eafc921a9978ab12acb7c0bf487846fee30ae4ec1fa3bc5c6dceb8dec702e2c6155936a654be9000f43194bdc6706eee3e47e361bdc33a53b43287df1d470e28e5848d20cf204a77f765b9471c27312fefe7bc0c22ec9a79e062eca160b8b10c19285277df35003d79e", 0xef, 0x800, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="116348409e8e085fb222ae2ffde749bcdfefb7af4c3b6252347543c0cfd361dceeb5e9ad7b6d7345c38bfdff633f90c170659e8387caa8212b8e2506933f05094ac1f244300388ee402bc786c1a21e11cc66c5854901769e9c5bff16d3fd7fdecc95bfe3bcd8acd824997cab267a1b5cf8ea72fe3c2f8e5323c0"], 0x0, 0x0, 0x0}) 01:35:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, &(0x7f00000000c0)={0x34, 0x0, &(0x7f0000000040)}) ioctl$VT_DISALLOCATE(r3, 0x5608) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 371.276496] binder: 16903:16904 got transaction to invalid handle [ 371.532725] binder: 16914:16915 got transaction with invalid offset (0, min 0 max 0) or object. [ 372.732867] device bridge_slave_1 left promiscuous mode [ 372.738540] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.792934] device bridge_slave_0 left promiscuous mode [ 372.798569] bridge0: port 1(bridge_slave_0) entered disabled state [ 372.894723] device hsr_slave_1 left promiscuous mode [ 372.947172] device hsr_slave_0 left promiscuous mode [ 373.017197] team0 (unregistering): Port device team_slave_1 removed [ 373.028484] team0 (unregistering): Port device team_slave_0 removed [ 373.039168] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 373.067727] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 373.147010] bond0 (unregistering): Released all slaves [ 373.937160] IPVS: ftp: loaded support on port[0] = 21 [ 374.076562] chnl_net:caif_netlink_parms(): no params data found [ 374.123231] bridge0: port 1(bridge_slave_0) entered blocking state [ 374.129674] bridge0: port 1(bridge_slave_0) entered disabled state [ 374.137666] device bridge_slave_0 entered promiscuous mode [ 374.145934] bridge0: port 2(bridge_slave_1) entered blocking state [ 374.152525] bridge0: port 2(bridge_slave_1) entered disabled state [ 374.160032] device bridge_slave_1 entered promiscuous mode [ 374.183341] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 374.194629] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 374.218010] team0: Port device team_slave_0 added [ 374.225363] team0: Port device team_slave_1 added [ 374.285394] device hsr_slave_0 entered promiscuous mode [ 374.322501] device hsr_slave_1 entered promiscuous mode [ 374.435572] 8021q: adding VLAN 0 to HW filter on device bond0 [ 374.451210] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 374.459199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 374.473050] 8021q: adding VLAN 0 to HW filter on device team0 [ 374.486115] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 374.495767] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 374.504134] bridge0: port 1(bridge_slave_0) entered blocking state [ 374.510637] bridge0: port 1(bridge_slave_0) entered forwarding state [ 374.553465] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 374.561377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 374.570056] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 374.578011] bridge0: port 2(bridge_slave_1) entered blocking state [ 374.584565] bridge0: port 2(bridge_slave_1) entered forwarding state [ 374.592034] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 374.600432] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 374.609093] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 374.617362] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 374.625822] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 374.634056] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 374.642490] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 374.650303] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 374.664578] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 374.672693] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 374.680681] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 374.697866] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 374.743728] 8021q: adding VLAN 0 to HW filter on device batadv0 01:35:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:55 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = gettid() r3 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/222, 0xde}], 0x1, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x2000000000000015) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$FS_IOC_ENABLE_VERITY(0xffffffffffffffff, 0x6685) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="ba4300b00bee660f3a172e0010000f32652e0f0866b83c4a00000f23c80f21f866350c0030000f23f83e0b450eb804010f00d00f01f60f3800210f01cf", 0x3d}], 0x1, 0x0, 0x0, 0x0) fstat(r1, &(0x7f0000001280)) stat(&(0x7f0000001300)='./file0\x00', 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, &(0x7f00000019c0)) lstat(0x0, &(0x7f0000003180)) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000006500)={{{@in=@empty, @in=@initdev}}, {{@in6=@loopback}, 0x0, @in6=@empty}}, &(0x7f0000006600)=0xe8) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000180)) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 01:35:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$cec(&(0x7f0000000180)='/dev/cec#\x00', 0x2, 0x2) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @local}, 0xffffffffffffff0c) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x10100, 0x0) ioctl$VIDIOC_G_DV_TIMINGS(r2, 0xc0845658, &(0x7f00000000c0)={0x0, @reserved}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:55 executing program 3: r0 = syz_open_pts(0xffffffffffffff9c, 0x40000) ioctl$TIOCNXCL(r0, 0x540d) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syncfs(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="105cb10000000400"]], 0x0, 0x0, 0x0}) 01:35:55 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r1, 0x0, 0xfffffffffffffff9, 0x20000800, &(0x7f0000000140)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) read(r1, 0x0, 0x0) shutdown(r1, 0x0) 01:35:55 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r1, 0x0, 0xfffffffffffffda6) [ 375.686471] binder_transaction: 2 callbacks suppressed [ 375.686570] binder: 17040:17041 transaction failed 29189/-22, size 0-0 line 2896 [ 375.709025] binder: 17033:17036 got transaction with invalid offset (1125899918466064, min 0 max 0) or object. [ 375.719828] binder: 17033:17036 transaction failed 29201/-22, size 0-8 line 3097 01:35:55 executing program 4: [ 375.765925] binder_release_work: 2 callbacks suppressed [ 375.766028] binder: undelivered TRANSACTION_ERROR: 29189 01:35:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) r4 = mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000001, 0x131010, r0, 0x0) fsetxattr$trusted_overlay_opaque(r2, &(0x7f0000000480)='trusted.overlay.opaque\x00', &(0x7f00000004c0)='y\x00', 0x2, 0x2) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={0x0}) r6 = mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x7c, 0x0, &(0x7f0000000280)=[@acquire_done={0x40106309, r3, 0x1}, @transaction_sg={0x40486311, {{0x3, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x58, 0x48, &(0x7f00000000c0)=[@ptr={0x70742a85, 0x0, &(0x7f0000000040), 0x1, 0x4, 0x1a}, @flat={0x73622a85, 0xa, r4, 0x1}, @flat={0x73682a85, 0x100, r5, 0x4}], &(0x7f0000000140)=[0x0, 0x78, 0x0, 0x40, 0x38, 0x58, 0x70, 0x20, 0x28]}}}, @increfs_done={0x40106308, r6, 0x2}, @acquire={0x40046305, 0x100000000}], 0xb0, 0x0, &(0x7f0000000380)="6ce47d3bc40102ad2174d7f1ed3279a01a701a5482151e111892f890ab5af36ffbf7158f23217594e86be2f1781b4d18eb49ff537224132c2131274888314f51db36c8ebf0d727d9a64e8ea10ff60bebdf938df3044a4854289e4b08ee99c4fbf2f4972181c598018039fa9df79519f446c1d932fc0d1f2ca29bf3250a74d14a149311b5e49e548d1bef844c9cb7d6121346d0356fc9a13e70a88ecd91cec0cbf5d09655187e097b7fde5a2e3605b9e0"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 01:35:56 executing program 5: r0 = open(&(0x7f0000000140)='./file0\x00', 0x40, 0x20) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e23, @broadcast}}, 0x3, 0x80}, &(0x7f0000000240)=0x90) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000280)={0x9, 0x2, 0x4, 0x81, r1}, 0x10) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x15c, 0x2, [0x1, 0xb231]}, &(0x7f00000000c0)=0xc) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000100)={0x5, 0x0, 0x1f, 0x7, r3}, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 375.964252] binder: undelivered TRANSACTION_ERROR: 29201 01:35:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:56 executing program 4: [ 376.233410] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 376.241948] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 376.251252] binder: 17062:17065 transaction failed 29201/-28, size 0-0 line 3035 [ 376.270040] binder: 17064:17067 BC_ACQUIRE_DONE u0000000000000000 no match [ 376.277302] binder: 17064:17067 got transaction to invalid handle [ 376.283757] binder: 17064:17067 transaction failed 29201/-22, size 88-72 line 2896 01:35:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:56 executing program 4: [ 376.404865] binder: 17064:17069 got transaction with invalid offset (0, min 0 max 0) or object. [ 376.414096] binder: 17064:17069 transaction failed 29201/-22, size 0-8 line 3097 01:35:56 executing program 2: [ 376.497377] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 376.505915] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 376.515506] binder: 17062:17065 transaction failed 29201/-28, size 0-0 line 3035 [ 376.614221] binder: undelivered TRANSACTION_ERROR: 29201 [ 376.625192] binder: undelivered TRANSACTION_ERROR: 29201 01:35:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(0x0, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:56 executing program 4: 01:35:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x1, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x400, 0x0) syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x13a2, 0x100) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x60240, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063403900230000000000000000080000000000000000008000000000d3ca22dc3d59b700000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 376.722820] binder: undelivered TRANSACTION_ERROR: 29201 01:35:56 executing program 2: 01:35:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mount(&(0x7f0000000100)=@sr0='/dev/sr0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='reiserfs\x00', 0x0, &(0x7f00000001c0)='/dev/binder#\x00') bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1163a540"], 0x0, 0x0, 0x0}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x208000, 0x0) ioctl$UI_BEGIN_FF_ERASE(r1, 0xc00c55ca, &(0x7f00000000c0)={0x1, 0x9}) 01:35:56 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:35:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(0x0, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:57 executing program 4: [ 377.020532] binder: 17193:17195 unknown command 1084580625 [ 377.026430] binder: 17193:17195 ioctl c0306201 20007000 returned -22 [ 377.055615] binder: 17188:17189 unknown command 960520960 [ 377.062194] binder: 17188:17189 ioctl c0306201 20000440 returned -22 01:35:57 executing program 2: 01:35:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(0x0, r1, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 377.138752] binder: 17193:17205 unknown command 1084580625 [ 377.144738] binder: 17193:17205 ioctl c0306201 20007000 returned -22 01:35:57 executing program 4: [ 377.185040] binder: 17188:17191 unknown command 960520960 [ 377.190674] binder: 17188:17191 ioctl c0306201 20000440 returned -22 01:35:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, 0x0, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:57 executing program 5: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x40040, 0x0) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000180)=0x8001) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f00000000c0)={0xf537, 0x3, 0x4, 0x9, 0x7f, 0x6, 0x1, 0x6, 0xfff, 0x9}, 0xb) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:35:57 executing program 2: 01:35:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) rt_sigpending(&(0x7f0000000000), 0x8) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000100)=0x0) ptrace$peekuser(0x3, r1, 0x93c6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x6, 0x2) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 01:35:57 executing program 4: 01:35:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, 0x0, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 377.560448] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 377.568936] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 377.578294] binder: 17220:17221 transaction failed 29201/-28, size 0-0 line 3035 [ 377.782185] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 377.790584] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 377.800089] binder: 17220:17234 transaction failed 29201/-28, size 0-0 line 3035 [ 377.823731] binder: undelivered TRANSACTION_ERROR: 29201 [ 377.829390] binder: undelivered TRANSACTION_ERROR: 29201 01:35:58 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f00000000c0)={0x7ff, 0x4}) exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:35:58 executing program 4: 01:35:58 executing program 2: 01:35:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 01:35:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, 0x0, 0x16, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0xfffffffffffffdaf, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840"], 0x85, 0x0, 0x0}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) recvfrom$unix(r1, &(0x7f00000000c0), 0x0, 0x21, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e21}, 0x6e) fadvise64(r0, 0x400800000, 0xfffffffffdff0000, 0x3) 01:35:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x0, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 378.007444] binder_alloc: 10623: binder_alloc_buf size 9007208918417408 failed, no address space [ 378.018107] binder_alloc: allocated: 2832 (num: 197 largest: 32), free: 9456 (num: 1 largest: 9456) [ 378.027521] binder: 17254:17255 transaction failed 29201/-28, size 0-9007208918417408 line 3035 01:35:58 executing program 2: 01:35:58 executing program 4: [ 378.143509] binder: 17266:17268 ioctl c0306201 20007000 returned -14 [ 378.157356] binder: 17266:17269 ioctl c0306201 20007000 returned -14 01:35:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x0, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(tnepres)\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) sendto$unix(r2, &(0x7f0000000400), 0xff26, 0x0, 0x0, 0x22) recvmsg$kcm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000140)=""/134, 0x86}, {&(0x7f0000000200)=""/151, 0x97}], 0x2}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000000000000000000000000b637000000000000000000000000000000000000000800000000000000000000000000000000000000000095000000af6e7d1d8c73a29e562f19b3a0f606d40f623a9da15aee3213ba2fcf8b7fb08134091230d0b776ba7fd6543a0e4d8ee6083017b9d9503971a61e581a75b8f4596ae81fcc52a36960ba13de5b30649e9ea7405da5a6fa5103e3550f14cfd5b7ba946f298f4bb6e4ff6dc20bdae9e458c92635698ba7c4389685ea4a2fb130eaf19164af1cc2a388d176ae32f0a26a8a334acdaf5a26fc0595be3b52341f5a82ab1455a1672c64f7146b15d4f8857e4e97a245a6f193a26f750ee7e143ee9122441d2f2470066123b66884240f34abc1ac0cf95c55f9453fa9b04a2288ac0ba11f65ea344e620ab42d2701df9e26817c951601c879b4a0aec58b3e788c4af17e08b970f651adeec51b40336d17fb0f83364b1f5319ddba7bfc8924", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 378.264968] binder: undelivered TRANSACTION_ERROR: 29201 01:35:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 378.534898] binder: 17282:17291 unknown command 0 [ 378.538583] binder_thread_release: 11 callbacks suppressed [ 378.538608] binder: release 17285:17289 transaction 513 out, still active [ 378.539927] binder: 17282:17291 ioctl c0306201 20000440 returned -22 [ 378.545763] binder_release_work: 11 callbacks suppressed [ 378.545774] binder: undelivered TRANSACTION_COMPLETE [ 378.618702] binder: release 17285:17292 transaction 514 out, still active [ 378.625864] binder: undelivered TRANSACTION_COMPLETE 01:35:59 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x3, 0x1410c1) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000040)=[0x9a17, 0x7]) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:35:59 executing program 2: 01:35:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x0, &(0x7f00000001c0)) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:59 executing program 4: 01:35:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair(0x1b, 0x80005, 0x9, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000080)=0x9, 0x4) openat$audio(0xffffffffffffff9c, &(0x7f0000000300)='/dev/audio\x00', 0x1, 0x0) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f00000002c0)) syz_open_dev$cec(&(0x7f0000000640)='/dev/cec#\x00', 0x2, 0x2) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/rfkill\x00', 0x480900, 0x0) bind$inet(r2, &(0x7f0000000680)={0x2, 0x4e24, @loopback}, 0x1) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x8800, 0x0) fsetxattr$security_smack_entry(r3, &(0x7f0000000200)='security.SMACK64IPOUT\x00', &(0x7f0000000240)='vmnet1\x00', 0x7, 0x2) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x400, 0x0) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r4, 0x84, 0x16, &(0x7f00000001c0)={0xa, [0x80000001, 0xa94fc03000000000, 0x1, 0x2, 0x80000001, 0x101, 0x3, 0x1, 0xfffffffffffffe01, 0x4]}, 0x18) ioctl$KVM_HYPERV_EVENTFD(r3, 0x4018aebd, &(0x7f0000000140)={0x1, r4}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x2, 0x0, &(0x7f0000000040)=ANY=[@ANYRES16=r0], 0x0, 0x0, 0x0}) 01:35:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x40000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0x6, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000480)={{{@in6=@empty, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@empty}}, &(0x7f0000000100)=0xe8) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000140)={r3, 0x1, 0x6, @remote}, 0x10) ioctl$KVM_ARM_SET_DEVICE_ADDR(r2, 0x4010aeab, &(0x7f0000000000)={0xdb, 0x100004}) 01:35:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, 0x0) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 379.010972] binder: 17410:17413 got transaction with invalid offset (0, min 0 max 0) or object. [ 379.020165] binder: 17410:17413 transaction failed 29201/-22, size 0-8 line 3097 01:35:59 executing program 4: [ 379.080077] binder: 17411:17420 unknown command 3 [ 379.085168] binder: 17411:17420 ioctl c0306201 20000180 returned -22 01:35:59 executing program 2: 01:35:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, 0x0) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:59 executing program 1: r0 = openat$cgroup(0xffffffffffffff9c, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000040)={0x0, @aes256}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x400, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) read$FUSE(r2, 0x0, 0x0) 01:35:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x1c1000, 0x0) setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000100), 0x4) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r1, 0x28, 0x6, &(0x7f00000000c0)={0x0, 0x7530}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x40000) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000040)=[@mss={0x2, 0x200}], 0x1) ioctl$RTC_PIE_OFF(r2, 0x7006) [ 379.314400] binder: undelivered TRANSACTION_ERROR: 29201 01:35:59 executing program 4: 01:35:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, 0x0) ptrace(0x10, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:35:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") unshare(0x8020000) semget$private(0x0, 0x4007, 0x0) semctl$GETALL(0x0, 0x0, 0xd, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x40, 0x0) ioctl$EVIOCGID(r2, 0x80084502, &(0x7f0000000180)=""/34) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r2, 0xc0bc5310, &(0x7f00000002c0)) ioctl$VIDIOC_G_FBUF(r2, 0x8030560a, &(0x7f0000000040)={0xa0, 0x4, &(0x7f0000000200)="bc78b98879854b98eda524ea0d4e72ef4084519c3f66e8641d49f5c989abfa620427f482138a27e4ccb16088c43be86a1ca6e2494b5651a568a4242a3b603a2fa5f18ce85108aead9d1f09a3397e27d2b084c5e045004bb551f0f7beb553412b384370982f71f74e6e40dab516e828c437e36bef3fc93c9e27c4a357f665b37c55aa2c768769696c7a9e1ecd176fd7efa25693285089e57b5bbe3f632b29", {0x8, 0xb3, 0x41416770, 0x3, 0x6, 0x7fffffff, 0x0, 0xc0ff}}) socketpair(0x3, 0x800, 0x4, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f00000001c0)=0x5, 0x4) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r3, 0x84, 0xc, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="eda84fd1f792731dc0db2589a4f7a7f090563ce6add8b0741253432a6d584a2c05468c9c67f01b05aa98ff48821e92be09abd53a089cbc0bae13ca84cf0100f4b9107402729f2a4c7dd0972c5ee84b67a909e2561c4b96e4df626b53864a1034f51442fac1e038fcc303b7f8315e4c50d43449cbc3634300000000000000003494abe9f4dae7a5c3d6eced41ad824dba51cbfb336a1f6e028a52fc8e6903c7e6d5b5d4e692b8395dff22635edc77f6f98a5ebca50d741751e1353d4af7506699d41288b4c9516136decc13e279aeee8742ebe50ac2de71d32d872527eab6538efedce2db4c20e675f26f0846da5354d8c50000"], 0x0, 0x0, 0x0}) [ 379.480450] binder: 17435:17442 got transaction with invalid offset (0, min 0 max 0) or object. [ 379.584009] binder: 17435:17442 got transaction with invalid offset (0, min 0 max 0) or object. 01:35:59 executing program 2: 01:35:59 executing program 4: [ 379.659822] binder: undelivered TRANSACTION_ERROR: 29201 01:35:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0xffffffffffffffff, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) [ 379.750653] binder: 17448:17464 unknown command -783308563 [ 379.756590] binder: 17448:17464 ioctl c0306201 20007000 returned -22 [ 379.814736] binder: 17448:17485 unknown command -783308563 [ 379.820520] binder: 17448:17485 ioctl c0306201 20007000 returned -22 01:35:59 executing program 2: 01:35:59 executing program 4: 01:36:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000000)='./file0\x00', 0x80200, 0x11) setsockopt$RXRPC_SECURITY_KEYRING(r2, 0x110, 0x2, &(0x7f0000000040)='/dev/binder#\x00', 0xd) 01:36:00 executing program 5: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x800, 0x0) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f00000000c0)={0x10001, 0x0, 0x0, 0x3}) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 380.142879] binder: 17570:17571 got transaction with invalid offset (0, min 0 max 0) or object. 01:36:00 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0xfffffffffffffffb) clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') exit(0x0) shmget(0x1, 0x1000, 0x840, &(0x7f0000ffc000/0x1000)=nil) read$FUSE(r1, 0x0, 0x0) 01:36:00 executing program 2: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) socketpair$unix(0x1, 0x100000000000002, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup3(r1, r0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mount$fuseblk(&(0x7f0000000000)='/dev/loop0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='fuseblk\x00', 0x0, 0x0) 01:36:00 executing program 4: socketpair(0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0xffffffffffffff70, 0x20004004, &(0x7f0000000040)={0xa, 0x20004e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, 0x0, &(0x7f0000001780)) recvmmsg(r0, &(0x7f0000006b00)=[{{&(0x7f0000000200)=@x25={0x9, @remote}, 0x80, 0x0}}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}}], 0x3, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000140)='tls\x00', 0x53206bdc) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) sendmsg$TIPC_CMD_GET_REMOTE_MNG(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000080), 0xc, 0x0}, 0x8000) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x3a, 0x20, 0x0, &(0x7f0000002140)) sendto$inet6(r0, &(0x7f00000005c0), 0xffffffffffffffc1, 0x0, 0x0, 0x1201000000003e04) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) [ 380.230299] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 380.238777] binder_alloc: allocated: 2848 (num: 199 largest: 32), free: 9440 (num: 1 largest: 9440) 01:36:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x1, 0x2) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000040)={@empty, 0x1000, 0x0, 0x3, 0x5, 0xfffffffffffffffa, 0x7fffffff}, &(0x7f0000000080)=0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="0000000000040008"]], 0x0, 0x0, 0x0}) [ 380.329786] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 380.339341] binder_alloc: allocated: 2848 (num: 199 largest: 32), free: 9440 (num: 1 largest: 9440) 01:36:00 executing program 2: syz_emit_ethernet(0x2a, &(0x7f0000000080)={@broadcast, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, @udp={0x0, 0x0, 0x8}}}}}, 0x0) [ 380.391494] TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 380.577568] binder: 17589:17596 got transaction with invalid offset (576465150349934592, min 0 max 0) or object. 01:36:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x20200, 0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000540)=0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000005d80)=0x0) stat(&(0x7f0000005dc0)='./file0\x00', &(0x7f0000005e00)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000005e80)='./file0\x00', &(0x7f0000005ec0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = socket$inet6_udp(0xa, 0x2, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000005f40)={0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000005f80)={{{@in6=@ipv4={[], [], @loopback}, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@empty}}, &(0x7f0000006080)=0xe8) fstat(r0, &(0x7f00000060c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r1, &(0x7f0000006200)={&(0x7f00000000c0)=@kern={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000005d00)=[{&(0x7f0000000100)={0x414, 0x20, 0x800, 0x70bd25, 0x25dfdbff, "", [@typed={0x4, 0x6b}, @typed={0x8, 0x86, @fd=r0}, @nested={0x270, 0x1f, [@typed={0x8, 0x6a, @fd=r0}, @generic="403bab00b2cd2058b7807526eecf6307341cd84b2a553440c994eab99eedcf04aaf03ca2f77cc1cb82b70b9d185900fcdb5263239cc857a23cd21d2cd4ac81f4eca7f6dd5b51fde3ded7ddf48ae65d0c90526450fc8e91825daba0b33e473e122f686559d2d40db021ab3eb47df31d90cbd3b7281176d06fd291e473e8f8b2e23d462d34f19d5d1ccf69a95cea7637e0bb3d324a2be279371ca300181f9e9d49c251e2f81e532849737e6a23482a2be3b2ce1020a64b65dc563e576b9122170cd428ec87cf3f61bf6172925d625caa4a8e1fb551d66a71d4b0400995126a0bf16f5757976eaeb208", @typed={0x4, 0x1b, @binary}, @generic="06a57d6055d1d63550694f8e234e6e0c02355489102a44258460fac42586fd660efedc6a827460bea38b85b917b212b9528abe5d7464994fd42b9e724f2d1f608e7ce340d0d901c41da3bd9cae79ed6ebf4760fc598c0edc27e6798f47e609fe9a02e87a1773b1b80e915632a9504844e372546955067f7276569f0194caca227bf0fb60559ca6b7547436c3f6f14d15f73475e8dbd89c75078d69bdb59d5b0ad7baed37c0ccc265d936", @generic="d4105ed4f55b072b41e1c1908daaf721540707809c9450744cfe0f59d704f299af689ba806785b55e9093fef377ec88c56820b0382e8a733aeb05faf1ed928346c310e1edb3f01eb8d4eb7458185406d75c0d1cad97364a0b0676224ed96d065f611befbd7ce239c611bccec68c397a85d23192b0693d904df28b25ec4bf60254f80", @generic="ce6daedaefd8f470ac3e46721ea5b66f1c364591ce9d5dad8c9a911fc3f55925b214701f08a23eae4c1285251dbbe5bf19e310df54f71d62917941150762b6", @typed={0xc, 0x35, @u64=0x1}]}, @nested={0x188, 0x64, [@generic="42f8108c95a533fc9979af9da393a7d7595fbf48f052ca52a1bd875a9162ae834718069a3ee8ae98e2c1a729cff62c9a9e62116593bb7f950f457280f3f0f8f303caf561b7282cda48cd67698fda2d8e2c030f80d76d3aeaec444e9bec7c3665b2ba29b49fda6d2b4491a9e5901bec50245317e5682bc2db5821892b977997637e5fc09e0945484396adcadb4b14f2fdb676", @generic="15392e39b4be7827a115544b67e8bee27a9d98f13b608a72407e7a11368fc1550b9349638018e5e0474cc843acf42427c9e56c55854648e2f154da0048a8caca9bd68507e54754580c8e3c7061f4311ff03949290e5404d8581727b7003e7b15609286fb84c9a57a4472e381546fb8d714cdd6d172a093abaebad8e16f18711a128873cc727a73ba46514486d34c2e0838b3c7ab2ecc648177db3ecb2d22053541d129af55736038604c5e43efab56490510e9eb16c4e5f74990f987ce9418dda8248c30e5741fbe0310f0851d5125780ce322c6c5e1c3a379e6f31a5015338b59c7a4ec10540ebfc66a52d3f8", @typed={0x4, 0xe, @binary}]}]}, 0x414}, {&(0x7f0000000580)={0x2e8, 0x3d, 0x22, 0x70bd27, 0x25dfdbfc, "", [@generic="5e1fdee0a1eaf3c2646344cb9febc0399119a6af7e689edf304a9535f1cecf2b62cd8c35b96dc6ef003c4a0c06eca86dd087253ff65a67c5a169f92269011341c0cf26e5cd840d5d2684134d083606639d18784c078099cd552f0034d573a299ebf0b12af473156e", @generic="1b6240", @nested={0xc, 0x56, [@typed={0x8, 0x15, @pid=r2}]}, @generic="81e409557fe03485bb50bae091952c2c4d62c9eebb42743464c2631ef12fed47025edbd3f2985a29bd10a4be05df8317b265db6a4f45664277425e85e04d1f722652fd2d0b21ea541c3af2aa66933a2305eb6109b5e55ef6323af3960e7a1af63bb31827597b341ef04b8022671f4c3bb462b145e9a7e6b7b93fdf7adad2beab7b9ec3d2980a5589ce2f90a7d675847cdb26e13ef9c663d0c9a10ca2b7bf1c6649c2c64becf657760b3844d2f7d7e238bd60ce3e9cf052487cffd0a2aee1e229b45715", @generic="8b6788fabe754fae93a847e11729afdcc8d5a4619f93804cbb54eae6b3345e1e199ade53b2868962ab232f45333c9e12cbfda9a1c6cd822b40d4293fa503c5bddd10f84d107aa52c905b1c990bc055bd5b4ae54ed6b5645b3aa671c0464b432bfa4b483198359191c298f6bc37bd420a09753c4684713180523d5d03a9623d9c736e7a2a0909b4acb2a1ea0290c95b2e261f95ed64a1ffdaf47283514aa5f8603ba7fc4323dfacd360123fccada0f5ed9311c715d8b007db3e0a3fc55337633acc5fc39d62a540bb9661256192", @typed={0x14, 0x3e, @ipv6=@rand_addr="44434579b5365d3c1e2d506a143cb90a"}, @typed={0x14, 0x28, @ipv6=@mcast2}, @typed={0xa8, 0x5f, @binary="7b3c573c0a9554c56cdf4a87d435f6bc77c14dcbeb3f8a143b6ecc3a6188c6a7177aa706eff7d5844f1ce6b6b773e9edcbe5089b1b9dbf8d750b18f3b76a7333f879919e129ae936843e8295f8658ad14acb3a367d605e83db33f3f9341158c7d65729a0154e0a8bd8fdd4916172703fb64068917935b497d2cfb3f13212a1be7518d4b601e3685dac9d04a7f167730e2ea48736cbc1e19437703486f3570faa90b3e270"}]}, 0x2e8}, {&(0x7f0000000880)={0x10f8, 0x41, 0x0, 0x70bd25, 0x25dfdbfb, "", [@generic="908bf2f16f1b2fa27cca7c43a2212242f3602ebcb3228f9dff0d015b1cd53f3b10f34e892fa44e2e9a94536e5820e6798e57b0458ba495abc75272aec29d07381b01df667a0c1c2e0d8b32f6961c856f2683175be94ba6cd0112018f7d5b93160099b74af31c9f818d0be744481392ae94a0b565a97d035fdf4442f140dfee95976faec879c2f507638540f6906eb548ca18adf3d9aa13f3585cb15335f5f2b00c16847ad5105dc0348facfb8b40a8cf56472ce7ba4595d08f58511ebc4400be1643f5fff8246eb0b38a72c1757cce66939d80c6444cf52d31ec3e9cd44746660d25928dcd92b3adcd05db99314606325172d277021c988430e1b8ded10295f3a6d031111ea7d9e1aa42c55396a5dc045ee2c850f5197d6d3ef039f76eab2bd6efa50218be44ecebcc262c974980763f150465d1db7949478fd53c50b17cff934cef69f01138458a985a6339c49a4e0f14590b1f2bce437f69d9ebf693f8c1c52abce53dbd7b2ac97b40f3e42552d84b4184defa906cd1d5deca2a1494b328cf689e7741d3fbc921b29dbb5fd611dba3394987099ebe289a83a0dc7d0125c37bb5aa6335c70fa0cf6b1aaa7d3f748007eb7ae3bedb5dd605d8af37b2eb82152c1e722de39f2d2e839c7460ec3a5a048d34215ce9b66397a2a92d1b11d40f6504ead22016bfa9d7c677fc27751a35a5c94240188bc1dfea7b83242f7bae7f50910b4e4664d9748cd73a70494a5707b62cc57684224431499857c3167b54790e39b1fbe66f425c8c8c9ce3776fc22f8dbf0d5fda880b1653967b7f099de81776ae6b1c463b1f1c7f30b42575a6b013910e2d6751d90cb1d87edbb0ab85a59778de9a064b7b3a5b70c04ae61d8d17b63ab4265879995f4d1929d67c9b10ba658de93e8f0d0e9fde9b6b69323983357b2cb72618e402e668a69074254c7dfcde4af6a519af0215bbed3526b59673998694eaffcd054c816edda2e16daa28d9d28b80a1a2c5d6da7adf6411bff37fc67e30a9ccd3d8d760a38d0ec7de65a0cb28f09bfde2e9d5abac6bfb27ea24ab808a58301d97c6f9c0d29d302329505c6a0ce5b1e0c6baee9c1fa01f0b2f20babc564ea7d8373601aa6f451c308b8f068e58c5cd70bb757d47b3e1fd22ca858cf823dfa2d732c22abc378abe78da7f4cb709969ae5a0eca81bbfc3219c57183ae3ee4ac7203e944957b8a0af126c0347a8450738df5e797081e59383c0a003422b819cd6c063574095b8c9afb083dd8b39428c2a5a287038dd4c38e5500314e49131a4a2eea461e987e9262b41a583ebff350f78a69008f63b2bf33eebd85e10174bee5e50b038dbd0593b560f11ac296b5b4cbfa7e40ac2c7ab3758e2d552cf7ab11ecc047f9d5543ac50bd2e3bd48832ee4d98484314acd22ac540ac823d3cb2a6cb29e584eb8894d446ee9b046725d143050dda80cd8d0961a1084acda690d1ea14d02cc385964c732478ce42e20c3dd1826c1a061bd62fd9f2e1909078c96192e5faeecda42be0df558a2a3ddb5a9c5e28ca74f74881d494fe01bb9f4f9a815cd2d8dafd2cae88063a4746cbd3c6b93480551667a36dbde490da205cb75b4e5f72ccae6381bea1ca7dea47d71c58bc39bb4dd2a7d3999d2144659228f2a0bbc6029a8a35b07b4f31e2b46459a0fcfc07df10be34e08105071ada50b74b33ff91443ce0f76a14a714a9ceef965d03a88f2989659b2c73364119853c2c9fc3e0a6107317207d6a0fe0d50dd57de50c34079a5c5c128d3d34de18b9ef67be0a045fa574b12c46fb1579ba3965f8003a1afd9d70439487014481096da4317701ac662d04dbe0cd4efbe6038375f4f57f635c6ab673f1995f112bd73638c2c2a98a6d7b4f40f3de7c7abce7babff63143f2512ee2dcd8a250d84bdb7d754fe95ce4f48e45623af1095372c5212a0bfcbaa6670eb39f95ecc8cd2825467766868f1d08dc588d4d694ddd0200c066b06245b3142ce38823e0c97183c7a0b4cc63157b9cdb937f94d290d127e0bd401274a9a95160e73b77ddcb3b12527e0b7d9483ea47cf004f527d3739a6b72c4754fef47906c9239b5a67ebfa3a986a6ff2d989854466eaecbcdbc12b00f0ca0819b8d8066dd06b9b88595ab648c52510e962763dd9aa8801befb15265a0a595f7352be3f13d74b04b922822609b8a611c3091785085ced217c70575a7fd7187e505be35cf925d4e9e5a294fa333ee558c7c4703181296f361146dc0b61e905710c4af597d706c393549fb1a63ffc933dfd32e4eabd7b1367c86136251f397681dc74ba9fea0268c62fc8fa6af57b0fefd19ccda4bb383a76242b383bf2a1f4895972c3619f75f65fa8249826cfe39151de7ac3d8990e1bb02d4fc1a9c70ef2dd9027ff73a366508ac815a725cf299b5d90acf5067c2a3be5672565d1755a984ade444db86b9ce667f2c03b1cc981d788feaf4d54ecd377871c1808b67824df418c4b95c340923892c05678e3706683f2fab9739f09075aa04b04a88c98fc2a7fb0e65f7e1dea69bde13f011d40355a11aba6514f834fb8426fcec996d0d8a73d6fc7b1a7af91c1884defa799740413451e133b8a6c6c3df5674fb275cf4014633ed4f977ccde8581c44e7bbb231bd86c30174f543d4cb7f0d94fb52a6178618c3d374de1872ebea8eec9a5b72e8cdda8f9de2120cdefdd48937ec4e16e78f104e550ff290f72ab2c10843c641328dab64b03fd31dceeb5ea3d259e550d8aa38782226c15077ceaf4537e270d84448341c6ec0bf401e9c88b7cd16919eaf154a7594a535d142fcad0d230f38ef7bcd1ffd16d615694c42a33d03f9d3e1c8ae788eb44636180d05b9b68e68a8c7e18d9aba5a1c6319fd412cd645127a0c32ea69666a462c5fff042d27d173fbbde1708a81333d1a64d1d39bc3b1979a7d46d7cae10a0205718a7eb12aa5bc9042e3a479916f84cf60e997e7e640f1ba78a3f0c2dfdf61aa95bd707c54ec206fb3bf550fdc6b412d32255df437dda74d5c57d7a4bbfee57622c895171125b76bee2078a259655bd563d74503b194624248f470b2d04dd3b1a45a1d9c3eb2878f72054d1b8c9558280527ea8bd73ed8f9e4d189ae601419ad537a0810a8aefcbdd52a1c7a0ba660c2a901be4b3558aa34647fbc660b6818cf6f76ab0f854773c5f95fae0254327ef0f954fa5eefc0a6ce530ec452b7295cf01cb8b23d35768656d22aedbc602af1cfd6f9c8088eb298f529a70f66ad2a4146a98ef5fdae30c76f6c95e8b37435cabdff03bd6aaf7e3e9b5157761e6ec61ec3c4233842b7d77364228acf57b5e5df40d2b902e072bb31141280d7cd4e4acbb8d88472c3fd4ddf28c0e0d3107e7719523b0b67853caf64e9ef7667500e425322fbd8c13c1837ef7b50b208f26f2103ddab2e5cbc040dcf247968944f9ed47fd6ce8fffd9e2ac0df9928a38d29414068a887839640139e9d483734b70f8dc2cd4e5fd8ff6c0beea8b3b92685cafe5096d821ee905b5a3f192c56b42e05d8084894584fc4d37dfb42d2d325a3c03ed7a159e6d5b344761859abd886fec6764251fe81407bb572396f7f0e0aa3912e6fc6abef817561f8f6be73f7c6365ee86ec424795a90d306133613971db2bd57de991654617bdbac4c2660e71e06e58197b9bf0eba0ca8daea72e171e77633544eb780006d67556a1bb653cd1034e1bfc1bf75dd862c96edb53f8f5a02b92175abde5a619a149190fb7db6bbb4a498ab4a369514f388f66b0ab12cb6000e8834b5cb804df6484edbfc26cb2287ce9fc6136856829df7761b09e02082de235bf2393e0c06677d61ad46686ad835d18a205be9c37f8f48e5021999d83e88327ec49f95f0a33f1c7c4680c46e31347244b855b3c3617260a3b7d0fdfb34e0d9c45a955e8609a88add19a11fd119de52a89e79f2e7fbbf989e6def0f79ffa93fc81bf8c3a47d29fdeea302d7bc97a8f0a4d2c944fe4c718bff50c3d31014bf66f1c5f598543f5d0ee55ea9597e0e5e7d683ee3d590810559cf53e8abbb5ac843490d71a64f0eb3a808b347d0a2cdb712e8c8234f830b2440bfbed088d801a8d73790dcbf2f115e0f17c07d07d900506d8cc68a16764ac074f79d07f2471447ece7f5572926d0ea9e7fd955bfc7a318e6fbe920f20eb4d222c5c6113f4f7818032dfdba2193e7b1a523292d4b092efeb20807aec7c65332a6513ea0d376780a3cb8fbb57f9a79f8e313dc50b8913fb38816a3f6cf537cb600a0fb3e35cf8fc05a6554f63066a82d32a080a918948478dac60b580146850647b59df93b4875a60794e806217a6a92ffab3d0a3747adb7b8cc8ae947227c7c9609dc4cb691e21d73eff569a166edddcce53e6af029c442c43ef90d8af1a303308be0a07b2da3b21ebc40df3dbc653449d0e7ac938341598eba8c5e6f278f8a691b4122c6deac704840588fcf3f04808538b57c43809e3706c0a654003889a132162bf7909ef7b20dc46b60a16ad8c59c2144c468da651b2c6d7eaf1637e0dc93786a4b3631ae1a4b3b4aa1a1f27b1b278de07c640c5fadf9c2efbd2ffe1a144893d868bca50ce82027b3e509286068c3374dbc568e2b1ca3e802324b938d02ee4f1d8d7d6e924d3bbdcc6e771c4ac405db9d210a58575d602178bc4db203a0a34ea960c99a72a8d4cc004a6407ad0267f4fb0664147d463127f0d2caa109b37702c5d7e376cfe0357d6c1fd9eb6199f9dc89a0bae7c554612c44a92c02d84d8083b63c6524099e071fd35893939a2ee04a2d0071950bf65abd3632c7387bfed3b6bff725932d8021aab34f02ec518d780c1e19df5e879d151b0a9d8d1cb09080d6fc888d583f0528cbb53fa94096978790c084759efc741a4ca741f0226f3194ef09f07fc2a3a96439de25fe25eb89e547bf3aed04e8c003145f9925ac16bbdae55d695465b536e4899faeec405c2a2b0810e042bcf67974e7b2ca5c53e9d55f613e3f036bd51704993f2c581c7e2b81c7a4dd552186784925debe7c2bee6c8acbecdc7082715a8b5edb99503463a9c3cc7bf56af89924b0db7ac710b7395454a694ce7ddc1ebafe2cdd6f6c4399ecc653527d69222958f7d8733b7255a26239f51abf7049a820b9b622740fd42f0bed002dced0ea9de3651377d59f1899e1e37e446849e63c138a42c457ac31ca7baa10c1f73ed34ae64cab93fb727f69e7975558d4abc17bfb8c0b84ab037af97d76bf40ecb2519b044422d940304d43c72368303cb118511b315a2ce5fd5556b9027c9c9d74c11c3164f0984e4c8eaf55a5276a8619997430015ca32ed82a2d9cf49062a1eaf39dbcf68adea0e775e28f4056ffa17f396f043de0475335341986f7a325a61a698602858249566339f812a4ec13db0e033bd1b493c77fb1f74715fa6b4750e9d02f6a1c7a1b0b986a48ab3c9c35389b76e0b94c63c183f0711ffd8ba162ea5da8f8c2a2015e2903fa46873be4e1cfebfb706516c347eb57bd1aa83dd6172518c7a70841327370271374d3599761f769429271b0655ddbdc4d1b01d6df84a87cc72c6d3a7b158ef9b6e5427e6fe8a56d0eb38063b8cb6de6d41863c421f613bc7016dc27d0b4b0aedcc87a002cfba611bcf0a223177a6cd3cb7b24125069a2d2bd0eabd9678df31d79532970c173c131a1413ddc17409a3b9e1c2861c34049e4a0368a4b0bf9314b89baad73f019effa29f9c587acc987e07e0d691f01db75407cae8950e5213875a566ad760093a469bd13ea3b64a8487c4fc2de59642600dff7c43ee5132ded2bc8b322fb", @nested={0x8, 0x1, [@typed={0x4, 0x21}]}, @typed={0x14, 0x42, @ipv6=@empty}, @typed={0x4, 0x10}, @generic="4fe0c136f07174ba8af482c3164629a5732ab388a7892133671dccc3a58abc38a0d58cccef0267424d2b2d6d9316a16fa86aae02849b812b9a18eb81d293a3ac96d0ec51c89666ab59d7f43ec389365258dfe1665d6591d0924a45c385dee7b57b2dfbcc90aea055b59aec19856dad5ea257b9b2880ed099ee9dbf3925e8f5fd3a32b9b1957c888ee97012b319a486b47dba98eb0b5f9bc295d0b7fcac4406306cb4ddcb41962d3de761ecfad4244630d24f3d8d8e9197e0e47dcb1e8ecb5e6829129e076586ef"]}, 0x10f8}, {&(0x7f0000001980)={0x2668, 0x35, 0x20, 0x70bd27, 0x25dfdbfc, "", [@nested={0x12d0, 0x2d, [@generic="b4eefcb264962e35e9516353f0603e238371fcd0dc34457fa43891f03d94cab362bbd03a2c43284e527333bb5d5c2310bb7b9d58d7f43ead8229642eee36f9d4d60e2743cfbcb3a60faf1edfb3132d100b550baa7d5d242df941ee7b181adf9077a0d84c39fc7c6ea0c24cfbdd3174296f04f92d056ed30205ba6cd6f9b1414cdc24640f232050bb1276c966a06f833e2700367ab57c0b14032cb9f00a2b736d22d727c049fceb47b5ddf98732084bd573ce555c213cc393498065d874be075d685aee873138515561cdc0", @generic="58813bf1104b9c3c71477170e898e2f5cf2a9dd4cfa9a7c3cb8f1c6eed93f354062b460dcfe0d1dd74d194ba8d8fd106d898cb4cf4e98919e3aa695a3d8e8b98a3d6a7292e7860ed", @typed={0x14, 0x35, @str='/dev/binder#\x00'}, @typed={0xc, 0x56, @u64=0x1}, @generic="c8fe6b293b7b3f9ffc6f80577be658313c5fece9fad68a755ac363ea46514e03b933245db2d42e86f8263371f8f272ab3d6a7ab9075bb18671a1e06abf52ae9149c0f38671f164d9922583a59fdcf7ac834e38d5f1cec95ff693325217d9a9146676656d7ce98009df070f17eeec2985d1fce116230084fe4c93b6c1445973a0be26f455c33bf4a182be85602ab6d92cbaeef2cf0dd80d0544c02939345835eb9d2887eeeb427a532e73afebb03bee7a1e1b362b0e07ab96d18de02f01e44f694c3135ad3ca2cf889219a7d2c1c432182f7b947344889166d29502728d75978d8a17c6004497642f61d5bc6af31435b7c01041d264de75af936723c8e8debf8d61a95aa2445b1dc3e1851c21b21a19feeef0c406b27e8156f8611632b575a5e884985e8bbd57e708a4de992e9f354d00674f615a4704388177586556f46aee428772b0fa5e40eca2c4056b94cc7b23e8bd8de941d9e4251f37ee4994601a7a5083788ce5581a33f74e2d8c06282500ece4232a0c7d2b075fbdf235202343f7d4032f200e1065ef001767734739e431c0d9baa363f68587f07fb432aed02fb0073128c1f4d5c844e4fff601761659bd440ebd794201610be1f39df7ed12b07168309b264b2e3bc09ba0fd014d52d90b0fb2481d7c631a9b56bb9a647c458f198f3a6b3f27bdc4ee6ada909c5fdbe7641ebfc3681c6212582a80a92e3da6e5248054fc818843d5c70e9188364d65bcae68352575eabeb349b0b7358b4767bfe9facfcb64959a6c0b1028fe39affd016a8e719d7c09f4189476933c8270d6c964c561553675b168cb403b162fa40e1c46a8254de259224bf5ce55e0f49a6e3015ebe728b625bd1884218eb746c47ab84bb6b0706287bce28f8dbbb118d3577628b9200981dce0abb2ff86f0632d1395ee353f7de92869c1ec60a1f7d1329ae8757b81cd4114545a5f19160259d18ac8dc33556afeb3c39e283b7731481850bf6e24bb742bf52c816bebe803b5e5d93c36436412b24a4bb3390c2f57bf45a7c579c936a69ee0b857bb1e1540fb8f331fbcd47d2c3a4c00caca332a04cad1b810d3014746b1535edd65869e2f94de78945f439c8a28908fee6b999b71b83832b526fa9a6ad3b18c8d3cdcca5e074d0c9ad81876633fa91e2cd3dda62a71c624948ff4a5389ec0a05947f54b50a775840b8024d5a2279b5426175ea85edf1882cdaaa75180f027b53f0ed6537102a6b5882e03dcab2f69a33e6f7c82a5e9fb3a1fa1d04f0efb1fdea3eb336c54dfb708a47790098163c8e1192c2958eb47589801d775a7ef7847685663b0660d8b9eadbdd133096b0f1af9797a97085f96baec041960ace25056cdf69676690437703e50ac5247e680a82033e129dd1e23d829d11139738520c2b03ab35074a29ff929d9865383d90994663f483ad347efccbfe326edfd3f210f1445afc9292c7be12b7555e1bfc089b3b56abe5923951ca78feafc90dec3d656cb508a0b969cbe0a113dc4d843b7e736cb27e4f8762fdb4ddc26291384b58bfc6e0d96ae6e428a4dae89b34fb70d5501d3f983c89f798e4d5aa98cd521562b6b701c34a9e7deac45d53135e0cdc76aaedafff0c50cdfb96a669e82fdcf4141cad6af4f977bbc54e7fda4ae136ecb17f03773197e70eec4b6806d69d9e640f71430ac596840888f5575deaafdc38a499a925e24b9915aa8facec3a9b85cbf90cc337d9b094e4e24117337bbc9d00e6a0c395c84512781d78fe7660acc5bc8c36153d233671a414c376d170650b65cad8a849c9b544845d539e19f540820c4ed5eefc5595e3c2c1979959b177c58fbf2e4ae3d8026fa7145cba099991156eab5b5352155a75cd97bf6e4c52d61a2900e2109055cb96356e265d08b07fa7fe197a08e8646f93872bf0f6d99faa740be018cc63840c0b23914425d818bfa956961b3de397f22f7345807e2baed296049e7bb59dbb6d01aa016defafb2bd04ba078f73b17dbba24142cc6043fb7f8610eea5ff6a98df5c2ed83797c8c99534c0d8cb8497f6964ce176449c201923f7b0edb4c3b480b01c71fa012222085fc7eb3b1ffdaa134782b94005d82fdc786648b29330ba2fa1dae38495e3014080bd7cb2e49b02490f1a60739e0345ff7134ebe90a47a80fc8c52619ae439448dad402fa416e1e74d0161d4e483f7b3d35e7330dfe6d8695c61bdd3e7057eaefcc35fa852bfdb44b3ea2a32e2831c4debe1f7d693d5e8164a33c680b1a4c7f5ffa0e6c353be5cbd55d15b024f0b3e56de8bd48976fedfd6c11941273e7ff29487f8e661ce16d1760169ec2e1a3fb7b3634abb1e1d161e9d92a3b814dce7f1df4bcbec36a0b20be3e74d6dd9aa281cbed46e8732d6441e200f52e9006109ec2e523baded0a586c8c57fb384c3a310330dc5161a10e5fb1cd4708de5c65bff24fd7b495a6794b696ff2f3e073647543580053c3e9628cfeca674057e5fe67fb05fb96c8a555ffe35a3976da03204603df2877d6efbc65bdc9a300e06abdba4e9d38dd5345d2c150d4e83c14e2b70fc2e34251378ac9377405a1df5b09ceb346a16b2f1d03fc12647373abb0e2e45a3d3a77ccd2cab48c1c6096da6b02c2cae9271946a9bb38e6a81c7d647512b71ebccd46b6fd944ed75bf7129e17313c30ab935fff50c1e866c43935fd465aa1d31a0910dff3d9467d53529dfcdb31fabbd851c4b93570d352387345ee7c330ac0ad1f40ee5cfa58aab7689d4aa34f3f7bb323b954501fd365cb651948c4a90fcfa2e7d593faaf79d191ad4c0a344c8e98b38e2b71bac255ed9831f03f3d3663487ae07837fe7d61d2271f400d93f7525e706f284bf33ce09ea3d9858c5583ab03a6b2fd5ca5b3044ba8704ffc635d7d9cd39c33748462a706e5262e721844b47fbce0ddb3eb2f920e0a5cd6af5cb5f4d93048dfc005e989a4d9a87ecc735c6651b00d27d0bb473707b45f9021e3f940156f45454f98001364b0ac513ce1a5e2f629e03a67053a5fb366a5a9d0c60ff6f063497b87e5a2aa2fbfa9f87372fbb433e37ef1d22f2fa8c0cf219af3d12d60208217cd7087469921c2073cc82fbeb41608c432bc90c946bc6882a70b6f2ed7d1b6acc026b1afb9b4670d39f84df25b7ed291ae8dddc61db23c8c7f5b700328026329dfbcf4c9c64a48921739384f8c464c17d9e690d8d9738b2bd5a853191e5527c5ab646e9e2f6db60f6caee63e1f6e1d44ddb07eca80ffbeb32c6e8db78d9831f9eeab4ab00c71d7006c88489e8f80ccafed941592c259d32d2f0dce7e04a6cf9394725a647bfb7efc4fb623c02a3832309ba3a96775876e40e9d5b172c46257aba4ef7510461a62eed56b25044044f497bc1c3e5466d02e54ad31a79f5f309462bd8eadd8fbb0874fe2bdb27d1fb8d3a69bb211afd91e356088547d41aefad44fae0fd52c410d3342cc4ad5b5889d5bf9e39f3b3bd2b58258e1a8caf1889e3d210bdc77c9afeed9e6e71c1d264d939efd62bdbaff8614ac79ab5029892306123191fe4fc52ce1ec718ac5b612d7430c7408d3953b461a9ce58ff26a330a649710d10f56632a11e6d01a52db5edacb7467b3085fc749e7d5535a10fd26bad392d7982dcf512f4c64d8fbf1189c862f7f078ce85bc3829d1e240ba1d4d636430ef821a8576a805b8bc46c6c4332c67f8647cb92f0bc37a21bbe09e3ae751f9ba85b7c8edf89061961f3cd3f595d766a15540849a27a5cef8ab1ea38c8a2a013e1270c417fe65a4cf75dc6c6765b1f1c117116a9be40e6060c5dfe3e73a7574f00b366a09b9a53b2c7b32cfcb1e4935e08fc2069570c34f66cc464b04416cbf7e3a1497ba04fa08362d395c34dade7b27f78891016d77c169382b6ad2b1317b1dd1a844860652e45bea5ed1e4bdebd07850403c12ef886fc0287655bf31633595ad9e58f192e5c0821d9adbeb11f491229cacd62d89c2093948edc8980b32f9078348e65b7187bb0f40f4ca70258a48c65416576f4ed046cd8e3336cf4409fe9595ec381b1210eca2f365d43f0601c825ae8deb18131de0b86616cc0866187ed4532ab3a311f2aedb1886cf022cde43de0850bfb596088c4cc8e625af6e6f5a864030052f9aeec34eff73a33d658226dc3cfbc22d4413f2e79266a94447b02eeafa6e4700d393b64025c1422ff9ddf89809c5710081122c2f3b188de6f7547ea0aaceb95799d2696e4412f89b4845ac08fa0bd87d00620cfd710053d62adde7b143d0737e8128704657540682a4bcceb5779cc96f7398364a546fa6b5ffad891573314d9ed6f05b93fcfd23a117bb48e533d7920cbece3de61038177af3abe873434a6452b888bf9797baaf9b0ce47ce8edbf249653e2d282aa05f7631265fb6bef640b43c21cff0de62a9e97ecc83ab5d613158bcf83babafbf28c877fac5b4932cf73415ab43c5dca1b3481e602dfb55f83a0b017a06ff410b986a16dca1771479b3db4c89aced9dc87f7af77c1674aff0ec5b157b4c0b58fa980e090d9b3065e477148d549dcbf2e693aec70afa89357a38d42d45db56230b40c2971f3887e4fd2b379a0e2a84b6c1f0e23ce5e05c3f12f58e10d68cb148cf7af82c55983be89ce13d6e2b53172d9dd67b9882c9efec2ae6c577ce19946264b4b30f819bcd9fbe1a68304aec4b17d243ab50f259e08d779c6be52165727da47f1650dc7398309cb91a6f6c7046b2f6c6cf2597ec3d00bd44bd1ca89e1f7c2f28d60dc77f24e8132352ae9384ebcd18beab54ee2de4bac1b76eadc21ed27743be9c00b126dd8542f14b8719005d845c7dd9e7c00dee7e618ecfd1363ed753b82a34fb4ef1a530e35ef2247d2bfb0e8eb39bc2ba6906b879efa8c951f585d1d13474bb96656fd373719d7d24457b41b53e886f268ff6194396f8456b60242c5fa719104ef83fbce1b46af357338ddf8ffb62907c5c190df0f8849822d3f612181be6c8318e44603f64ee3dfc0a7ca8820251514ec25b0aa4beb67fae5acc3e98321af69b707995d19bf4ffb3331bf17686b350ef0b1b69f6ce2279530de0fc9fb1b22097dd638c790d16080cb84ab3ad2e349bab9c0338ee248a208f3c4856b734297c0313017a08f52dd0a3ac0494bc985321dab2d69eb5a91a8c32f82a32c7831ea62d808418cf9aa5deb27b5ea1497dcf18b43f7a1bff63bd386bf8626005d32d14a548412325a6b9575d30b753fdb2db02421c7f81222cc33051a5559b6e04e4c1227127fcf82e2cc99842d3e87abab2403e42c3d104cc2e96b9cff43b697db58334db23221078aba489303cc5dfa7c57a3e4a4d38f6ecb5e4fa57749977f9123f31f37192c1cc450e441070be92931263dfa63e344c9b7a6a8907627741910c5eec7f284082b84b0a1c794db3d147fa25f025a6f3cea5c939db0a562731391ed38977f018952d6831a3d8c3a1ed81ed9801f41c7682081dec95be001a2ea55a8933e7849f1a2b92b574a769e62c33cdab46f3002b60ce6cfce9380e69496fa8d4bca85194b81dda65797d0ffc7673d311ff0d0efcb43a80c74424f9022160ceab8c4c7016d519d229a9b1aa5827d5f8c500e349ff67e3c261f67cace77bd3c0a281670593a474da57b43d726e591a59d3ef072ce8b467dbeee86bb916a617bb63671cc706c250534796165350b843657690235984b1e04ae2e36083f5f014a3136be47a3096e9103310f566034d12bccca837abea8169959603cae141f2064fa9c94e79b1a6ea189eaf054818b5c90032eee3986cd67bfeb76a40a5ac5aeb57491e30e187a83998", @typed={0x34, 0x2a, @binary="a285e11119c68b059aebdcbdd34a1e2745545cda70461af61167821c7ff6a94b8ff2295ed0aa401040e50219472968"}, @generic="d1c755cd1f2f052985f0fcc097e0d8114862db972e72597aafae29946bee639a8709cb428d7f8ed8a73155fb794890855e3b5f3a6266f108628d5051fcd8025d51f495b3660efb11687fcef59b555805ba3cbe000d4fde703af177c08653731ffb835a458e6a460d039475306fa3e138c7698089be3ff9775924e6570bbfd1467f2b6a38a7129ab481", @typed={0xdc, 0x49, @binary="6690d50731d4df3dcf34a419ae332ed8d7b25cfca5478deb8c1f7e7ed480d26da440b2966b4c350e1206a8e5822087e7a7058554206596946b68d7745e1d9378e20260e035d3fa8ea03546ad56280b9b76597d70d03729c46579a0f755dbd0215988a81328dee32874cf74e2aadbc6ba5df4b749136d1a8dc2b35776908fa829852d5abe0ecf4a0fd0f1a676cb0d3b0635fb68309bc1955f0ad91c9027b7d84b7fa8064d8cdf2e61cd309f89ce15ae0acfd735955afc98efd92dbe2061919d9e1c645ad827a3b243a6ecbed81623798b5edbe6adc588c093"}]}, @generic="35042189b364492f636321bdbc13f80ee03caa3270ea529e2e1dab58ee08d0ae62eecc2e23be822f54686d994d367e091138b1cea04bd4eaef6004c3e66ab8e80bf49c1b9992ee5874b708aeaab393e2ced11c17e9c1f5f9f6fbe1dc596796b7882f6403e86b9cf59af734d07a0e9cfec185912e88dfe54f739c027c323a8bb7b042ed2cd57db84b83bf7900783e17208a10f48bd56a723e72145bcdc7c1e0a6f0e16145065f094ea2a15c8b4a6e4a5c900fb1fc11126c50ef87a9ffed94b102c03c5612d5f112b93c7bbae9dab466b48dd741ae", @nested={0x1d4, 0x52, [@typed={0x8, 0x8a, @u32=0x2}, @typed={0xf4, 0x3e, @binary="80c0a3c7a1545799bf848a54ee4f99704496d3060d890f413177232ee9799f7891a1188b0b7a845fdc6a4d4171336d1a9f1023794cdfee801a845a4b5ac5431555db29352702fe4a03c2f153f1bac7114501ac1085c661b0e7583605653c4350820762a79683cea427ac8fe27afd6257905b10601b1ae04e06a1ae9fe6c222c1d7769e9dec43c0b1dd64bcdfabf959dae76a9419b4ed81477b404c66dea565e470c60388d9b5f0ca4d648c97bc95f50ae2622f161d08a9be4969dfce6ac629106849ec0ce55e6e0737f0f7b246bebaaea22ade13734c86c38238a022db5f59e847f2892f6f828973a57f4f5354"}, @generic="a76208725b16ee65275e9f8dc7d8394bfac882e3a61b04ead950db0bd02085a296aa46d0225f6327e3cf547bfb651ba6ab4bcccf6e3e25d1d69181fd4a79a15650dd21c1925806638d3d377de1fb0183c9a9e0fbaee139eb18095d880a7a26d4b3f3f88e8fff2aa2", @generic="de12cad1eb8bd05f88f7338bea707ab9a7d99a4064da356cabd6f9e6f062e4bf87f15b3a0c8a014562fe49378ba7f5aa7f4e49b0efeffb3520cc41ac2e4a2a9b3ae8bd320aa888b56803a44d860a61aa044fea9902000a59f2e04e6df979f718207a8a671121cc2325"]}, @nested={0x10e0, 0x45, [@typed={0x14, 0x72, @ipv6=@loopback}, @typed={0x8, 0x73, @ipv4=@multicast1}, @generic="e6e8883fb4722cd98ca147151c6f417af24202731dbd6674df6efef37ccd7ab0cd2a4a32ef1f8034b8b99a9101288c3149bc617624bf25676130379fa7bdb22112e70d27d064067ebca172b9813cde88aabae0bbb045e8b1d750e2053a912387199c3c8f4b902e0c522f10a9b899b2ec2ba0fc037082077d1d68a79556bb99e3e799e926869b582dab3a16815ed76d120774bd6193a8a2207813d206f2c177265b58c35baf2531bb5f76d91dad7a9241edca511001400444915f05ca19305c22cb8baff13b7e8cf5b0ce770b55993b2f655434de41670f40923a1c0962b1ef75aff294a508da921ddce2f86d322c3f3ff0620a2d4a42b838a8b4cd05b2eea0ccc23032079491ab8e0ae22bb67144beb1e32d64c88b1b51d13e70120d18a449f76bbd8f6700b479fc69e951602393ea825a8c73b311bd89465ec922e47e0d0deba050f3526ed706e42210d2627eba30fea7d56a45c7f33f66d7a5e86443b0ab61111d5f5f0a049a46bb40f8450eacec39757ec49a2ed95806459d29d92c9b40cdf0167a4dde7c532803c0fe51dc26def9460e7cb87b0297bd4952e5614d2d45ac37d84b4ee390f31cc2cf63b027b453d02cbfe601922c072dbde23f83fda928747ad8e35b6d8a4a7f6b6612f9c2a8c05c4c6e87f55b199056c79c5a486bde906ebb50c4af97e840aa81f71552750d87e95ca055796590cbed57e96cf9b3942a88767c09ffd7c99001e998a3c83ad2bbe278f17a5da3cf7a68c0158bb36bda4863ff6937c673906b3b6b40701d660b8597646536867f202f04637b0b1d8448a3fe86e628168588437c3cecdd749807108c404329a45102880e276eedfe6c421d16e730141fb8f3cccc071eba05d4842b9ea314907c1d707979b5ba337412885dba64bfb0b3b9ae0d11c0e02f2b02b9cd898a528c9e0c04e4b4583b60a60f8e47f0e154354d1d8281535ebb0c679e2cb6ef661793fc94cb42ca6da4d59d414a3b6d6c684e3291c038595cce8bf81db095541577dc54de750868e812fc68b45c8ba7f536950e90b3473c90de1eb81fd9f098e378b258583909b9be54fe0813ed33e2421ffb049f974c2a6331071a7445d51853c88c0b40dc0e2260ee63bdf997f5876d28e3b6dc2fc52a373821e14da709aeb73448782d83d1fe76874ad2cf5681358af90b3f61123d0ce75be83d4ac3879360911372583ec1ec3009f18f6339d4d2bd734bbd35fc9193f053255e432bf301444bf9a03a09c50b3c1a2cd3aa1e7b975c327c9031976ce263071a5608fd0bb847d773c27143f56bdae3c4ad3910a46eda7da4fb7512e806c52b9dde603f8defc54b9afd405de859f947204f184a8dc70dc5779d002e12fe0a65e9e34a2e84b0eb30037c0beac77ef786a8b8935e7d866a8fc4bbd0319e0c29e764d88f9356d2b672ef11112771908e763f6ce6658528712fc795e94b56cb88220525bc67bd60a129208e31a6c4090da3b504c39cba50f03624fa968b5b798973e72665b9f442f6f51d3ed06d868dc791818cbfde16c4fe7ce3df616e2e53f68bd9c0e0563fddd5df7271cf2c0095f554559bd2754cfe0f6a91eb3ce93faa85d4d22c611f1b4dc438d1ee8daf6551a97c0791398b8ef26b7b126c30a644304cac3793de30b6e0fc93b8fcb1609bd05d6f259e9fabfb929e70eef84bb5bf3158b7575db4499de4b10322f5fdfe201075b22a0a217e56741fda6a52f10d29f078b44df5d443e931dc9e42940e79a7c7b83edafc6ca7e9e86f9ce4bc2b18fc885e26b1aa7161e708d8f72ed1bfb4e6f7488a8d7467d7833826ebc00c94927bd04b9bdedd989c54ec40052b5b612c16c36f5ebf4670f8d42ac9ef5bb24e690021d7999bd3b459f1cfc8cd8a02709ef4448c85dc9c82f161ea788c04aef218a9176be54aa066b076f93db0d53c196a27eca7f493edad143982fcd1e411081c5764c7fc6ec9e1a78d9fc79c76d2c74a0ca098e891cbc457a68975a7efad1e53da9c8aca5d543843394626b3f43fef02a4bab8967f06e95f6540d908d21a0eee6c832b46ac6f62263f5c24b2e347360ca2f03a4947bb96891c5a58fdc158f28e9211639a116d35157f9bc0187ba55bb619650ba487f71350da4563582f742b7b5c0acfd295e2fa785f30c0e35e56ff2084d66b22d4ebba15d0c2857cf2a4e4a7bbab22e668edb3f4c64983c1e801697deb75186ceaf628266462b1b7a32c89732a202859410a75f5a8c05bcc6c669d16e8f7a77f512f3132df5b5f8c885a340eab1e2bf15d6b30d9c3175c679d16d663a9388eaa523105ebd8e7290446bf876f35b00eac1950556b75dbab1c5f15b7cd2564077d0132669bf87ed5eb960c5d22c49513800ef685b8999d7f93e5bf1aa4e0a22e0b571c324e0738c20a9256ad1d559a459157605d283c3b204b79a2460e8462d781e17ee4ae244ec7b59d1f3076b627c40d76a8dab2d6e09229eb4e0858e03b8d6a2b4af9c308ea17d284ac4b9fe6651242376628c930d7d81c54e0d4c74bba79f471348df60afea1aedba90bbf51dc8ec380883457fa82c5a872f0a305b7305e4df08a6c0a69e524ee13d90e926d63296561be3a11574000f44cb1a6313be25f0256aeb25edd185c3f89977f999e461e592ac291193ab7538d5e470f1b05f3a8b865c443b411ea031c7432a85233f4d36c88eacd5ad719ec545fa8eb9e33a50ecef3894829953ecb06ceae7fb8eefdfda250b68b576ac04b5fee06ab5267501bef1d91e7e7a211298342d7d8c4bc4c8778acbdcda84845e99846acc0d50afc8ed87f047497aa390d045c82be9e724b5f464ac226714debea3d87646a3d164f1055d83bff813c4b8882d609a2e3f46a06eabe648d33092f9d0b1274aeef599ffb924921c68d0a09dfaa3663ce414a77002663d35bcd522eb184f612b5aeaf8c26d57e161150b2527f8700647f35161bca6fba259feba529fe9f936e9027f87908b05c740e1456bb992f68782c023c0ab5f4e55026128f9efbba9689b704700a69f244e4d761dbc034463242efcac728d911a619b909fd95abeb1ddeaf94c74c61bd63b11132bd89d08f80e91b15be5bff50d8697ef0eaf00b386d6bc467b0967d4fd281e96bb3c94dd3ba231456709241795b4d6babfeff79c799183b81fc4af7daaab1a9a58f71492f57ce1bf68518a9a828d470ea7356556c19144fe4027ac96178b15e1ef022d78149e5872fd32ad01e4c5ef4991ebbdf6e42f1ae828523755d07f1b2956bcc393062bf92038a9f3153f2a74903c92b55584d7d7253a422f8e2a54881801b19e44ea327886cd573999d7e59c9e831447b6ad608bc6071a385f6bab4e9a7d6bcfc834bdf0e778d0abb4017853e3fec2fd7ee0f3d4077bdb6ff262973463110304dd764a14809e0ffcde97b783cd1e3a168a637d547a7fb2675ca9b122322ef2284bec52c701df8f0b1c27b9dc26973bd7d1d40271a57f81e5e55fe8bc85c09463094cfec0463adceefa711639a24230757ab1bc93e1a4a194ba73e9e027d95021cedf9426a6f76cfb77fc4780c80be7cc6a9d7426c4e9c94e69d3171fe05283f5c241a98cd3ee1001c19180408c9df3b81c587f438ee7fee19edb0344597aa483e21461ab56ace0d9c211bd499fbda556480dc22959c001878b057673ff43cd730b2db0b1be49f046843a5ccb9ce6c06566bb30e649fbbe6c972d87edb0534b9c7527478ebb1cb778e445a48e7f2d674c80ef7f9ce6716899d0561dd134948ccda0d51de7f8beebddc62fa8440995fc1b443e91a50f89507d44c008dc9ee246228690bb60a5dc2c69530f03afec94ceec1182d5554699600a10e378ab219240cede6966d2a5662ad1243a6259d58fb0500c61d87f0756d17c0338ce9c475e4574d89ed0b940643242af1c0f7a8ff1241ed39cca9d632bbd78d1a31d6aac90a8f0b4792f3582baa9be4bf07b061e8f63377c990df007dd55e4fee9a0170bc932c0f3be99c4ba981c167753b1be04496240fd839819bb2b5c5e746d3c47a296c2485bb4ff8191ab4a9c0a185c851b24a92434ac72aef1e5f6866e1f403eaaaf14388a0513a3d37c98b0516d0cc17f9c01328094423fb70d440d596350ddd53bf10a52ace8afc590747dc8fadabe0dc759e25278bc33223ade79f82aa7c045cb24310586a7287266c2ea453a6ca75fa33a0cdfe71c7177c0148bc50e4d9e2d58648710df73bcce1745241b89376c99e48fbfafc23d7e4e70c61d43bb6ec56ae8948dc65686690d1743b003cacc8baa7174dfd845f35b28f2cb8eec504e31a98219700b3663cc6cf226c9909b8f33f1d8788ad4c6ead4b504908f1e34acf0d6b2e27c847b69542ad4bc4066152352593c3ead82b0527b795c2cc69a6133d987646b212091ba4f111816c45acbee04539a632ce5cfdbb47b5ae9b47f21283ce7af1a7b65ee39469d11e7b817ee6fdcccae672090f948929bd25e379b54a1663c242ff346e23fa8dca7d7062f16bcf08b8a92391814d6326fd727ff734f6eca01db3a5500032a6a8d128162a444e644a706209afc367ce11420c35a07dd281cfaab4faf241765d79e2f3908c1798ccccb9494e566906c6a2e36a1158a295a6bf126a22094cdba262d3a5e9c4cfbff686b66f3d8bc680b85f25d9498701c975b6df0a3fb6093b69927555c2e9df0003ad6686e3af2d09baa65dd0c37bd0936a0d632a746e44b99804adfe5c4c9709e72708702feee6cea70aafc40cf8924a16ab0aea1174c536992efabaecbe299dbc3dabb734ecdeb2f2d6ace80f87778269aa50c9b179615055e7f150935b4ea3746cc5ad6871463de3113e2f6e6a1c7f56ba5ff6f5aef2acdf32aa7f8d58b5d12a5bfae652d86eefbfac429065b736b6e6f974dd2edfe07a667ddba732207cfc479febaff7ef182b22c507398ef71e48390f3cb3eaa900fda406dbce114b7149ea7b90bddc03376472ce4e23c927c22476208bc9ee7924f3031fa92a46a0054d768334b08f4a950f0dc60fba446b6f4bc45239fa8096f63807decb547d9c2ecb3f70e97fd73d28d152e694bd1212ceb8e3d833aef7f0a668d69b1aaf117c0e465d09555f2571921b9e80110fd39802846096b0504c95564d5f797eeac548a55b05bec258e895d3fae9295ab3a8b2c30db8545f42b7e8521b79c1f91982183f6ac28732d877fee70e9ba631fa4177a51eb0df9bec76b027db7f905d0336cfbd52a5e97d4ace21b41a6475f577e8346cf269a0a2acf85bf313e1d02eafd6117517fb209fa7ab8adc9cc11b2c77ee253200cac190926555d2ac94f3e483bb0cdd1c1403f5afbcfa3e8a27622cbf47c79687adadbd90f24a2731f23c4cbf86ba92922c2ec9af5a70c68719009129227a97f2ed9337da01907c3bb8deef26e489bad49634b542a943fdc54a49eb01f4fa6faf9be925e47219b4854a35d9254a29aa9b859c22810460f76d0bb9052b08b311b40670747869724c357d7225fad3a258f90a1605eedc12150fac8552c771c6121b11e4c9020ef1d13d8d5e7e1d9c87b3c6ba1eda43f2e4f10cc1d691bd9453aca97726b1a647bbb8801349a48d46d9818d46b94fcada5c7ecee62e5569fbc81ad3feb0d48ebf94574d485e2fe13611d228301558d799d70de5ea8db93d364d93dec14ce951200cdb3283b36cc0d23dc9a66c8f6ff903ac92b6bed32352eed88c34d674faeb5dafa71ebdd2e1ba17fc98c1e3a7930f68613ae6de35ccb176bc70788ba10cf78e3bea2c05f5a7c4499e76df91d8422ec91abb9f00bf187d1d03d2f3e3d2e8a0ec", @generic="cb2518fd4c6644592a2ba702e8a97e26549858a34c0d4e20bb106510fb2954fa8cb5e34ccc0d0187373b2103c2fe8159fc8d2c696642ee1c4b43108685d34b1cee77d9d064a092518bfb63a14037c22324221b902f6b40969eedccd233994cc7a8dc86a239a39a09b2cd85d717dad6560024587825495ee123f70a9c6031a9dd4764181bb2a0231f92c008bc24938f4077a312d894f91e8a7c90580fbfecf286a6e3", @typed={0x14, 0x2e, @ipv6=@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, @generic="7be6a92a8811471b"]}]}, 0x2668}, {&(0x7f0000004000)={0x5bc, 0x3c, 0x200, 0x70bd26, 0x25dfdbfb, "", [@generic="a2c2ecd36c992b48b7826bd7ac47326c96ea7c9f41a1216ba8849cc64f92e442d48afb20e6f7d881a59a2a356804f8e45fc4e3eef106e7bc994d0fdb7163a058de5ede9f7b4f85bfc081c1b16efb1ede05c663ffee1b6e1522943f3a3938ebb311f3211685500186bac983989566d978cecbd44f2d3bb1e0d6baf4bd0d59fd4766bada06c532c06fd1322a065880ae078e554a57a0792646ef49640f54c9251f2c1a7e4269f729e6e6ae75405663992c8ae1c4bb35045bc217aef5d11d9ff5c0af6047bfd9a857d34bf4b1f9b35d38a03c8f021f2f7c179a6c1c08882ec07d42f487b905", @nested={0xd8, 0x78, [@generic="223d7f29e1f2e37e5d635f126ac39480dbc0ac1f18ba5ded6378425fa9704b1bef55cb95b8827d69c45d9d5a5fb3f23ed4b3230cd0111b6e5416528423b53731ad172ff65bf1c3df544248f23be6b2fc5c5da4d1989af724fb88f5baa62f51ce9bce572b1c5c7c4efb6cedb663a3e227a43d4291c75d9ddf3c4fdf3bf95169d115c514fa5739a172650a2664bb7ed6c5340f2e7959e2b3c87f391b11a6b1a1937308fbc2d698d16afa8725930d64fad49b56d28fdc9a2a09eecbbd0ce1f68f856e099a8ead08af6bbafa922fcd3c69912a73"]}, @generic="67fc034e7119f53fba86f01aa0dd5ec6742906e44179a18fe3dad9df290cd2fd02efb246f25f895219f5683de59a29993d", @typed={0xc, 0x6a, @str='system#'}, @nested={0xe4, 0xa, [@generic="70ca1dd955ffe94251aca191a7ab3189dde3cd71dfd5760f0d612ab7302ea9144cf7c599dd289aa0f90f5adcd8494d4b1abad0f11e4edca585b0a0804b5f0657ed27628170a4acc78bd213ba6e3bf1576514ffb9d21835e8d03acda4447ee4b33306217b039f71203c25f4cc35ac0cd2d9de3c9d9a732a5c9fde9ba822013561157c01d75baa7eb1fe90ff7212834b479658522babf521b1eb6ac1389b45edfef1bdbe482805f5f8950783a6858eeb8f", @typed={0x8, 0x4f, @u32=0x6}, @typed={0x28, 0x4d, @binary="41ca2066101e36455c31eb99f9509771302437ca86f844f13816564728ae714510"}]}, @generic="92537f2420a8c84269dbffe399fb2e7b606dad015dfde20a43cc772bfc7039d3f28083bbbeced2095c21e38d3ba4b0d72748234affd5fa0e96f45101e9e4bdd2617ee7a33aed934b683625cb3197", @nested={0x26c, 0x53, [@typed={0xc8, 0x52, @binary="b5da8adbc3cf4d1c12a6c1698604f473d4cfd85d562d78e9db0f0e80c7504ff5cea15b38ce88c227576dd30bfc2c08fd96b9337ee68dae110e9c3af84df49acf593a7789cd1551ae02cd2bceca3ea0a7c4e454bf196259c494130efe7b2c0d4b9bd0fa0e2764fe4661661d48bb7fe62430a6278415b74a78df0b404493f3fa33acdabdf0131d2524941a9449c5e23ca8f0a040e3567ea65e4a6c0d87f7c6a721234ddf03d362281e3ef7b41a800efb9a03ebdf1a3bf710a644910d0d1176adc86a"}, @generic="17d849fe5367459d4e979a67a98aa00047749940fbbd6d65b082d52937d590f2348361afeaba3fcf7ee66c9fef1a2b27f4d41fc1ee5b3f77f46eec15ee36aa05d828e6343c627f86ab571be88cd2b4e0daac129fc9b4376915b78dd257a141b832cd3c854b06c63eae70659cec933b38606828bb37b24aab54497722b866ab51ccc33233c1af1d8658544b87f7bbbbe72d79dddc8016889909bb9506bbc39d26d74f4b29ff62b7527d5fdf4051bd4cfead99843b6c563353f5c852bf036d43c2f74013ea567bb46245c9550fafaeb1", @typed={0x14, 0x8a, @ipv6=@empty}, @typed={0x14, 0x75, @ipv6=@mcast2}, @generic="cde5c598dee2950809c95abe26c19e39a86c9d2f5d7cdb32aa340056b279f687ae626fbf0621a85c4e8acbd01f943266035eb6d0ac05bb8b9941c431b12ce1a430367b191b70ebe6395c32d2f4fba0bf1e103aecc410c3f36a5daf1fa488576df254db99164c348d0f1cf55d6038d2b8599dd79fa44aa186e937cdf62c0558e7413d00b11c57763cc7c8c28e8735ea831110ee4d3f2681cf84c99f4e876849a6ad7f89a6bbd09afc"]}, @typed={0x10, 0x8c, @str='mime_type\x00'}, @typed={0x4, 0x46}]}, 0x5bc}, {&(0x7f00000045c0)={0x10c, 0x1b, 0x100, 0x70bd26, 0x25dfdbff, "", [@typed={0x8, 0x8f, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @generic="df6157e66eb8eeb65502e64d323cc5a4d70a1fd5da306169d9f0bd6c0710bc25430a5ab98e91ced58500f0e9f5ace062f2be8a7ba8961c99c412bb7974ae5feab4def8494007a671ece9120a3fa00f9dbeb3d86bd7589f66fb74bf49627b70caa81621ce19ab3dd7a32bfeeb7a04f4b0b29568e49f1d4549671b4b65581b48c5a6d5204ff4048129444ae8fb8377c9b3996b096a16673886ad4aabc02878ad48c704696a7db0de676a4e75a3a38a8ea9c6df3d159a9477dd66d5722568ba9fcdb8d3bba20eb8a1d31662712bc91a60a4baab96c52bd1860b174d53c291d6842dff4c92ee096840421ee55683b02bf88ef3"]}, 0x10c}, {&(0x7f0000004700)={0x424, 0x20, 0x708, 0x70bd26, 0x25dfdbfe, "", [@generic="7b7573b2547cda35985c3c275b2a877fb51b", @typed={0x4, 0x36}, @typed={0x8, 0x33, @ipv4=@empty}, @generic="df035b16550453d0b745ca4bddad4d489863f2775cac09731308e93ed8c28a3ad1681b416780bd30703681fc037d88a421a13268e2be8d6c4908bab2d5d533ecd1b66ea73a44cb535e2367f1c36ad630283bddf80dd97f05c4b187e4d0e42abfb429f5943e9c40e53082a872938408f2fa6ca9e987227aa46a74ef2b5eb8d353c22f160134d292f033abc411f3e48f1ac61ad8a0702d597aad5dec749d4ca9f8bf4765fda2edd3c5ddedde8253141c84205eb917835ea2dd56a867c4ed691f22feb360d89a9936039edc4ee920093e51ed1360e1f00b9b6ca3c9110183c5e08ffc4c036887176a41e54b08d348d02a6fbf95490bdacd54d364fe2f14cf", @nested={0xf4, 0x22, [@generic="f3c8ca2844979f831f6794cf18ace4ec7f016c02ca0c9a8e1a894254ce421bc162ca5deb2426f4c600753f25613d5bee91d91072ba7085996146e53cc29b4d1e3a1f8dbaa3bfcadfcd33a82c31b5ec6170f8e779ad3dde849013efbcf0561a86ac369e70f6da23cace52e7a86da9739885967e1c31dde68363c415bf0a553c25e241181a294a33d74772e1ac691972af367d12e05d593daa628cc0aec1c0215dfbd7a1375d98cf21c273e1d0070d043afd649a282d133c94326925be81eddc53bbbe12b639910daab1a8794015af33ca7b7b42235c4571f8f0bbcc349d9219540e77df7473ae8ffa", @typed={0x8, 0x90, @u32=0xc0}]}, @nested={0x140, 0x71, [@typed={0x3c, 0x1f, @binary="115bdfa82b030e1e6542ec52e132197a96f10cad9a6e4f4b7dea067b67c318644e0202bcbfe0be9035141ed9c55abf500228d169ade0f377"}, @generic="e8101161c71674a07c3ce5a69cb37639d5b3d5bcaae3284afd308586a4a73b43c527fa8576e8838a4c68faca2e8e957477328014f533e9934f292bd9e4cf0792829aba820825952df77e97c1852d9cf4eeef5d36058db5191bf1356dd1d39d6ed64a338a66e54084ce8840c6e60f82bb711b8757844ab7081f6c47f334bda6d62eac35063701dc52ade0fb9246c8", @generic="6e0de4cfd9c8a9ae12a8a067763f8d3608eb603812c95b3c62f60cc7b1faeb7cc01da74f42559eaa9cd2132029a672b669438f825ead0417f540a52d647c6b0a7e8a760deb723379416107acfab32b0d5b1f83068df7d3fcb836daf3158fec8940475315b0526b8ad42a22a3dc3ee766"]}, @nested={0xc4, 0x49, [@typed={0x98, 0x62, @binary="39cd9a647e9e7d6c5358dc1277f762aa157206a6133d0dd1c288a0002bd7588f84bc2df8eb81999d2747156a720ff58c851a6bbedf794cf21f54e34f0bd1f093cbb6fca5ba5798adba3d033936e24bd0de96ddc9bb161c1329b81b79d5fc7524a2c6721daef2b24b3f5225d6326075c8e0df78ca3bc3080c93b969fc179b5c021c207488e0c413bba2e42c42ba7513c78457d6"}, @generic="ea904695c3c4d3771cfd8454079e523248158f3e69c22325a5b7a00d1084c4cf", @typed={0x8, 0x11, @fd=r0}]}]}, 0x424}, {&(0x7f0000004b40)={0x1190, 0x15, 0x8, 0x70bd2b, 0x25dfdbfc, "", [@nested={0x1180, 0x44, [@generic="d71765eb933e930e710cf0bd6b7ae3d0740ebec8fe92b430b256553b8a927c152da25733dd51d080af85cdeece1e2492d1f961eff0ac8ea4d1ea26d7a302e797394d14f24217c546f35c784a3d3cdcbcd680fc8a1c4cc78a5e54e76a58ef880dd53a686a73de8f0a6d6a", @generic="843413d157823d180c803e1799a0a19e0421656fefd15508912525336034850f6a8189a1a2c5af7f5dbd5dc3", @generic="ff290e19f4c4a24e107dcfb470f1a872e25cd6664834562b73535f6b1e1bad7b0348a1ff5cc36b638a5ac44ed06c148921ca4392edaad4cab75bf37cd5d0ddd99e3d324c8197185b0cd4e8a1b2805b0eef5e14c5f1c9dca3c2b574e073b3052a3d1d978e669b993be35672c37de01f849855629d3dea388f9205f5fd52008e4f6b7092d8101a3c2244699d32ba286341adbd0cbe77354f52e6095e2c9f338c5be5a21adcc8abec767edc35cfec2400d7290f8dbbc25cf0f1302a7e6f36bddb5d9771e814be8ad7722ae1ab0fa788829a3e41191c47a2d5cce8125cfc5dc5", @typed={0x8, 0x51, @fd=r0}, @generic, @generic="cc765cb0e92b1dca41892bc24c7b769ff81e5f0e0ebb0e838ef9aab07c1772eae9d019a2e5aac1470967167c6eadf5e1a8c4a7a744de121fe68a6f7394d7362650ffbdc6a2233588117d0c108d2292eabb81400c73cd229f067a64ff0f8e39daf039993469a20ca03cd1e7a34397ac9dc96571db4a499fc02ce3a005260976cafeb43a9412bba3378e159f8753bc4ae1a8befb193e4afbbd5361a5bfa32ac279d4d7f697aaa47c289a770e38beef5019a65f073533a4b87790be91b1f9b7a74eb51112a9ae5394566c813c6e9f2e67b78f2b7965d327478330c339ef7b277a46d87b415d237c53d604df125d65fdc30c2dba5747be9fd5b21db8920b812ab41595bcb7b8d789334dd5e0fbec3d2677dda3b30e96fdfe1d5fe106d01f1fc4c6b4dcd4da368f0b462bcf568308046382cada71deefdc4d153425997283e7d3cd2265ddd878fec71c2b2c67c9860c3578d42b72652db673783e1a37a24071c2a8a1543d0be1ae387ca1fcc4d7278eab6d3804ff538ef90bf01c1d0b865895ec098efa9fcbb910a07513148c4ebf20d3847912a0b497577e1e2d9153636ff467456baceb50e8c31215b31946de7a8f810460b60623772fc2ff88fc8218c1b819fd4077ba25f9ff10477a2c059e0564ffe2e46c4ca07944478f77adde45ba4ebeb2000cf1c8b74f0cb6d98925c18bf00977e6b66a5452785f9f9740a111cc86c93e70ca3a78ce7c0df2bcbc7ce4323f0e859ab7af998063c400b12a0aafe7113dfda1ec306fd0f2eeef4e895f7607dcfa225e25c5e998c0677d710d7b662b9087fec10bf38d2591b11afd478195cf492e4a65464cbb00bc5bf06d8147bac92646d6454b87224e59d33db9c745f9efbbe761a0bfb34c1a9dbdbb0b9ba775543f009656091da13939ba53f9843388f4058acdb252a2470f9823c05b9e83ffe39656fad479d06757bb8d0630aa9e63f192865100edecf7c4b6e6b21c2d7d46ed09c95bf49a503b8d1a3b633b5ae4255c5864b7c7a5e9966f429fd1745dcd0ac50edbc9e099a6e1b334e77f1d8d4c66987698a05abe080b07014bc90a3b2ee464b6b2834bbdad01fef6f487390f4fdacfbcd6e2e5d0d16fac733485827a4d2ddee9e65c3aabca5948d3f81a6c3367794f1579f48dcd669642f739711f11c24ff12e5741fad967220c15143d82501fd9cc2854942c7b633b4cc5666438b5d98d17fafd44e022fd04928aefa9c54d7c33f7f09e2479f8591d204c77331fc0986419b4829b3e759aeadb26e4e98b621eb07ab8c1ca70c8e70d7e874eef7992f6b76fc8d2ac338f2a1b45d6b44eecc2680a0c180f2b2546dffe1dca33cc21674ddfd4b43b27a53ef8cea6fc3288aee005a4d49976015ff4eede35990a578146e03cbb4861f3b16670a2a60fb7b3e501ac8c2a989255dc804e3e393153151171f1bc5a00bb044c450ff1cf1a17fee25119a973e6ba133a52e12531c1f67d84bb271093e9b9165a9ff5ca6fbcbaafb288195292ddcbcbc8874b449e8f626fc74a7821c70ec779017e951de64fae13fb44d34e3ffba63df8652db99b6bb4ac7e2462ec5f9567c45e66f431b75ab72320b49a0bcc258097fc90bb7d68568aa1d4d0fd634535ee4010aa6729100e3cc5bc7f369f4113d7e0c0035e33aa42a355f607c8494101b683d664560d9e30a14b36fb27c6019e1338f37f4a2bd7a1c721d0347c313053ee5476ad692d57f108ed9367613d9bbc15dce7598a136b63b83e23565559e4d530cd0b7d962717f0ec04dcb5ced5424516134553ae7f3ac9cf135168008f23819267cfade7a5f9c73883bfb0d4e24fe051bcf1383cd3a7b5cc332c5f9707b33c42afad8a8e6e3f6c2432d768e18368f8a081bb4336640d0e8d2f0d7f92de616ea6ac646f68ff79860f80fc14b0119860ae223709899d1f3118b94f2a293804f27ef2faa5672cb090f2edbbcdfe32a835784c9530d6a0a4ebdf3a9e6ee278f5b381bb43c7e903516071f6d43c494c79be2a7b0d7740aa2149805bd77ece27ce9855d2b927266a48be8025a616e094729595e3fe399fa3d30594da0110893fc0fee3f35af184ddb6c74b8c6f4c687422cf77674dcfcb8a7ace2427ae2ccc7af11d57545182436539504d43a04106d012a6a0a196f38a14ae65df6596d26c3e9d15f249a3706ff356ee18bcd6b9720ca733adb8aeaeab05702d9359eb0d8fa9968a07f7faea07e2cfda3d7b1331046ca1293ea2a39b69c30749c4a578b7a59dcbcaeb52e72be6dd74c5c17230b90bbd77f4c3822db2aea130cc9b20f1eed00a115364fb6847fa58b73630fb0a69d39d1ebe05b844dcca98eda60d77a9e2dd911b624bd2ec8afb455d5f9b91c2b7c17556c17e4a428f0b8793b3d039414d5d115b41372bfaa39426f9d05d7ba0aacc0e2374d64e37e7e1c1d5fd6afe4908023f2ad959f449f36b57fd8a28b58e9b1c56644096df83166fed3440681f5d6cb0ada9100f8712b5f9db98b793e1a7e4cb0d8ec9fd1857b0b5eea8dda5444a698b47d1c9297605ed00294550b11661be996dddb14de5c9ed9c47951d10e8f053eba35f9588236518dc02f7781b27c14c4a2a65ac66ef5184fd7346871861d1698be841d1f7491f3ac380b3f44da05a478ce7e2e1de31a696ab20a644d813db31482e3f0a5b922f1558a76868505bd0c5d11fea630f5534a51aa20e83695c5ba17186d9616eb343d24b0a0411d8e5df8b65468abce3061522ef0953eb8fa810549622e3fc6de3baab8e840ea334cd4df25ef67109636f358440b4581289ada5c9e2d101a266d0f49e139151c8ea26cb483bab74a226ef251f941043dcc5c62471141109e5fbd9a66d1ac04ea6373d5ba6b9296bd38c1cff53601a2519126a60750c99a6e39bb63f7d1afead28034c5a2afdfddc67ac28b0a590d42ed92ab227eafd596cc0a5a7d64ecb520ee0aa7f3558c70e72d7fdd5f331a256d01ca0c9538dc73b47bc01b77195ea37c394cbb9a2d7399d8ee2728d3caa4f72e6935ae473c7862afdd42b81a21589020fbf00aecd4e3eef62ecc20941db1ac8d5fbc23b685f6f68a9f25b0a403b88ea7c4cfe7d8e600e12b01803124fac955253c8b7519c85283110750fcb32fbff64ce155dc0611c120d16a67f9a96684cbe51a9c325bb1efc7049d505ccb62fdcf7eb880e931679660190065aabadbe3700385f3f9408a9da570dc07412792065f170de6e877ee5e66bd387303e69b2f5ae741edf788ab9b7146aa2ff86bf947a59ea8394b3142d842f0e7c32d39d213ff0fc18264d555d6a28d6365bf51b1cfc8e5f578fb94e4340619a029f29be463bff93770007ece505711f815e108bec0c3a0d64fd47ad1e9a550444d458672784921468d816222e1f0b66b858787b3dd394c297aabba30c3563dc4abaf46f3e5c1f1f20a7f102b8f19d85ea1028221ddd1141f1238388b28ad41510e2ac8e3eaecf7194adcfe719484fe4a762234c122d4947a1691199296d0b13efa7b561de1ca6a8a62839f1aa4b51177239afafee10b527a10494eb8c3de7d3592b3971d0d1eb7a54e5693588004062feba9e7df8c93b1211441f206ef06414f1c78a356929b9dcff867fdc1508c967406aeae9f7360351a8ec2d6ae9af291ece11340a0048d26c73303a7cf7fe85d1754d2672b1b290b9e73ef2959008decafd258115b02c406b241eb32b6355494796dc4696d80689a5cab45caea50f7045ab9e5d63eb06325320ce5dbdbab84039a0fb14d6822632ba17b53240202bfc7212e0091d0b12026ded49d1a6a166a12481f291433a916b00ca9fdc4ac9c7647483c00359c473ae2de1ba76104feed19116c75441787571633d4d50a721b6d73156359fcd9b8413dca186dcd920546ae03f7049caebe02c66a955f5872f99ad3dda7c7a8acab6e6b1e9dd6df35af5e7da2e636b74f9ba4e3779d273c9439ab0596510094a134b1c04c963e1a5499f01da23bdf98535cdf8ce3abfe89bef221f70e7db005236b687ad14cda74c6759f9fe239ac764e7f8335b7a0747b3e3f88e8c2c20fae5a9b1ebeff97b479b70e8169f3e0f9fa17aa29d1ed9ac9d9911ce29d177d446f88b867aa885433e1666b97a1344315ef1dd45f1b5e8d3e38a42e9c7bd6b7399351572224ae0640a90aa480232ce08fb261a9a715afda79815e60300a4c4aab0d77e3a24e200d28bc24f3be6e5d3934bef66ff81122b296895aba4f216656e2f7cc60b8ada3b53707ec72c1d8f8acfb0dda12f47ab865d2ae80e8330b59b34e088270a004c0d9b57ae79cd1f984d039e9867dcf8d7d46d661f7e2f0af7bddbf2aa23c92ce2e449b98d12937e58bb885d1c775c92be6edbfc0a1354b3f081d81ed7a2dc769ef673b192e7403a92aa968bef63ecde29b1a8b934894f2d532a5d0c9736d2728841e33dcfb3235b8d47ca9df2aee5c4fd34199cb58bd4fc0866c94508cb337f9ca45989b2a2db356a3c62be3e2f8fd72294b3ae28c68fd84924783b5e3ab0b165e5224fdb89c7bb3c0a91e54ae8a62c0989d3fa9a998912ff584f1dab535a059579b0d2fb6b304a96810a4189de08dfef965d8031d1c080918431f736f69953a2e188e7224decde93127a44b2a2f8c5a28f6e9490aac39f2f6f94edbcefa49d35f45803cb4fb0a7b2a72c771b1a920acaece9e52175dd42a258515d620b160ad9914a7db50d50c020bf111c6b1f942c693034f1db44eac5d58e5a56f9a18b3934454ab41c5f7d34f261caa309b8cf4220f4ebfbe02c947e140e252156a6499dc8071e9c1329712a5bb796d106528409ec5ab4ad8169647cc09d5014b13dcbea8d6015bee5558cae1fc5604f7bd6c301b95c8cf478d4c24c1d453db5f4f5b73cecf03cff1681c08efbe4ebdd23566e0b2b6d2dd532d41854e75c04768efcd3962585d06e6a82b029510ff7f1974df079df42164ae4c99401c26bc703cd0f58b06533d573e6eb4cd3c4c2e223d57ce84e3b75c513290c14a94906abaf5a25c542a60699fe3fd8acf66d376bbb075760ff9add8c6eeace4f546c5d5804f5553e740b9c78ac345c5bc31636a341c3618d293503fae0285a0066268eef8de376aa6f67bda1b3b808617950a43f37f728e836c0926f33c3a08f32d0264153cb14b81b50bb4c9a74ae4b2ccc17adbd89329e2072356d3e1a423368e736a940f5cf7e66ee351442bf14e8bc3749fb6d8c0ed08958695d1fd13a087d30f8e338f1574c62f82d0e1fdbb90f54f7b4d12c18e0d3e0ee94a9708966ae13b859f08313f5c9f64c0faafc89562fa59bb2faf72474c0d0ca3e2186fa3f7fb88f1a5500bccbcc8d1d38ccc8ecc0fffe3e242905325ce67b4418e1fd3a76c395f73dfe415e852d4d345ec5a19df1c751b3dbecf6970051cfcc79013498c9ebac4ebd55170e625cf6784bb088d91b19e6d6769ee1e2fe352e0b691da97df5dded47472dda385cb52f0abeea1c2d15389378a0d3a130db3c4cffd551315d7ba791e9e591fb269cc61e2a19953a82744841dafc9d5c6d5d1f820839a06e0f51f0ee851d7410c99f3c78b2bdb2224b6a025328f95314608afbe8972226ef86aadabe4b929ff40e174704cfa31e7a7e4f6ffadefa9bedf0c09a6c57e429ee4b703823631cd527d3627e9be70d30bd9afa900aca4f2af6d597ffb65101bd2b65edd2ef43ecc6ab35f05e4e31dffc07db87ed9e7df069d0d680cd86e9aa2d459dae0c1c447bd91efae999d26b8018f87ffa05bf79e31a2298cc9159ba6133f875b545afadb8527af36b9676559de86bb748f23dbb46aeec65"]}]}, 0x1190}], 0x8, &(0x7f0000006140)=[@rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @rights={0x18, 0x1, 0x1, [r0]}, @cred={0x20, 0x1, 0x2, r3, r4, r5}, @rights={0x20, 0x1, 0x1, [r0, r0, r6, r0]}, @cred={0x20, 0x1, 0x2, r7, r8, r9}], 0xa0, 0x20008090}, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:36:00 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in=@multicast2, 0x0, 0x2b}, 0x0, @in=@local}}, 0xe8) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="02120000020000000a000097d3d34473"], 0x10}}, 0x0) recvmmsg(r1, &(0x7f0000000f00), 0x274, 0x10000, &(0x7f0000001000)={0x77359400}) [ 380.761582] binder: 17598:17599 ioctl 5429 20005d80 returned -22 [ 380.868475] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 380.877204] binder_alloc: allocated: 2848 (num: 199 largest: 32), free: 9440 (num: 1 largest: 9440) [ 380.886550] binder_transaction: 6 callbacks suppressed [ 380.886587] binder: 17598:17599 transaction failed 29201/-28, size 0-0 line 3035 [ 380.948407] binder_release_work: 4 callbacks suppressed [ 380.948425] binder: undelivered TRANSACTION_ERROR: 29201 01:36:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000001c0)) ptrace(0xffffffffffffffff, r1) ptrace$setregs(0xf, r1, 0x0, 0x0) 01:36:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x2, 0x1) getsockopt$ARPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x63, &(0x7f0000000080)={'IDLETIMER\x00'}, &(0x7f00000000c0)=0x1e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000100000000000000000000000000000000fd0000000000000008000000000000000000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="2430f2aba617a8510000000000000000"]], 0x0, 0x0, 0x0}) 01:36:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PPPIOCGIDLE(r1, 0x8010743f, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={r3, 0xffffffffffffff9c, 0x0, 0xd, &(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff}, 0x114) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x2400, 0x3) syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x7, 0x82000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="bb3d00dc4d00000000000000000000"]], 0x0, 0x0, 0x0}) [ 381.179243] binder: 17598:17632 ioctl 5429 20005d80 returned -22 01:36:01 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f3188b070") r1 = syz_open_dev$admmidi(&(0x7f00000016c0)='/dev/admmidi#\x00', 0x7fff000000000, 0x0) socket$isdn(0x22, 0x3, 0x0) getsockname$tipc(r1, &(0x7f0000001700)=@name, &(0x7f0000001740)=0x10) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) r2 = add_key(&(0x7f00000000c0)='encrypted\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000140)="3bc9197b04a3e5f8f6ecd8a2964ff231cb5e150fa9fa399cd0bc6110f16e9f99295b25320b3498422bb1a41e90a80bf81d8d1238b9110e2a2be0a4b4b303fd47778e026895705a9a0767f2bd4d0aca10f23ab2f539fe608dca8703d1c693d19c633d217c88eeb5109e50b0698579ad4340c9cb6b0ab7a165c275bc3d5b7bb125bceb2447a649d1e528503bcc24706e45f0159899db181a7cbaddd6d0de69ae15fec6ca40568c2a02765ca0b8b5fb8f972fa355f6623bcb7e1c", 0xb9, 0xffffffffffffffff) setsockopt$inet_tcp_buf(r1, 0x6, 0x1f, &(0x7f0000000200)="77f28bc380767cdd35c633c917ac2ef02ca8cdb268d666ae2918911cdd62bdd7ac3702611f3599549729e38b1d46f2bb3b6198d89ebe9a77ca374f716e51c99cb8283a5d6fc4372f888dd59c0b7702ba9e8d4ff0d75b98695d1df428d8d3496cc522cd8f5501ab2c46439991d215056e2546bca84ee0ba0da5a2", 0x7a) keyctl$clear(0x7, r2) request_key(&(0x7f000000aff5)='user\x00', &(0x7f0000001ffb)={'\x00\x00\x14', 0xffffffffffffffff, 0x4c00000000006800}, &(0x7f0000001fee)='R\trist\xe3cusgrVix:De', 0x0) [ 381.282067] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 381.290406] binder_alloc: allocated: 2848 (num: 199 largest: 32), free: 9440 (num: 1 largest: 9440) [ 381.299784] binder: 17598:17717 transaction failed 29201/-28, size 0-0 line 3035 [ 381.331874] binder: undelivered TRANSACTION_ERROR: 29201 [ 381.337433] binder: undelivered TRANSACTION_ERROR: 29201 01:36:01 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) acct(&(0x7f0000000000)='./file0\x00') clone(0x2102005ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') ioctl$KVM_SMI(r1, 0xaeb7) exit(0x0) read$FUSE(r1, 0x0, 0x0) 01:36:01 executing program 4: [ 381.415106] encrypted_key: insufficient parameters specified [ 381.471822] encrypted_key: insufficient parameters specified 01:36:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) ioctl$FICLONE(r0, 0x40049409, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 01:36:01 executing program 2: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000280)="2e0000002b00812de45ae087185082cf0124b0d057e74400094100000000001883b2e6dc02e7dc8e5c8ef10b80a66819c641baa1470ec61389e5f92899da189f6263a5fe37d00e8b647d4ab1d198d9fa9e7593d2433b5d750e0c7684cde7877a7993af7090e7a873", 0x68}], 0x1}, 0x0) [ 381.653280] ================================================================== [ 381.660726] BUG: KMSAN: uninit-value in memchr+0xce/0x110 [ 381.666294] CPU: 1 PID: 17734 Comm: syz-executor.2 Not tainted 5.0.0+ #12 [ 381.673229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 381.682596] Call Trace: [ 381.685215] dump_stack+0x173/0x1d0 [ 381.688896] kmsan_report+0x12e/0x2a0 [ 381.692742] __msan_warning+0x82/0xf0 [ 381.696574] memchr+0xce/0x110 [ 381.699881] tipc_nl_compat_link_set+0x121/0x1550 [ 381.704758] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 381.710003] ? tipc_nl_compat_link_dump+0x5f0/0x5f0 [ 381.715042] tipc_nl_compat_doit+0x3aa/0xaf0 [ 381.719471] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 381.724714] tipc_nl_compat_recv+0x1ae7/0x2750 [ 381.729349] ? tipc_nl_node_dump+0x1300/0x1300 [ 381.733961] ? tipc_nl_compat_link_dump+0x5f0/0x5f0 [ 381.739005] ? tipc_netlink_compat_stop+0x40/0x40 [ 381.743939] genl_rcv_msg+0x185f/0x1a60 [ 381.747980] ? kmsan_internal_memset_shadow+0x14c/0x430 01:36:01 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="f6"], 0x1) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x7f}) [ 381.753397] netlink_rcv_skb+0x431/0x620 [ 381.757478] ? genl_unbind+0x390/0x390 [ 381.761423] genl_rcv+0x63/0x80 [ 381.764741] netlink_unicast+0xf3e/0x1020 [ 381.768952] netlink_sendmsg+0x127f/0x1300 [ 381.773321] ___sys_sendmsg+0xdb9/0x11b0 [ 381.777430] ? netlink_getsockopt+0x1460/0x1460 [ 381.782145] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 381.787374] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 381.792767] ? __fget_light+0x6e1/0x750 [ 381.796785] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 381.802031] __se_sys_sendmsg+0x305/0x460 [ 381.806242] __x64_sys_sendmsg+0x4a/0x70 [ 381.810332] do_syscall_64+0xbc/0xf0 [ 381.814081] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 381.819293] RIP: 0033:0x457f29 [ 381.822504] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 381.841420] RSP: 002b:00007fb94c02ec78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 381.849148] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457f29 [ 381.856428] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003 [ 381.863973] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 381.871252] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb94c02f6d4 [ 381.878529] R13: 00000000004c5561 R14: 00000000004d9408 R15: 00000000ffffffff [ 381.885836] [ 381.887476] Uninit was created at: [ 381.891039] kmsan_internal_poison_shadow+0x92/0x150 [ 381.896165] kmsan_kmalloc+0xa6/0x130 [ 381.899988] kmsan_slab_alloc+0xe/0x10 01:36:01 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() r1 = creat(&(0x7f0000001140)='./file0\x00', 0x29) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="dc02"], 0x2) close(r1) dup2(r0, r1) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) listen(r1, 0x3e93) [ 381.903900] __kmalloc_node_track_caller+0xe9e/0xff0 [ 381.909027] __alloc_skb+0x309/0xa20 [ 381.912760] netlink_sendmsg+0xb82/0x1300 [ 381.916934] ___sys_sendmsg+0xdb9/0x11b0 [ 381.921022] __se_sys_sendmsg+0x305/0x460 [ 381.925188] __x64_sys_sendmsg+0x4a/0x70 [ 381.929266] do_syscall_64+0xbc/0xf0 [ 381.933041] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 381.938233] ================================================================== [ 381.948283] Disabling lock debugging due to kernel taint [ 381.954160] Kernel panic - not syncing: panic_on_warn set ... [ 381.960069] CPU: 1 PID: 17734 Comm: syz-executor.2 Tainted: G B 5.0.0+ #12 [ 381.968396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 381.977762] Call Trace: [ 381.980390] dump_stack+0x173/0x1d0 [ 381.984061] panic+0x3d1/0xb01 [ 381.987327] kmsan_report+0x293/0x2a0 [ 381.991160] __msan_warning+0x82/0xf0 [ 381.992788] binder_alloc: 10623: binder_alloc_buf size 16777440 failed, no address space [ 381.994983] memchr+0xce/0x110 [ 381.995023] tipc_nl_compat_link_set+0x121/0x1550 [ 381.995060] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 382.003361] binder_alloc: allocated: 2848 (num: 199 largest: 32), free: 9440 (num: 1 largest: 9440) [ 382.006499] ? tipc_nl_compat_link_dump+0x5f0/0x5f0 [ 382.011350] binder: 17737:17743 transaction failed 29201/-28, size 0-0 line 3035 [ 382.016510] tipc_nl_compat_doit+0x3aa/0xaf0 [ 382.016532] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 382.016590] tipc_nl_compat_recv+0x1ae7/0x2750 01:36:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f00000000c0)=""/129, &(0x7f0000000000)=0x81) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 382.016638] ? tipc_nl_node_dump+0x1300/0x1300 [ 382.036453] binder: undelivered TRANSACTION_ERROR: 29201 [ 382.038449] ? tipc_nl_compat_link_dump+0x5f0/0x5f0 [ 382.038481] ? tipc_netlink_compat_stop+0x40/0x40 [ 382.038503] genl_rcv_msg+0x185f/0x1a60 [ 382.038568] ? kmsan_internal_memset_shadow+0x14c/0x430 [ 382.038608] netlink_rcv_skb+0x431/0x620 [ 382.038630] ? genl_unbind+0x390/0x390 [ 382.038671] genl_rcv+0x63/0x80 [ 382.038703] netlink_unicast+0xf3e/0x1020 [ 382.097963] netlink_sendmsg+0x127f/0x1300 [ 382.102255] ___sys_sendmsg+0xdb9/0x11b0 [ 382.106351] ? netlink_getsockopt+0x1460/0x1460 [ 382.111066] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 382.116284] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 382.121673] ? __fget_light+0x6e1/0x750 [ 382.125696] ? kmsan_get_shadow_origin_ptr+0x70/0x490 [ 382.130921] __se_sys_sendmsg+0x305/0x460 [ 382.135124] __x64_sys_sendmsg+0x4a/0x70 [ 382.139208] do_syscall_64+0xbc/0xf0 [ 382.142954] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 382.148163] RIP: 0033:0x457f29 [ 382.151386] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 382.170559] RSP: 002b:00007fb94c02ec78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 382.178284] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457f29 [ 382.185572] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003 [ 382.192871] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 382.200163] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb94c02f6d4 [ 382.207445] R13: 00000000004c5561 R14: 00000000004d9408 R15: 00000000ffffffff [ 382.215482] Kernel Offset: disabled [ 382.219111] Rebooting in 86400 seconds..