"0a5c2d023c126285718070") r2 = socket$inet(0x10, 0x2, 0xc) clock_settime(0x0, &(0x7f0000000340)={0x0, 0x1c9c380}) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setregid(r3, r4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x1e893b6a, @loopback, 0xffffffffffffffff}, 0x1c) [ 991.451757] binder: undelivered TRANSACTION_ERROR: 29189 10:07:48 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:07:48 executing program 2: r0 = socket$inet6(0xa, 0x100000000000800, 0x2000000003) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0x6e0c9ced) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000000)={0x4, 0x100000000, 0x80000000, 0x5}, 0x10) [ 991.552033] binder: 7810:7815 ioctl 80045626 20000180 returned -22 [ 991.575793] binder: 7810:7815 ERROR: BC_REGISTER_LOOPER called without request [ 991.609512] binder: BINDER_SET_CONTEXT_MGR already set [ 991.615509] binder: 7810:7822 ioctl 40046207 0 returned -16 [ 991.623738] binder: 7810:7822 ioctl 80045626 20000180 returned -22 [ 991.631479] binder_alloc: 7810: binder_alloc_buf, no vma [ 991.647525] binder: 7810:7822 ERROR: BC_REGISTER_LOOPER called without request [ 991.666929] binder: 7810:7815 transaction failed 29189/-3, size 0-0 line 2973 [ 991.704365] binder: 7810:7830 got reply transaction with no transaction stack [ 991.712054] binder: 7810:7830 transaction failed 29201/-71, size 80-8 line 2741 [ 991.721004] binder: undelivered TRANSACTION_COMPLETE [ 991.731112] binder: undelivered transaction 3548, process died. [ 991.748810] binder: undelivered TRANSACTION_COMPLETE [ 991.754321] binder: undelivered TRANSACTION_ERROR: 29201 [ 991.761536] binder: undelivered TRANSACTION_ERROR: 29189 10:07:48 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x20000000}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:07:48 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:07:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000000, 0x10, r0, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="0000000000000000877813fecad534dc4db4f48e5f49abfa59eef2bee969fe48c564a004a8963f701e6d0e53219fec25c8e5c02dbf7b8bfc5a946d20d0c812768e1d65865221aef7988643a257a53f3444841e30c70f517eca91dcbfbe85ec6a20da64f3747b6365b752e05d6dfdd75e458c7106129609ec4bc2b53b63c966a3f5c4deeeb64e7a44a1071800a499be86f2c52330cdbf195be08ece6d84de82a425f1c183"], 0x0, 0x0, 0x0}) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r0, 0x111, 0x5, 0x8, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:07:48 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x22f}, 0x0) 10:07:48 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 992.067131] binder: 7841:7847 transaction failed 29201/-22, size 5259757867467206233-8088349104156992709 line 2973 10:07:48 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) fallocate(r1, 0x4, 0x13a, 0x4) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:07:48 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 992.108289] binder: 7841:7847 ERROR: BC_REGISTER_LOOPER called without request [ 992.155870] binder: 7841:7860 got reply transaction with no transaction stack [ 992.189335] binder: 7841:7860 transaction failed 29201/-71, size 80-8 line 2741 [ 992.862194] binder: BINDER_SET_CONTEXT_MGR already set [ 992.867606] binder: 7841:7870 ioctl 40046207 0 returned -16 [ 992.874843] binder_alloc: 7841: binder_alloc_buf, no vma [ 992.880746] binder: 7841:7870 transaction failed 29189/-3, size 5259757867467206233-8088349104156992709 line 2973 [ 992.891514] binder: 7841:7870 ERROR: BC_REGISTER_LOOPER called without request [ 992.937515] binder: undelivered TRANSACTION_ERROR: 29201 [ 992.943185] binder: undelivered TRANSACTION_ERROR: 29201 [ 992.953125] binder: undelivered TRANSACTION_ERROR: 29189 10:07:59 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x400, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x80000000, 0x500) write$P9_RMKNOD(r2, &(0x7f0000000140)={0x14, 0x13, 0x2, {0x48, 0x1, 0x1}}, 0x14) ioctl$IOC_PR_PREEMPT_ABORT(r1, 0x401870cc, &(0x7f0000000040)={0x2, 0x3fffffe, 0x7, 0x7f}) wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x1) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:07:59 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x1000000}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:07:59 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:07:59 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = getpgid(0x0) r2 = getpgrp(0xffffffffffffffff) setpgid(r1, r2) r3 = socket$inet(0x10, 0x2, 0xc) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:07:59 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0xb02}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:07:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rfkill\x00', 0x248000, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x38, &(0x7f0000000200)=[@in6={0xa, 0x4e20, 0x1, @dev={0xfe, 0x80, [], 0x1f}, 0x5}, @in6={0xa, 0x4e21, 0x6, @ipv4, 0x9}]}, &(0x7f00000002c0)=0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000340)={0x200, 0x3, 0x8206, 0x1, 0x4, 0x9, 0x8, 0x80000000, r3}, 0x20) r4 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x5f, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r4}], &(0x7f0000000240)=[0x38]}}}], 0xfd39, 0x0, 0x0}) [ 1002.939073] __nla_parse: 19 callbacks suppressed [ 1002.939083] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1002.966871] binder: 7878:7884 ERROR: BC_REGISTER_LOOPER called without request [ 1002.975431] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1002.984573] binder: 7878:7884 unknown command 0 10:07:59 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1002.994356] binder: 7878:7884 ioctl c0306201 20000100 returned -22 [ 1003.002858] binder_alloc: binder_alloc_mmap_handler: 7878 20001000-20004000 already mapped failed -16 [ 1003.013374] binder: BINDER_SET_CONTEXT_MGR already set [ 1003.021389] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1003.031475] binder: 7878:7884 ioctl 40046207 0 returned -16 10:07:59 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x3) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x40) write$P9_RGETLOCK(r1, &(0x7f0000000180)={0x22, 0x37, 0x1, {0x0, 0xdbe, 0x5, r0, 0x4, 'TRUE'}}, 0x22) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 1003.035366] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1003.047754] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1003.068944] binder_alloc: 7878: binder_alloc_buf, no vma 10:07:59 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x20003180}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:07:59 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x80800) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r2, 0x800442d2, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, @remote}]}) [ 1003.097826] binder: 7878:7889 transaction failed 29189/-3, size 0-0 line 2973 [ 1003.102147] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1003.131277] binder: 7878:7884 ERROR: BC_REGISTER_LOOPER called without request [ 1003.167751] binder: 7878:7889 got reply transaction with no transaction stack 10:08:00 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1003.217481] binder: undelivered TRANSACTION_COMPLETE [ 1003.218924] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1003.222827] binder: undelivered transaction 3559, process died. [ 1003.224812] binder: undelivered TRANSACTION_COMPLETE [ 1003.244829] binder: 7878:7889 transaction failed 29201/-71, size 80-8 line 2741 [ 1003.255564] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1003.272693] binder: 7878:7889 ioctl c0306201 20000100 returned -14 [ 1003.293070] binder: undelivered TRANSACTION_ERROR: 29201 [ 1003.316440] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getrandom(&(0x7f0000000300)=""/170, 0xaa, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x351, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1003.353121] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1003.354456] binder: undelivered TRANSACTION_ERROR: 29189 10:08:00 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:00 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:00 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x0, 0x2) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x486}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f0000000180)={r2, 0x101, 0x200}, 0x8) r3 = socket$inet(0x10, 0x2, 0xc) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1003.514683] binder: 7924:7927 ERROR: BC_REGISTER_LOOPER called without request [ 1003.542593] binder: 7924:7927 unknown command 0 [ 1003.549114] binder: 7924:7927 ioctl c0306201 200002c0 returned -22 [ 1003.569682] binder: BINDER_SET_CONTEXT_MGR already set [ 1003.575001] binder: 7924:7933 ioctl 40046207 0 returned -16 10:08:00 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') r1 = socket$inet(0x10, 0x2, 0xc) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x102, 0x0) ioctl$TIOCSWINSZ(r2, 0x5414, &(0x7f0000000040)={0x5, 0x6, 0xf8, 0x1}) ioctl$RTC_PIE_OFF(r2, 0x7006) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000100)={0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000180)=0x28) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000200)={r3, @in6={{0xa, 0x4e21, 0x6, @mcast1, 0x1ff}}, 0x4, 0xfffffffffffffff9}, 0x90) [ 1003.615618] binder_alloc: 7924: binder_alloc_buf, no vma [ 1003.637785] binder: 7924:7933 transaction failed 29189/-3, size 0-0 line 2973 [ 1003.652809] binder: 7924:7927 ERROR: BC_REGISTER_LOOPER called without request [ 1003.675121] binder: 7924:7933 got reply transaction with no transaction stack [ 1003.691225] binder: 7924:7933 transaction failed 29201/-71, size 80-8 line 2741 [ 1003.698700] binder: unexpected work type, 4, not freed [ 1003.698709] binder: undelivered TRANSACTION_COMPLETE [ 1003.698843] binder: undelivered TRANSACTION_COMPLETE [ 1003.698859] binder: undelivered transaction 3566, process died. [ 1003.756356] binder: undelivered TRANSACTION_ERROR: 29189 [ 1003.762297] binder: undelivered TRANSACTION_ERROR: 29201 10:08:00 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:00 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:00 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:03 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$TCGETA(r1, 0x5405, &(0x7f0000000140)) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xb4c, 0x40) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000040)=0x8000000) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:03 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") ioctl$sock_bt(r0, 0x8907, &(0x7f0000000000)="77476f50ca38ef7cbf6968df0d7f81259f91c1e249fd377f776f71e5d5e257f4fc7fc465b60b6bbcfa214533d495fb47ecf0de3fe86480d0133809fc6732062c0c8fc2f636bc18483c6a412b8230f88b842a788c5a687e067f3c0abb96d441") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000100)='teql0\x00') 10:08:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000180)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="12634840000000000000000000000000000000000000000000000000000000000000000068000000000000000800000000000000fe6180811529b747e32c14e6453fe42cec5399c95cc20fae62fac0b5d27200750e7b2ffc1923a557377303671df7f07a3c895de4a3ed", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="8561646600000000000000000000000000000000000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a627300000000", @ANYRES64=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='8\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 10:08:03 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:03 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:03 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:03 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:03 executing program 1: io_setup(0x3b39, &(0x7f0000000000)=0x0) io_submit(r0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) [ 1006.291118] binder: 7968:7971 ERROR: BC_REGISTER_LOOPER called without request [ 1006.326827] binder_alloc: 7968: binder_alloc_buf size -5904286882684382112 failed, no address space 10:08:03 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x6) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x402000, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000500)={0x53, 0xffffffffffffffff, 0xd4, 0x8, @scatter={0x3, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)=""/200, 0xc8}, {&(0x7f0000000040)=""/9, 0x9}, {&(0x7f0000000300)=""/176, 0xb0}]}, &(0x7f00000003c0)="bdd3df1eed18717670d4522e560476151b063de87d33d0c163b73327863f377641e409893296ee75348af8988dcfe5be679933ff024cda0a171af1276109dbac5de95621973bdb914bc007a25828e9f2663079c91b703a687db154a72f5588ab2d3cffbfce02f1d9af44c77d003990f48d502bd29449395d932b072449a720f20369f8bdfc112e4736a45f0ddb1c9f2e0c3ad4e37046416eb1c85924b0aa7db6b1ca2c046c60c080433a66b8a02e39f29856669df57f7c9f2b552b4d455d2a304e8b767760a45adacbb7c4283bcfde5abb6fb072", &(0x7f0000000180)=""/43, 0x3, 0x5, 0xffffffffffffffff, &(0x7f00000004c0)}) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:03 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1006.343925] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) [ 1006.382446] binder: 7968:7971 transaction failed 29201/-28, size 104-8 line 2973 [ 1006.437651] binder: send failed reply for transaction 3572 to 7968:7971 10:08:03 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1006.496801] binder: BINDER_SET_CONTEXT_MGR already set 10:08:03 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1006.544141] binder: 7968:8007 ERROR: BC_REGISTER_LOOPER called without request 10:08:03 executing program 1: r0 = fcntl$getown(0xffffffffffffff9c, 0x9) ptrace$getregset(0x4204, r0, 0x201, &(0x7f0000000140)={&(0x7f0000000000)=""/162, 0xa2}) io_submit(0x0, 0x0, 0x0) wait4(r0, 0x0, 0x2, &(0x7f0000001280)) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x17) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$cont(0x7, r0, 0x5720, 0xeec3) r2 = syz_open_procfs(r0, &(0x7f0000000180)='net/arp\x00') ioctl$sock_bt(r2, 0x8907, &(0x7f00000001c0)="b85344b46fa7ec60bababc6d3c14651c9f5beb95da88fe8b61778f027055f0516ab47860943e7b3a0946d210b89886740cee8605e8dffa2d447a1ad96d551d196420c048bbc01e5e9e92d35746baca3a7aafff4896944c4bb2274eb32f50c503b37cb1e7f891d0a68cd4996468805a4b5fc82f2ad97305e163874b30264ff5d91a39c470756c7974607f11791cd2b0bdb72e4a86d0949a6cc425e605daff466b54159d4094f317c2b77fad5b714f0bf9b827670b4b38e459d0e440c4d5995cd8f52497c39e7d22cad6ff06e8a88f99d5afbd4815cafd043620f08be2e111cce8f9456801b537ac228f7d7d5c69aaacf9066943dd76a288aedbd8108e1a998ee684c221d1814d1a8b530d67fe1a04b19ad568d55c8219584e8d803cd5b6be4566c2daa1d81b37fff1eb6cdc75be141eb82735751566899622a9f69db4e4d1dd758f907e56ba16804f08213b8cf29839a3fad73ef5d9cb50fe503fc01cb2dd8378fa5d05f1a3677aefb110c9a0160b319686a743493bacaa888c273812efe087ba38af74022cdb8e46a81e969d857ef0a9c90b5fb550da9f1bb90db80c1b9ddb13d3af477225c92ef0cd228de6184efd1633441c93cb61cb7ca12919d66f704fd8f836af458058e5081fe0fea770b87066692601f8d9452805ea79e7c9960fd5b924b74b4816c44d56f07687d32cf33cd96883b6bef8d3fbcd0f95555daa9693a7b5bec799f7ead88b21ee4e22e670f1aa4743538182c5678bbc34853da50e6414e6836b4651a08542275e985fc32f973e8fa6cee3746e6041c19ba9a35a87f3aed12ed1adc145d015c4764359b05b5dbd8f1949f0570c89dda2c108c8c73fa5f1f73e8cae9cc52b0ab90dacfc3018f923d3e6f3e07aa2f3db66401339f6065c9c4bfe08d887b7e6b4cf5e38f0aa755494a9bfb55de22609d3c0c2f804f3a29755c98a531b766f383dae8d64ffc7e5d855c3d3f8de067114e1171cd6bd37de52b193e42b14259b0757503a8d8157c9bbafa0286188b8863a49906b1025f666918ba02d96776552ba8884fcf3049c46cd8de86f3d1cddb030127cd67b62d2725f91ef06c34bb21095b34dbdf1c6acb68f4ccf1dca13d2dc43a97062b323bb4249e7cedf07f1ffa48f3e8ac31c2dcd3ee314d12f99364455d6a533b341797090189084f8a7841b2191f0bf3ff7134d0681f918150b47504af3acedd5055df33e41e180b0ebcb3d7198ddeb0ac023cc78da7b5acd9a0ec8f513b98bf5e263bb757ebcfd75be0f187993df4843b5d14d14bf84d2c0136f621ed990aa6d131cc288eae42428156f73627611f4fc4eea9d2c46912c087f2ce7c76d897c6ea917dc4b5dd3b3c9c49c458161c6f2e1bdecc86874d859d72d66c1d024947f884c7d61de84f45e152b8d6446cce267270995a3e60f5a96ffe3e751046e73953d090ea17759a13d30e163e60ca0fe3409bd94b0cf8992d50c9a8eac7e8c37dc66936037fc8e88827e624b6bb7e5638a6e0923db2ca8b20dd0d7e03627a97ab7728cb23da2f808cb1d78affa92acc71cba866d6dac6a81133ab7a05816eea185149ca2a9e1ad36b8dfae033228d6159a3cf8ebcee5e88925d3326d90a4fd551270486632318cc1ffc613ebae4d373b182454a69252b30e63cc59337d79bb557af1e60f5941c391b3a36ed5b432339e07eec7c3771f4579fe6e186d7bfd4019d3fdc41529431e3dcfb8b61bf212d22696296ad930d66e31b9a6aa3e3e395dc806051ab4f32504c0d661afb51da884f3f3b779f7f2b6732db313730db46d1a8da5602cfc383a3cd9e5e91b59568a421c01fa3cd0f37acd1d74350ee8d4faedb81b0ac7f47203801d760120bf2ab4d6dc716ae8ea2af3ab2fb0e3071ad1a60075cf9a94ff896db748e0a4473c33f1b02d77ab7629f80a30e077093a555f2aa4299e971c59dfcc3e5987d78569b0eeca3c5e76db4858382d7d5383f280df76d246784e60b32d18ccb7682cc4311220e287182e9e15a416455ef098fc574185f36bef599dc536aae238060b5074550f6a7a9472053416da3bdba6beeabe20a7df21740c4bba01b901c62ae93955df14db2b239420918d03be790a6ac77f1006cc5d1c798d254fae936ba678b5c2b8d218a50bbcd768c9b3aad781ead012d3f7382f6007d33c7fdd9b9855c982e6702a7f0e89f44ac9297ecc68e265160220c313be8aaa12181b514d80e638d2546935c1df99d9f7905de7dbdaf4a467e28f4e485565bde74ac9aee70945db716c619e89689cd83037e699c84d48c38b9940a165466a80b918a052ab6d10586c20610029d8325b2ccd28695f1365226632e73c25a7a3f2d71244e6c0b0fbb6ce5e38c4da5cb581713ce0d6cbd987400dfb59bb9b9af9a5e0dbb79d1e117c6848f6e9ee4c0f2576c60b71a02bf672beaba88b44b0ef8f3114ae15c411f3ba55c21ce7f6bd7a5e6cf81a9fea4326995d56cafadc69ed9b6bfa53c21ac4bd3f1e5576cc4842e582711f1f7703bcf63800ac333c74289297f1cc31aa8c445d7aefc084450796401d27cb4a5bc55799066e36fee4b144530c4e09740c48bc9c2198810915f2eaaae8f58343ef898206279077118dc6fec8e5b48deab562a7b23ba459858a14413c0cdfb4da003cdc9b1cb8e925da7c2c2ec8c8d569722272ad37631ce12482be6641a751ad926e6f1fa31f41411b4eb844e3fa509ed0a986d51486e190e6bd1996118bdc0205f016719303d1a004383aa9f74981fba9971eab7ecf7c41ec09e9134570ced9e5e77d951ab7bea8218e17eaa741cfa6d8b0fab3cef8285c9755800e666a7a6de742416576add5a293b93d35c8be2025326ba1ab535e8f68eadc63811b3a809f690879b5563b7697fbc0b3313e203655ca5a3bc30189740142a6efbc049c26e30ce567eb1c64ade02c24290a4c68e1cc045d8b828240c41612bfdc67e72de09777cbc2c606e917920fe2500624761ad3f182f5297edc5330e3a56c0984bd1d569d6039299d0cb62d7dc343a243df1b34b79bd432659e9e5a50598bb6221392ffe73f8b55134d663ca53841481054c06cfedfee55587573aa77dc2e521dda8aad86ac837a797c6971df2f137f54f9d5a6b1edf95b4d056f323e8da1d7812881689471e5676e0968bde3524f5493fe886e2b91558eee87d71fa84a674a46d40ef70f37c35fd5352a1099bcfc23013e7dbf54a8f23d1c450b0d676d16f3b639fa00fcfe4528ec615ae82486775d26fc15383c8819f61e9f31608548d0d9a7052ba8f6f551ad82ad320045f2967eee194b3ba71ed82240de8195d7e99e8776448381b7478424dfd90bbef27cac78d3e280a2b23c8901e55c5fe4da52c7d278439592d6ae782d292a0f8fa50c3803fb51eec7e3e2bdb3185d90fb34130360c90e2a77f90e35dba19c9c820b94ad97042c879f48a3dbaded94577b2f8fe22a3d9497aff580e515e5d086007175a41406abc53f102e5ebe1fd202f385206b1f5f09d3d6e28d891513372a4aae6abb6a9f5791f38b071f1dcb8bea8c40a1b890fbe4ab1adc9bb0f9ae2fc8f26e618f4a449673dfa1960cd8e6b7c511ceb3520eafdd4083af6a198641ede50f46a1160d3c3835a4981aaac3f769a247f10d99bccdf4d5fb20b91e34addc4753ee9c32781a76ab0358f0a81fa6aa0ac956c601fde96886327ee9834fcf1681144f151e6645966ab6ec58f3d7836e42f69b56fdc8b25481eaaa2bf2e03c5cf45ba58e8305f2ae995fed11727ab69e2c523694c83d9f2134fbac4bcdd917c63ebd205d1d50c9abdb2ed48490b81c65b2af42e8fc94c4e5c3fe6b0a6ae2960526665e7f9607a058678831eaaa64f238006aa6dd7e29d12301629f4957fbcbd6ff80b7c8c2afff7a3d8b71b7c0eeb4b2927ba43a20de7d32567932165c326b31c790c482eac8e4bb51a9f9cbf0096f21da40cf9cb3ad25ce44f98b241086554f28a441e133a6088484f170a9c5678cb120249de8789835bda0c9157d8218cd6026869941622dba5663018c76480dbc84fcf09d55e7784c296ebb3a1c507e54d1baa38553ea023b6628dada71279f95db24e8826508d5a0409766b43280df39dd56677c12b424c5c88cbd72c421107f6ebc7aa375672b0b1e5790553ebff428e89e7145cd13b756eb5cdc19856d0eb8995c16a6bee494944c2c927559a970912723a52bef61cf764487763bf40b503ff6ea00b925520e4a36ea3d37aa18d38f02c8a576dee17a7bc0eae5455dfc70595bd23493bb298cbd2af2369aa793618b51359d0f51d1250b04d19e1d0ec44ac6c2adf71fa7ad275d7b6a462adfe1d6d9f6224cb574b0b958ea0d5427eae330595743aec5ac0092afdc5a677ffabed89eb7fbcf8f595218f0c7b12cd1359a4da4b7ec672851d25d126670409c3d6ff73c84776a512da02b0fbf090f5147f436351ae28857d86199e07ce9d844f4f8688d7bea6a8a9973450ed5e42f815ef57848dc24487516ce81189ac3ad7790f8ceedc6c1ab16d6ee82a2b621af80fe5e659e32b1f53847cafc20dc1ddbc69cd53d2439aeab2bc5252a2bff0219ea69312cded41ebffb28b71323f72e32a12dd448ac3351908f3d2b44bde495d84ea925ce72bb54ff3a3f1b819bb0bb9630133714369719f292b10bf2379958c7bb2a5fb0c73d0077860be5950ace033ca987f05a50ec290b76b6ae4e80c4049c31d444d30fda60c929349d82dd5a4dad9d7fe5ae0658d8fb76885c000ded67cc1e40e9738a30329f09b037d04a4740e4422e67057f6c48b1e9121ab71863106a0c8d46de1817c5460605dac5f953b9943362cd4a865ebf236a8a7f691e656e5a810a5c8419ada088530332a903af9ffaad0377c2d86f62bd8ad74389d87c9c5023c09db453e9b65f01fd4f3aac10725cccd07cb33659d63748224a066248b7f84ced3c6a1948223110349bc66ac265b74c6b486a09353b9ad1b04d7cdbb0b5a1f6c23e54b769adf506f76836621474ea170d9e4db7102d9acc4df7726cf88cd41c9e21f0ae92adc0b17646a03e642cce20649bf1d8eae32c66e7da5cda92453e31b4d830513bede231c8c4f9846b023c4749a8d3d6d87fd7a70bae1842c73f920b9aef3f0ad88d6bb69f141a2aff230173b2a274c4c0ce41f0dad642d41ce65df307782ec72c636758973a773383aa3b4aed6320d43b637abab7be33af07a8e17f179226a1ca0c85d06b1c2e4578cced553fe2fb3b147c2fe1a61b2270b5db712f47511b7ac5d68a0e5c3456ef48bd388d92b7da39ca53088ca1295efab520c3a3c007b1ce19e22d0fa9bb2b824c20fcec4455c9e504b3adca8379a99b4ff1e71641e390462e7eb0b1a03165179f5d2c31ef912b1a7814c4ccf4790bed84c4f5e876733d80690665e1974a174f89d35371f1dc462a5c3ed985d7a1719f417e1637519179c5f6a9df551efbfe5409c4e66c05fc8464a3cb7d1f5c0d81dd1a4351e56d181a8e2bd7ba17c38c49c9fd5e70a642ae25d623cb1f1dc1924cb383c6de2cd36269b2c537554dd670e111d7588fe5e462c91bf138d91d07e5ba3c3820dc0f8ec173fa35048daf583a9b8efcb5456064c6997f7ac5820d2d6b2a1bad45eb2d3eb36d2b6eb485e018766669b1991e9f974dd087c276c09d28134db900b3c9c5d470d0f1fe115a0d676722b2b34a5425700b8e108e3d4cb88e13da90f1a6a10649c96f76858c06b0fc2d7c583b499eea8d04bc00a9eb0888f4290ae2b3ef80eccfa3e414d1d815c21b2e261b5fe090c66529a99656a04e872b9dad6006822040ad5bf5") ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f00000011c0)="ac98224795093faeb99dd0b38d2517c615fdeb2acf57d7a046d1643b772dfa") ptrace$cont(0x1f, r1, 0x0, 0x0) [ 1006.597664] binder: 7968:8010 got reply transaction with no transaction stack [ 1006.604825] binder: 7968:7971 ioctl 40046207 0 returned -16 [ 1006.606256] binder: 7968:8010 transaction failed 29201/-71, size 104-8 line 2741 [ 1006.614630] binder: undelivered TRANSACTION_ERROR: 29190 [ 1006.638001] binder: undelivered TRANSACTION_COMPLETE 10:08:03 executing program 2: r0 = openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.type\x00', 0x2, 0x0) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/81, 0x51}, {&(0x7f0000000380)=""/238, 0xee}], 0x3) r1 = socket$inet6(0xa, 0x803, 0x6) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@int=0x8000, 0x4) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c126281719070") r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1006.651142] binder: 7968:8001 transaction failed 29189/-22, size 0-0 line 2834 [ 1006.679205] binder: undelivered TRANSACTION_ERROR: 29201 10:08:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) r3 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x10100, 0x80000) ioctl$KDGKBLED(r3, 0x4b64, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:08:03 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:03 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(r0, 0x0, 0xa000000a, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x1, 0x7ff0000000000000) [ 1006.768822] binder: undelivered TRANSACTION_ERROR: 29189 [ 1006.778070] binder: undelivered TRANSACTION_ERROR: 29201 [ 1006.927015] binder: 8040:8041 ERROR: BC_REGISTER_LOOPER called without request [ 1006.958640] binder_alloc: binder_alloc_mmap_handler: 8040 20001000-20004000 already mapped failed -16 [ 1006.971167] binder: BINDER_SET_CONTEXT_MGR already set [ 1006.976661] binder: 8040:8046 ERROR: BC_REGISTER_LOOPER called without request [ 1006.976712] binder: 8040:8041 ioctl 40046207 0 returned -16 [ 1006.984238] binder_alloc: 8040: binder_alloc_buf, no vma [ 1006.991481] binder: undelivered TRANSACTION_COMPLETE [ 1006.995855] binder: 8040:8045 transaction failed 29189/-3, size 0-0 line 2973 [ 1006.996008] binder: 8040:8041 got reply transaction with no transaction stack [ 1007.004855] binder: undelivered transaction 3578, process died. 10:08:03 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x9}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:03 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:03 executing program 1: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000140)="03c92db1421bc108b2760c36dcaa3bd5752d01d665c5ee9281f45a47eed0d2c13b393121a63b5226858215a9426cea0e5db9f65e695437d501122ff68938d4418a31fe7447bc37268854383d828f40417856cf86f2c6b064de83698f5ad53ed2f0c22334247025a73a7ac23e35038e757af43d2b033cb56efb18ef1edb8d0039663d6550fd7acf976c22dbdef47187e0e10636c548d73d92dc7ef2404b8c779cee7a10e228244c682a13dfa0f42e315115271d9f203b22ffd90698470c3a94567073377895862333884ecb514b10340d3142f897d123780a041a0668b15184739bdcc0c1e8cd1e0e2ddd269048f35c5c278601c53c3e0b1de611a02308b82e05") socket$xdp(0x2c, 0x3, 0x0) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x4561b66ef29b29b9, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:08:03 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x8040, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000080)={0x0, @empty, @loopback}, &(0x7f00000000c0)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'bcsf0\x00', r1}) r2 = socket$inet6(0xa, 0x803, 0x87) r3 = socket(0xa, 0x8000a, 0x1) ioctl(r2, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r4 = socket$inet(0x10, 0x2, 0xc) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f0000000200)=ANY=[@ANYBLOB="6e6174000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000"], 0x78) sendmsg(r4, &(0x7f00000001c0)={0x0, 0xffffffffffffff02, &(0x7f0000009ff0), 0xd7b8b9a44e12b4a, 0x0, 0x0, 0x5}, 0x0) getsockopt$inet_tcp_int(r3, 0x6, 0xa, &(0x7f0000000040), &(0x7f0000000100)=0x4) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000280)={0x0, 0x9c6d}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000300)={r5, 0x8}, &(0x7f0000000340)=0x8) [ 1007.022803] binder: 8040:8041 transaction failed 29201/-71, size 80-8 line 2741 [ 1007.030702] binder: undelivered TRANSACTION_COMPLETE [ 1007.037564] binder: undelivered TRANSACTION_ERROR: 29201 10:08:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-control\x00', 0x200, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x28, r3, 0x220, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x240000d0}, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r4 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000440)={0x316}, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r4}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000100)) 10:08:03 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1007.096573] binder: undelivered TRANSACTION_ERROR: 29189 [ 1007.243737] binder: 8065:8074 ERROR: BC_REGISTER_LOOPER called without request [ 1007.271186] binder_alloc: binder_alloc_mmap_handler: 8065 20001000-20004000 already mapped failed -16 [ 1007.283143] binder: BINDER_SET_CONTEXT_MGR already set [ 1007.292649] binder: 8065:8078 ioctl 40046207 0 returned -16 [ 1007.303266] binder_alloc: 8065: binder_alloc_buf, no vma [ 1007.310640] binder: 8065:8078 transaction failed 29189/-3, size 0-0 line 2973 [ 1007.322177] binder: 8065:8078 ERROR: BC_REGISTER_LOOPER called without request [ 1007.366930] binder: 8065:8074 got reply transaction with no transaction stack [ 1007.368435] binder: unexpected work type, 4, not freed [ 1007.387537] binder: undelivered TRANSACTION_COMPLETE [ 1007.396938] binder: undelivered TRANSACTION_COMPLETE [ 1007.406568] binder: undelivered transaction 3585, process died. 10:08:04 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000040)={{0x2, 0x3, 0x4, 0x3, 0x5}}) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:04 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x900000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:04 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:04 executing program 1: io_submit(0x0, 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0xffffffff, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000200)={0x0, 0x8}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000380)=ANY=[@ANYRES32=r1, @ANYBLOB="b1000000853ae4ead9a0672bd8a6b71af35a6603ed0fe76887bd7b8695c8cbf8a39f8044d202c3220d99c2427ab82818b552e5dcee0c9fcb472fcd836b23dcd74ce1d85d58776bd6490a1c6dc8efa9c3bfdc6955041eda45c97ff1568bd4b46935388871f0fc008a09b543990f7c11fc657043f09c04f1fc3388e17df3f776739d3555211dab134590a4e8e1b09af6825e1e8951e2a0c6562cce51216bcf85fb1df1eb03583bdb6af23fd0168a77ec29faf9088e738ea9380d93a5245d410ffa3da0984fd1f40f35e4dc6d8c7176bfc44c366f4300baf462f3fe91b471cc67178fb72a20aa4d30a4d6ded10a9dac2ea02ecf428e37"], &(0x7f0000000340)=0xb9) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r0, 0xc0845658, &(0x7f0000000140)={0x0, @bt={0x28438ee9, 0x400, 0x1, 0x3, 0x3, 0xff, 0x0, 0x400, 0x819, 0x9, 0x5, 0x3f, 0x6, 0x9, 0x8, 0x2}}) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x10) accept$alg(r0, 0x0, 0x0) ptrace$cont(0x18, r2, 0x0, 0x0) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r2, 0x0, 0x0) 10:08:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0x80045500, &(0x7f0000000280)) fchmod(r0, 0x100) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x70, 0x0, &(0x7f0000000440)=[@decrefs={0x40046307, 0x3}, @acquire={0x40046305, 0x2}, @increfs={0x40046304, 0x4}, @reply={0x40406301, {0x4, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x48, 0x8, &(0x7f0000000300)=[@flat={0x77622a85, 0x0, r1, 0x3}, @fd={0x66642a85, 0x0, r0, 0x0, 0x4}, @fd={0x66642a85, 0x0, r0}], &(0x7f0000000180)=[0x28]}}, @register_looper, @acquire={0x40046305, 0x3}, @release={0x40046306, 0x1}], 0xa9, 0x0, &(0x7f00000004c0)="998db081e3b70fb6c1b34d46d04376ad74547a02ebfd29302e84b30408882de9e8d4f541e818bf106127b56f45a55112593e40383077c8ab875c46b61d2ba39d40590c7ff106179e62163926aebc5128ea7b4001bcf08ba4500084ea6ce4a77eb2473537207b0f11c4ff37c9388a31f55f3a0d72dd1793415e9d790efc2c3f4fa65697c3a31b445f67bf64c09214c5dd57106abb4a8d7488d101a32ce81ea82155540a863e76094801"}) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000100)) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:08:04 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:04 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0xa00400, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xfffffffffffffff7, 0x40) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) [ 1007.556573] binder: 8090:8092 ioctl 80045500 20000280 returned -22 [ 1007.592881] binder: 8090:8092 ioctl 80045500 20000280 returned -22 10:08:04 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x1ffeffffffffe, 0x8bd) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:04 executing program 4: r0 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x4, 0x400281) ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0x100000001) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$vcsn(&(0x7f0000000200)='/dev/vcs#\x00', 0x0, 0x2000) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x7, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) socket$inet(0x2, 0x3, 0x80000000) r3 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r3}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:08:04 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:04 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:04 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) socket$unix(0x1, 0x1, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xffffffffffff33ca, 0x10400) sendmsg$nl_netfilter(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000400}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x1560, 0x1, 0x7, 0x0, 0x70bd26, 0x25dfdbfb, {0x5, 0x0, 0xa}, [@nested={0x1414, 0x7, [@generic="adbe9162ee59aadbbec51a94ffa3e4b27d330789a8102ecb0dca9baba51a77e8d185b06750e8aa1b350d44ee0a168d2e26c9389e4b891d621a5d322ca77209f48fc9364b9b", @typed={0x8, 0x7b, @u32=0x3}, @generic="a72bb31d979fdd94b881e32fb78ed5a2aabf3149d5e10cd9360d60e164b78017f4b9681886b2ffc62b28aae9f105e863784f3691670acc3725dd4a7a82220bbc9aecf5bf5c49c10817e6ff8b93ab5edff8a93d6e1e4e562e6af30162fc6a574fa71c4cae8e7b33b08d5fa7c1d2ed44e9d056c2d31c4fa66ffd83c6817424fa6518462cbdea846b19eebde1ace80e9325e971e900c0a9fcfe2aa2aecc20eb83e1d449e8584f39f777e8d0", @generic="41f2fcf671a56b30c7e913369b3a195c59439eefba19bb8ae003f7f012c37811232a66c71c259b7ad5b34c4b4dcccdc1b9fc852077e2b8d807fd77d602c64a9b82dbe82328f4df390cac7cd9861740ef36d2c58b9ae740db846189a450135a4d994ea88938d4c56d4a78d0e6c2921f2a74ecab7a8dd4d0c875f7da5ba66a337428aca6627390d85148493d62ca80", @generic="a70325d6d5b7ceb9da53d5a95bb5c8b66a9489755f7d9fd4b549f8894a72b6e1a402fc47088238d07f84c237cfce775fb57a237ec8934c85c1af025d9eeb8a9b29ad7e3ae7bd4c2ebe1aa5aef5356d2e203201523aefd021283563ae3a723e3b2a15b5bea9d4779b38dbfe3b452d354c879ebca1b4fd2e9b0f8a5151aee09b3aab2edb6c82c485e746cb2c2d0d9702ad76cc7eda5202e58ca531be3f31ae2335074923b79a73b77b3b8d87c65c0f5d28c9b50500639d3f0cc1cbe2a7a5a5a4122c2561dad2b5b04fbb0fc18645a8a2dd8f7ca1496001d4db28463c22841ae4f6a97d7496026f701264efb8b84742877a5d97c6af9b19bfd28c8408826fa3d2c0b1c9087dd1c204f8ba5332f293b7002aa1fa86827de2391140b7e1e8884c8e456112bf3c93f71d7c696ecadbb902018b834ec22e90de6344aab69122193485f777a9348b974e454c4cedd7ad478ff072fea2fcb5cc4ec71865e3f7f028785778eaba1ff6119639912a401c6239cd1d9c1a23bef22cc723cdcaa2cfff9e42978c9c2fbb09504378624c9deaf91381cde0247b849e3f9e142c57434ef2af82bcfc128f12ab973c8650a593efa0eb1abcb65af0bb0db85a1cb47a652f35927dfbe10a9dfeed58b2d63783a99bbe3834e7970f23960745027d9962f1abfc9fa202e67c7e37ba05eae2d7d31858ff9a963e0f5c719999327d45235faf3c858609fc83007d0ea9687420bc4a6286cfcc0b25ada8d5f1fd5d0acfb07493d94a3383eed2f02c956ec358669b9ae508f442d6e5dceeeb4a93020041954c50305cfbe376ee36fedc96ff58545a1f055cfc568e5c319eda1cc563e8978f89afb75862d6b998752479d26c9a07a26c3a8c53a6f02ec20d74307f74b16befdb23ca67d5f0afc19f176ac7756598a2518cda9fcd16a24c07bfad839c9cc939124efb89e49d1cf78da3b66b5b8bccd246fdf244271cb0dd2f13e14d9a685eaf86084129122955e7cb0fae64e22ff6558f78a17562c7ca8280c63eb3ea874de6c2d5fa4a9ed36e92c6eb8f18cbcbeac4658f1fb994a14f79b3fa5989bceb77870991578aadbdcb46588029340deaf980b1e6759994e432c538057e7246a880e1882c0a2b74711e51d309afc4b30d598bc0361a1ff3d5607e4f9176f57097348ee2d6078c0f26cc8f5a62824d037312a5850408789f825dd386fdae78afbe2ae0df2788cc9f284e0efba758ee8768e151e2bca24a1062005a92fca7f6b4a6ac48594d23159f343690d5ccb0c376912ed55da5fe8369d77b32106145faa5d8a94259e2aff3d3530d1af63b4b45d2e2e81626eafc4319d5101b9a8a5882b923a332b63eed1abc7f959b984e0af3e4d4f989f0a26b7bf730c6700a8a02db2c06fcc0f75e7840b8fa5466b13bcf8ff762ea9984acce0dcb6bb4930e4a89ceb6dff74108b481ce3b509d6208c5a5f0c5433c1d1af83142a56a742536138ee18e299e73e6e11c08168fc53c6237f3d6241ddf038b24ea42605b092e756911f5c730a7bc7c6b32b9c1f5bbdcfd864b7be0526f07a63bd6a2224d352900f4fcb4cb48977155c28a8f819b065d5195a617ecd07a744365f655d8c4d6f6e4eda4b5f8571955e5bc06d5cefe34f087286a6a4f1b42472d614166eb8511247b205fb3c3b7277a258d01fa66dfc6b231edf84452fa33c948b5de05813085acf41301af2d697272c5dd435e19d26d863f135dc51dc1c50f6c4391930beb41a20fc8cd7ea44fc4d5acba09416ba6f2658774517740c4a94d4dd1fd46565b475c265fbe6c2bc09cfce87f36b3abe8634236c4b6e45a83b13d3efaf8a9ebec2ecc76ea13405824f2c2265c22446cfa514035e5777010847f2eeb88577ecfe0114502a1eadd5d7203a1d8866e8816ceeecf190482dcc0b1f40c4b9c25c75a116f6fd7560f086758d97999fec58460ed948eaa29280a9fc4c94858ca5b1e73b4603e62cf07edbf6db103a14e916bc6f616a90093b158c251e2d98cffdcf9aa2e7c8382fd1eda0283a9241d35ee518db8156b87fd6d6227d65dad7f2e06a07cc3b34cb0df66a8027ddb12f0d0827d2ecf3f80534d0188170ebb542e672853c01a2d0082e709126cc90a1e5c905831c8417b166fbf8b430fd224217aaa3d7219e7d902c7cd6ff750ea060230fdc5d19964753e9871a4904e13d7c2e6e5c24f88bb03fdcd8e477007feb5687c2b14b5288187c61b80ddf71552ade26491d71974326a5cca38c1a3760c45768d64c80f792447c280d230e140480c884ea7933af4ca62fc19a2d339bbb8f2fcc0cd6b6118f87377347d46d54ba375f372cb416aeed513caa2380bb7343e38b02974d372ad39f0c27556a62c0b9f703d278b90f1c6cf258b13118878886a0e5f45bfb89def660b7a09cd79fe2c728a505ff4d8109fc3e2166084b239abbe48b26f09bd883b832105e157f753787df21e78e7255a4204c5236ef802f9e03064a011353df652f50bb428ed51582dae1037809ef644b6da66f736cf734efb374d4aaf7ca4a352df990af0bf12c2f284b34fb80e0246011e106a519920d2f9c0869da02943dc21f64143102a546431cc0e22ab0dbf1fa06a24968ee8fe8247d927599c6ed342bf6698f2d11cb001681f5a93488aaa1e6ac1806e213f3e5ba2dc44f507845a3f22580d98c1d0862dbc6df530f6b977564d46c5e96148bd9ef93d659b4f940fad65401548b01aa91b3cb36c243880f3a353bf7ff3646033049f0e4149c39514a7c0b59f3e9095ed49297d765afb6b8613ae5ed5e3d019d5e05605ec244f257838fe33518c40888f52fd7407a07dcb28313c9bc184d5e944b6c02a80936c0953ec5159adc6b72050c54bc20af1a0ee2fe725cf788db247c754dcd7d32e6d6ff083fccc45eef5a4329a2558e4cd78b51c2167062b49ea5667143fcd97a41f3a8c3115409f64b7522138e1b515b404c97d04f64ef6c42a1a3cc02e3beb6ab2033e88611c819356192b0e556cfaa104d9e1ec2998695fc0401401eb6f228a900d5b4482e0ff18dfc6cf8d6f799f2bdacad3e2fb2655da2708408e2c72d5715b0b6ea0d8d40ce06a3f40d2f1a620ca2d26ae84e0d09ce08171be20288129fa8800906cc79b8200c69441744cac9790f057cf097122b1b9e064cfa9011b7a372767cc9e0c22d50a6016ee2084ccf95fef9090670e11fef3c54b3fc39035243114503dd56b2d5e37da7c164f563167a81ffdfb1abb76e4c0d74098d92f592250b0588b1e4e3149825a2b46f4c76727322245808f46dfe2a673a7dddd586d0b53d7363e58a4880c0da0e1a9df9231ec0f8b4594ce35db630e5db94c0268465527ea42bfcff901031fb17c726a6e3e736c09a948f562c813b863c9682645a2b6aa1da97d34ccc3a35a1fd20206859ebeda9993545d63934a51b10098c94ef51640551ea6f5d93c6965047b6d725b3a94807f1b2b0f0afc6a9ac969c187ac1800bd3900696eeb79c36efc3173264082147284321ffb2e4809a43f05f0e45091a29e144a96f1617fba728967928c16f74c71f09ebd19e4d20c37531eb5e75ee96749f4ff3ef5a7235aae0e6e677c76fd5a5cb107f49194eb21c2980d80b65e987a2a3d33a4bbcf5bb47556c589c257a6b41ebb376c3a7c2414199b300c9cfab38b77589b7e7ec2986b232e02f9db52600d881fff687af4660ce1f7e598690a12c55919de31e527e3a21b2eae7f98c57337f515192ae59e718eb56778d14f41426de1dbf92c45c2a8b7085d95648d7f29702f603acae43bf70c8eb087e642d41d42dd1425c4699d02f702a3d339797e64aa1b09d2229d44d001947f413b9bae46a54684bea38d2b8c90c1b4f47717f4a6ba04971aed930755d883ae11335e95620da580e076a2dc2d61e96a0e925f5df0bc7c69e82d9118b659e27bc9f6befeeb69a87d5f3e95eef1b3767693f0a78e7eb49470a2841fc54403db20cc8f8ffda0f7e25d4274bb2c17ebe857da82cd62f5286b810d3d16de801495d9266e8bded1dddb8587d5795d522f753089519068f3127b08e8028c90c08c306f6ec58a11769122d95dd4d3a8539ee75e0d34ef9a71bae45614f9ed5b0ca4795bc787aff2e7c3e84ea1377816e7f4e9e0ad6d98b6697490275b897324a54e2ab03a72bdfa8a7d47659e936f6d4705ad6f5a667974c02dce23a9f3fa45011154bcf0d6a1bfd48b945dc9a21c9f47f0b211f2abaada22b3aff0ccb306563e45f38a1c1bbdbaaa51d8ad144fb956aaaff855b117b8fd533da638d43ed935267e12e903d8e1557430129b10dd07ce811c5e5de93c51f8936ce8c3a86e4992588b7cdf381a9dbf8e3bed95d9106f9888b2000d94f2cf1212127c157d3ea30435bb2aed48bed25e04943db617ff9e9598f39dfd6bb284822a43ce7a43a0ba4b69898293e670af79d03c067b46ddaab0ea6f9a9fd6ea3c886bd3432acdee69beca1636f5dec49387159bf818fbd0c8481082fa3fe489de55a6067e1fbbdcb49d2b018f19ed49674b41e0cd2ba5da4b0b8fc87d2daa16c41d08139c46cd1987d57a29fd9208c4708b391946ad548f1bdde71c3f023b889b15f7c9a1ae87ae418e2dfc572be241edec48038fa81c1176ae0d47a289eeaa9ae72ad9b11377f98ab163385f7f3cf3ecd6403151cbfc3edbdc2c2922e6227c5645009039e5bead22d7cf169c9f9984ea989ddaf0a7673699d623194070574f0e437a92d308836c17c4710c601140f288321fb7935d8c1f1ad1651e253980a81cc21b81fd25e4a91755ef7a6f67f32ab170ebd2c02db9d98eabffe00015848dfe2e2e65ada9ff66a3eeb3c690662e66e8dc804e31859e891a80a9b26d1177ab2689af801d065512ae495ca55b20ad7068b032818b05f5353a06cca031186a7db25a5ebde8b52e326a0c97c037ebf334273bae2aedf91ba1c1da7461870bc7f75ee2461e705ba641eb28826177078aea7a83d8df1842e500c5298217dd04987bf85661d82aeb3190351bfc38f8ddfbaba52564713f50a6e766d2b710a8bae6b567ac030e54fbbff783dcee81e513bcc43c2ad095ed0287da4c69c781288f4b435f0c4c4ccabd5b6d8cd81b17a45c8c1509b995523fe7573dc2c27369621229f9f0db6fc6f0679b665441507708281161fd90f32d1d0d03eb7799724dd858a3452244dcd496689c026be7377bbf3930214d8d6a1bfb87ba6efe2ca0b3d42459fe78fbeffc63aec3418d503bd49fb5cf490a2b1dec363505f4a8473dfaa2c7d332f292f301fccea5b080a3904f3418891af7839765382f93d8e2557c325f0ed62fbd930ef154bbe7845f8bf0ab5666cf5b7e747e3f366c2c6e8afbaa7ca05c906940208956ffd41f999ef12a1130ca4effc739362e04d0c57d9cc5e37965a2f3c0c8ad3901b70c692dbde0fbb4a3b17e5741a1c64abca98adbd46bf92e84219b58da34f4724375b1c8687a661ead0bd13830a710dbf5e6ced11c9920bda0930727fc34934765b7e0e2ef26fbd3e99f0515d0300dc192eca57743816a725e2ba568a6fe212c12dbbb25c246b00fec71dd8eddc01ecd7cfe9e35d98f0177ec17883f65c81f3d247ef3d1336f3801c41517e13098b3825af0cede12f26f610d1f5deb0c25ac1a121ade1c4a97c2ac6196f185a2de65b32eb5a7345b7f839065b8a5884825e8450e379536c6961c0c988e74bf0b3de14076f3440205093d5ebccd12f5e42ef59b458c7edbb8e6a1069d4eccf91a72a2145cf40959a06a925c2a9b48015a25f61fe33203308a34851b6558d71bfc77d826fbd2ad2b08314283bf", @typed={0xd4, 0x5, @binary="70350e0b16dbb2140db5287677f1ea9144234586c98e917f3ac6277704ec18d1189b9c3fac4d61a5d2970c9f47b4a636a38ecf546dc1d33f62bc51e3295431024f861bf0e29377930e2f9ab5078f8ac8d89e38b53c9b290de88ad76b2b0ef4a6a6d4782c92f9fa1b5f247bbcb693a7d99b13ee0f08bd9f5fa3e9f656221f636a77891f805b7cff53ca28160656b6bce49a0405db14c97fb3fc1ccab8131b93fb43ca95d9f315b341e3ccc8a69462674af131f18cedbafb3a45ee3a35d25340dedd148c171c20021b2cd14b8026"}, @generic="44cd7180bf8b0d739ee201a589fd30bac674b4b63f84f28b2f4f760be6850666e5293c8894ae0b682de1e2570db6f9dd98e98ec62751b7c8f6a2d3d17570add36dcdc5784b36640913e1d4c214681cfcc20f71454d03c5c0840b8ca513c9cf9237ba8e5d085a86635ddf00395c28b05ada540c26960f871efc0b462cb8954d5f86702273ca1688e9d684e0621e82f6a875e37070e5e4ab0503cf58a887c42fb24639dba029c78c428117055eabdc8e7bc23a1903df38ca61f1908f6d99a389d5c9a32f8827599d2c65a5e33cc89d66ccd10ce294b9d5e84c2ffabb0091a21d0ae7", @generic="3fbb35f06562c09ad9039b680f0649d2bd866e7d9435bc1848c5c2a2ecfc72772441cd1d2d47af68cabde4a143dabff6239ef1c1a2548a36010981c11f7f1a3cfe646c379966e4add27ca213fe749efb94d1904bdf2126e55c17f4579966fb84ab5546530e8221ae8a5c11b371bc9abe92bed9786508ea2e637efa78275e5773a072fae5a3b60fbc2f474febf89091a9597f33ac5e308d2b428d6a331a45fdea601fcfbec55ff6bb300f62be94957c384e7d2a959efffa575409133accbb6939ff7764e6cb2a465d95a096474de37888ed8b6d5fd9"]}, @typed={0x94, 0x6f, @binary="86c4b3782d1d4274b8c1cba6d95ce494111b9fecac5bff5bebcc52653e6a09c11e2fe3e2d1d70765e60f8549c3df5f87e5ce3ad69415e11e762e81dc377cfd1651905ce511678a8bdf38ab303a2c0b7dcef424949745444d051e87a27fa648b6d4c0a351eddd6d0c9d529405c48bb5590d52b2a55003620d781039c79344f0018cb68f0bd53a1956f9389df6d16c25"}, @generic="ad717224590248d07f3d5581e23c594aa032785b67ad742b9439c1eddb1496f792fd29341ac2f54235ad35153518265864e7608d41889be23b6a021da80c253b18e7c56198316c2cdee3d08b5a0dc86fb2863e7673c20ec07106d64a3e01b63cc437e8f257d05a266533ce02db4080e273eecb3edac61274c3aced8715b825964cd27439646f2d4e0e2a2d4a7e585f28a388c3313c62796dc2fbdb22da7aa603dae8e5a1"]}, 0x1560}, 0x1, 0x0, 0x0, 0x81}, 0x4000) [ 1007.808581] binder: 8112:8123 got reply transaction with no transaction stack 10:08:04 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:04 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x10005, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_NR(r1, 0x4008ae73, &(0x7f0000000080)={0x5, 0x4}) tkill(r0, 0x10) ptrace$cont(0x19, r0, 0xfffffffffffffffc, 0x5) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) ioctl$DRM_IOCTL_GET_MAGIC(r2, 0x80046402, &(0x7f0000000040)=0x1) [ 1007.910126] binder: release 8112:8123 transaction 3594 out, still active [ 1007.917039] binder: undelivered TRANSACTION_COMPLETE [ 1007.950762] __nla_parse: 39 callbacks suppressed [ 1007.950771] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1007.964292] binder: release 8112:8119 transaction 3594 in, still active [ 1007.989676] binder: send failed reply for transaction 3594, target dead [ 1008.033045] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:05 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x300}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) read(r1, &(0x7f00000004c0)=""/126, 0x98) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:08:05 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:05 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = gettid() r2 = gettid() r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x40, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r3, 0x800448d3, &(0x7f0000000240)={{0x77, 0x80, 0x7, 0x7, 0x2, 0x1}, 0x3, 0x9, 0x100000000, 0x1000, 0x9, "c9e6169903492a3f42d884ef438371e20d99156bc5a1b4cdfa9d91d8ce39778e9daa40e63c03bee9e0d8ad5f82a9a8ff29e731d165ecf5904e4acb163a06941438c97e6440b9c08752f4d5cdbac67cd7094838a9332760def561f656354fab656177badefde776ad8e8367e8440be2146f40a93b302b2b6c2f049c4c7e208057"}) kcmp(r1, r2, 0x6, r0, r0) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20c327ed01cc0", 0x4c}], 0x1}, 0x1) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) ioctl$NBD_DO_IT(r4, 0xab03) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r4, 0xc008551c, &(0x7f0000000200)=ANY=[]) 10:08:05 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1008.266875] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1008.284372] binder_thread_write: 1 callbacks suppressed [ 1008.284381] binder: 8152:8160 ERROR: BC_REGISTER_LOOPER called without request 10:08:05 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") signalfd4(r0, &(0x7f0000000000)={0x2}, 0x8, 0x800) r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:05 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1008.313159] binder_alloc: binder_alloc_mmap_handler: 8152 20001000-20004000 already mapped failed -16 [ 1008.326788] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1008.339943] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1008.348879] binder: BINDER_SET_CONTEXT_MGR already set [ 1008.360049] binder: 8152:8169 ERROR: BC_REGISTER_LOOPER called without request [ 1008.368002] binder_alloc: 8152: binder_alloc_buf, no vma [ 1008.368028] binder_transaction: 5 callbacks suppressed [ 1008.368042] binder: 8152:8165 transaction failed 29189/-3, size 0-0 line 2973 [ 1008.379631] binder: 8152:8160 ioctl 40046207 0 returned -16 [ 1008.406768] binder: undelivered TRANSACTION_COMPLETE 10:08:05 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1008.418214] binder: undelivered transaction 3598, process died. [ 1008.429142] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1008.440646] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1008.452629] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1008.463002] binder: undelivered TRANSACTION_COMPLETE 10:08:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup(r0) getsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000180)={0x0, 0x2}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000280)={0x2, 0x8000, 0x7fffffff, 0x8001, r3}, &(0x7f0000000380)=0x10) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r2, 0xc04c5349, &(0x7f0000000300)={0x30, 0x800, 0x1}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r4 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r4}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1008.501703] binder_release_work: 6 callbacks suppressed [ 1008.501709] binder: undelivered TRANSACTION_ERROR: 29189 10:08:05 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f0000000040)={@multicast2, @multicast2}, 0x8) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = msgget$private(0x0, 0x6) msgrcv(r2, &(0x7f0000000200)={0x0, ""/59}, 0x43, 0x0, 0x3800) socket$inet(0x10, 0x2, 0xc) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1000000000000276, 0x0, 0x0, 0x40010}, 0x0) 10:08:05 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1008.585127] binder: 8184:8185 ioctl c04c5349 20000300 returned -22 [ 1008.602229] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1008.653960] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1008.668904] binder: 8184:8185 unknown command 0 [ 1008.681897] binder: 8184:8185 ioctl c0306201 200001c0 returned -22 [ 1008.704849] binder: 8184:8185 ERROR: BC_REGISTER_LOOPER called without request [ 1008.750057] binder: 8184:8194 got reply transaction with no transaction stack [ 1008.765830] binder: 8184:8194 transaction failed 29201/-71, size 80-8 line 2741 [ 1009.376835] binder: 8184:8194 ioctl c04c5349 20000300 returned -22 [ 1009.378337] binder: BINDER_SET_CONTEXT_MGR already set [ 1009.384563] binder: 8184:8194 unknown command 0 [ 1009.388695] binder: 8184:8201 ioctl 40046207 0 returned -16 [ 1009.393443] binder: 8184:8202 ERROR: BC_REGISTER_LOOPER called without request [ 1009.399701] binder: 8184:8194 ioctl c0306201 200001c0 returned -22 [ 1009.409408] binder: undelivered TRANSACTION_ERROR: 29201 10:08:07 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x20040202002, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000040)={0x1, 0x7, 0x5, 0x9, 0x8, 0x6}) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) ptrace$cont(0x18, r1, 0x0, 0x8) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x7fffffff, r1}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:08:07 executing program 2: socketpair(0x11, 0x80000, 0x327, &(0x7f0000000000)={0xffffffffffffffff}) bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) socket$inet6(0xa, 0x803, 0x6) r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:07 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:07 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:07 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x3, 0x0, &(0x7f0000000180)=[@increfs={0x40046304, 0x4}], 0xae, 0x0, &(0x7f0000000440)="c5db28e9c9c14df5a61665cc27eba48e4d70f529377759296c120d356afa821dc22d3a71a037dd14d0c00cbf2fcb5b6631d2cd1ef4f5e5e4ae96f58fe7b7fbcbc7cd8383cc0f3cce82adf00104ba9390043c80ae6ffa4836f0b7df7911f999549a600615183f3559790d774483757c00e94b9f45231d5309ecdc4826c52dd3b3daff9cc4ea7f3b591c2fb91bbda5568f294f00aa256a8235c1a4f4f9ee3e76f71ca146c41076e9820cf7549f7adc"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1011.035049] binder: 8204:8209 IncRefs 0 refcount change on invalid ref 4 ret -22 10:08:07 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:07 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/anycast6\x00') ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000200)={[{0x100, 0x7, 0x2, 0x10001, 0x1, 0x400000, 0x0, 0x1200000, 0x7f, 0x7, 0x2, 0x2, 0x2}, {0x19af, 0x7, 0xfffffffffffffbe9, 0x100, 0x8, 0x63d, 0x4, 0x9, 0x1000, 0x6, 0x1, 0x2}, {0x7, 0x8, 0xfffffffffffffbff, 0x9, 0x81, 0x101, 0xfffffffffffffffa, 0x2, 0x8, 0x2, 0x6, 0xbd51, 0x3f}], 0x4}) r2 = socket$inet(0x10, 0xfffffffffffffffe, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1011.081427] binder: 8204:8219 got reply transaction with no transaction stack [ 1011.087306] IPVS: ftp: loaded support on port[0] = 21 [ 1011.094087] binder: 8204:8219 transaction failed 29201/-71, size 80-8 line 2741 10:08:07 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:08 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1011.388815] IPVS: ftp: loaded support on port[0] = 21 10:08:08 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rfkill\x00', 0x400100, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, &(0x7f0000001880)={0x1, 0x4, 0x101, 0x4086, '\x00', 0x1f}) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x3ff, 0xec, 0x5, 0x4, 0x1ff}) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = socket$inet(0x10, 0x2, 0xc) ioctl$sock_SIOCDELDLCI(r2, 0x8981, &(0x7f0000000040)={'vlan0\x00', 0x4}) r3 = getpid() syz_open_procfs$namespace(r3, &(0x7f0000001900)='ns/pid\x00') getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000280), &(0x7f0000000100)=0x68) ioctl(r0, 0x1000, &(0x7f0000000200)="8fe2c1fbb4834c41bece5eb77cc35b8f2e79c28b5951784f406db63ff06d79002150ab6caa2dbfcbe1d266f1e0e6d7ecf22d56f48c21d5c2cbb98e8996c4a2b20c99ff5a7960b584978dd10e14ebc368d739335e6d5e10b42d70bdba8bf96b1e24aed5fc97b1cf2f") sendmsg(r0, &(0x7f0000001840)={&(0x7f0000000300)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000180)}, {&(0x7f0000000380)="7a3b8e1fd6d13d1d59523213b4feaf", 0xf}, {&(0x7f00000003c0)="fc644538298c7dcc42409ba29abf7265d487a018927b4a4f85137b81aac9e2f9f4733219a4c5dbac06ff55ca8402c1d5ab3ff2cfbee96a0f0090ffa19be4bfd7b18e9c84ebf768c299088ff8a45375daf3c3d25a0c5160bd43b66665", 0x5c}, {&(0x7f0000000440)="1a2af01911a89044a1f5fbb3607e6861977ad0d3bc551695c170f701", 0x1c}, {&(0x7f0000000480)="8addba83ddb63fc8467cb3c589d38089812a5db113971a35b1c329fa68ad84aa58", 0x21}, {&(0x7f00000004c0)="497a6ead4edfb600bee9b28e9b639280d68b5754f2e37abfff7238535fbc7891703a8575ad49c8e030546e6a52dabee34614b1952f2a7ae3098a8bf88baa8fbace45dfd030e94e98c1ca15cfb7b578b60ef435b9173b69275c51a6bc5e534dcbca9de14fd4e43bea4d2187979551111d442962247becea298d91de1a3753290a3bb5d49f09d34ba115e599c7dc2deb539db2c7389ff65918dd02b210f65b7128", 0xa0}, {&(0x7f0000000580)="ca15e581ae0010b344d442db360d66f12ed8f6671641238411f750052e408750e5bb8a121350b5d19b11050846cdc495703a0d252a2de849e22b4477c88059427e7d2ecd67abaa79aadbdf3d13b17805d22902b339b68e5191a91a6229d400ff83c5948525afecfac66826ab2e1d0dd6fddbc8a1425a0f6201cf091ad17043055876438ee66a2d32043531226a7157117167dba0bc6d512a31360c6847790bb764a2c92ad55c693f108f197b9ecfb90948a86a1dad0520dbc9fd27733242086054dec51166bf0e21d6c7ff2033d62f2b6d38", 0xd2}], 0x7, &(0x7f0000000700)=[{0x70, 0x108, 0x3f, "3786ccd2c2eed86f90483db9552934d672c0059cf1f8487cdb501d7c7aff4654f62593e1945114122d4c857a47f991a52b1d48f936adaf7515a1d1a6206e37f36ffa1a3602b8dbe3f776cbd8a646d3029b34419d8e95fb7fb49405793b"}, {0x1010, 0x109, 0x0, "b2ea0bb7d6846a973f42ac8d7dbfcd08468e38828d6dd9979c6f6d94c30a43315be1c66b9cdd3484e1516040094bec8a134916e09317c540c69d1a9fd1c455a3d877c49849daee8ec65a9b19e73b8f13574ebde1efb40020b02058ee1ba12990eedaab5b93bd7bdf94406828cbc49283e013985e07b9c5193d6657275f6adb97b7af772d8fa84abd995d5337588511d8f86280934090916e5ca4d9b70174e9b1b925074a1d9ee9d145f08d6200afdc4c79d1fb3bd7f8879b0905065c0f9d5ebb0e183391c9d38b6f35ff6b328fba3ee5f8d07080995045e5dae07a105832475734470a67b2eeeb4ad05c6f5ce443c49497f61b4aa0d6135c1b720b6f80e2b3742ec25be1805916ee28a92967765aea7da6c3e06629fed8f2690958920e2bbfddbb8b637b5dc37a4089cb4763fbd94c67b66cd81770ca1ebbd4c60dea531c9ba25caf5a1be9d9e489d536d828c4fbf23dedbba3080f125a47d144d7c9e74ee6398c022a9c1f0366782582495aa25457b7e17f84c5bdbd927bdf1706fdadf0747e7da77cbe0936d7d2ef3b4220c9a2c5eaf9b97e804861188dc3f2d496c53fef3e0bfc97b1b6ab01e97fce0cb457bee23adbeb5b13b36517f488a992568cd60c468c8a6114b776c841a451ae707abda37f97d8155b05fb1593cf89dd3144f5794d06ce986fa1cd27741148190dc9b57d010ba4a6c50a6f8246a708e23c2fa7319d03283e5904f60048328e33110b71dafbf00a13795efb585d421ecfbc490aabfe8fd40f66e170f86a979527a08c45d86f53d12c35217d32b133f9c5629afd92284aade3a4ef1711f2be70fb4e87e1b197211044609424395613465419343fefa428f8737a8d7aa99a8a7dd15588b5572dc8c584b809f89a03e893170c65e586b299a8eb20a3f24274cd3f570f49997b88c7938710d6cf769d6f0ada13e41e469d62bd51c85a37efdee85e0cbbd15453478cc8dd8765b6cbb209d7bc2756814ed1158646efd12e45ac35f1d25e1b1e59ed5a24e868ce7c8f05a8fc780edb55545b2e0e05a4034fb9aff123c136b655ce72af8661d9ff333b8318eaff1a82b266372613efc463f341c837346be3eb0bf4ab6efe6316528b91094d39eb42ae6a2de913239bdc4ce96a8d5cae515e7787f0a3cf0055a9b62656d34a11a57fd3d39c0db75e38df230dc7020da255aaa65f92291e66f8837a03732c64cadf7b303b55e0597df2c4baab1261ff3cadca741fbd9667095f9c79656c13a3e210e081489313b82c40e17b843924ce2ff712e5b14c3c1f71c05cebc1ae173ada29aa2ce53cd73722af70e9bb584cd348329f0fd65c335905c661dab57ec023bf28f40ab88ee049b664fd8acb2ef13552325f7bae3830509a4c04ad64aa24c33cef7f4f909dd694d6e3f29fa54e7f41ea1d41b0a1404e14ad8e4e051cdd7ca2c5b98676a593d96e46381784011cbb51249f57d865ed41228226a22a7be8ca72c98bf7b9f8518036cf131b8c1acd365afcaa65ff52e9c4c1287fa1d8627d3a173adf9553f0d4f672686ff676de9a671b641f6f3451d4a8b25e23424fa6546f0befde8451d8fc95525dbffc797a4ba5bb98dbebed0b3645ea6df650c013085580cff9f6d51f1d4c6a776f400d71d004a9ca839c255ab8e6e4e561625fae356c1d9392921078da97e90216b073fcb46d873528b18cde7c5ee87b83439523116c92276167dffe7b842ccd7f53db844f093ef515b0a962e556a5cd6f6ef625cf16844c5e97450161d1d83cbaf0f6efd877631b4b3819ca1964691be6bac11642be8a1bfe0160f63ea20c6575e985f5fac5daaf818bdbc9ed20a14cce9ece50b325920e4bf5d8273603c86971f8d16f271ebc4428a71612e5aba51e38e2981c207532d30a86ba54ad18d2c7cd82f092126e5dd87196eb2162847dd3416f2ab261b3521b7ea2219b89fbbba1238736916e8ba376d2ca9046846b94b67312880b8499dfa6da8a551af44a69864a43392ba06503d22d707ec6c3ed4dbf20266763441b164e4a5670c26770451dc4856f27b0430f733e39f1a2a1f8fde18691b3e629183766b159ece1bed6dbdb403defa78511a93ff2d6869c95e28e8b69f8b94798f3eb4ed696f93c759d82e6afebf22f4a9d467c5e4449913e80439998a5b2a50613518dc6771e55a25087198cd0761a621606bcbb0dd8bc2a98a8d2c6509e04b61e8502a38b446aa936d70649596afc41e878c56dc7a31157879d156d1e5d7b93ea5aabc47737b3e979828911d887e69b615f4f15ba27fba2c2c56115d39ecd0eb434175ee73c7efbd1cbb5ebc670466db3d7f17257070fdcab7de2444d021f5be1552e6d8bc2e1c6ba3ba8d1002c5541df96890bdadd3fdfb672e82723a6b665b79fe367816153bd3555bcb6970401cb607f35bd7fa8456a19ce6960142bc496bb32eef89012ed38f456bddeff0bff8ce4b013519e652227a943d22b0050f8fc06e0a235c8f5a4e9ff5afdcb776a894c41bd6febfcf0b2235982e4490e99289c6731d90e6ebc242927825a490ba166128d487a3e52559ab38bcc0a5d21f48786f43e68249a0c534156652826a2d5ee0df4139ab34ced29c04f0446753f7f3913c635d75db2c904e32fc35705640e36f3f706a6e4dd42501853956943d3eecaa5257d5e5175b1669dae273a4b9bc89992e964b5a33ab0299f9c1d9954b916246c00c123e74a7e3d12a515efda15bc293d18257dd6849ea88d6cd9738a691c4cca74b2a00fc62f8a57b27d3f6b17b5b825c390107952a3c4d73a08972ce04a66b51d7bfed7df1a314025bbf1f096a59a4f393105b988d69658ccaac9cf660b90996b8a8b9ea7b85a6c902f8e16652bf15d00d80e13b48eb99236bf7b2432dbaea4629008c55cbe582269764769b935496babda6f12ff115e1c270908ebfcf1ca7f4af4f9d32b3414718f660d484cc97a993033313eab36a136cfe1cf21dfea6de1f943ea30ad8962c64335b331686ec9d65a43931ca744078526c95bfdb70914494484cd1d0333e5a1a06c213ab9ed50e1ace2386c2932dbfe4681ee8be9a07eb717eb0740e7a4596077a366f3beb6580de4c52eeb8b5cd6c4afba820d3790501498c3e9f50d3888210ff5ea4c1250b8ae2ac4c85b37c1d14c1c13931209e5c36d59dbeef7b5d19e95a2f0f45d9c27b7198d0fee56deeef7dcbe07ff3ef2b6017ba5689f917c6a9d5193747bc9fcbb4c6f2ff496667be79710df7957b1bc1c91a9fde3408f74074beee7f376132934a60f24974e886da12872f0d2d65b947dcb059e9ad20025ec495372e4e708f6fc7daf305d4698394d5bbdb561920e9944c6817ad369f934501fa190cdad468b6936af9f682fe6215fadbc49287ec1ca900b3007345102d9cb6e2f078112669f1e1ca292bfc220739ee7706eaac9422e4174441f1507d2787d7331646ea79160d8ad73cbb29f542e1165a964bd18a672f7ca1f42bc22e1b5903f058707bfe71c6d83471b3ea8c7375e50dbb67839bd3adcf6de2b88153d0c9d5f8074575e2edba378add10e7f29a8df713bb33c44ad73c194b7dab0f739d41c009cf2ade114fb1cf419a1223e242f24f70a2a07ffe5e54986c021cf045d95063f498e1fe46f66754155390d5d933239de86f77e1f575d8fe9c48a226f2da29ee24d2de2c36d012fcc0537a3535bd6bb4516fd3cb44d138695e839bbfced5093baeced4378f73a8aa1c65988e61e87ede256600bf2e0223a0d983fa82e8ca479811633919137f714fcb60b7747511338e89538106c0f586a9d66978c93ed54870f76d77bf3150ba9daa4785053b30919b34213338f877bceb9a7b6b5e24cde91d7a9de18ef80153bcd2462d6d8c925bc1566cfe30577f030b7c8cbe85cabfb1c00f047d8b2f3ab8abea2c163f43f70e89ca60263e348ce5a5b9099d94f67cd023fe8de1a2f0264ccce797d099c8295aae0b05674ba19a54b318cdd8a174c5cb7460700155311369ef7b084e92b3c1f67535c5d2132ee542ae29b3128051264d0ce8176ebdbbc7f15a877d379784e1c9a7ba0542d21b62302aa716ed734d0c5740cd88b7905b10960f5c5ddd02277d5e8a49a6544f53414cc339eaa9a185b25d3dcca49d71e1b14c94932308d309c2dcceb72e90aec26b4c2199a51de776c3e5d8b5b7a1f19630bd619cdc4dd24cc3bb044c4d869898c5ad12a5578e24a880328ba4310c07a1bf0b27d590fe69b03ab8b4d21d15ddab911206cd459b4d8b19493eb1de7e149a4960dd349878e09cf49e28c6e9b111be1351fcfddb7c8366dbce31a0014aaf444207ccd2742382d7d7833aba4a5f7c0a2f92eeb10359fea5113d4b068b8165cd78729934ccb86524fabac93fc8039d28eee2c7c23399a2738d97ee7c7b4bc500d91ccd7b4a9b151aef1d50c81bebb994f7d13cd8327cab24d6a1d366e4d36421cd2171c4b94acfb64f4bd7e36e08a5eebfa8f201795e22db77d143232ba4ab35ba956216dac072d4a940459d348692e7baafe8dd4549fbbd23b101a1954ac77ee5581c7513ea53a4e27837388972f6d2deaa1bf5389c0cb755ff69c31075061c316fc9884dd5e00d276e67f1b4e02a09c56fe4bbd013d72407d2da280b26295d1ce0dd7784ca005ece97c29242e53f0a20e33736ad51a7c5d57595964ea8e27278b10c4482e0b7c3f8770262d33a4317012da2384dc24850b0f50dc8abc9478d6ddc7534ee60d69100e293b7f4bbd8e4d073ff25f3527324d6bab9ddbd5332d7e18acce3d862ed998207625ea2a97041f68ed5c708ef9181fb031bdea9bedbefd1c4b8c4a8cc44d47f84ace8de20850e86803a4f9d6acf9571c3ac47e4c339b948af240a501c01e4c1ed0718f53ec3807868cf15395b21a911b6386d0be2425ae905375604dcdedd76cb7b06f4676629bf0fff336287375ffc3345cfe019de0768de0679d23ab38a05d04910276fc85758f4a9b421ef5ba25a552b0c8f36d1db5659f307b4b31daa00d699f8b8b9f884994e7a72857c30c434974d7a34348b6fc7827013747f9e7b80e9c1d31cd741b81f9b5653c2a79947f6841b336eeaec022229033336a782831975d71ade7974e89f64a9cac03bfbefda3fa4722619461245adb8879ee3ef77c2ff81a39ecf014629de88a8606bd9b967b3b7639941fdb259b35149ea9bb7790535cd563e25c8fb82b085cc2ea7615611ca9b286a33fdfd811fc506f7f29fba404af3745b81fc189c10615794029f8f8cb0698254ca3facad45e419b04e7600c6727e5448b5774a3c15dd69d2b001b57f5a325fea6899334b30d4b88e223d76abd416b3c886089da06aef7fc7f5063b6b590364b4c29582eccb1b8474a4b404f2afe25f93121e8c8b4f374851b060415b02782f437028dddcb5b38e6ce911234c7bdfc6fd2b075a09e377a8bf8136f47afabce25822f38317d9139429b2b4b0a66e75d02388f4b16206e4d3471ddb8a65e39de24107c681c97cec2e84d09aba77acc1e767651377058cd455e946a9c4ed5885c04c813179f726230b99282fc2206a168aadec68feeffbfb9f0c32ec786e12fe692f85a326d7f7e5642cf5386238a5829fd44328ce717035b8597b1766750a18b0c78e69dda368f439ca819c1196ef0f1c3bc50c262b730cfcf941c07113d25128132495490ef4ea86262784814a2c3300807f771fc3857062234dc7af4a581c0b77024f513cd4653f9bc9e9d8287261f89388531dfbbbd054efa64dd5bb3b0cee41d57cf791b2953c25309de70cc6197c96b999e7eddbe9261594490d56823bbfe0c"}, {0x40, 0x11, 0x6, "b3cc4b40ad442207a5c87c19d458385651f05d16b0506f5644b1b651ea99664b7dc60ffec569c399c6fc043ff71aac5a"}, {0x18, 0xbe, 0x0, "8d587c23aa"}, {0x68, 0x101, 0x5, "d89f5b3226026464bad857589fe8b27e33f22469ec5f5fe352ddce2947e429b81c2b5a028e512a1dd27b8a92a657e6c3a07d49c38f2da6606ada77fc8d483bc3c0164a5944b03d54e52a85e298765e98cbcf788b0c"}], 0x1140, 0x4080}, 0x0) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) ioctl$sock_SIOCDELDLCI(r2, 0x8981, &(0x7f00000018c0)={'bcsh0\x00', 0x1000}) 10:08:08 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:08 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x2, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:08 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:08 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:08 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") socket$inet(0x10, 0x2, 0xc) [ 1011.823329] binder_alloc: binder_alloc_mmap_handler: 8204 20001000-20004000 already mapped failed -16 [ 1011.846377] binder: BINDER_SET_CONTEXT_MGR already set [ 1011.856776] binder: 8204:8278 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 1011.864944] binder_alloc: 8204: binder_alloc_buf, no vma [ 1011.871563] binder: 8204:8219 ioctl 40046207 0 returned -16 [ 1011.881804] binder: 8204:8275 transaction failed 29189/-3, size 0-0 line 2973 [ 1011.892213] binder: undelivered TRANSACTION_ERROR: 29201 [ 1011.898354] binder: send failed reply for transaction 3605 to 8204:8209 [ 1011.910223] binder: undelivered TRANSACTION_COMPLETE [ 1011.917053] binder: undelivered TRANSACTION_ERROR: 29189 [ 1011.976540] binder: undelivered TRANSACTION_ERROR: 29189 10:08:09 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:09 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0xfffffffffffffe76, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x14f}, 0x0) 10:08:09 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:09 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x1e1203, 0x0) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:09 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0xb02000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000080)=[@acquire_done={0x40106309, r2, 0x4}], 0x1, 0x0, &(0x7f0000000040)="f8"}) r3 = dup(r1) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r3, 0xc0405519, &(0x7f0000000100)={0x4, 0x6, 0x4, 0x8, '\x00', 0xffffffff}) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000440)={{{@in6=@loopback, @in=@local}}, {{@in6}}}, &(0x7f0000000180)=0xe8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1063084004000000000000009e4b8ccb64afaa88177d6bbc3735a0b749b3dcfc9bd8018e2f46e7ea31c63cdbdbe25f605ca055bdfbfb03fa018d32901b75bf60d095e9abc350f8314e93ae3e70d535b94997a4c995136f5284bff070c00e448062f237bb24d6cf6c7053f2e488cedb960e537d04e88c4449fa5fc992eb8bf1fc6cf7"], 0x0, 0x0, 0x0}) 10:08:09 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) 10:08:09 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1012.796750] binder: 8288:8292 BC_ACQUIRE_DONE u0000000020ffa000 no match [ 1012.843295] binder: 8288:8304 ioctl c0405519 20000100 returned -22 [ 1012.851204] binder: 8288:8304 BC_DEAD_BINDER_DONE 0000000000000004 not found 10:08:09 executing program 1: io_submit(0x0, 0x0, 0x0) r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x1, 0x400080) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000040)={{0x3e, @multicast2, 0x4e23, 0x2, 'sed\x00', 0x10, 0xc4ab, 0x45}, {@remote, 0x4e21, 0x2000, 0xac, 0x9, 0x6}}, 0x44) fcntl$getownex(r0, 0x10, &(0x7f0000000180)={0x0, 0x0}) syz_open_procfs$namespace(r1, &(0x7f00000001c0)='ns/mnt\x00') clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000140)) tkill(r2, 0x10) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r2, 0x0, 0x0) 10:08:09 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:09 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x0, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:09 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1013.060277] __nla_parse: 23 callbacks suppressed [ 1013.060286] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:09 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x80006) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$TUNSETNOCSUM(r2, 0x400454c8, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:09 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1013.104283] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1013.129419] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:10 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1013.218227] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. 10:08:10 executing program 2: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x40080, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f00000002c0)={'nat\x00', 0x0, 0x0, 0x0, [], 0x3, &(0x7f0000000380)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x0, [{}, {}, {}]}, 0xa8) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000040)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000100)=0x1c) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000180)={r1, 0x544}, 0x8) r3 = socket$inet6(0xa, 0x803, 0x6) ioctl(r3, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r4 = socket$inet(0x10, 0x2, 0x9) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r3, 0x84, 0x78, &(0x7f0000000200)=r2, 0x4) sendmsg(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1013.290163] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1013.307162] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1013.342639] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1013.372028] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1013.577742] binder_alloc: binder_alloc_mmap_handler: 8288 20001000-20004000 already mapped failed -16 [ 1013.587230] binder: BINDER_SET_CONTEXT_MGR already set [ 1013.589592] binder: 8288:8358 BC_ACQUIRE_DONE u0000000020ffa000 no match [ 1013.592973] binder_alloc: 8288: binder_alloc_buf, no vma [ 1013.601133] binder: 8288:8359 ioctl c0405519 20000100 returned -22 [ 1013.605186] binder: 8288:8304 ioctl 40046207 0 returned -16 [ 1013.617336] binder: 8288:8357 transaction failed 29189/-3, size 0-0 line 2973 [ 1013.619617] binder: 8288:8359 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 1013.632489] binder: release 8288:8292 transaction 3609 out, still active [ 1013.640840] binder: send failed reply for transaction 3609, target dead [ 1013.656582] binder: undelivered TRANSACTION_ERROR: 29189 10:08:10 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:10 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:10 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:10 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000000)={@multicast2, @broadcast}, &(0x7f0000000040)=0xc) [ 1013.864526] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1013.892017] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. 10:08:12 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x40, 0x4041) ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000040)={0xfffffffffffffe01, 0x1, 0x10000, 0x81, 0x3, 0x8}) ptrace$cont(0x1f, r0, 0x0, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000080)={0x15, 0x1, 0xfff}) 10:08:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) ioctl$VIDIOC_S_MODULATOR(r3, 0x40445637, &(0x7f0000000300)={0x80, "1288e05f2ac05f7d1dbab44f64539e94ed55b1602ba5a1f206e1b4367354add7", 0xa, 0x8, 0xfffffffffffffff9, 0x2, 0x7}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x346, 0x0, &(0x7f0000000000)=[@register_looper], 0x10, 0x0, &(0x7f0000000180)="d5eebb8aa56415ecc353da71741733f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x8, 0x8000) 10:08:12 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:12 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000100)={'L+', 0x5}, 0x28, 0x2) r1 = socket$inet(0x10, 0x2, 0xc) r2 = dup3(r1, r0, 0x80000) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000180)) socketpair(0xb, 0xa, 0x6, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SG_GET_RESERVED_SIZE(r3, 0x2272, &(0x7f0000000200)) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:12 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:12 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0xb020000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:12 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1016.096546] binder: 8382:8386 got reply transaction with no transaction stack [ 1016.104156] binder: 8382:8386 transaction failed 29201/-71, size 80-8 line 2741 [ 1016.116746] binder_alloc: binder_alloc_mmap_handler: 8382 20001000-20004000 already mapped failed -16 10:08:13 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1016.161126] binder: BINDER_SET_CONTEXT_MGR already set [ 1016.167276] binder: 8382:8403 got reply transaction with no transaction stack [ 1016.175799] binder: 8382:8403 transaction failed 29201/-71, size 80-8 line 2741 [ 1016.180631] binder_alloc: 8382: binder_alloc_buf, no vma [ 1016.213462] binder: release 8382:8386 transaction 3612 out, still active [ 1016.221331] binder: 8382:8386 ioctl 40046207 0 returned -16 [ 1016.228515] binder: undelivered TRANSACTION_COMPLETE [ 1016.238850] binder: undelivered TRANSACTION_ERROR: 29201 [ 1016.250086] binder: send failed reply for transaction 3612, target dead 10:08:13 executing program 2: socket$inet6(0xa, 0x803, 0x6) r0 = socket$inet(0x10, 0x2, 0xc) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:13 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1016.279138] binder: undelivered TRANSACTION_ERROR: 29201 [ 1016.288026] binder: 8382:8393 transaction failed 29189/-3, size 0-0 line 2973 10:08:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000100)=0x20000000000000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x3, 0x0, &(0x7f0000005fd4)=[@dead_binder_done={0x40086310, 0x1}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b6300003235299eef8f17e7ff2019859e422110d87db3bf44a3480ceca0fd1010c7e34c5ffbc8c07f19c21bd5eafd621b8d0218e77480e24ea6ba28217979d61308a5ca94a787ea81bff689ddce6488af8ff7f5e47d0a1521ceb4586b5c30ab6b069963a4633e346c22fa406de36efa2fd617e765e76e50240316e4e9e5b12d2a3205f1d8dc2893e90fc0d98743f44240496695794755193f95e3b62bc272fa1c5a2393fd0691e9d8bb0198e21dc3b42c3a4edbd06659592cc37fd5aef394258a361878417e1fc6d42e016a05c210"], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1016.333118] binder: undelivered TRANSACTION_ERROR: 29189 10:08:13 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1016.446773] binder: 8423:8426 ioctl 1 20000100 returned -22 [ 1016.486430] binder: 8423:8426 BC_DEAD_BINDER_DONE 0000000000000001 not found [ 1016.507656] binder: 8423:8426 ERROR: BC_REGISTER_LOOPER called without request [ 1016.558737] binder: 8423:8435 got reply transaction with no transaction stack [ 1016.566750] binder: 8423:8435 transaction failed 29201/-71, size 80-8 line 2741 [ 1017.233838] binder: 8423:8439 ioctl 1 20000100 returned -22 [ 1017.239972] binder: BINDER_SET_CONTEXT_MGR already set [ 1017.245258] binder: 8423:8439 ioctl 40046207 0 returned -16 [ 1017.251382] binder: 8423:8439 BC_DEAD_BINDER_DONE 0000000000000001 not found [ 1017.258746] binder: 8423:8435 ERROR: BC_REGISTER_LOOPER called without request [ 1017.266215] binder: 8423:8439 got reply transaction with no transaction stack [ 1017.273929] binder: 8423:8439 transaction failed 29201/-71, size 80-8 line 2741 [ 1017.281978] binder: undelivered TRANSACTION_ERROR: 29201 [ 1017.300383] binder: undelivered TRANSACTION_ERROR: 29201 10:08:15 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = geteuid() getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) chown(&(0x7f0000000000)='./file0\x00', r1, r2) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:15 executing program 2: r0 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x0, 0x2) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000180)={0x0, 0x3, 0x30, 0x7fff, 0x9}, &(0x7f0000000300)=0x18) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000340)={r1, 0x2}, 0x8) r2 = socket$inet6(0xa, 0x100000000000803, 0x3b) ioctl(r2, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r3 = socket$inet(0x10, 0x2, 0xc) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x68000, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000200)={0x1, 0x0, @pic={0x308d, 0x4, 0x9, 0x40, 0x7, 0x800, 0x0, 0x10001, 0xab, 0x2, 0x8, 0x7f, 0x9, 0x234, 0x0, 0x8}}) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x174, 0x0, 0x38b}, 0x0) 10:08:15 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:15 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:15 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x9000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="02000000bf2e5d05db2c5c41e6f2a4576db50d718be6c30b8d35cbaba32a65c27436dc9b915586a4f3e26528abc40bfa098ea4c71713cc77cd3f1ce7591fc4d9b7a57606dfa6840fb67e44746ec1eb14b05d029b6e153f4938c22660618a0d1dba3631dc2e3d6942b8d057ee11e8ae66bc8e7aad07799653372fe9e77fc9342962a015162b8bec645e", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="f30015ed"], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1019.178424] __nla_parse: 17 callbacks suppressed [ 1019.178433] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1019.183158] binder: 8443:8451 unknown command 2 [ 1019.202961] binder: 8443:8451 ioctl c0306201 200001c0 returned -22 10:08:16 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:16 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @multicast2}}, 0x10000, 0x2, 0x7fffffff, 0x7ff, 0x1}, &(0x7f0000000000)=0x98) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000180)={r2, 0x10000}, 0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000040)={r2, 0x8ed, 0x30, 0x3fa, 0x7}, &(0x7f0000000100)=0x18) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1019.222452] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1019.230664] binder: 8443:8451 unknown command -317390605 [ 1019.236434] binder: 8443:8451 ioctl c0306201 20000140 returned -22 [ 1019.239561] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1019.245600] binder: 8443:8451 got reply transaction with no transaction stack [ 1019.262765] binder: 8443:8451 transaction failed 29201/-71, size 80-8 line 2741 10:08:16 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1019.275112] binder_alloc: binder_alloc_mmap_handler: 8443 20001000-20004000 already mapped failed -16 [ 1019.286066] binder: BINDER_SET_CONTEXT_MGR already set [ 1019.303306] binder: 8443:8451 ioctl 40046207 0 returned -16 [ 1019.335388] binder: 8443:8470 unknown command -317390605 [ 1019.352344] binder: 8443:8469 unknown command 2 [ 1019.357575] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1019.371790] binder: 8443:8469 ioctl c0306201 200001c0 returned -22 [ 1019.377731] binder: 8443:8470 ioctl c0306201 20000140 returned -22 [ 1019.381355] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1019.404925] binder: 8443:8451 got reply transaction with no transaction stack [ 1019.415924] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1019.429880] binder: undelivered TRANSACTION_ERROR: 29201 10:08:16 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:16 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x80, 0x0) bind$llc(r1, &(0x7f0000000040)={0x1a, 0x334, 0x1, 0x3ff, 0x42be, 0x9, @remote}, 0x10) r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1019.436502] binder: 8443:8451 transaction failed 29201/-71, size 80-8 line 2741 [ 1019.442220] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1019.471064] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1019.471873] binder: undelivered TRANSACTION_ERROR: 29201 10:08:16 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) [ 1019.589180] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1019.605798] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:19 executing program 1: r0 = pkey_alloc(0x0, 0xffffffffffe) pkey_mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, r0) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:08:19 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:19 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:19 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x921b527a62bfdc30) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1}, 0x100) write$binfmt_elf64(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="7f454c4600706a5ce1a2ee467d3bca22f507643a066104010000000000000200000000000040000000000000000c02000000000000a6d10000030038000200ffffffff468051e57464030000000300000000000000bc08000000000000f9ffffffffffffffff7f0000000000000600000000000000000800000000000005000000020000006f000000000000000000000000000000ea2b000000000000080000000000000003000000000000000800000000000000f8d1cf6bc8252c025b5f92a84bb4d5efd7201c0b3858f135eeae2dc7f0e87b4cb7c2ebe8e1bf26d90204e8796ae2234ab4507f89e0a927c56e06ac8486242f23306477b3ced713f3ccd7a0f1572c2cfeceaf21bfb67974157e7a4e10510b1d74ca0f796a92f62c8102c33ef139e0cf2ccd4388e8404194afc7dcb3c0580904a76736e493f5c3e2c8d91d510485793916f26e041f6b30857e8c9b55fe64259328116a71513c065b05319d42f98f000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000008f0000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d75c6ef81318e50000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x345) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYBLOB="7f454c4600250000050000000000000003003e00060000002c010000000000004000000000000000e1000000000000000500000087003800020002000700ea000200007001000000ea0a000000000000f7ffffffffffffff00000000ffffffff00000000000000000100000001000400010000000000000001000070040000000500000000000000000000000000000005000000000000000100000001000000ff0f00000000000000fcfffffffffffff423273d395b5dfe49a633eb0eb0263328129db30c89d614ca312379424593d1149401363a977a2b10bc8394762bab422771360aa38dc889b26829f721e3098b0f80c2f4ee55bcf0df04911af0a6a16e0ab5b5bb1e2227df0cb7b403be567ea3b9adef738dd4b7efbd9e56dfc0dc488a064d4ad246d477bc8fedb6c1fbcd09469e544a6ac9afa9987b94c8d1209a41a79416931a8f43bd761418a2c47221a2a4d6bee2592cd6eab8fa3ac582965b48d68fb1dde708c9901874b0f1628c0adf0dc15872d102a327edf073a52942892de4cc87c25e76cde841dd1e09db3f59955450018b682981af9bf3133a11fbf7915b41105bd663e6f7116777b3cb43f260d25a06d22119ca7674f7d9eeb496cccae5ea73758600072b6f0c2a040000002001cb0000fbc132be60c8b0bf6ac0a892b355685d62cb7077a1e889c359d7bfc544111c6ca232e6c6593a0b8f085567b065536d649fea6d4e202255fc1a0dedba780af208b0457ed33958cfd97c0155f59b06d997423bb3b6f3d5e01c8b74030434cacb0e508ef261aff03a72021b6011f6ff05f6070f0bcb7d75cbf1668562cd6599dcf1eac792c47370ac83b2730215d9955f6fa81f59d3209fbaf52f41f8c413432d976fe6eb3ae98661de6250e09bcf7b82d0492b349ca022abe346a443d41aa83ba7d2ed5193dda7e9c78769b1430e5a171e12e0fa1d057e1aef4b856ab0f2dabc8b207f09d78e1f83461ccac0b2558732ea70d369973971d2c6d94081f33308b1e4b27a2ce6f45838809407045aa63b07372728d2aabbb752eb506219d82564c7323f73bfc2260fd95e5e8eeca550b29adcca477de69469764858d7aa3ab8afd99e883c43dacae12ac88e7fea5a99df90755e5caf59185794ed6419a22fe36d9070ed6558b090cb871914491e2a135047b729107896b784bf87c941f7b993033898b993c83b8bcec93aed20e900921e8c8e65939b23a0f84c837a71633aad5664665e7f89839258d1477a2e8fceaa9280b9c9dc53b5ed4bd907c3948f04ac1eff961bf3040ae0faed3985bccc355506dfcd52907750828fc988e60aec5b577af9769cebc8d6e87a826826f8362c84fe7ec9e6d3cc39c1b6b6b9005eaaf0d9037fa576757018d3f60fbab576284cd734f48b0e4b3e70a4b8143dc67e94c1090b7376eec330f5995c4b3a119646b4a953cf0669d6e52264827bbbae2c7565529a68f46f5e1a23137059867d0192caf6b22e2d74f8fbe12a139bc90a0d12b6acc0a106ba4fc2baf87c254bb54083ffffff7f63dbc82581cec688136c617847b1a3b6c0c331af00086cae971610587c4683d5f1b0dd68b8a419f581f0387cc9d1a435e329a0595d73a4489b1ea23c331ca752bfd46de13f0ee26e7e2e9b11dd7151883ac8112c0ba049070bcf00881cc0a37395f1a102cddda4b0b903b0233461e70254e6a75b9c29c02fce51b630d5cd58867e5f8e5b47fdb2fb53e0b9485f1079ddb39d7b3ef5d8d37be9a08714575e454274581a8ad758ba53da32d2c893e8a40de0febf31f84016558a9db7c53dec27895d69fa1a34e4b5b856f4d0974a9dd4031e28632a245b921a576f1a19f47d7ba08e9ca94a7ae46c89b379d90e0dfdcffb790586d920ea79f94af735aa51695dfe0c9c73a44b277e877b473b43f5c3a960d7c5e22678ab3f7cf46bdf23cbbd31df613827f8e23f7b2c71be25eab7dbd56f7b426b78f8e5afe72366ffcd05c29b92ad591e35a19df805a2b89b9b87a13109c19ea941e9b9f6ee1c47708870abfda2debce7eae0f356bc896a5a207f6bc3ed4186117e1ae9b861d3a9a94520a6df99fd700c6fc3b82467a1257c2040dd34b2fb30c032224e6b864900f93168e387edaeeedaebf8b7b40d4caaa97c85229e63770ced3382013fd11010d0ee46333666aaec98aacc511c92be9e55eee400c74ab4614552624ad88f5d63b6f87e85826ee7cf6f15418f9712c6d07f36a54f097d9bc48b3035ae569af4753e7831dc520fe4726d0c96d0cb7b45e5ca5002884d38ed8e8ead8d4a7da76f9bcfd848fd27345bec7dd4356ef7b11a0cd3113bd9c581e7e647eddd060553fd6e9194bc07ffc5ca9eb6e9ce36aa545ac0f6e242e381282522481668f05909a69db9c8f417ce2406fb727c11fa8ed3ec6f097fed51414f3286075c414753979f58a70d97539c1215ad15f4f24e9921c3fc4636f4fb616d5b871cbdc9cb27e00245bb2291f767d4c581387a63022c727026043c0180a848edd1c3fffff21c3fe0b11c65caca8941959536882277e3dc9e61da52527a24e2d79a367a80b33b24f1ca184d56ad13194867d7a0a424977b5f256a4643460a03007ccf2abb042c6a8f357ee967298f4ee68fa10d82aeec9c63884f43927692db04bfa6651a630ff1e945d5c2ceb1552d0cd69830f257e5d2b500e4447f03edc78938d82871b7075be875dee546cd23ae617356f51fe8f1fb11417e63a436d7ca0ecd22fab3719ab5b4a4fa0ac2b6a44002fdddb61f7d6fe2beac291455b144cff1da4cb487c430a42cd6dee2b0752536175bdeb3abf2a393823dddf4567d7a6ac785662eb272ea9ea223e0d63a2d027fc3bfa6da9c1537a5c207c9f2495bd45ee28be938ad3dbdadee778875ba641ceb20f3fb23d57269a4e40e0baea56d0b4247f12ebb7cf6ee0e64b0d521c8636ca845287f752adfde004e37bee0451540bcabf455b43233e287e4ce36ebbf2cf0aa8325b72b90c40cc5bdf77f66b07bf5423a80409e1e95424e2d63c09e621354d87d29d28758c290f29746e00e72e1f6ee9fc93841a7a4ec7420c1d78c09f9355b41c5b6a2e94d0a218428a4e4e40bcab84f0cdc9a230101146a11e1f36367b4b5f21e76b5e58c31aec27a47e7ce6c22d29c553f03d0515199b541750e92718c53542cb8c0e4202c89b5bc2a4e3cd4fd1e33ba846b2d2d1c94d2e73327b1d327fe80ff1113634e2e94769b97a1088c2f00001fd26ffbf3b4b82036e960a01efd1eecb0e4cff79c5943cb7f3390757f2ebaa20ac131cddf19065dad03237cca7406b5c30228494fe25d9d26631795f3b0a17ac6c8c27e37a75bce127c592beed29fe6137efe5ac28a2a89597db794c570055e318e92f17f36e3fcbc68c8233d2f0c433f9e11b2819ade8026682c9c966d13605ba9cfa66d91f8203260ed06d8c53912b2c25be01165ebda24e3b70c4fa4a99c56470ee400000092272d6ba4a0906d5b8df7039b82bf83378b78ce124aca8b7944fffdd65bfca51e33614282fb1738dd43c6b95f2bc5e9b24605ff3fb5a06ece40c2c4a86b93acdde534777d1ac562abddbdcce0d91247c5196e7ef7d65ff45606324b402aa6b81afa463f63f96bc442cd25a033b7b6feed08de0f00bccb16c439813c6c4b1d1733bb55a6245a9180ec71a7f31631613c60af161f5ef64493b859a6c4baa9e3811250984db538169178a4f4cb4141f74e366a28b4fdeef59bb22f6f525c493912a044bd99a3b4b86b2834a40437d58d4292a22a730b6a2e5ec7bf358c2016326fff4889d5d5e1beec898a3888d0f4a450d86548a1a9b1cc1bee45e6a4e2c4e0bcd69a51d46190755bd42c1e53d4a1f80010da651d6c500a066afa9c98755acf643ff381af66742c6e091746c77e0f14f2583d6d70339ed50e9da34a0aa8820359872132179f087f16cdaf3636688927e39a857a99f911d08406b6addefa9f895f3b29812234eaf4d5a93b9363fa02a4ee9fe8676811004fabc8121f7639e9f92c0d7f796a6355e984d7a85aadc638b3b17d74fa96eb571516eb1a9fc487e918956411823e1edef555a61ba7d45931457b221bdcc8aaad58e8007497a8846278e0aed68926d3ea9fd96a89ccc89627c86da315c3eb5445bf799df613befe958390660f6c9f7ac02e3187100f18eb3bfacf9662601fc9868329b3524cb8c07850726355bd748f7c51b32e6c4341676cef6af55351e599d196d38d63bf0cd20b85f4bc79a2895b9c5c4d46090b4e1a10394f8ba7201d45d3878dc9b3e7ec3510073424b92a7448f9d8d9c15fff2a1c0e6dde7e6ad83f6243b21c6c14bd1b36e834b9cdc2b09022c0ddad8b5cdedb4ade2e81d79456e11360da181cfce8588814cfefa8bda9ccea60f525df95037485c014eda45dbd57ca63e2a6f61553b7f0358f61f2ed518652528701f1879ffcffb5c468b84948207b13ee0f05da15fdc1a40cea5c960a57163efd982c84a1ee8454a0bbdeca176488e28eeb7fa34c9fff8c4b3b671c0365ecb1769d6a2e5a4c5f58500d4a61c343e830dd50d1369f5da248b743411461f887e503d68df046eb49dd9207e4547cf3f58577a8021cc00682d87ee798"], 0xcbb) setsockopt$inet_MCAST_MSFILTER(0xffffffffffffffff, 0x0, 0x30, 0x0, 0x0) 10:08:19 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:19 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x10}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:19 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:19 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x801, 0x100000000) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x146}, 0x0) 10:08:19 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:19 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:19 executing program 2: r0 = socket$inet6(0xa, 0xa, 0x200) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x2, 0x0) getsockopt$XDP_MMAP_OFFSETS(r1, 0x11b, 0x1, &(0x7f0000000200), &(0x7f0000000040)=0x60) r2 = add_key(&(0x7f0000000100)='user\x00', &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$set_timeout(0xf, r2, 0x5ca2) r3 = socket$inet(0x10, 0x2, 0xc) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:19 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:22 executing program 2: r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000040)=0xe2) r1 = socket$inet6(0xa, 0x803, 0x6) getsockopt$inet6_udp_int(r1, 0x11, 0x6f, &(0x7f0000000100), &(0x7f0000000180)=0x4) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:22 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:22 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x13) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:22 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:22 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:22 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1025.318312] __nla_parse: 12 callbacks suppressed [ 1025.318322] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1025.321737] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1025.346917] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. 10:08:22 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:22 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)=0x0) process_vm_readv(r2, &(0x7f0000001340)=[{&(0x7f0000000100)=""/129, 0x81}, {&(0x7f0000000200)=""/236, 0xec}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000001300)=""/10, 0xa}], 0x4, &(0x7f0000001540)=[{&(0x7f0000001380)=""/191, 0xbf}, {&(0x7f0000001440)=""/74, 0x4a}, {&(0x7f00000014c0)=""/19, 0x13}, {&(0x7f0000001500)=""/60, 0x3c}], 0x4, 0x0) recvmmsg(r0, &(0x7f0000007b40)=[{{&(0x7f0000001f80)=@nfc_llcp, 0x80, &(0x7f0000002180)=[{&(0x7f0000002000)=""/46, 0x2e}, {&(0x7f0000002040)=""/110, 0x6e}, {&(0x7f00000020c0)=""/144, 0x90}], 0x3, &(0x7f00000021c0)=""/177, 0xb1, 0x9}, 0xff}, {{&(0x7f0000002280)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f0000002580)=[{&(0x7f0000002300)=""/199, 0xc7}, {&(0x7f0000002400)=""/165, 0xa5}, {&(0x7f00000024c0)=""/123, 0x7b}, {&(0x7f0000002540)=""/54, 0x36}], 0x4, &(0x7f00000025c0)=""/186, 0xba, 0x4}, 0x7}, {{&(0x7f0000002680)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f00000027c0)=[{&(0x7f0000002700)=""/156, 0x9c}], 0x1, &(0x7f0000002800)=""/4096, 0x1000, 0x9}, 0x78}, {{&(0x7f0000003800)=@pptp={0x18, 0x2, {0x0, @multicast2}}, 0x80, &(0x7f0000003bc0)=[{&(0x7f0000003880)=""/160, 0xa0}, {&(0x7f0000003940)=""/239, 0xef}, {&(0x7f0000003a40)=""/106, 0x6a}, {&(0x7f0000003ac0)=""/207, 0xcf}], 0x4, &(0x7f0000003c00)=""/207, 0xcf, 0x2}, 0x4}, {{&(0x7f0000003d00)=@in6={0xa, 0x0, 0x0, @local}, 0x80, &(0x7f0000004140)=[{&(0x7f0000003d80)=""/14, 0xe}, {&(0x7f0000003dc0)=""/129, 0x81}, {&(0x7f0000003e80)=""/27, 0x1b}, {&(0x7f0000003ec0)=""/155, 0x9b}, {&(0x7f0000003f80)=""/49, 0x31}, {&(0x7f0000003fc0)=""/246, 0xf6}, {&(0x7f00000040c0)=""/3, 0x3}, {&(0x7f0000004100)=""/29, 0x1d}], 0x8, 0x0, 0x0, 0x7f}, 0x6}, {{0x0, 0x0, &(0x7f0000005780)=[{&(0x7f00000041c0)=""/247, 0xf7}, {&(0x7f00000042c0)=""/84, 0x54}, {&(0x7f0000004340)=""/252, 0xfc}, {&(0x7f0000004440)}, {&(0x7f0000004480)=""/162, 0xa2}, {&(0x7f0000004540)=""/96, 0x60}, {&(0x7f00000045c0)=""/231, 0xe7}, {&(0x7f00000046c0)=""/4096, 0x1000}, {&(0x7f00000056c0)=""/133, 0x85}], 0x9, &(0x7f0000005840)=""/243, 0xf3, 0x9}, 0x9}, {{&(0x7f0000005940)=@ipx, 0x80, &(0x7f0000005d00)=[{&(0x7f00000059c0)=""/5, 0x5}, {&(0x7f0000005a00)=""/215, 0xd7}, {&(0x7f0000005b00)=""/58, 0x3a}, {&(0x7f0000005b40)=""/56, 0x38}, {&(0x7f0000005b80)=""/34, 0x22}, {&(0x7f0000005bc0)}, {&(0x7f0000005c00)=""/193, 0xc1}], 0x7, &(0x7f0000005d80)=""/185, 0xb9, 0x100000001}, 0x5}, {{&(0x7f0000005e40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f00000074c0)=[{&(0x7f0000005ec0)=""/212, 0xd4}, {&(0x7f0000005fc0)=""/110, 0x6e}, {&(0x7f0000006040)=""/240, 0xf0}, {&(0x7f0000006140)=""/4096, 0x1000}, {&(0x7f0000007140)=""/100, 0x64}, {&(0x7f00000071c0)}, {&(0x7f0000007200)=""/168, 0xa8}, {&(0x7f00000072c0)=""/221, 0xdd}, {&(0x7f00000073c0)=""/106, 0x6a}, {&(0x7f0000007440)=""/100, 0x64}], 0xa, 0x0, 0x0, 0x101}, 0x9d8f}, {{0x0, 0x0, &(0x7f0000007840)=[{&(0x7f0000007580)=""/136, 0x88}, {&(0x7f0000007640)=""/241, 0xf1}, {&(0x7f0000007740)=""/210, 0xd2}], 0x3, &(0x7f0000007880)=""/208, 0xd0, 0x57}, 0x1}, {{&(0x7f0000007980)=@ax25, 0x80, &(0x7f0000007ac0)=[{&(0x7f0000007a00)=""/189, 0xbd}], 0x1, &(0x7f0000007b00)=""/45, 0x2d}, 0x7}], 0xa, 0x40000140, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000007dc0)={@ipv4={[], [], @multicast2}, r3}, 0x14) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000007f40)=ANY=[@ANYBLOB="7f000001ffffffffffed000007000000000000020000000000006607ac1414aa00000000e0000001e00000026a4f296a45d8ed1207c137758914aec1c400a198a0e28ae2825f2f7cfb97c21e0130433fae323b797a950f8cc4ddf412cfe42682c02e72e763743ef79c772917ac7faa93b4c5301fffe1ad313332739aa72a0fc4f6ab5b95fe95ba141d41ece72086aa0a000000800000000017d35d55f334451468931b4d94f8bef56417fb1a176fd68c32dd7a52a22fb83d8eff2b955cbd530076da517f8275d76068e9a1627fd49461de1c83da8c205b251a16b55ab88b867fae3e4154395a93eacbd6d45e30f3928d19042b3b7e08d964524d508f3c6db66150eae7ba1c0be0ea3a785a5f740cff114008d8385866dc1158d3d4b86ef66fe6cb"], 0x2c) process_vm_readv(r2, &(0x7f0000001bc0)=[{&(0x7f0000001580)=""/224, 0xe0}, {&(0x7f0000001680)=""/49, 0x31}, {&(0x7f00000016c0)=""/170, 0xaa}, {&(0x7f0000001780)=""/218, 0xda}, {&(0x7f0000001880)=""/148, 0x94}, {&(0x7f0000001940)=""/248, 0xf8}, {&(0x7f0000001a40)=""/93, 0x5d}, {&(0x7f0000001ac0)=""/32, 0x20}, {&(0x7f0000001b00)=""/134, 0x86}], 0x9, &(0x7f0000001f00)=[{&(0x7f0000001c80)=""/22, 0x16}, {&(0x7f0000001cc0)=""/220, 0xdc}, {&(0x7f0000001dc0)=""/59, 0x3b}, {&(0x7f0000001e00)=""/129, 0x81}, {&(0x7f0000001ec0)=""/35, 0x23}], 0x5, 0x0) socket$rds(0x15, 0x5, 0x0) [ 1025.362243] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1025.377888] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:22 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1025.460892] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:22 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1025.532544] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1025.553292] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1025.574389] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1025.583907] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:22 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:22 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x800000006) ioctl(r0, 0x1000008912, &(0x7f0000001c40)="0a5c2d023c12628571807062513029ef3c39a4c4a0ea0a474e4cb9fe1e98af21ded76dd2ecf789c369f097a573cd28b771ef3e0588b30ca93839f9535762eb8c356284c122e514827df6b156e6dc01c6a2bc06047de284d429e213393d36aca519562f4720b95d673414b7c6e05562397c00dffa2a2fc8dadeafa880748b4c6d256031becb59c73867161b3a93e0be717b6434c75d818e3203661b787e69ca06269db77164e1cc79ea79179b85e62779eb") getpeername(r0, &(0x7f0000001d00)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}}}, &(0x7f0000000140)=0x80) getsockname$inet(r1, &(0x7f0000001d80), &(0x7f0000001dc0)=0x10) r2 = socket$inet(0x10, 0x2, 0xc) getpeername(r0, &(0x7f0000001a00)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, &(0x7f0000001a80)=0x80) accept$packet(0xffffffffffffff9c, &(0x7f0000001b00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000001b40)=0x14) sendmsg$nl_route(r3, &(0x7f0000001c00)={&(0x7f0000001ac0)={0x10, 0x0, 0x0, 0x4010041}, 0xc, &(0x7f0000001bc0)={&(0x7f0000001b80)=@dellink={0x28, 0x11, 0x8, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, 0x4}, [@IFLA_GROUP={0x8, 0x1b, 0x3}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x24008881) sendmsg(r2, &(0x7f00000001c0)={0x0, 0xfffffffffffffdcd, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x1b, 0xfffffffffffffffd}, 0xfffffffffffffffe) ftruncate(r0, 0xfffffffffffffded) ioctl$UI_SET_SWBIT(r2, 0x4004556d, 0x5) r5 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x0, 0x40000) sendmsg$kcm(r5, &(0x7f0000000180)={&(0x7f0000000300)=@pppoe={0x18, 0x0, {0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 'veth1_to_bond\x00'}}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000380)="ea40d66b9750ee936df250c8f13afaf7f39b5cb7ffb1648e6a19161586c1dffebedef7ec92593adecba613c5625a094e2d0aca1a1e3e37ab7052de092a84d8b1d95fc90811052f1d586943a2955e6a1399cc9245c1729b8c1aa2d2af119cde56b8cdb8440775643fd45dd9b93c74cd5120c11eabdc9eeb18198a1b77d42425d6f37fa246d7318dbbf89d37ea503bc4ba7714b921fe49465b42af1cff43fc69818b99cdb505df79eacd78c8ad98878f06941f2b08663b09bd2b96bd0781401e84fd60087f6407259a0114e5f7d17a3243505d0e77c0de77", 0xd7}], 0x1, &(0x7f0000000480)=[{0xf8, 0x10c, 0x80000000, "0c8ca5b7adbeb56b306d184f3bb51f0d73e1946cd749ea330ef20c2ab20eff785f02153f786cf1a41af5b4287a7c4322f9a1d97a280f5ca9db757351531068b7102ba49743516e7c63d237d1939665e3023f05780c5fcd5136cbad1e9984f52c4bc9f8c59eb471247719d16fcec4e0032b1c9ef3e5ee11d4a5c876d40e748ba6289e1c4b6aa50614dd34cd74f895c717c7d272d091c338da661788039a356121d506566839c84ff31bae5b35b6b7ba63ecc8bf8a101fe8939fd4efb31cf2a1da0804b9b1f529f5bf9784f4fa216e0786c61fc737c2d748689455d8e669103782b0"}, {0x58, 0x109, 0xfff, "1db578deae18605dac6c844462da9a7dc7c8a3f8eb0127af357a22832e55a55ebc182df5704405d8aa30270385dd6cbcac97589f686d814163ab72355ab660e06301"}, {0x70, 0x1bb, 0x800, "44bd8b8ab1517113a77a50ea38a3a0bb163f44fdd52b535cc27dfdb434661a8b98382dc31509ac82f5888c1f8c2a7f56de3d5f06e6ae696a148b4f0311453a5c30f2be8a9144aee04ccf9dbb1231c6743c0bb6093561802bc8f4"}, {0xb8, 0x100, 0x9, "9d19e4562592e4b44492cdb553a0598176a84642f2d3cbcc87bbfebfc9bf920a2129ceb2b546feb26ebc4562b41475941f5c83a43b919ded3cc1b366767deb05f424107c13bc35e575990515edd56ec8ed12db1944171cba964de5638caa6c6910fe9596bcbf081c52af36e9c6ed3f4643d7cb35bd1fedb0e03f2b721e0d6f5b117ea157c8af938c718be7b4fd93a8269817fe6b2cb354deb4c0e8e366b519d0e7d83dfe6325"}, {0x1010, 0x1ff, 0x5, "cb82c7a3e4fcaa93e1bf8d2f964cefea8628fe7acc999b5ef3df90e894b6d19a29f8b6e0529e7e53a00e850940787d8e885d56d2cc39b2a0a057bcc242ee0f22997d8467af4d4d87d0fc8e9b2bad8643d1c72a60571eaa78b1a85c5e92d3de16c3e19f695247155cb7676aec9c3b567fdec3f4db30fe0618e0875a0f74877c30d108dcb391e08a018ab918c66a6134577a7e3d4f5dd685e848567ad4bee910ce6737c2dcc43026db2b0d5fc577f04c059fc779722cf4201d7d2a5c94f8d06ea1d8c3cff2f9f83901c0f455a3e2ab02ae33f8e42c3692d455eac05d056b72db9c1e37ad6830e63a87f26210552220d17561c114cd792e9444c143c50063a857e31953933be2e1a56d2e22c1cd009323daabc1f30ca9bda6dbbbe5446b9c52f9864225916bfb0efd46d129394748751ad3481c2d9da4aba510fe36f6c4c7a65a64e8cd1ae15c7e8b24b448d20dac7a92afdeb0bdc9658579a0e4927a8b506013a0ce6a0057246d2856fba630e87d1efd5d6da21eff6f38f57fc7ccf2baf0ae8191dc0fb6b365c242b5f82d56f7ca87b842a50d1392bcc7420a2d53adf4b917cd197f9bd0e4ed77bbdb0edb3a2f1951b7c522079044536d7669cdffd82c4d32ee0bce5e59849355c3d3d2c4280f02b515d056ec396411567cdd3c529142dfa35e6824b1e3ea205ba25069a6f5427b0578f189f4a6755542c254cb0a7ecaec700635020b2e7edd78c32b01814ce25212df40aa0693d97ebaacda2a4d0f71ad3fbe96f8b8304e1d275efea46a79d1dd273aae83d6ceb704130c6873857d17fb085dfd39fd36fe847ce8a47323ff2254e11cb50c22884c514f8929b72ca207746ef85d31a653a2c60f195a5f72c210d83f4b9ac9cce4ccf1bfcc1c368c8ec59f4eb827552482719dee8c968d4cd632326d3c0aee32e282ed1863e30db5ef99e6daa952c02a74c3e0094f1207bbefd9a23f5a9fe1a9fc270398f06c846a39cc02f7687aa6c270e28b69ca2ed038ec7567a4b2cdcfc3398a829a6da35b2dd39d967fe6e7d932a0ca449c5707965518fca414fbd9e7620041c0a643eba6e37ab42b8bd4df294cd16ba67c1dee612bd0f5ba3976a5fc7c7e5a72fe9541555d1544b2c0b4b80479f88cd2b7bb6dce7ff0f11cafedf28fdde567e1f17d49be0170e443b9c359e6313efe9e3f9bffcb83dba038cc7ebfbf4dcbaf2c19c1aae8392363cbabc535099f5d6b2ef7bcb84b78faa39a9849a31e24b2fc5f6debd440a4dd5f63d1c68dbf5a38dfdaee069e456fd3d73aba21004483c1261c43fe8bcd84119dd98cd225d708143e00783d172bdfc29c14788988027df3d9495aaa33a58147403ab6e02809e10121952beeeb13b552b7eaff54d61cc5c1e01b81e892fbc2f2dc24e9358edd85779f4cc55066d1b1259e244ec28bf4edc55c9286a7855b4349d213712d7a75b746eeb87b8151c7e0129305e251f6e6b99024d81de5ebed3a571d28a9454503550012af35d268067e6c18f9c8910aa43ddd0ae24e95f7c060c2d0957b1812a372c706c28441e6f0b443ebeabbab4d4e8ca6934061946609494ec7113e0281caedcca927ef44c22c341b7675abec6f3b9c79dc25dbd1e7055beaa8e3592e425b4f73cf24be6b8f3fb975ba869d7f4a648d123df3e7577923c387cfdf98b85bfe7a8146a305e872aecda7657ff542de486055658e8aa2f444cee6360a0cd5bb2e5620bae962b50aa56891207f8550a9f4edaef2e061472478a27af206a227a9fa9f365fcea81776ded1f5244a60f323c0bf0764b7afa85d1bc04b0b78cea183b569b1a566e199ae414b1dec116e100e2471df4986a8e806bc00ac148b6e5df8b8579c1b8ea34cb523dab0bfc1da7614093de083ad1dd92d96da1b0298dfaf6b3c450822a73a552b4dd85d66e49154ff74a4b488ac066fe8c96b686f77be9bd4991ff74d105e4ff692d93f090088e3fefd48483fa7bd319a1f4179ce372a63f0e934284b94e148a066f64d0758d04bbd1f41b654c1a1072990af9eb9744af7667ba28cb07c8ee623fcfe64bf9c5e5778a9c92aad6064b0d1acd2307310442b4b7ea5cc845d4a42ed6d3f7181ce53aff4e0e0527f27d436f5af82c7f4f1461310032dcd89e1e6ff8c944b79b5ac27a36b2dbcc653a2cc33e4faf06fcfb11c86cb2cd4fe08ddf5c7d43cdd5c5f840256a300a943faff11143f2f888b57a2f2961af0269274747594fcbb0eb89714df447abd7a37b89c7635477816b6d4a8f668539980dd2d48fd84aadfbb793f515b6aa35802a19aa94ebfb06f97aa71d8120bc9b6ba926c032e5836c8dcff6e52c8b4828d2a44d06af54a3d30e9f667b245cee754fe5bf874792538188c5a7396c835082ec73f0b9a29d9080129c7e38270e2ef30e74779d80387f7ded39b88751f9746f22236cd1111f5f06c4bc675fe9edf21667573519da426dc06c848a61efcb466e7f881f25f2f32484957e755dafd960a4353b0763e926476ae253d4e927190779d156ac171396022501b1a594d6582a2e5ae0269598b3fe2b1a155eec5f3fbce2b823a8c927fea0ca32314676b59bd84f920632d5cb51bbaa8c1a90bdcf29b8b089e1973d5bb990c9f3501be3a3b893e1af4d90660b4ec14186e3a01359c1a2813a0e495ddf05a9f6a2ac7f20df2de200d09a7087c42fd00fc8c83bcdfe921303b96031815ec34143775f18adcb0c16dd92a46d374b6aa6d17e1a8b8422959d725348108154ea7bb13348ff2534534724d36e9e646f05526e15e8fac74d7705693e46ff37f48eb51624643124611f33165ea6f462b610787c9ac54c7fee29cdd6aaeb41a0fcf3f461e7f967fd081ed9d9b104316d3a7cf993e965e3f2526bbb54cfaa8711846bcf4264cdfb1988ad80c1a2ac6e74f575c5d21b4dbb7b8a4dd2c6c0f5c62cd095cebb4e2146632f03f7974f80697d7d56d574b15a4e3bb1a4e9e654ca08a0293aacb3d70b59a51ef029fb8d628fa5ad4482e5819ebade5dda7b6fae0487bd29498e704873eeb1dbc6746fd11a9c18aa5c5977dc7894bf56496dfc95004a71991822c8987e425ae75031156ce0a778daae8ef22ef0c0569202b7fe711e2e349aafd2383ceb650afaa7df3570262c90599f886778c73e04dbee98c74efd1923505a1c5bd8ccf68be7fa1261125517321d77eb32e61b595dafa93805baabbd93b759e3870c013060cccc9f0dcc5a62994350757d278f22c48068a1b64da1bde3facb0d0c20579e1b00816eb9c937380759f3d9ac8c1d454d030d0ca2e50f7d8f84548c8a8e72ada5597c643a1df61f907f4e662b3fd883363e7572671f6ea65c6091db6af336a7fe0512591f115c3df1c660959f07abe480ce267a0b523979934baf7994a7372381268808c65fd49a10712764a895a7603df188a93c9379d3c4174b168ba912ef4a5b3e990002c7e605d354b2aee3292c0184a000bb06f42e03327b7872524ad4641f35f4574c017439736be1691becfecedc9d390933c973fba603963b03f7f81d32cdef6961cf74dd532069d524049ae51dfb0dcbd143e675f55ebb6291feb91469b686daba17d3090e6e3b6191878563066a3ee255dcebc773cf11a8c616b46717c78d7524dc161ce95d2922f52b2edb8205fa9d00c86f3c860f1a0e10bd31a66c36136b59e962339ffcc1174fcaf29bcf17431f155fa70c8463b04e2497c59b55184f237b50cbd0d96a25c4c0e738fa59b07718c9987db25d95a2fa5cf2c57d2e4ee81ca7c0ae6f19017184d252a2addf094ec9cc16017ab64fd2b2c9ec1a9f41f92ff8bcfcf7411aecbfd7d5f75ea0ff3514edda0b680f30701889aa3cde4b01beab9e1d86a9cb57c560fa110d19324e8aa5a25bc3cead7301ec39ecfaaeda85510d1a13dfe21e480f7b72b398a74e56a0ba7479ac411df575f8f243666f72455f107abc88ccc1248450ea6352555b2711a507e8d84c7da8d0a6784cf692800ad59fbf18727d35670c268a7ff42b9045b09ecc623e0f6676f5a901effba706d594770cf217fa8ca47141f0296a1ae15f944bce07178d298d8383dd18803bbf586e151f7987f8ea6d09e0e7dd575c55f3f6ce8cd52944b6abd676462c6ef2398bc87a404ff1afc7b637422f17a24fd87a2af1dd1c254032c3959c00078ff7fc2a43336cbfdbb670c91c6b028b4d124904c4503f57634967d2e647a31e7de553b34854364a080d3e6fd60f10359ecdac617bba0dc78729e57ac15a0831349e4fca4750f576f5e44fc4e7aa71e14d3890533e8da083f793f9596e8b2495a2e3027cefa0bd3c5fb21472a824dc2b6f77e422560a177eda8bff3c9d06b32547c664911b68e1096d01bfe98a49b2554bb56f2d43eed3788c7e23490d472a7268116e5e252a008be71b5296e0cacd067ad0b501e3604850e89dffeb6fe3d3eee28e84a7e66ef5e5ea108b97c8e51564ade3322997507aec554f6ca97eb2a6fe91be741d717be368eb462e13c4f97b614b3a843f86557b08bf2e35d6d04552ec4958ac1e9d865bb68e58e03f84bcebcafa1bb7037d5258cc56e84ae4896a9faa50e8675143f7cb90133422c1f8bb188a47784f142a611ddeb7ca5ac412d06c130b0bebfb499861ce75f632f6fc563c5ae3e26d5919112d0b7870aa8fa79a645dfbec8a8983274a9d8b38aee61946611be443d23781dd8ab8a46ef2848b31cf1909aa7992cde427ae18a5d3b49d9717b04e7a14ff36bdc4b4d81a84b1c5c426bcf4164ac03a5df2a35a9ab622b47ffac329b6680f08a993bcccf500d88fe31e3375fd2604125e2cc11da9b2743c5a4736344db5965cee57de2267b96c3e31321bf73dfe17c94668ed699ab678dff932ab2a220434ac3dde217851cd13bcc6e96718421028a6935792f34bd2b718d06ecd073ab8405a6b9d7333b7e663b361d57bf6b97425288cdbe0b5414544d56137e706a6dc6e2fd0ccf4d4d9dff9484ed7778c7104078e6aa10f7e8f80820641e81e62d38616fd26b4870ea8c9c882fc5dbc52d01ca08c85c108c1f949c6faba25b16044e14ee9b27ebde6e31b953dcc54eef137f71a8bc81782b5d2dec8939b775dd6a61bf55ccbbbbec80e10951e95d85c5e9e446c502c34baa917ef6c6c37a573e59479794ddae1ea4753f424bde9059da62c3357bfb5e5f36ed177b8fd6c0e7dab5a1f7c1e39ccf74d1ce64f8aff8f8f0ca8ded10f4df7c4efe24143a5f0967dc1665b41f69cbee55b9cd3b3bffa7baabc9880295eacc9c53cdae8adee89dd5437dd53f398fee43020f327429afccf515b8bd29eaf50418783cf5faf48c8c6735f38e30b759379312021fab4078c6fd9a58ac44dda1349b84b02eda4f2b3b012b200b08a6d0963603db46650c7692e31671ee213ad48dd32dffed84e756ec757d819e38a02e54227e10cedc3218a548699d7963536b55291e209b5044046569c57405c217b9996df5d1096e1990fbe7269c291659dce9a21b50af51ceb4af0bc4ebbe76d7d7d37bd3b43a78706d0859150602dfca098786d22f63a0d6b1ef4e9d17863c5253a7e8a525165f2eacc85082824fced6045e7e5ad20d183e692afde0921a8058ec3f2cfdf74a40707dcbd9a941c3695aff940098011bf9823aacda551249798d2e26996ca4da37880fcbd43516de16651b5bff1d9e37763ace233039f01122f7d072e63ef4d2b9de08ad4cdb15d40ac41de80e2cbe69acabd3a378a0ba9bf708bb834c20a1816aa7bdc1ac864d239572db4ac66ac106b8f313636256c1f5f4c7f4abc10fab6528bb05adace114c3f1c06eec"}, {0xe8, 0x11f, 0x8, "635c61603ba377bc202fd5327cdd30d6b47ea8c2ca9055edda2ad23811e2155efe98e8c4255a8ca7ed388094907439c5b6c73e34e75f9b6750a92312c81f5d641bf17bf2f465f503e8b67d9b00df621d892ef8d3ccd346d212a099e522a5bbe442a49b91bf4bff3bdb5e029befefe6c5d8e0821c38e9be7ced1004ead50a33f1d95746081e3875d74367d71294863d1847c575eb8e5c87831f6a0d49f7a68ad60d9ffa01ebd0d0ec032f2533c614fac7dd2116d64cc1e563080d19e86f8a6341caf4748f0c3ec7faf9a5ac538d4f4128bd30e2d557d719"}, {0x70, 0x11, 0x1, "8c5c25601f4dd69d363068bf09781b13ebe0e9cb0c24fe05a65ab4476ce39f70447a4bf801ff62963fa495f943316d5f1b40fd95fbc053a5976f5b1033a8fe3bdf5b4e3ff9ce6b9c53e7a1641b27530380386d76985259792cd58e"}, {0x78, 0x0, 0x38000, "6f6a4482c2c95a32bdd7c76e5dd11c138690542dbbe204c55467dfa1e89140c2a550412b3094cd4842e5fa9b818433db9baf8caa13b1a6b3dba53bb0b856970b9df8f45e7d0d44eb1136d0a361cd8ff167d9781a19c761329ec3549a191dd334829de24e17d5"}, {0xb0, 0x10f, 0x400, "5030a6a61547360e56034ab82fa4798be4c119cb26aa24f40990a440e3f37ce0582ee2618ba24a5f086ec37bf406b46f1e19c81b0772f17780603ceb0d1471fe8bef43692d35e2b15cb24b18d0be8562629348f9747b089834062ebdcc42eb783971e3ec085724fb80e11c61d50f3f2d1cbcb9f521d1513699066490725446fa04c771e948f8472c1938a7febfa1e7da3c19ec22b9c9bfc5e1"}, {0x20, 0x88, 0x7fffffff, "203328cf997493d0a7"}], 0x1528, 0x8001}, 0x800) ioctl$VIDIOC_DBG_G_CHIP_INFO(r5, 0xc0c85666, &(0x7f0000000200)={{0x3, @name="7933f383694e1aacfea45d5ba27f5afaa0adf7d3294b26a86dd3394f9ff3bc86"}, "193da44424c7b2ba6dde009a92e8d7d649044bd17475c5524cabae8834d23194", 0x2}) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x111000, 0x0) clock_gettime(0x7, &(0x7f00000019c0)) 10:08:22 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:22 executing program 4: r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000340)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0x104) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x6}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x4008080, &(0x7f00000002c0)={0xa, 0x5e1f, 0x0, @mcast1}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 10:08:25 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x200000, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) timerfd_settime(r1, 0x1, &(0x7f0000000080)={{r2, r3+10000000}, {0x0, 0x1c9c380}}, &(0x7f0000000140)) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:25 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:25 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:25 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0) ioctl$VIDIOC_STREAMOFF(r1, 0x40045613, &(0x7f0000000040)=0x4) r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x181) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000180)={0xffffffffffffffff}, 0x111, 0xd}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f0000000440)={0x13, 0x10, 0xfa00, {&(0x7f0000000200), r4, 0x3}}, 0x18) sendmsg$nl_crypto(r3, &(0x7f0000000600)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2882020}, 0xc, &(0x7f00000005c0)={&(0x7f00000004c0)=@del={0x100, 0x11, 0x408, 0x70bd29, 0x25dfdbff, {{'drbg_nopr_sha1\x00'}, [], [], 0x0, 0x400}, [{0x8, 0x1, 0x100000001}, {0x8}, {0x8, 0x1, 0x9}, {0x8, 0x1, 0x7}]}, 0x100}}, 0x4) 10:08:25 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:25 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r1) ioctl$int_in(r2, 0x5452, &(0x7f00000001c0)=0x2) sendmmsg$unix(r2, &(0x7f0000005240)=[{&(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000540), 0x0, &(0x7f0000000680)=[@rights={0x18, 0x1, 0x1, [r4]}], 0x18}], 0x4924924924926c2, 0x0) recvmmsg(r3, &(0x7f0000004e40)=[{{&(0x7f0000000000)=@llc, 0x80, &(0x7f00000006c0), 0x0, &(0x7f0000000080)=""/9, 0x9}}], 0x37a, 0x0, &(0x7f00000050c0)={0x77359400}) ioctl(0xffffffffffffffff, 0x0, 0x0) 10:08:25 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:25 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', 0x0, 0x18}, 0x10) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0xe70, 0x80000001) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:25 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000200)={{0x2, 0x4e20, @loopback}, {0x307, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0xc, {0x2, 0x4e23, @remote}, 'bond_slave_1\x00'}) r2 = dup3(r0, r1, 0x80000) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000001400)={0x7fffffff, {{0xa, 0x4e23, 0x24, @loopback, 0x5}}, {{0xa, 0x4e22, 0x5e, @dev={0xfe, 0x80, [], 0x1f}}}}, 0x108) ioctl$SG_IO(r2, 0x2285, &(0x7f0000001380)={0x53, 0xffffffffffffffff, 0x29, 0x6, @scatter={0x2, 0x0, &(0x7f0000000040)=[{&(0x7f0000000280)=""/104, 0x68}, {&(0x7f0000000300)=""/99, 0x63}]}, &(0x7f0000000100)="21134dd71ec6cc5cd47504e34a9b2d5327de36f23ff8fb6eea537d38b3f6a4219db2512623287bd1a5", &(0x7f0000000380)=""/4096, 0x3ff, 0x4, 0xffffffffffffffff, &(0x7f0000000180)}) r3 = socket$inet(0x10, 0x2, 0xc) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f0000001580)={0x1, &(0x7f0000001540)=[{0x7, 0x9, 0x1f, 0x9d0}]}) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:08:25 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:25 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1028.612424] audit: type=1326 audit(1542794905.418:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8652 comm="syz-executor2" exe="/root/syz-executor2" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45a3ca code=0x0 10:08:25 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:25 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00020035000c00060000001900154002000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 10:08:25 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:25 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:25 executing program 4: io_submit(0x0, 0x0, 0x0) r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x1, 0x400080) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000040)={{0x3e, @multicast2, 0x4e23, 0x2, 'sed\x00', 0x10, 0xc4ab, 0x45}, {@remote, 0x4e21, 0x2000, 0xac, 0x9, 0x6}}, 0x44) fcntl$getownex(r0, 0x10, &(0x7f0000000180)={0x0, 0x0}) syz_open_procfs$namespace(r1, &(0x7f00000001c0)='ns/mnt\x00') clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000140)) tkill(r2, 0x10) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r2, 0x0, 0x0) [ 1028.867821] netlink: 'syz-executor4': attribute type 21 has an invalid length. [ 1028.881945] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1028.888902] IPv6: NLM_F_CREATE should be set when creating new route [ 1028.895421] IPv6: NLM_F_CREATE should be set when creating new route 10:08:25 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:25 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:25 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1029.405461] audit: type=1326 audit(1542794906.208:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8652 comm="syz-executor2" exe="/root/syz-executor2" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45a3ca code=0x0 10:08:28 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) umount2(&(0x7f0000000000)='./file0\x00', 0x4) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x21, r0, 0xfffffffffffffafe, 0xfffffffffffffffe) 10:08:28 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:28 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:28 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000580)="0a5c2d023c126285718070") r1 = socket$inet6(0xa, 0x803, 0x3) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(des3_ede)\x00'}, 0x58) r3 = accept4(r2, 0x0, &(0x7f00000016c0), 0x0) recvfrom(r3, &(0x7f0000000000)=""/125, 0x7d, 0x0, &(0x7f0000000240)=@hci, 0x80) r4 = socket$inet(0x10, 0x2, 0xc) ioctl$FS_IOC_GETFSMAP(r4, 0xc0c0583b, &(0x7f00000002c0)={0x0, 0x0, 0x6, 0x0, [], [{0x8, 0x80, 0x4, 0xfffffffffffffffe, 0x9, 0x1}, {0x3, 0x43d7, 0x27d7, 0x4, 0xfffffffffffffffc, 0xde}], [[], [], [], [], [], []]}) r5 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x40000000010201, 0x0) ioctl$KDGKBDIACR(r5, 0x4b4a, &(0x7f0000000500)=""/65) getsockopt$packet_buf(r5, 0x107, 0x17, &(0x7f0000000040)=""/60, &(0x7f0000000100)=0x3c) sendmsg(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) syz_open_dev$midi(&(0x7f0000000180)='/dev/midi#\x00', 0x4, 0x80000) 10:08:28 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x1000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1031.598637] __nla_parse: 26 callbacks suppressed [ 1031.598646] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:28 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) gettid() 10:08:28 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1031.647708] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1031.663590] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1031.665108] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:28 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1031.730620] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1031.782170] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1031.867474] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1031.889649] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:28 executing program 4: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0xb02000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:28 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) r1 = shmget(0x3, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000140)={{{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@broadcast}}, &(0x7f0000000000)=0xe8) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) getresuid(&(0x7f0000000240)=0x0, &(0x7f0000000280), &(0x7f00000002c0)) fstat(0xffffffffffffff9c, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) shmctl$IPC_SET(r1, 0x1, &(0x7f0000000380)={{0x7, r2, r3, r4, r5, 0x0, 0xffffffff00000001}, 0x1f, 0x800, 0x8001, 0x1, r0, r0, 0x8}) ptrace$cont(0x18, r0, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) vmsplice(r6, &(0x7f0000000600)=[{&(0x7f0000000400)="d2719b6c6e6bc3bf26c5cd38eb87900194a92806bcab039709d44d3580fb67a17921a5b47fb9368f6d27dfaadf119b5764b2889d0e0c6f2d3a93e88edf5748656d9535769ba4dcf2ea4fe15e9182093f7010d3582769348c2eae78914d0f812eb0da5a11a933b3657b8e46b71877954c2b8811885fc7db32b3888109fe1f1a5f8362c71d8b1bf930fbfa257254f7bca045fe4fdf1bf3d170a0e036ba95ea3e0354050c6cc120eed991a7e5d67bdc715775a762554058107f94520d620fd7b80381a1545735099c2a7eccafa1d2943e8cff7805", 0xd3}, {&(0x7f0000000500)="4be6c535cd63cd64d19f95c1201c759c961e47b06da058c22f5e9193c41d857712f417251c3b831df53ae15800c8485d6e7879b73301b02919a2c4eb6350fe5a609c02cfddbec386abad165123957bb2b29f2f41e6facff0b50e", 0x5a}, {&(0x7f0000000580)="ee6c5d833e6aa193c383b23842f5db834955dba821a3d5e86c6cd9641335023a0307fc7119614ef00fd1c111883de48c18ed61da36fc73604be8110fb41a82fbf9607afeb87975014fdb2305a6e8f282cee528", 0x53}], 0x3, 0x2) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:28 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5387, &(0x7f0000000100)) socketpair(0x0, 0x8000a, 0xdf, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$unix(r2, &(0x7f0000000200)=""/167, 0xa7, 0x40, &(0x7f00000002c0)=@file={0x0, '.\x00'}, 0x6e) connect$l2tp(r3, &(0x7f0000000180)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0x1, 0x2, {0xa, 0x4e21, 0x9, @ipv4={[], [], @broadcast}, 0x9}}}, 0x32) 10:08:28 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:28 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1032.041977] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 1032.064568] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:28 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:28 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) sendmsg(r1, &(0x7f0000001500)={&(0x7f0000000000)=@nl=@kern={0x10, 0x0, 0x0, 0x40404000}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000200)="bd3838a3c203124c4b228e00a6dd2014926d64a8c01fa9260097d27e095d3f2bea79d09b6344cf305455f8e1ac777f761c00d870f233f7d6d7da0e28b5573c5bfcd737efdc998a7ba752d272cc5ff23e015b23dfd3c8a2ee94b0713a52048ecaf55295d2a008f014dbbc8b96a0f7c997f1b1d9a3f884b1d50f6de17ba32addb266634928d18a4e2257cf0ac22e747556c12c8cbdf5f78e23d0282e9c1c005ca49da8f4d4", 0xa4}, {&(0x7f00000002c0)="8aac31b02d851019abeb32bb7371d865fe5d81a8391f4aab04a9c35c66723fabe709244bdacbc682700cb9ff5ddc33aa79d14047bb29edaa7426feb291364fee5da79a11b5fb60dd914327ca1335b2499b3785180ca4c35e761635e2ef0a37", 0x5f}, {&(0x7f0000000100)="f07ac87175c281801f8f96dc40f4c6f70ffb3244f743bd360795a1694200edef4d35e3b0cfdc12797eb4da3150b9f387bd906c234bbfc88363a943", 0x3b}], 0x3, &(0x7f0000001540)=ANY=[@ANYBLOB="101000000000000019010000fdffffff9f345b239a0a20ae4f72a0010d90caac9c83682841c9372297c7e9b733c4107f2c5dd0554511983ac85756394664b463a17c3c16528263b05b3466373ae64589b6244dec48dfe5414504e492a77ae8c5edb940227ccdf45ec9370892f98c4627e978fd3b564ae6fc31f239b72f573b0361ef54a8dae56a3b7e9999fc18a8b0f834636e735275faada3a0bc9c70a3cd29733c960ea93523293ab8039e7ba305a15e4dde7c1091ce232304fb2719ef1b738e08f7e2050b74bea0f281943d3febe1f7154ae33e76c6b6033f9c3f52194a075be88dcf784d8be80c76d03df041693773b7698c6586bf06fd719b59eafef5eb5fb110fc21b600cdefd3bbccf78ae56f9c0bde8f87a2251cc6433f0786d6eb0090a246a86fbc9921552c93b4947bf5726cbc2d8f29d89bb52bf40614a2ac95ace2712c00a99a0a7ae640d7cd55463d2556d57412ed2c918b65b371c234121d346650afc9939bb2580da5f62393029dc899b55b2eb72d3e2eb0cdc5d2884b2118c8f269111712d57d9d29bbd0a9e030defbe6a12ab748c6e5dfa9774b637cf2d9cabfb191ca227fbddb1815125e9d2f8a1e6acbbadfd263bf463a15a73c2498da61ddad69294141fba8341da6124bab8ee4676ef63f86b3aedeeb9e863e019b525436c131ed63c2a181c9c20d4c0c18a7e38e9306a1b9954711f9204464eef4fb6dc3a6c634009874025d4e2c9c11c9082112fbab34a7cf0d72b33131e22d6cd57ad48377ca781ded8e3b06c088a56681dcd1970da07eb8cb654c7051eb9c1096dcafbc1a7f760e7f66fbd0188d216170de332a2087672a769d31009f50b8f08073463fe44243a918a3c97c0f7691e0bc68c27449d3b44a01cbaea703b35eaf3a4b02de9cf8ee50d5f59a85f89798ca4d759847ae23af4d9ed5f36202355e44d25b38fdf3ad1af8221a45e1b231a806a8fd17abfa71b063c5c1c0aabc8c47621c435e8d4887d3302df64ecd0e34824b82525e1804b3103e73eee2ec4dfe4e4f0d7e391049dbaac2324877e8b72feefad0b5c2a914a7e81066423e6532b019358ce47a9d3d3cc5e3cfff14989ce7699053494c3fb6570223bb79fe85681cb885571119f400b6a8656ffff3486f71ce0f64eac4b8c1ee912e202c2a7a59dad2adc26a6aa1105b2b67c441358a609355d4844d453c22a13e7d0bf00154bb17830cc121ee2f4cd787351a4a58fdf72a36288d8c52d6c687675f705be3d103e66291715faf6ae3066cd59f2e5e633c7ea8d11cf67992077594a47ccafcae27a52c45acbea299f1482d2a33dfacc0b74972839aa7cf4bea203ea65ed58b0815c54fdc6cf9ace13f962308716bb8e33ebf2a0ffbd29f8c4575c602e1fbbc20555a559a1474bb703017898ddb9caab2952d2e2c4af31f63c792a290a1dbc0c34b3321c8c4906754743627a6ec7e5750c4cfe0a353f6af347c0f9f84290a15bcd4c07f44f230f7b669f799feccf097a498b4c7476abf800f34876a57435a9d7a86710c20639bacf6a625b133afeaee38c665f27a9150fe7143c9f07279be6279ee4f87514147f30c702239b27f693e2ef1cde08c2ed31c9964f3a695a7ce7b8ae025960ba3610fcaa03ea455edab62a359a94de46e43f6bd0a62be383aeb9eaf4fd88e3eadcbb393117e83130a779b143c48079c23e0e9c2205973a4c765df4c117039f3f7e1e7b38d2ec9574a27529b7ea7a50c452e6df6b4f3e025d32012bb969d6f655bfdb03c8534c69cf77b80b5b7ee24a210adbc6a94e0642862cefeace8f372008783f11211e28ac4abe7bc72f4f33acac5db3b61c5259aec68ac2914dd0b31fde7b284f7bb4f40cd7b78d724f0560b02965149fb6a79350cedaedc00a3e603d4c5a3d0caeade499c9fba4355a9756bddd62645c09d8f351775ee5020e8e09b7e5e0bed3bad08acbf728e57fe6158dfda9a8e87aa637245f52c7deea74aaa52389e47c71d500c5815949b16eafbaf34fbf6671ad1b9326cc5821826bb7e2c560f4ed9e4071836c9837a6f76fe42a5ac138cf307d5354ffb8f030ccc562bbf55c8be1110359aa88f8dee2063d6764799c67f49b7ad3bf58d39b32df95582e039176bf59951fd21c97f5432844e393f6e8b5cd48fb8b119d84266f32aa85ae433d161b246aeb2c20a98070e8fb5f55a770ca857cedc325089e99a36efd23743d0a6c372bd7af7e92d0b58209068d3081a2dcf863fc96d825122c838982d7e46f1207652c27912f30710a897607211d1134dc8e407975c8d6eea785f7e8e89cb3d2f6d3d7abaf7c4352296cc3e14f0c984ef750e406a4b4d8cd6ca874b2bbee19cd20a9144f0a1fd7111e5c322875b12f1bdf81e56fca4bb649c7032159d5b08cf9796a25ec0f66a651caf7050ed2170a6e8604d4a27d008a94341dce9654ecaf6ee5a7fff78f86e027bf8423bbe230c4c839bdbab7428403d365b6aaa44fc0d523c288f1357ece04b7be515d152fed0c4a75a62b3a4b3bc5a036bf3e2d327c87d1c570f68a036352ce3ba020867f1618156b14a7567082666d1fee65aa1262f4e6fee900b5b0afca7d311ecd26e79dd4f16d53169716ed80f012c6adb2705436d752a80c2c4fd331e499e49ed501ba2e901cd32bc565a761b69dfa744496684d29bd0baf7187ae65219d234d27282c395030ba99f3fdf91b19dcebfe11c1f22c66ba1f905fbb98b1a084ea1ab3c82cae33323538cae6ad7095ec0c2a7c56d5ee7b761c8e841daee570357b487bf13c7e6a6bddc63fb502c82da0aff9139cdbdef05f44e89f82f7dc81cd198db4bbd2da4907ce12a63eb3e642ef9e7e986687644eacb63f8fc818156d2d27254a6f3300849a44261cc8959a5cd940bd14f7f55df13813e69cbdb7d3fd473e2f22578d4db090f5fe59df031c530f086583427472a3f68c1800f0f97b455f262bdd1e8bff5ceb8a53d465197365a010a41554eb2f5bb0c6f82669337576334b0b9156674ceca4aba3874ddd675853dc8f248354e744ab413e16f18640f22786e5c3aa4de917bf29f962a6804cfec50c1070ab6536a5976c82497290d9d09be5e28b525394f96f2e0c3737d0baee30a43bb74cba78719d3c6869afa40e6ce298273eb5a85e6cd9fa271e8b2f62035b99781acb09c686044cf49d9d063d542108a51f754e438965ac0854e18a74913820352ac641334b8d445bc5392a41cc49a2c5900ae22c1d2cc605c5049f11c6e44985a343c08215f9db7e51dc705e710b0afc3c89eeb02035737ef75543ee5f9f3c0263d4061cc663ad485c081b15d4740ef6fc335890ed7de0cf2adbe722b457c4073cbc51b1436a84f4dce10bf9da6b9de3bfc1e5dccfd2a269c131b6fd25c4025135a501ebf143623ed3bc3571683e1dde49025d9b25b6faa0aba3087452fe4a9b6a52595297ae9957f360d08d20f8369f24d7f0bfdfaa02710d8e0d9232f80e806693f8ae03a926f380ec97499862df893af7917b4a4c0a69c554c2d2d37e9cc6b75388d423c2816bddbc7593b699b3d691c7c6a9381da2b2162ab043648c5d4205502fd837775eb71231dd8886633a4cabe4d5e192f726060c4a134505846650f8c2402af703da369bb100c99e1dca280119504f1633a8b0fe9757b8ca724789569857a4efe5484b9c98054d01fc7b0af2c318eeac495b79da1911a8ca8046e93004017b472c21d7021a6a55cb1adf3855d96291310b72aa620a08314439ae9e684a061bf998683cc69a7274121dc950427db8e888bf0b362c2aea5493bfcb5b8eea084bf504ba06f3baab6e07a562bd3f60de715398a814ad4296fc6a4f8425fc0052449444c385d6ad9eb1b787e33ddc275af0c46cecac79c43792eaeeca2c65dfa34502982971c2192151f756d3840b629cb6eb1548d25e05336b6750e79cfe50e1c00beeadffb0eb36c0c41fe183e79cbcb221ba182887be17c013d8b6df361b02e218cad7d0e440588037adbba506a120ad04e12af8b1bb1314152795d4e30adfe6436328364df4d4abe9d32756fea4ebd11a8bed9d2d271ca675222195c143f6546bf0a510b3046aede27d45e6e422201ea80d21e6dba13c214a04a0827c166b889b0c79d486d258793c5f35db18570a36516d075f920a78d2134e202d24488a7f4c25f7573e4730bec892b6b78ee78af5b9e5c3e4e2daed5fc5cbacaf79912211ebe89d84f5a93c6157f82343e7d1ed221736be84b79daab475b9d928d2ee035c4426abc058af359fc0f8cd033ec37ac8fbfd38d514ca8d844031f23dd664c53465847d4c332e9264639df00c64ef00c16a1e5fab7dce7d69c8c2905817e03ac06b58bd99151ef7b022f361e1c6d7865d2e23249d35a7133c0ed46463008f75446f864d08a5374ec9bdd8fe379cb9b417f3f6153e60fe48392837152cb71e8d23586942ffdf0abf9309bf6ecd7aa735995b81f6b15ac649607258ce4e06d091d4fbfff8308152beb9345d17127233cd97ec6aca4f043ca19bcc6581bc43cd686bde8b22fb73d88c73700bfa1b99b8a3f7a7477ace8e4912e03d3736c8a7afc1705fe00b3f0f8be6cb8052c211ebbcd5ff4d30a86a95040278dc32531d5e82ff8efdda80ab06968b8dfdfdd6ba8f73751f3a11bcd24f1a2b969bc68c0b4f6cc7eb42f3d95f9c544bfd370f7fdda6043c8fb0389529b2ff31aea4e628cd1d991a8eda2afca3e7b3fc1cc73395063d9436590c7034e1ac007c7f72d10f3d47f5276d4cb1d2aeed1fc7c17a1c98e55794f6b656f90a92d2587fd59d465059b868ab0dd8a2a62a9565fc888e79c006a1e5c619a7cf0c4919bafcb963d0aedd7091dabdf6cac37bc08e94e88d894e542362eaf1b356810e2e0dc4efd9d152084d7af588baf07fe1d4e92fac7ba2b8e4e48a0b5d307a650612dac7215f5116860936e5db044dcc9cf0241a66e69193276db852d5db4dd28884f67018ebaf0acf43c288772b7e8abd0b177018e464cd6f972319c1e77716dfd0d1bee298344f43c1ef057f980c250b027c3e74211b12b1f296ab0f2bf1bc7c0653e323782cc955a18ae7177d1ffe50d65278d2c0c6c2015a928ec3cb3b82e4c73babde09f95adbb4b25bd3f3c0f5fecac4e35a72cf1535d9085dd6a2ec82cb6bf04e8b3c3308862e2cb9b143eb494c85103ee4aac1abd4d6f49bc9903d06442aa1dadb894fe3de664d6394971187dee961d2ecf4243bf79b19b6f9a5a6edb6edb2557c6edab77188c0989204ef556572910e54551e40e85546103cd774be48e01c85e96093a6aefa22fb099579a29c1b3f81e5be82b98fc90905e08aa7577c0bbdaec19c7fed251e1f13192f4bb02b46c3afa46602c18d03016a74d1e5cd8ef9bcb34c8e6621013d0f9ee85d0a628aa86d553eee824fd90c75e6acc712dab354155c7bab57d3ca51c416faff3730cbf7ed1f73863a4ea502778a3458157a9354d8db550523e410944a217c9e4bd6898b52c9a9cbe0a3ea4f39d195e5a0a33508e66b7f210eca649290f390ca7c3c1f2fb7ed859aac10ae9a6abc69f9d9050c4bc6bee3cac39eb96de18375e48ce0fe0816bea20f2e5621729ca66004dc0333df55d145be036183fcc27703ab7855dac6b573cf88f7c01f168f86ff9b1f7227cde266ab9ab5780940f043f8df7daf43bedc950463209a4894c04c92c8a1c2bc5717f8f5b65d602a11a3b6fcab5e23280aa0962c5aead41087f910c67fa049de391bb37985c81b0ef7f88a156551d7a27829692eef374b059b386ccf62c21085657f9eb4800508590fe250fafa93bfcae76e8c431d3e7f4172a499f238c1bfb5c267f5fb1290f982779afea5b2d2d285bad4f1bfb9c29c8000000000000001b01000004000000a4551de0b2475d944a979921abba5a1375a8c8a43b0ccfb4da01f9286f8326302eb65b253f1b23981722979e839eb6eb4998faa8cd4e95bfcb55ea16771b829a3e4b89b69fa1ad3ce609a30facace08b2b05414d3493a9c5a9919e02e43c1db1530a002918dee4bc040dadad46c0747fcc7116d368a4f0decc9e425e5c1c9e599b82e54570ef095f864d3a45070ac1e29f4fd29f254fb33d89d5ca3990510da501d0507126c6ce1208b15a5c505cc6f37600890000000000c00000000000000000010000000400007befe02c9c295e6452886420239156e2bc4e7554d374984d15215c2dba2521fbb88863018c2fa638d6085cdc93de8fcf689621c6c0de41dfc83d20fc09b7061cc426e118025dad3c08ad2966913563fd414b06923e42de420fbbff1708c6cce0fcb0db2f5e46e0e129112389f56d352e02f8276719ff0f90439b3b5ca4ef48b9eb44a099eb38ead79337d69439a87f0fd0ae35da0994f443944b554564ae43fc3a4643"], 0x1198}, 0x8000) 10:08:29 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x0, 0x0) ioctl$RTC_VL_READ(r2, 0x80047013, &(0x7f0000000040)) 10:08:29 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x4000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:29 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:29 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = semget$private(0x0, 0x5, 0x8) semctl$SETALL(r2, 0x0, 0x11, &(0x7f0000000000)=[0x9, 0x9, 0x401, 0x2, 0x200, 0x2, 0x140000000, 0x101]) 10:08:29 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0x0, 0x0}, 0x0) 10:08:29 executing program 4: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0xb02000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) lsetxattr$security_selinux(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.selinux\x00', &(0x7f0000000100)='system_u:object_r:tty_device_t:s0\x00', 0x22, 0x1) ptrace$cont(0x817, r0, 0x8, 0x2) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000000)) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:31 executing program 2: getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000200)={{{@in=@multicast2, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000180)=0xe8) stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_virtio(&(0x7f0000000000)='C\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=virtio,cache=loose,euid>', @ANYRESDEC=r0, @ANYBLOB="2c736d6163546673726f6f743d5d65746830632d2c6673757569643d663e7300376677002d61627f622d756300322d336137002d627766303f7734322c7569643e", @ANYRESDEC=r1, @ANYBLOB=',seclabel,\x00']) r2 = socket$inet6(0xa, 0x803, 0x6) ioctl(r2, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r3 = socket$inet(0x10, 0x80002, 0x80000000) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) mount$9p_virtio(&(0x7f0000000480)='keyring(\x00', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x20001, &(0x7f0000000540)={'trans=virtio,', {[{@noextend='noextend'}, {@version_u='version=9p2000.u'}, {@loose='loose'}, {@access_client='access=client'}, {@aname={'aname', 0x3d, '/ppp0+\x00'}}, {@msize={'msize', 0x3d, 0x1}}, {@noextend='noextend'}, {@afid={'afid', 0x3d, 0x7}}], [{@uid_eq={'uid', 0x3d, r0}}, {@obj_role={'obj_role', 0x3d, '$proc\'ppp0trustedcgroupppp1ppp0selinuxcgroup'}}, {@euid_gt={'euid>', r1}}, {@defcontext={'defcontext', 0x3d, 'system_u'}}]}}) 10:08:31 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xfffffffffffff000) 10:08:31 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:31 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) r3 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x10100, 0x80000) ioctl$KDGKBLED(r3, 0x4b64, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:08:31 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x68) [ 1035.093477] binder: 8813:8816 ERROR: BC_REGISTER_LOOPER called without request 10:08:31 executing program 2: socket$inet6(0xa, 0x803, 0x6) r0 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) fremovexattr(r0, &(0x7f0000000100)=@known='trusted.overlay.redirect\x00') socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000040)) 10:08:32 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0x11, r0, 0x0, &(0x7f0000000000)="ba29ed2ce3f99969252692f95e98426e1084195855cdf1d88c251e0255b2c8e7398a320fbc342ad07905ec5caa7151857241942e2e62ea5e0630511aa7139275b2a6122b534bb9ac3697d16ea86fcbbc97df2f86db9761c3a53266eb48c4f0f9e40b4aa8e0474fb389d5c0377bb2970a60777b6a588f9090db55557619887c4afa6941d348bb384abeb2ac88e3c5ee5a00000000000000") ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:32 executing program 4: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x20b}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:32 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1035.184640] binder: undelivered TRANSACTION_COMPLETE [ 1035.189933] binder: undelivered transaction 3624, process died. [ 1035.213469] binder: undelivered TRANSACTION_COMPLETE 10:08:32 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x4000000000000000) 10:08:32 executing program 1: io_submit(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x40, 0x44) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000040)={0x0, 0x80000}) r2 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x3, 0x2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000140)={r1, 0x80000, r2}) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) setpgid(r3, r3) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x10) ptrace$cont(0x18, r3, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r3, 0x0, 0x0) 10:08:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair(0x0, 0x0, 0x4, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r2, 0x118, 0x1, &(0x7f0000000180)=0x1, 0x4) r3 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="12634840000000000000000000000000000000000000000000000000000000000000000050000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="85616466000009000000000000000000000000000000000000000000fbff0000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a627300000000", @ANYRES64=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='8\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 10:08:32 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:32 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x600000000000000) [ 1035.590084] binder: 8864:8877 ERROR: BC_REGISTER_LOOPER called without request [ 1035.631807] binder: 8864:8869 got reply transaction with no transaction stack [ 1035.661579] binder: 8864:8869 transaction failed 29201/-71, size 80-8 line 2741 [ 1035.746133] binder: release 8864:8877 transaction 3628 out, still active [ 1035.755262] binder: undelivered TRANSACTION_COMPLETE [ 1035.768029] binder: undelivered TRANSACTION_ERROR: 29201 [ 1035.786904] binder: release 8864:8877 transaction 3628 in, still active [ 1035.818820] binder: send failed reply for transaction 3628, target dead 10:08:32 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:32 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:32 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x4ec) 10:08:32 executing program 2: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x4000, 0x0) bind$inet6(r3, &(0x7f0000000180)={0xa, 0x4e22, 0x7ff, @remote, 0x7ff}, 0x1c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:08:32 executing program 4: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:32 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x100000000000000) [ 1036.025307] binder: 8894:8899 ERROR: BC_REGISTER_LOOPER called without request [ 1036.056130] binder: unexpected work type, 4, not freed [ 1036.064233] binder: undelivered TRANSACTION_COMPLETE [ 1036.071469] binder: undelivered TRANSACTION_COMPLETE [ 1036.078811] binder: undelivered transaction 3632, process died. 10:08:32 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x40030000000000) [ 1036.814469] __nla_parse: 29 callbacks suppressed [ 1036.814482] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:35 executing program 4: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x1, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) ioctl$KVM_SET_DEBUGREGS(r0, 0x4080aea2, &(0x7f0000000040)={[0x10000, 0x6000, 0x5000, 0xd000], 0xd6e, 0x0, 0x80}) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x3, 0x9, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0x3ff) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:08:35 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x6c00) 10:08:35 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:35 executing program 2: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:35 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() prlimit64(r0, 0x7, 0x0, 0x0) wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:35 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:35 executing program 4: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:35 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x2800) [ 1038.559298] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1038.597305] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1038.626218] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:35 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x3, 0x20200) ioctl$VIDIOC_STREAMOFF(r1, 0x40045613, &(0x7f0000000040)=0x6) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:35 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1038.709606] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:35 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x100, 0x0) write$P9_RWSTAT(r1, &(0x7f0000000040)={0x7, 0x7f, 0x1}, 0x7) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:35 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xffffff9e) [ 1038.855362] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1038.939108] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:35 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xfffff000) 10:08:35 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:35 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x7a) [ 1039.180187] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1039.211402] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1039.216309] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:36 executing program 2: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:36 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:36 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:36 executing program 4: 10:08:36 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x4c00) 10:08:36 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x4800) 10:08:36 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9, 0x0}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:38 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x8) 10:08:38 executing program 4: 10:08:38 executing program 2: 10:08:38 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x14}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:38 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x800, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x80000001, 0x3ff, 0x80, 0x7d3, 0xf, r0}) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x4) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:38 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:38 executing program 2: 10:08:38 executing program 4: [ 1041.997968] __nla_parse: 8 callbacks suppressed [ 1041.997978] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:38 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x3, 0x202040) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x10001, 0x24000) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000080)={0xb, 0x5, 0xffffffff, 0x800, r1}) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x10) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r2, 0x0, 0x0) [ 1042.039407] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1042.056041] QAT: Invalid ioctl [ 1042.066978] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:38 executing program 2: 10:08:38 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x10) 10:08:39 executing program 4: 10:08:39 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0xf0ffffff7f0000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:39 executing program 2: [ 1042.285232] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:39 executing program 4: 10:08:39 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x4c000000) 10:08:39 executing program 2: [ 1042.387248] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1042.450485] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1042.516659] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:39 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:39 executing program 4: 10:08:39 executing program 2: 10:08:41 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xffffff7f) 10:08:41 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x3f00000000000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:41 executing program 4: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() prlimit64(r0, 0x7, 0x0, 0x0) wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:41 executing program 2: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x1, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) ioctl$KVM_SET_DEBUGREGS(r0, 0x4080aea2, &(0x7f0000000040)={[0x10000, 0x6000, 0x5000, 0xd000], 0xd6e, 0x0, 0x80}) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x3, 0x9, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0x3ff) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:08:41 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x2000, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f00000001c0)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), r1, r2}}, 0x18) r3 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x10) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) utimensat(r2, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)={{r4, r5/1000+10000}, {0x77359400}}, 0x100) ptrace$cont(0x18, r3, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0xf, r3, 0x0, 0x0) 10:08:41 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb02}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:42 executing program 4: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:42 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x5000000) 10:08:42 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x1, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 1045.283352] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1045.328576] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:42 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x2000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1045.383203] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:42 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x20000000) 10:08:42 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x100000000000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:42 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) r1 = epoll_create1(0x80000) fcntl$getown(r1, 0x9) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:42 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xf5ffffff00000000) 10:08:42 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20b}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:45 executing program 2 (fault-call:11 fault-nth:0): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:08:45 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xf0ffffffffffff) 10:08:45 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x320020}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:45 executing program 4: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:45 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:45 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xfcffffff) 10:08:45 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x7ffffffff000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:45 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x3f00) [ 1048.283543] __nla_parse: 7 callbacks suppressed [ 1048.283553] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1048.306894] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1048.451711] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1048.483332] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:45 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x28) [ 1048.512347] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1048.584534] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:45 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) sendto$unix(r1, &(0x7f0000000140)="7a94718861112fa91fde9e85aaa0e55a1c14f1d6e9bb55217a35151aca04a26f5e7aaac3ead418596e2f981295a24dab5f40a1d1960349442b2f0b02c7ab3c5db06c20de7fa19aac0a7ec122439b0baf3548968120381b26525632174b54dedb7326acb703870b8013a9f96ff8836c00009746276dc36df1fb77b83d253e845f86a6b08929245774a4ed4c08ad08c17517fb122081e5c5861acfde0d9ed37768614b905ccc829ad874ec250e66748cd3caf73ba01bd7467ded24199dcb039e0c560a7264f6fe47caf59ae6b41d387e0498cb6ded14b23a83d21bfef0aa63ab2af19901913c3bc6b2b7a489abfeb2b982ffd1", 0xf2, 0x44800, &(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x6e) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:45 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x2}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:45 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xf0ffffff00000000) [ 1048.772924] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1048.803373] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1048.841976] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:48 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:08:48 executing program 4 (fault-call:6 fault-nth:0): r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:08:48 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:48 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x228e00, 0x0) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000040)=0x8001, 0x4) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) r2 = socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet6_int(r2, 0x29, 0x1000000000000019, &(0x7f0000000100)=0x4001, 0x123) sendto$inet6(r2, &(0x7f00000000c0), 0xfffffffffffffceb, 0x0, &(0x7f0000000140)={0xa, 0x4e24, 0x0, @mcast1}, 0x1c) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f00000000c0)=0xe3, 0x4) recvmsg(r2, &(0x7f0000000400)={&(0x7f00000001c0)=@nl=@proc, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000000080)=""/36, 0x24}, 0x2000) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:48 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x74000000) 10:08:48 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x32002000000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:48 executing program 1: io_setup(0xff, &(0x7f0000000000)=0x0) io_submit(r0, 0xaf, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x6c000000000000, 0x100) ioctl$VHOST_RESET_OWNER(r2, 0xaf02, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) ioctl$VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000140)={0x100000001, 0xb, 0x4, 0x0, {r3, r4/1000+10000}, {0x5, 0xe, 0x8, 0x75, 0x800, 0x1, "8800827e"}, 0x3, 0x7, @userptr=0x7fffffff, 0x4}) 10:08:48 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1051.311318] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:48 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x8031002000000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:48 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x600) 10:08:48 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xec04000000000000) 10:08:48 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0xf4efff7f00000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:51 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x705000, 0x0) 10:08:51 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0xeffdffff, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:08:51 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0xf0ff7f00000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:51 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xec04) 10:08:51 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1054.361386] __nla_parse: 8 callbacks suppressed [ 1054.361395] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:51 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0xff030000, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1054.415408] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1054.430676] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:51 executing program 1: io_submit(0x0, 0x0, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x400, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0xa000, 0x0) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000080)=r1) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={0x0}, &(0x7f0000000280)=0xc) wait4(r3, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x10) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x4b}) r4 = semget$private(0x0, 0x1, 0x10) semctl$GETNCNT(r4, 0x1f61db2d15ad370d, 0xe, &(0x7f0000000140)=""/243) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r2, 0x0, 0x0) 10:08:51 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xf0) 10:08:51 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x14000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:51 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x1000000, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1054.584101] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:51 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x2000000000000000) [ 1054.624621] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1054.648391] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:51 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x8}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1054.764609] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1054.803604] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1054.843141] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1054.866401] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:54 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0xfffffffe, 0x0) 10:08:54 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0xff03, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:08:54 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x300) 10:08:54 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x7ffff000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:54 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:54 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x100000000000000, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:08:54 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/mixer\x00', 0x80000, 0x0) write$UHID_INPUT2(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="0c000000f9003a3a808e730c2fa37ef7bd2912b321e2bf189a1140e8201674b18b9ff130c3aa6518dc2eb080f2dcffdf46570c2dc9267529caaa3b40a3d2f5ff93c212b6f0e5a28af58cc6e888725b3d456d308759c3c64081ffc15996f18f06ef9078d56294095166b4ad97980fbe543efba77236da634a55e946023d191077fe66145eea2ac1f6d78af2fe7abfe683773abbe6b3df9cb6248873808572fc809f0840630383a9abef7a99615ecee755f784e1101368200dafc4f93506c72d33591991da28caea3d7531150fca6bca4cba2e07cbe1fee4ce34ce3609d7ba71c710e88ecfd207b31ce3595aa2d16b2f8bde61e26dd7b0932b5439cffc9ee3b63b6c7f5d9f992c9a"], 0xff) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x8, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x80000000000000, 0x8) 10:08:54 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x6000000) 10:08:54 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x2000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:54 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x4000000000000, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:08:54 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x8000000) 10:08:54 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0xffffff7f00000000, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:08:57 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x930000, 0x0) 10:08:57 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0xf4efff7f}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:57 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0xff03000000000000, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:08:57 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:57 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xec040000) 10:08:57 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x7400) [ 1060.538674] __nla_parse: 8 callbacks suppressed [ 1060.538682] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1060.568048] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1060.584671] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:08:57 executing program 1: r0 = syz_open_dev$adsp(&(0x7f0000000180)='/dev/adsp#\x00', 0x0, 0x800) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f00000001c0)) io_setup(0xfffffffffffffff8, &(0x7f0000000000)) io_setup(0x3ff, &(0x7f0000000040)=0x0) io_submit(r1, 0xffffffffffffffaa, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000200)={0x2, [0x0, 0x0]}, &(0x7f0000000240)=0xc) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000280)={r2, 0x3, 0x8, 0x7ff}, 0x10) r3 = gettid() wait4(0x0, 0x0, 0x7ffffffc, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x10) ptrace$cont(0x18, r3, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) r4 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x8000, 0x10000) ioctl$FS_IOC_GETVERSION(r4, 0x80087601, &(0x7f0000000140)) ptrace$cont(0x1f, r3, 0x0, 0x0) 10:08:57 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0xffefffffff7f0000, 0x0) 10:08:57 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x40000, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:08:57 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x300000000000000) 10:08:57 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x4}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1060.740113] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:57 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xa) 10:08:57 executing program 1: io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000040)) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x10) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 10:08:57 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0xffffff7f, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1060.817273] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1060.886646] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1060.889112] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:08:57 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x20003180}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:08:57 executing program 1 (fault-call:7 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1061.073270] binder: 9448:9450 ERROR: BC_REGISTER_LOOPER called without request [ 1061.086000] binder: release 9448:9450 transaction 3636 in, still active [ 1061.093944] binder: send failed reply for transaction 3636 to 9448:9450 10:08:57 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:08:57 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x200000000000000) 10:08:57 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x4, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1061.122613] binder: undelivered TRANSACTION_COMPLETE [ 1061.128080] binder: undelivered TRANSACTION_ERROR: 29189 [ 1061.134400] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1061.160127] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1061.219172] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:09:00 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0xfeffffff, 0x0) 10:09:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:00 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x7fffeff4}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:00 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x4800000000000000) 10:09:00 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0xfffffdef, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:00 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:00 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x1000000) [ 1063.796770] binder: 9475:9483 ERROR: BC_REGISTER_LOOPER called without request [ 1063.818077] binder: release 9475:9483 transaction 3638 in, still active [ 1063.827140] binder: send failed reply for transaction 3638 to 9475:9483 10:09:00 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x707000, 0x0) 10:09:00 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0xeffdffff00000000, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x5460, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1063.876207] binder: undelivered TRANSACTION_COMPLETE [ 1063.881524] binder: undelivered TRANSACTION_ERROR: 29189 10:09:00 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x6) [ 1064.001228] binder: 9498:9500 ERROR: BC_REGISTER_LOOPER called without request [ 1064.034830] binder_alloc: binder_alloc_mmap_handler: 9498 20001000-20004000 already mapped failed -16 10:09:00 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0xff03, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1064.073902] binder: BINDER_SET_CONTEXT_MGR already set [ 1064.082161] binder: 9498:9500 ioctl 40046207 0 returned -16 [ 1064.097582] binder_alloc: 9498: binder_alloc_buf, no vma [ 1064.103853] binder: 9498:9505 transaction failed 29189/-3, size 0-0 line 2973 10:09:00 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x10000000) 10:09:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046205, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1064.177814] binder: undelivered TRANSACTION_ERROR: 29189 [ 1064.183827] binder: release 9498:9500 transaction 3640 out, still active [ 1064.216436] binder: undelivered TRANSACTION_COMPLETE [ 1064.242022] binder: release 9498:9500 transaction 3640 in, still active [ 1064.269776] binder: send failed reply for transaction 3640, target dead [ 1064.312385] binder: 9521:9524 ERROR: BC_REGISTER_LOOPER called without request [ 1064.343619] binder_alloc: binder_alloc_mmap_handler: 9521 20001000-20004000 already mapped failed -16 [ 1064.413881] binder: release 9521:9524 transaction 3643 in, still active [ 1064.422193] binder: send failed reply for transaction 3643 to 9521:9524 [ 1064.429552] binder: undelivered TRANSACTION_COMPLETE [ 1064.434957] binder: undelivered TRANSACTION_ERROR: 29189 10:09:01 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0xa0010000000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:01 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x3000000) 10:09:01 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x4000000000000, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:01 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb020000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x5452, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1064.658580] binder: 9537:9539 ERROR: BC_REGISTER_LOOPER called without request [ 1064.715551] binder_alloc: binder_alloc_mmap_handler: 9537 20001000-20004000 already mapped failed -16 [ 1064.764988] binder: release 9537:9539 transaction 3645 in, still active [ 1064.777974] binder: send failed reply for transaction 3645 to 9537:9539 [ 1064.793462] binder: undelivered TRANSACTION_COMPLETE [ 1064.805654] binder: undelivered TRANSACTION_ERROR: 29189 10:09:03 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0xffffff7f00000000, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:03 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x4c) 10:09:03 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x2aebff7f00000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:03 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x3f00000000000000, 0x0) 10:09:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc020660b, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:03 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1067.030396] binder: 9558:9564 ERROR: BC_REGISTER_LOOPER called without request [ 1067.048100] __nla_parse: 9 callbacks suppressed [ 1067.048109] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1067.064854] binder_alloc: binder_alloc_mmap_handler: 9558 20001000-20004000 already mapped failed -16 [ 1067.075012] binder: BINDER_SET_CONTEXT_MGR already set 10:09:03 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x100000000000000, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1067.081188] binder: 9558:9564 ioctl 40046207 0 returned -16 [ 1067.095759] binder: 9558:9570 ERROR: BC_REGISTER_LOOPER called without request [ 1067.099074] binder_alloc: 9558: binder_alloc_buf, no vma [ 1067.107288] binder: release 9558:9564 transaction 3647 out, still active [ 1067.110258] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1067.115965] binder: undelivered TRANSACTION_COMPLETE 10:09:03 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xf00000000000000) [ 1067.120074] binder: release 9558:9564 transaction 3647 in, still active [ 1067.130617] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1067.146924] binder: 9558:9564 transaction failed 29189/-3, size 0-0 line 2973 [ 1067.151549] binder: send failed reply for transaction 3647, target dead 10:09:04 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x1000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc018620c, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1067.245941] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1067.255883] binder: undelivered TRANSACTION_ERROR: 29189 10:09:04 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x2000000) 10:09:04 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0xeffdffff00000000, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1067.350925] binder: 9590:9593 ERROR: BC_REGISTER_LOOPER called without request [ 1067.367238] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1067.377216] binder: 9590 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 1067.377229] binder: 9590:9593 ioctl c018620c 200002c0 returned -22 [ 1067.398202] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1067.428706] binder_alloc: binder_alloc_mmap_handler: 9590 20001000-20004000 already mapped failed -16 [ 1067.431134] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:09:04 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x20003200}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1067.451983] binder: BINDER_SET_CONTEXT_MGR already set [ 1067.468941] binder: 9590:9593 ioctl 40046207 0 returned -16 10:09:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40049409, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:04 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xa000000) [ 1067.534794] binder: release 9590:9593 transaction 3650 in, still active [ 1067.546734] binder: send failed reply for transaction 3650 to 9590:9593 [ 1067.576727] binder: undelivered TRANSACTION_COMPLETE [ 1067.597698] binder: undelivered TRANSACTION_ERROR: 29189 [ 1067.615420] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1067.637049] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1067.659118] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1067.689804] binder: 9616:9618 ERROR: BC_REGISTER_LOOPER called without request [ 1067.716564] binder_alloc: binder_alloc_mmap_handler: 9616 20001000-20004000 already mapped failed -16 [ 1067.727860] binder: BINDER_SET_CONTEXT_MGR already set [ 1067.739357] binder: 9616:9618 ioctl 40046207 0 returned -16 [ 1067.776801] binder: release 9616:9618 transaction 3652 in, still active [ 1067.783948] binder: send failed reply for transaction 3652 to 9616:9618 [ 1067.791102] binder: undelivered TRANSACTION_COMPLETE [ 1067.796372] binder: undelivered TRANSACTION_ERROR: 29189 10:09:06 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x1000000000000, 0x0) 10:09:06 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x1000000, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:06 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x7fffeb2a}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:06 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x48000000) 10:09:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:06 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:06 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x4000000) [ 1070.140436] binder: 9627:9638 ERROR: BC_REGISTER_LOOPER called without request [ 1070.158262] binder_alloc: binder_alloc_mmap_handler: 9627 20001000-20004000 already mapped failed -16 [ 1070.168279] binder: BINDER_SET_CONTEXT_MGR already set [ 1070.175450] binder: 9627:9638 ioctl 40046207 0 returned -16 10:09:07 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0xeffdffff, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:07 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x2000000000000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1070.187869] binder_alloc: 9627: binder_alloc_buf, no vma [ 1070.194367] binder: 9627:9643 ERROR: BC_REGISTER_LOOPER called without request [ 1070.202336] binder: 9627:9638 transaction failed 29189/-3, size 0-0 line 2973 [ 1070.210415] binder: release 9627:9638 transaction 3654 out, still active [ 1070.251572] binder: undelivered TRANSACTION_COMPLETE 10:09:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x4004624b, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1070.282446] binder: release 9627:9638 transaction 3654 in, still active [ 1070.314473] binder: send failed reply for transaction 3654, target dead 10:09:07 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x3) [ 1070.358552] binder: undelivered TRANSACTION_ERROR: 29189 [ 1070.443406] binder: 9661:9662 ERROR: BC_REGISTER_LOOPER called without request 10:09:07 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x3f00}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1070.485561] binder: 9661:9662 ioctl 4004624b 200002c0 returned -22 [ 1070.527273] binder_alloc: binder_alloc_mmap_handler: 9661 20001000-20004000 already mapped failed -16 [ 1070.544150] binder: BINDER_SET_CONTEXT_MGR already set [ 1070.583597] binder: 9661:9662 ioctl 40046207 0 returned -16 [ 1070.686840] binder: release 9661:9662 transaction 3657 out, still active [ 1070.696691] binder: undelivered TRANSACTION_COMPLETE [ 1070.705590] binder: release 9661:9662 transaction 3657 in, still active [ 1070.714712] binder: send failed reply for transaction 3657, target dead 10:09:09 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x730000, 0x0) 10:09:09 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x6c00000000000000) 10:09:09 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x4, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x4004622f, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:09 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:09 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x800000000000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1073.166840] __nla_parse: 8 callbacks suppressed [ 1073.166851] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1073.203562] binder: 9691:9697 ERROR: BC_REGISTER_LOOPER called without request 10:09:10 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x1000000000000000) 10:09:10 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0xfffffdef, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1073.230654] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1073.247973] binder: 9691:9697 ioctl 4004622f 200002c0 returned -22 [ 1073.256837] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1073.268897] binder_alloc: binder_alloc_mmap_handler: 9691 20001000-20004000 already mapped failed -16 10:09:10 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x1400000000000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1073.364881] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:09:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0189436, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1073.405414] binder: release 9691:9697 transaction 3659 in, still active [ 1073.413022] binder: send failed reply for transaction 3659 to 9691:9697 [ 1073.432487] binder: undelivered TRANSACTION_COMPLETE [ 1073.441312] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:09:10 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xfffffff5) [ 1073.461674] binder: undelivered TRANSACTION_ERROR: 29189 [ 1073.464805] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1073.501353] binder: 9727:9728 ERROR: BC_REGISTER_LOOPER called without request 10:09:10 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0xff03000000000000, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1073.511300] binder_alloc: binder_alloc_mmap_handler: 9727 20001000-20004000 already mapped failed -16 [ 1073.556479] binder: BINDER_SET_CONTEXT_MGR already set [ 1073.578534] binder: 9727:9728 ioctl 40046207 0 returned -16 [ 1073.630798] binder: release 9727:9728 transaction 3661 in, still active [ 1073.642071] binder: send failed reply for transaction 3661 to 9727:9728 [ 1073.649758] binder: undelivered TRANSACTION_COMPLETE [ 1073.666333] binder: undelivered TRANSACTION_ERROR: 29189 10:09:13 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0xffffffffff600000, 0x0) 10:09:13 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x80310020}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:13 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x7400000000000000) 10:09:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:13 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0xff030000, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:13 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb02000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1076.258943] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1076.289126] binder: 9745:9755 ERROR: BC_REGISTER_LOOPER called without request 10:09:13 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x68000000) 10:09:13 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x40000, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1076.304922] binder_alloc: binder_alloc_mmap_handler: 9745 20001000-20004000 already mapped failed -16 [ 1076.315723] binder: BINDER_SET_CONTEXT_MGR already set [ 1076.317031] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1076.334571] binder: 9745:9755 ioctl 40046207 0 returned -16 10:09:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1076.362710] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1076.369823] binder: release 9745:9755 transaction 3663 in, still active 10:09:13 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x400000000000, 0x0) [ 1076.406438] binder: send failed reply for transaction 3663 to 9745:9755 [ 1076.455076] binder: undelivered TRANSACTION_COMPLETE [ 1076.467972] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1076.482706] binder: undelivered TRANSACTION_ERROR: 29189 10:09:13 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x40000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1076.516585] binder: 9772:9776 ERROR: BC_REGISTER_LOOPER called without request [ 1076.547176] binder_alloc: binder_alloc_mmap_handler: 9772 20001000-20004000 already mapped failed -16 10:09:13 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x7a00) [ 1076.577631] binder: BINDER_SET_CONTEXT_MGR already set [ 1076.594131] binder: 9772:9776 ioctl 40046207 0 returned -16 10:09:13 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0xffffff7f, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1076.648836] binder: unexpected work type, 4, not freed [ 1076.654167] binder: undelivered TRANSACTION_COMPLETE [ 1076.670536] binder: undelivered TRANSACTION_COMPLETE [ 1076.707494] binder: undelivered transaction 3666, process died. 10:09:13 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x8000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:13 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x500000000000000) [ 1076.755000] binder: 9796:9800 ERROR: BC_REGISTER_LOOPER called without request [ 1076.768243] binder_alloc: binder_alloc_mmap_handler: 9796 20001000-20004000 already mapped failed -16 [ 1076.782438] binder: BINDER_SET_CONTEXT_MGR already set [ 1076.798723] binder: 9796:9800 ioctl 40046207 0 returned -16 10:09:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x4020940d, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1076.871690] binder: release 9796:9800 transaction 3670 in, still active [ 1076.879484] binder: send failed reply for transaction 3670 to 9796:9800 [ 1076.890256] binder: undelivered TRANSACTION_COMPLETE 10:09:13 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:13 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:13 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x3f00000000000000) [ 1076.922529] binder: undelivered TRANSACTION_ERROR: 29189 10:09:13 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0xf0ff7f}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1076.976851] binder: 9816:9817 ERROR: BC_REGISTER_LOOPER called without request [ 1077.001568] binder_alloc: binder_alloc_mmap_handler: 9816 20001000-20004000 already mapped failed -16 [ 1077.039762] binder: BINDER_SET_CONTEXT_MGR already set [ 1077.083124] binder: 9816:9817 ioctl 40046207 0 returned -16 [ 1077.112679] binder: release 9816:9817 transaction 3672 in, still active [ 1077.120147] binder: send failed reply for transaction 3672 to 9816:9817 [ 1077.127207] binder: undelivered TRANSACTION_COMPLETE [ 1077.133431] binder: undelivered TRANSACTION_ERROR: 29189 10:09:16 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x60ffffffffff, 0x0) 10:09:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc018620b, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:16 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x6000000000000000) 10:09:16 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:16 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x1400}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:16 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1079.585720] binder: 9843:9846 ERROR: BC_REGISTER_LOOPER called without request [ 1079.616980] binder_alloc: binder_alloc_mmap_handler: 9843 20001000-20004000 already mapped failed -16 [ 1079.631352] __nla_parse: 9 callbacks suppressed 10:09:16 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1079.631361] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1079.642182] binder: BINDER_SET_CONTEXT_MGR already set [ 1079.656123] binder: 9843:9846 ioctl 40046207 0 returned -16 [ 1079.675229] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:09:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x5450, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1079.694971] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1079.704083] binder: release 9843:9846 transaction 3674 in, still active [ 1079.720608] binder: send failed reply for transaction 3674 to 9843:9846 [ 1079.769175] binder: undelivered TRANSACTION_COMPLETE 10:09:16 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x1a000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:16 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x700) [ 1079.792874] binder: undelivered TRANSACTION_ERROR: 29189 [ 1079.835051] binder: 9871:9872 ERROR: BC_REGISTER_LOOPER called without request 10:09:16 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1079.881732] binder_alloc: binder_alloc_mmap_handler: 9871 20001000-20004000 already mapped failed -16 [ 1079.892717] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1079.914949] binder: BINDER_SET_CONTEXT_MGR already set [ 1079.924415] binder: 9871:9872 ioctl 40046207 0 returned -16 10:09:16 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x2800000000000000) [ 1079.951532] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1079.973413] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1079.978287] binder: release 9871:9872 transaction 3676 in, still active [ 1080.020007] binder: send failed reply for transaction 3676 to 9871:9872 [ 1080.062950] binder: undelivered TRANSACTION_COMPLETE [ 1080.076790] binder: undelivered TRANSACTION_ERROR: 29189 [ 1080.081454] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:09:19 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x3f000000, 0x0) 10:09:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:19 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x4000000000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:19 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:19 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x6800000000000000) 10:09:19 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1082.694615] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1082.704669] binder: 9900:9905 ERROR: BC_REGISTER_LOOPER called without request [ 1082.726616] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:09:19 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:19 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xf000000) [ 1082.743272] binder_alloc: binder_alloc_mmap_handler: 9900 20001000-20004000 already mapped failed -16 [ 1082.754593] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:09:19 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x9300, 0x0) [ 1082.807699] binder: BINDER_SET_CONTEXT_MGR already set [ 1082.813017] binder: 9900:9905 ioctl 40046207 0 returned -16 10:09:19 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x20000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:19 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xf00) [ 1082.904206] binder: release 9900:9905 transaction 3678 in, still active [ 1082.929970] binder: send failed reply for transaction 3678 to 9900:9905 [ 1082.936822] binder: undelivered TRANSACTION_COMPLETE 10:09:19 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1083.003030] binder: undelivered TRANSACTION_ERROR: 29189 10:09:19 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x4000, 0x0) [ 1083.065872] binder: 9940:9945 ERROR: BC_REGISTER_LOOPER called without request [ 1083.113873] binder: BINDER_SET_CONTEXT_MGR already set [ 1083.133536] binder: 9940:9945 ioctl 40046207 200002c0 returned -16 10:09:19 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x4000) [ 1083.165303] binder_alloc: binder_alloc_mmap_handler: 9940 20001000-20004000 already mapped failed -16 10:09:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:20 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1083.257952] binder: release 9940:9945 transaction 3680 out, still active [ 1083.264835] binder: undelivered TRANSACTION_COMPLETE [ 1083.278463] binder: release 9940:9945 transaction 3680 in, still active [ 1083.319642] binder: send failed reply for transaction 3680, target dead [ 1083.365808] binder: 9966:9968 ERROR: BC_REGISTER_LOOPER called without request [ 1083.386446] binder_alloc: binder_alloc_mmap_handler: 9966 20001000-20004000 already mapped failed -16 [ 1083.399572] binder: BINDER_SET_CONTEXT_MGR already set [ 1083.405996] binder: 9966:9968 ioctl 40046207 0 returned -16 [ 1083.436709] binder: release 9966:9968 transaction 3682 in, still active [ 1083.444658] binder: send failed reply for transaction 3682 to 9966:9968 [ 1083.452674] binder: undelivered TRANSACTION_COMPLETE [ 1083.458925] binder: undelivered TRANSACTION_ERROR: 29189 10:09:20 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x400300) 10:09:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:20 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:20 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1083.582971] binder: 9977:9983 ERROR: BC_REGISTER_LOOPER called without request [ 1083.604825] binder_alloc: binder_alloc_mmap_handler: 9977 20001000-20004000 already mapped failed -16 [ 1083.655455] binder: release 9977:9983 transaction 3684 in, still active [ 1083.663069] binder: send failed reply for transaction 3684 to 9977:9983 [ 1083.670974] binder: undelivered TRANSACTION_COMPLETE [ 1083.676489] binder: undelivered TRANSACTION_ERROR: 29189 10:09:20 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x3f000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:20 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xf5ffffff) 10:09:20 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x2, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1083.848175] binder: 9997:9999 ERROR: BC_REGISTER_LOOPER called without request [ 1083.905591] binder: release 9997:9999 transaction 3686 in, still active [ 1083.917603] binder: send failed reply for transaction 3686 to 9997:9999 [ 1083.982832] binder_alloc: binder_alloc_mmap_handler: 9997 20001000-20004000 already mapped failed -16 [ 1083.992717] binder: BINDER_SET_CONTEXT_MGR already set [ 1084.018061] binder: 9997:9999 ioctl 40046207 0 returned -16 [ 1084.055135] binder: undelivered TRANSACTION_COMPLETE [ 1084.060356] binder: undelivered TRANSACTION_ERROR: 29189 10:09:23 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0xfeffffff00000000, 0x0) 10:09:23 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x9effffff00000000) 10:09:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:23 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0xa00100}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x2000000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:23 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1086.238465] __nla_parse: 9 callbacks suppressed [ 1086.238474] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1086.266339] binder: 10018:10025 ERROR: BC_REGISTER_LOOPER called without request [ 1086.275602] binder: release 10018:10025 transaction 3688 in, still active 10:09:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1086.284390] binder: send failed reply for transaction 3688 to 10018:10025 [ 1086.293221] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1086.308471] binder_alloc: binder_alloc_mmap_handler: 10018 20001000-20004000 already mapped failed -16 [ 1086.316352] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:09:23 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xfcffffff00000000) 10:09:23 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x8000000000000000, 0x0) [ 1086.336594] binder: BINDER_SET_CONTEXT_MGR already set [ 1086.353426] binder: 10018:10025 ioctl 40046207 0 returned -16 10:09:23 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x2aebff7f}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x60000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1086.452583] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1086.479374] binder: undelivered TRANSACTION_COMPLETE [ 1086.484534] binder: undelivered TRANSACTION_ERROR: 29189 10:09:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:23 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x700000000000000) [ 1086.563149] binder: 10056:10057 ERROR: BC_REGISTER_LOOPER called without request [ 1086.572461] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1086.593694] binder: release 10056:10057 transaction 3690 in, still active [ 1086.634441] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1086.647471] binder: send failed reply for transaction 3690 to 10056:10057 [ 1086.673797] binder_alloc: binder_alloc_mmap_handler: 10056 20001000-20004000 already mapped failed -16 10:09:23 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x200000000000000}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x6c000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1086.689292] binder: BINDER_SET_CONTEXT_MGR already set [ 1086.695248] binder: 10056:10057 ioctl 40046207 0 returned -16 [ 1086.695289] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1086.725971] binder: undelivered TRANSACTION_COMPLETE [ 1086.731359] binder: undelivered TRANSACTION_ERROR: 29189 10:09:23 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:23 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x9effffff) 10:09:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0xffffff7f, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1086.830899] binder: 10073:10075 ERROR: BC_REGISTER_LOOPER called without request [ 1086.849716] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1086.873632] binder: release 10073:10075 transaction 3692 in, still active [ 1086.876020] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1086.888964] binder: send failed reply for transaction 3692 to 10073:10075 [ 1086.908884] binder_alloc: binder_alloc_mmap_handler: 10073 20001000-20004000 already mapped failed -16 10:09:23 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x28000000) 10:09:23 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1086.952790] binder: BINDER_SET_CONTEXT_MGR already set [ 1086.958339] binder: 10073:10075 ioctl 40046207 0 returned -16 [ 1087.046313] binder: undelivered TRANSACTION_COMPLETE [ 1087.051683] binder: undelivered TRANSACTION_ERROR: 29189 [ 1087.085572] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:09:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0xff03, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x4, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:26 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x2000) 10:09:26 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x70700000000000, 0x0) 10:09:26 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:26 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0xfffffdef, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:26 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x4) [ 1089.544759] binder: 10109:10120 ERROR: BC_REGISTER_LOOPER called without request [ 1089.565725] binder: release 10109:10120 transaction 3694 in, still active [ 1089.575677] binder: send failed reply for transaction 3694 to 10109:10120 10:09:26 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x930000000000, 0x0) 10:09:26 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1089.619555] binder_alloc: binder_alloc_mmap_handler: 10109 20001000-20004000 already mapped failed -16 [ 1089.686935] binder: BINDER_SET_CONTEXT_MGR already set 10:09:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x4000000000000, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:26 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x7100, 0x0) [ 1089.720597] binder: 10109:10120 ioctl 40046207 0 returned -16 10:09:26 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xfffffffc) 10:09:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x200000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1089.833804] binder: undelivered TRANSACTION_COMPLETE [ 1089.839150] binder: undelivered TRANSACTION_ERROR: 29189 10:09:26 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x100000000000000, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:26 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x60) [ 1089.979243] binder: 10162:10169 ERROR: BC_REGISTER_LOOPER called without request [ 1090.044401] binder_alloc: binder_alloc_mmap_handler: 10162 20001000-20004000 already mapped failed -16 [ 1090.093176] binder: BINDER_SET_CONTEXT_MGR already set [ 1090.125786] binder: 10162:10169 ioctl 40046207 0 returned -16 10:09:27 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:27 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xffffff7f00000000) 10:09:27 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x4c, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:27 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0xff030000, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1090.183453] binder: release 10162:10169 transaction 3696 in, still active [ 1090.190577] binder: send failed reply for transaction 3696 to 10162:10169 [ 1090.207973] binder: undelivered TRANSACTION_COMPLETE [ 1090.217803] binder: undelivered TRANSACTION_ERROR: 29189 10:09:27 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xf0ffffff) [ 1090.309098] binder: 10191:10197 ERROR: BC_REGISTER_LOOPER called without request [ 1090.322805] binder: release 10191:10197 transaction 3698 in, still active [ 1090.329989] binder: send failed reply for transaction 3698 to 10191:10197 [ 1090.339492] binder_alloc: binder_alloc_mmap_handler: 10191 20001000-20004000 already mapped failed -16 [ 1090.349327] binder: BINDER_SET_CONTEXT_MGR already set [ 1090.354760] binder: 10191:10197 ioctl 40046207 0 returned -16 [ 1090.389977] binder: undelivered TRANSACTION_COMPLETE [ 1090.401609] binder: undelivered TRANSACTION_ERROR: 29189 10:09:29 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x3f00, 0x0) 10:09:29 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x1000000, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x5, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:29 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xf000) 10:09:29 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:29 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1092.839332] __nla_parse: 14 callbacks suppressed [ 1092.839356] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1092.858389] binder: 10221:10224 ERROR: BC_REGISTER_LOOPER called without request [ 1092.880890] binder: release 10221:10224 transaction 3700 in, still active 10:09:29 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x34000) [ 1092.887346] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1092.888901] binder: send failed reply for transaction 3700 to 10221:10224 10:09:29 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0xeffdffff, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1092.937356] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1092.940086] binder_alloc: binder_alloc_mmap_handler: 10221 20001000-20004000 already mapped failed -16 [ 1092.959998] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1092.996477] binder: BINDER_SET_CONTEXT_MGR already set 10:09:29 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:29 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xf0ffff) [ 1093.027667] binder: 10221:10224 ioctl 40046207 0 returned -16 10:09:29 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x40000, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0xffffff7f00000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1093.106316] binder: undelivered TRANSACTION_COMPLETE [ 1093.112612] binder: undelivered TRANSACTION_ERROR: 29189 [ 1093.174307] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1093.209769] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1093.233335] binder: 10262:10265 ERROR: BC_REGISTER_LOOPER called without request [ 1093.273377] binder: release 10262:10265 transaction 3702 in, still active [ 1093.295636] binder: send failed reply for transaction 3702 to 10262:10265 [ 1093.309763] binder_alloc: binder_alloc_mmap_handler: 10262 20001000-20004000 already mapped failed -16 [ 1093.319927] binder: BINDER_SET_CONTEXT_MGR already set [ 1093.326650] binder: 10262:10265 ioctl 40046207 0 returned -16 [ 1093.371024] binder: undelivered TRANSACTION_COMPLETE [ 1093.376254] binder: undelivered TRANSACTION_ERROR: 29189 10:09:32 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:32 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x6000) 10:09:32 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x4, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:32 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0xffffffff00000000, 0x0) 10:09:32 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x7a00000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1095.920731] binder: 10276:10283 ERROR: BC_REGISTER_LOOPER called without request [ 1095.935217] binder: release 10276:10283 transaction 3704 in, still active [ 1095.944937] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1095.957706] binder: send failed reply for transaction 3704 to 10276:10283 10:09:32 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0xffffff7f00000000, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1095.974176] binder_alloc: binder_alloc_mmap_handler: 10276 20001000-20004000 already mapped failed -16 [ 1095.982777] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1095.985363] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:09:32 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x48) [ 1096.036719] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:09:32 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:32 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0xff03000000000000, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) 10:09:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x7a00, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1096.134670] binder: undelivered TRANSACTION_COMPLETE [ 1096.147889] binder: undelivered TRANSACTION_ERROR: 29189 10:09:33 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x7a00000000000000) 10:09:33 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0xeffdffff00000000, &(0x7f0000000100)=[@assoc={0x18}], 0x18}], 0x49249249249276c, 0x0) [ 1096.258597] binder: 10313:10315 ERROR: BC_REGISTER_LOOPER called without request [ 1096.267297] binder: release 10313:10315 transaction 3706 in, still active [ 1096.278197] binder: send failed reply for transaction 3706 to 10313:10315 [ 1096.306366] binder_alloc: binder_alloc_mmap_handler: 10313 20001000-20004000 already mapped failed -16 [ 1096.351961] binder: BINDER_SET_CONTEXT_MGR already set 10:09:33 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x24}], 0x18}], 0x49249249249276c, 0x0) 10:09:33 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x800000000000000) [ 1096.374564] binder: 10313:10315 ioctl 40046207 0 returned -16 10:09:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x60, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1096.435361] binder: undelivered TRANSACTION_COMPLETE [ 1096.442324] binder: undelivered TRANSACTION_ERROR: 29189 [ 1096.549599] binder: 10337:10339 ERROR: BC_REGISTER_LOOPER called without request [ 1096.560047] binder: release 10337:10339 transaction 3708 in, still active [ 1096.568695] binder: send failed reply for transaction 3708 to 10337:10339 [ 1096.598520] binder_alloc: binder_alloc_mmap_handler: 10337 20001000-20004000 already mapped failed -16 [ 1096.640876] binder: undelivered TRANSACTION_COMPLETE [ 1096.646189] binder: undelivered TRANSACTION_ERROR: 29189 10:09:35 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x1000000, 0x0) 10:09:35 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x28}], 0x18}], 0x49249249249276c, 0x0) 10:09:35 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x7a000000) 10:09:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x74, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:35 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:35 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:35 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x20000118}], 0x18}], 0x49249249249276c, 0x0) [ 1098.997933] __nla_parse: 5 callbacks suppressed [ 1098.997943] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1099.019110] binder: 10353:10358 ERROR: BC_REGISTER_LOOPER called without request [ 1099.039413] binder: release 10353:10358 transaction 3710 in, still active [ 1099.058829] binder: send failed reply for transaction 3710 to 10353:10358 [ 1099.088452] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1099.099477] binder_alloc: binder_alloc_mmap_handler: 10353 20001000-20004000 already mapped failed -16 10:09:35 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x3f000000) [ 1099.103722] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1099.143512] binder: BINDER_SET_CONTEXT_MGR already set 10:09:36 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1099.154626] binder: 10353:10358 ioctl 40046207 0 returned -16 [ 1099.176074] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:09:36 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0xf}], 0x18}], 0x49249249249276c, 0x0) 10:09:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x4800, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1099.206906] binder: undelivered TRANSACTION_COMPLETE [ 1099.214684] binder: undelivered TRANSACTION_ERROR: 29189 10:09:36 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xa00) [ 1099.330704] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1099.339175] binder: 10387:10390 ERROR: BC_REGISTER_LOOPER called without request [ 1099.360313] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1099.365917] binder: release 10387:10390 transaction 3712 in, still active [ 1099.386445] binder: send failed reply for transaction 3712 to 10387:10390 [ 1099.401491] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1099.412990] binder_alloc: binder_alloc_mmap_handler: 10387 20001000-20004000 already mapped failed -16 [ 1099.440995] binder: BINDER_SET_CONTEXT_MGR already set [ 1099.449564] binder: 10387:10390 ioctl 40046207 0 returned -16 [ 1099.514568] binder: undelivered TRANSACTION_COMPLETE [ 1099.522188] binder: undelivered TRANSACTION_ERROR: 29189 10:09:38 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x7300, 0x0) 10:09:38 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:38 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x13}], 0x18}], 0x49249249249276c, 0x0) 10:09:38 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x2) 10:09:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x7, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:38 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1102.079008] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1102.108520] binder: 10410:10411 ERROR: BC_REGISTER_LOOPER called without request [ 1102.116821] binder: release 10410:10411 transaction 3714 in, still active 10:09:38 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x7300}], 0x18}], 0x49249249249276c, 0x0) 10:09:38 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x400000000000000) [ 1102.128648] binder: send failed reply for transaction 3714 to 10410:10411 [ 1102.140765] binder_alloc: binder_alloc_mmap_handler: 10410 20001000-20004000 already mapped failed -16 [ 1102.153076] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1102.166351] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:09:39 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x710000, 0x0) 10:09:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x6000000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:39 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1102.256718] binder: undelivered TRANSACTION_COMPLETE [ 1102.262598] binder: undelivered TRANSACTION_ERROR: 29189 10:09:39 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3202}], 0x18}], 0x49249249249276c, 0x0) 10:09:39 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x40000000) [ 1102.405328] binder: 10442:10447 ERROR: BC_REGISTER_LOOPER called without request 10:09:39 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1102.464145] binder_alloc: binder_alloc_mmap_handler: 10442 20001000-20004000 already mapped failed -16 [ 1102.508923] binder: BINDER_SET_CONTEXT_MGR already set [ 1102.532314] binder: 10442:10447 ioctl 40046207 0 returned -16 10:09:39 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xef00}], 0x18}], 0x49249249249276c, 0x0) 10:09:39 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xa00000000000000) 10:09:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x6800, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1102.625734] binder: release 10442:10447 transaction 3716 in, still active [ 1102.640151] binder: send failed reply for transaction 3716 to 10442:10447 [ 1102.712462] binder: undelivered TRANSACTION_COMPLETE [ 1102.750218] binder: undelivered TRANSACTION_ERROR: 29189 [ 1102.802707] binder: 10471:10475 ERROR: BC_REGISTER_LOOPER called without request [ 1102.829812] binder: release 10471:10475 transaction 3718 in, still active [ 1102.842705] binder: send failed reply for transaction 3718 to 10471:10475 [ 1102.881693] binder_alloc: binder_alloc_mmap_handler: 10471 20001000-20004000 already mapped failed -16 10:09:39 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4703}], 0x18}], 0x49249249249276c, 0x0) 10:09:39 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x6c) 10:09:39 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20b}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1102.935572] binder: undelivered TRANSACTION_COMPLETE [ 1102.940880] binder: undelivered TRANSACTION_ERROR: 29189 10:09:42 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x7fffffffefff, 0x0) 10:09:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x3f00000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:42 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xfffffff0) 10:09:42 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xb101}], 0x18}], 0x49249249249276c, 0x0) 10:09:42 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:42 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:42 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x60000000) 10:09:42 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2002}], 0x18}], 0x49249249249276c, 0x0) [ 1105.423754] binder: 10502:10512 ERROR: BC_REGISTER_LOOPER called without request [ 1105.432176] binder: release 10502:10512 transaction 3720 in, still active [ 1105.445564] __nla_parse: 11 callbacks suppressed [ 1105.445573] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1105.451390] binder: send failed reply for transaction 3720 to 10502:10512 10:09:42 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x100000000000000, 0x0) [ 1105.504949] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1105.513982] binder_alloc: binder_alloc_mmap_handler: 10502 20001000-20004000 already mapped failed -16 [ 1105.528050] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1105.553971] binder: BINDER_SET_CONTEXT_MGR already set 10:09:42 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:42 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x500) 10:09:42 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xe301}], 0x18}], 0x49249249249276c, 0x0) [ 1105.587697] binder: 10502:10512 ioctl 40046207 0 returned -16 10:09:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x1000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1105.712389] binder: undelivered TRANSACTION_COMPLETE [ 1105.717640] binder: undelivered TRANSACTION_ERROR: 29189 [ 1105.719185] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:09:42 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x6800) 10:09:42 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xfb03}], 0x18}], 0x49249249249276c, 0x0) [ 1105.762349] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1105.781183] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:09:42 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1105.873818] binder: 10553:10555 ERROR: BC_REGISTER_LOOPER called without request [ 1105.898578] binder: release 10553:10555 transaction 3722 in, still active [ 1105.909151] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1105.926770] binder: send failed reply for transaction 3722 to 10553:10555 [ 1105.953840] binder_alloc: binder_alloc_mmap_handler: 10553 20001000-20004000 already mapped failed -16 10:09:42 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x7) [ 1105.981301] binder: BINDER_SET_CONTEXT_MGR already set [ 1105.997983] binder: 10553:10555 ioctl 40046207 0 returned -16 10:09:42 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:42 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3b03}], 0x18}], 0x49249249249276c, 0x0) 10:09:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0xfdfdffff00000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1106.044604] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1106.058150] binder: undelivered TRANSACTION_COMPLETE [ 1106.063668] binder: undelivered TRANSACTION_ERROR: 29189 [ 1106.107277] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1106.190263] binder: 10579:10583 ERROR: BC_REGISTER_LOOPER called without request [ 1106.208062] binder: release 10579:10583 transaction 3724 in, still active [ 1106.218038] binder: send failed reply for transaction 3724 to 10579:10583 [ 1106.230919] binder_alloc: binder_alloc_mmap_handler: 10579 20001000-20004000 already mapped failed -16 [ 1106.242310] binder: BINDER_SET_CONTEXT_MGR already set [ 1106.248331] binder: 10579:10583 ioctl 40046207 0 returned -16 [ 1106.276342] binder: undelivered TRANSACTION_COMPLETE [ 1106.283677] binder: undelivered TRANSACTION_ERROR: 29189 10:09:45 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x202}], 0x18}], 0x49249249249276c, 0x0) 10:09:45 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x74) 10:09:45 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x60ff, 0x0) 10:09:45 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x7a000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:45 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1108.625649] binder: 10598:10599 ERROR: BC_REGISTER_LOOPER called without request [ 1108.642811] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1108.644231] binder: release 10598:10599 transaction 3726 in, still active [ 1108.667351] binder: send failed reply for transaction 3726 to 10598:10599 10:09:45 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xd703}], 0x18}], 0x49249249249276c, 0x0) 10:09:45 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x5) [ 1108.681693] binder_alloc: binder_alloc_mmap_handler: 10598 20001000-20004000 already mapped failed -16 [ 1108.691816] binder: BINDER_SET_CONTEXT_MGR already set [ 1108.705201] binder: 10598:10599 ioctl 40046207 0 returned -16 10:09:45 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x300, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1108.746302] binder: undelivered TRANSACTION_COMPLETE [ 1108.751637] binder: undelivered TRANSACTION_ERROR: 29189 10:09:45 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xde00}], 0x18}], 0x49249249249276c, 0x0) 10:09:45 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x6c000000) [ 1108.878883] binder: 10626:10632 ERROR: BC_REGISTER_LOOPER called without request [ 1108.914767] binder: release 10626:10632 transaction 3728 in, still active [ 1108.947253] binder: send failed reply for transaction 3728 to 10626:10632 10:09:45 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1109.010905] binder_alloc: binder_alloc_mmap_handler: 10626 20001000-20004000 already mapped failed -16 [ 1109.055824] binder: BINDER_SET_CONTEXT_MGR already set [ 1109.067553] binder: 10626:10632 ioctl 40046207 0 returned -16 [ 1109.091864] binder: 10626:10641 ERROR: BC_REGISTER_LOOPER called without request [ 1109.091869] binder_alloc: 10626: binder_alloc_buf, no vma 10:09:45 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0xf) [ 1109.091900] binder: 10626:10632 transaction failed 29189/-3, size 0-0 line 2973 [ 1109.112882] binder: undelivered TRANSACTION_COMPLETE [ 1109.118650] binder: undelivered TRANSACTION_ERROR: 29189 [ 1109.178756] binder: undelivered TRANSACTION_ERROR: 29189 10:09:48 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0xff600000, 0x0) 10:09:48 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x8f00}], 0x18}], 0x49249249249276c, 0x0) 10:09:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x3, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:48 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:48 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x4c00000000000000) 10:09:48 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:48 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x7000000) 10:09:48 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x8d02}], 0x18}], 0x49249249249276c, 0x0) [ 1111.706580] __nla_parse: 7 callbacks suppressed [ 1111.706589] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1111.729865] binder: 10665:10672 ERROR: BC_REGISTER_LOOPER called without request [ 1111.747250] binder: release 10665:10672 transaction 3731 in, still active [ 1111.758567] binder: send failed reply for transaction 3731 to 10665:10672 [ 1111.759168] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1111.769132] binder_alloc: binder_alloc_mmap_handler: 10665 20001000-20004000 already mapped failed -16 [ 1111.776968] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1111.785803] binder: BINDER_SET_CONTEXT_MGR already set [ 1111.802286] binder: 10665:10672 ioctl 40046207 0 returned -16 10:09:48 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x48, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1111.888529] binder: undelivered TRANSACTION_COMPLETE [ 1111.893888] binder: undelivered TRANSACTION_ERROR: 29189 [ 1111.905291] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:09:48 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x5401}], 0x18}], 0x49249249249276c, 0x0) [ 1111.959031] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1111.978547] binder: 10696:10699 ERROR: BC_REGISTER_LOOPER called without request 10:09:48 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000200)=[@in={0x2, 0x4e23, @remote}, @in6={0xa, 0x4e20, 0x8, @dev={0xfe, 0x80, [], 0xa}, 0x3ff}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, @in={0x2, 0x4e24, @broadcast}, @in={0x2, 0x4e22, @broadcast}, @in6={0xa, 0x4e24, 0x8, @remote, 0x1}, @in6={0xa, 0x4e20, 0x80000000, @dev={0xfe, 0x80, [], 0x20}, 0x9}, @in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e20}, @in={0x2, 0x4e20, @local}], 0xc4) [ 1112.003302] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1112.020443] binder: release 10696:10699 transaction 3733 in, still active [ 1112.031367] binder: send failed reply for transaction 3733 to 10696:10699 [ 1112.032795] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1112.040954] binder_alloc: binder_alloc_mmap_handler: 10696 20001000-20004000 already mapped failed -16 [ 1112.108830] binder: BINDER_SET_CONTEXT_MGR already set [ 1112.118574] binder: 10696:10699 ioctl 40046207 0 returned -16 [ 1112.128821] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1112.141826] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1112.208606] binder: undelivered TRANSACTION_COMPLETE [ 1112.213857] binder: undelivered TRANSACTION_ERROR: 29189 10:09:51 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x400000, 0x0) 10:09:51 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:51 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3203}], 0x18}], 0x49249249249276c, 0x0) 10:09:51 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x8001, 0x40000) getpeername$llc(r2, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000100)=0x10) 10:09:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x500000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:51 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:51 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x6c02}], 0x18}], 0x49249249249276c, 0x0) [ 1114.762268] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1114.785923] binder: 10720:10728 ERROR: BC_REGISTER_LOOPER called without request [ 1114.803161] binder: release 10720:10728 transaction 3735 in, still active 10:09:51 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:51 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0x8) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000000), &(0x7f0000000040)=0x4) [ 1114.849093] binder: send failed reply for transaction 3735 to 10720:10728 [ 1114.891722] binder_alloc: binder_alloc_mmap_handler: 10720 20001000-20004000 already mapped failed -16 [ 1114.905344] binder: BINDER_SET_CONTEXT_MGR already set [ 1114.914662] binder: 10720:10728 ioctl 40046207 0 returned -16 10:09:51 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x8602}], 0x18}], 0x49249249249276c, 0x0) 10:09:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x4000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1114.970594] binder: undelivered TRANSACTION_COMPLETE [ 1114.980367] binder: undelivered TRANSACTION_ERROR: 29189 10:09:51 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x5, 0x10001) write$binfmt_script(r0, &(0x7f0000000200)={'#! ', "", [{0x20, '#g'}, {}, {0x20, '\'eth0vmnet1vboxnet0##%@'}], 0xa, "74f5cd94c3ce615a17d1059e58465ca44c85d25ca3feac86e22a6c43c54fab4a852e62973b1b59c97e2b5255b027d8603643edcc1fed2bb5117c72d20c50e80ac7f10e6e5320ceaa7c6a6a0a63d9586a6f9735bc669bdea484178f7616b3665730ad1e193090faf520a47298c4d23179c8d305a126a28abdb05a48265137f08547f1713a2ad31a0fc5c18da43272125940ab35fe5e6f0da628a7b2eb26727227860d8fb121c45150165a11ec6fe2092a7724"}, 0xd2) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)}, 0x0) [ 1115.103242] binder: 10756:10759 ERROR: BC_REGISTER_LOOPER called without request [ 1115.144145] binder: release 10756:10759 transaction 3737 in, still active [ 1115.151644] binder: send failed reply for transaction 3737 to 10756:10759 [ 1115.160852] binder_alloc: binder_alloc_mmap_handler: 10756 20001000-20004000 already mapped failed -16 [ 1115.170753] binder: BINDER_SET_CONTEXT_MGR already set [ 1115.176441] binder: 10756:10759 ioctl 40046207 0 returned -16 [ 1115.211403] binder: undelivered TRANSACTION_COMPLETE [ 1115.216754] binder: undelivered TRANSACTION_ERROR: 29189 10:09:54 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x507000, 0x0) 10:09:54 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3400}], 0x18}], 0x49249249249276c, 0x0) 10:09:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x5000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:54 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x81, &(0x7f0000000140)="0a5c2d023c126285718070") sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x480800, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f0000000180)={0x3, 0xffffffff}) write$P9_RLERRORu(r1, &(0x7f0000000300)={0xfffffffffffffef1, 0x7, 0x2, {{}, 0x2}}, 0xfffffffffffffcea) r2 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x1, 0x2) ioctl$KVM_INTERRUPT(r1, 0x4004ae86, &(0x7f00000002c0)=0x7) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f0000000280), 0x4) ioctl$DRM_IOCTL_MODE_SETCRTC(r2, 0xc06864a2, &(0x7f0000000200)={&(0x7f0000000040)=[0x100000000, 0xc05, 0x7f, 0x7, 0x1f, 0x401, 0xac, 0x47be], 0x8, 0xffffffffffff2adf, 0x2, 0xff, 0x0, 0x400, {0xd4, 0x7, 0x0, 0x4, 0x9, 0x200, 0x8a8, 0x4, 0x4, 0x256, 0x4, 0x1, 0xfb, 0x6, "b60ff4aaf4a72c65dc516a8f2b8cc6658f37ff8eea1cf6180e7206af1eb043e5"}}) 10:09:54 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:09:54 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:54 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x6903}], 0x18}], 0x49249249249276c, 0x0) [ 1117.842476] binder: 10777:10781 ERROR: BC_REGISTER_LOOPER called without request [ 1117.855470] binder: release 10777:10781 transaction 3739 in, still active [ 1117.867983] binder: send failed reply for transaction 3739 to 10777:10781 [ 1117.884846] __nla_parse: 5 callbacks suppressed 10:09:54 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1117.884855] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1117.885680] binder_alloc: binder_alloc_mmap_handler: 10777 20001000-20004000 already mapped failed -16 [ 1117.899231] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1117.923233] binder: BINDER_SET_CONTEXT_MGR already set [ 1117.945346] binder: 10777:10781 ioctl 40046207 0 returned -16 [ 1117.964956] binder: 10777:10793 ERROR: BC_REGISTER_LOOPER called without request [ 1117.965809] binder_alloc: 10777: binder_alloc_buf, no vma 10:09:54 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:54 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x1802}], 0x18}], 0x49249249249276c, 0x0) [ 1118.007645] binder: 10777:10781 transaction failed 29189/-3, size 0-0 line 2973 10:09:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x2000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1118.093100] binder: undelivered TRANSACTION_ERROR: 29189 [ 1118.099069] binder: undelivered TRANSACTION_COMPLETE [ 1118.121731] binder: undelivered TRANSACTION_ERROR: 29189 10:09:54 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r0 = socket$inet(0x10, 0xffffffffffffffff, 0xc) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) fcntl$getown(r0, 0x9) [ 1118.152493] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1118.179689] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1118.212878] binder: 10814:10818 ERROR: BC_REGISTER_LOOPER called without request [ 1118.250540] binder: release 10814:10818 transaction 3742 in, still active [ 1118.267628] binder: send failed reply for transaction 3742 to 10814:10818 [ 1118.284710] binder_alloc: binder_alloc_mmap_handler: 10814 20001000-20004000 already mapped failed -16 [ 1118.300543] binder: BINDER_SET_CONTEXT_MGR already set [ 1118.313532] binder: 10814:10818 ioctl 40046207 0 returned -16 [ 1118.377854] binder: undelivered TRANSACTION_COMPLETE [ 1118.383028] binder: undelivered TRANSACTION_ERROR: 29189 10:09:57 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x710000000000, 0x0) 10:09:57 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xa403}], 0x18}], 0x49249249249276c, 0x0) 10:09:57 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:09:57 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1a, &(0x7f0000000000)=""/112, &(0x7f0000000100)=0x70) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:09:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0xfffffdfd, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:09:57 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1120.908787] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1120.910218] binder: 10833:10838 ERROR: BC_REGISTER_LOOPER called without request [ 1120.924750] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1120.944466] binder: release 10833:10838 transaction 3744 in, still active 10:09:57 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0x80000000000c) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0xc900, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000180)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000240)={0x7, 0x8, 0xfa00, {r3, 0x1}}, 0x10) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x800) write$USERIO_CMD_REGISTER(r4, &(0x7f0000000040)={0x0, 0x3ff}, 0x2bb) 10:09:57 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x9f01}], 0x18}], 0x49249249249276c, 0x0) [ 1120.953165] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1120.962077] binder: send failed reply for transaction 3744 to 10833:10838 [ 1120.971958] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1120.982698] binder_alloc: binder_alloc_mmap_handler: 10833 20001000-20004000 already mapped failed -16 [ 1121.001683] binder: BINDER_SET_CONTEXT_MGR already set 10:09:57 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1121.009892] binder: 10833:10838 ioctl 40046207 0 returned -16 [ 1121.090726] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1121.125726] binder: undelivered TRANSACTION_COMPLETE [ 1121.131692] binder: undelivered TRANSACTION_ERROR: 29189 10:09:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x700000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1121.131895] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:09:58 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x5700}], 0x18}], 0x49249249249276c, 0x0) 10:09:58 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:00 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x70500000000000, 0x0) 10:10:00 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x14d) r1 = open(&(0x7f0000000000)='./file0\x00', 0x60000, 0x20) ioctl$RTC_IRQP_SET(r1, 0x4008700c, 0x3d8) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") ioctl$VIDIOC_G_DV_TIMINGS(r1, 0xc0845658, &(0x7f0000000200)={0x0, @bt={0x5, 0x5, 0x1, 0x1, 0x3, 0x20, 0x6, 0x8, 0x8, 0xa62c, 0x3, 0x92d, 0xffffffff80000000, 0xb8, 0x8, 0x10}}) r2 = semget(0x1, 0x3, 0x40) semctl$SETALL(r2, 0x0, 0x11, &(0x7f0000000040)=[0x0, 0x7ff, 0x0, 0x2, 0x3, 0xffffffff]) r3 = socket$inet(0x10, 0x2, 0xc) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000002c0)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c824396900000000000000d01cc0", 0xffffffffffffffec}], 0x1, 0x0, 0x0, 0x4}, 0x8090) 10:10:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0xfdfdffff, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:00 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x6402}], 0x18}], 0x49249249249276c, 0x0) 10:10:00 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:00 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1123.989746] binder: 10889:10894 ERROR: BC_REGISTER_LOOPER called without request [ 1124.013745] binder: release 10889:10894 transaction 3746 in, still active [ 1124.025312] __nla_parse: 4 callbacks suppressed [ 1124.025321] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:10:00 executing program 5: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x0, 0x410040) ioctl$KDDISABIO(r0, 0x4b37) r1 = socket$inet6(0xa, 0x803, 0x6) ioctl(r1, 0x101, &(0x7f0000000140)="0a5c2d023c926285718070") r2 = socket$inet(0x10, 0x2, 0xc) uselib(&(0x7f0000000100)='./file0\x00') r3 = creat(&(0x7f0000000840)='./file0\x00', 0x18) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000000880)=0x3, 0x4) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000180)={0x5}, 0x1) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r0, 0x12, 0x2, &(0x7f0000000200)=""/251, &(0x7f0000000040)=0xfb) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:00 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xf001}], 0x18}], 0x49249249249276c, 0x0) [ 1124.029303] binder: send failed reply for transaction 3746 to 10889:10894 [ 1124.034637] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1124.079003] binder_alloc: binder_alloc_mmap_handler: 10889 20001000-20004000 already mapped failed -16 10:10:00 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1124.137096] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:10:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x6c00, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:01 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xe702}], 0x18}], 0x49249249249276c, 0x0) [ 1124.195140] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1124.225408] binder: undelivered TRANSACTION_COMPLETE [ 1124.231011] binder: undelivered TRANSACTION_ERROR: 29189 10:10:01 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x6, 0xc) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x1, 0x2) getresuid(&(0x7f0000000040), &(0x7f0000000100), &(0x7f0000000180)=0x0) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_CREATE_OPEN(r2, &(0x7f00000002c0)={0xa0, 0x0, 0x1, {{0x6, 0x1, 0x9, 0x2800000000, 0x3, 0x7a, {0x3, 0x0, 0xe70, 0x1cd, 0x4a, 0x81, 0xbdb2, 0x1000, 0x6, 0x0, 0x2, r3, r4, 0x8, 0x1}}, {0x0, 0x4}}}, 0xa0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1124.264532] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1124.298332] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1124.352540] binder: 10927:10931 ERROR: BC_REGISTER_LOOPER called without request [ 1124.388002] binder: release 10927:10931 transaction 3748 in, still active [ 1124.406331] binder: send failed reply for transaction 3748 to 10927:10931 [ 1124.438158] binder_alloc: binder_alloc_mmap_handler: 10927 20001000-20004000 already mapped failed -16 [ 1124.464548] binder: BINDER_SET_CONTEXT_MGR already set [ 1124.480570] binder: 10927:10931 ioctl 40046207 0 returned -16 [ 1124.501676] binder: 10927:10938 ERROR: BC_REGISTER_LOOPER called without request [ 1124.502312] binder_alloc: 10927: binder_alloc_buf, no vma [ 1124.523155] binder: undelivered TRANSACTION_COMPLETE [ 1124.528846] binder: undelivered TRANSACTION_ERROR: 29189 [ 1124.532926] binder: 10927:10931 transaction failed 29189/-3, size 0-0 line 2973 [ 1124.572816] binder: undelivered TRANSACTION_ERROR: 29189 10:10:03 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x730000000000, 0x0) 10:10:03 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:03 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xbc01}], 0x18}], 0x49249249249276c, 0x0) 10:10:03 executing program 5: socket$inet6(0xa, 0x803, 0x6) r0 = socket$inet(0x10, 0x2, 0xc) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x68, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:03 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1127.069557] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1127.084927] binder: 10945:10954 ERROR: BC_REGISTER_LOOPER called without request [ 1127.108859] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:10:03 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x8002}], 0x18}], 0x49249249249276c, 0x0) [ 1127.117927] binder: release 10945:10954 transaction 3751 in, still active [ 1127.125150] binder: send failed reply for transaction 3751 to 10945:10954 [ 1127.131340] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1127.139689] binder_alloc: binder_alloc_mmap_handler: 10945 20001000-20004000 already mapped failed -16 [ 1127.161274] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1127.184705] binder: BINDER_SET_CONTEXT_MGR already set 10:10:04 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:04 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) prctl$PR_SET_TSC(0x1a, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x800, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) r2 = socket$inet(0x10, 0x2, 0xc) setsockopt$inet6_tcp_int(r0, 0x6, 0x1f, &(0x7f0000000340)=0xc3a, 0x4) getrandom(&(0x7f0000000200)=""/171, 0xab, 0x1) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) timerfd_create(0x3, 0x80000) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000100)={0x0, 0x7fffffff, 0x1, [0x0]}, &(0x7f0000000180)=0xa) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f00000002c0)={r3, 0x3f}, &(0x7f0000000300)=0x8) [ 1127.205719] binder: 10945:10954 ioctl 40046207 0 returned -16 10:10:04 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x8103}], 0x18}], 0x49249249249276c, 0x0) 10:10:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x7000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1127.351638] binder: undelivered TRANSACTION_COMPLETE [ 1127.357200] binder: undelivered TRANSACTION_ERROR: 29189 10:10:04 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008911, &(0x7f0000000400)="99b49559c331ee92cf722c76f8f813d36ee715d7e9c06b572a36a17b511a9eb61a1a2b0df491b42a11e3187f8febdc0b6dd21fdb4b8ef6695d511948ed201e90afc0de5a8adffaa55406d9919c183e6ed1111b29cd641554965f8df302f107b2f92c5b1bc224e6fb7471bf833266ab64dcc73b10cf0d1f97b36eecc2e200d9487b107de9c55a694b9a6eacbbddd5d7f062ce30e111b7a9f6ab48abeb5716a0a3d90a62da11a795adbd2f4edb85c6531cd9777ffb57c16f5258fa4dc9355fcd73335edb047bf1896865dcf98ce49f3a5bd571f02716f326fe47a0405a9dcc53350d082148b66eb0527f9a78c1864143cdeb282943973b02dd") r1 = socket$inet(0x10, 0x80a, 0xb) socket$pppoe(0x18, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) [ 1127.464278] binder: 10985:10990 ERROR: BC_REGISTER_LOOPER called without request [ 1127.494130] binder: release 10985:10990 transaction 3753 in, still active [ 1127.505720] binder: send failed reply for transaction 3753 to 10985:10990 [ 1127.532385] binder_alloc: binder_alloc_mmap_handler: 10985 20001000-20004000 already mapped failed -16 [ 1127.581330] binder: undelivered TRANSACTION_COMPLETE [ 1127.586450] binder: undelivered TRANSACTION_ERROR: 29189 10:10:06 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x710000) 10:10:06 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xa701}], 0x18}], 0x49249249249276c, 0x0) 10:10:06 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x40, 0x0) ioctl$KVM_INTERRUPT(r1, 0x4004ae86, &(0x7f0000000040)=0x3) ioctl$KVM_SMI(r1, 0xaeb7) r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r1, 0xc008551b, &(0x7f0000000100)={0x7, 0x8, [0x5, 0x3f]}) setsockopt$packet_buf(r1, 0x107, 0x1f, &(0x7f0000000200)="fd631516de4e6eb102f4ed672043a630ddcf79102286e4508157d8bb0210c09441eba1367bdc7fe0b6b24e8b36226835da4e4e838f3735ea8d989cd2926d5809cc7e08e3e616a3cf80b1c505ac7324bb4301d39bb5d7386e4aa9700c67e71f21f570f7f75c5c0a482df2624fb98dc26a014793d59709d365ff15fbbf099d5bf419f7d1a4811c4b7bcb52afc2ab9ab79bf548e8cf8100bc33d9ecba824bf965166f793771f9cd5adb3b4d64b39894a72c8705fbbd8adb3522d51141bd52a4177d70a52004af5f027b54d0e83b2a4bc7d1debeca8fb6f2e6350ef40fca2e69fc68ce209f1f9ae16f1cdf41e16e8a3b6dd48ee3", 0xf2) 10:10:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x3f00, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:06 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:06 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1130.122310] binder: 11006:11009 ERROR: BC_REGISTER_LOOPER called without request [ 1130.140587] __nla_parse: 4 callbacks suppressed [ 1130.140597] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1130.155619] binder: release 11006:11009 transaction 3755 in, still active 10:10:07 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4b03}], 0x18}], 0x49249249249276c, 0x0) [ 1130.170881] binder: send failed reply for transaction 3755 to 11006:11009 [ 1130.173150] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1130.183256] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1130.197231] binder_alloc: binder_alloc_mmap_handler: 11006 20001000-20004000 already mapped failed -16 [ 1130.204523] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1130.213609] binder: BINDER_SET_CONTEXT_MGR already set 10:10:07 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x60400, 0x0) getsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000040)=0x7fffffff, &(0x7f0000000100)=0x2) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:07 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1130.252987] binder: 11006:11009 ioctl 40046207 0 returned -16 10:10:07 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x70500000000000) 10:10:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x6c, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:07 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x8b00}], 0x18}], 0x49249249249276c, 0x0) [ 1130.340468] binder: undelivered TRANSACTION_COMPLETE [ 1130.345799] binder: undelivered TRANSACTION_ERROR: 29189 10:10:07 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000002c0)=@sack_info={0x0, 0x2, 0x1ff}, &(0x7f0000000300)=0xc) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000340)={r2, 0xf0a3}, &(0x7f0000000380)=0x8) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000100)={0xa00000, 0x2, 0xe59, [], &(0x7f0000000040)={0xa10907, 0x81, [], @p_u8=&(0x7f0000000000)=0x4}}) r3 = syz_open_dev$usb(&(0x7f0000000180)='/dev/bus/usb/00#/00#\x00', 0x4, 0x101000) ioctl$GIO_SCRNMAP(r3, 0x4b40, &(0x7f0000000200)=""/150) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1130.445079] binder: 11039:11043 ERROR: BC_REGISTER_LOOPER called without request [ 1130.471262] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:10:07 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x70700000000000) 10:10:07 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2}], 0x18}], 0x49249249249276c, 0x0) [ 1130.508347] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1130.525175] binder_alloc: binder_alloc_mmap_handler: 11039 20001000-20004000 already mapped failed -16 [ 1130.538498] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:10:07 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xd500}], 0x18}], 0x49249249249276c, 0x0) [ 1130.624057] binder: release 11039:11043 transaction 3757 in, still active [ 1130.631249] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1130.641022] binder: send failed reply for transaction 3757 to 11039:11043 [ 1130.693029] binder: undelivered TRANSACTION_COMPLETE [ 1130.720995] binder: undelivered TRANSACTION_ERROR: 29189 10:10:07 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:07 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6400}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x500, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:07 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") socket$inet(0x10, 0xffffffffffffffff, 0xc) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="240000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e03000000110affffba0100000000094c8546c81c0029db4aecdceed37ed01cc0000000000000000000", 0x1000e}], 0x1}, 0x0) 10:10:07 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x9001}], 0x18}], 0x49249249249276c, 0x0) 10:10:07 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x1403}], 0x18}], 0x49249249249276c, 0x0) 10:10:07 executing program 5: r0 = socket$inet6(0xa, 0x80006, 0x1ff) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1130.887923] binder: 11085:11089 ERROR: BC_REGISTER_LOOPER called without request [ 1130.921737] binder: release 11085:11089 transaction 3759 in, still active [ 1130.930430] binder: send failed reply for transaction 3759 to 11085:11089 [ 1130.942426] binder_alloc: binder_alloc_mmap_handler: 11085 20001000-20004000 already mapped failed -16 [ 1130.952856] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1130.953196] binder: BINDER_SET_CONTEXT_MGR already set [ 1130.963949] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1130.970089] binder: 11085:11089 ioctl 40046207 0 returned -16 10:10:07 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:07 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xa02}], 0x18}], 0x49249249249276c, 0x0) [ 1131.084758] binder: undelivered TRANSACTION_COMPLETE [ 1131.093977] binder: undelivered TRANSACTION_ERROR: 29189 10:10:10 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x710000000000) 10:10:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x7400000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:10 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x9, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = getuid() setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@dev={0xfe, 0x80, [], 0x1b}, @in=@loopback, 0x4e22, 0x0, 0x4e22, 0x8, 0xa, 0x20, 0x80, 0x32, 0x0, r2}, {0x7ff, 0x8, 0x8001, 0xffffffffffffff6c, 0x1, 0x4, 0x8, 0x4}, {0xcda, 0x990, 0x0, 0x8}, 0x81, 0x6e6bc0, 0x1, 0x0, 0x2, 0xc9d9f22ccfed0cd5}, {{@in6=@loopback, 0x4d2, 0xff}, 0xa, @in=@local, 0x0, 0x3, 0x3, 0x400, 0xffffffffffffffff, 0x6, 0x67}}, 0xe8) r3 = socket$inet(0x10, 0x2, 0xc) recvmmsg(r0, &(0x7f0000005480)=[{{0x0, 0x0, &(0x7f0000001b00)=[{&(0x7f0000001740)=""/182, 0xb6}, {&(0x7f0000000100)=""/56, 0x38}, {&(0x7f0000000180)=""/33, 0x21}, {&(0x7f0000001800)=""/56, 0x38}, {&(0x7f0000001840)=""/119, 0x77}, {&(0x7f00000018c0)=""/36, 0x24}, {&(0x7f0000001900)=""/198, 0xc6}, {&(0x7f0000001a00)=""/197, 0xc5}], 0x8, 0x0, 0x0, 0x8}, 0x1}, {{&(0x7f0000001b80)=@un=@abs, 0x80, &(0x7f0000001f40)=[{&(0x7f0000001c00)=""/234, 0xea}, {&(0x7f0000001d00)=""/47, 0x2f}, {&(0x7f0000001d40)=""/222, 0xde}, {&(0x7f0000001e40)=""/242, 0xf2}], 0x4, &(0x7f0000001f80)=""/217, 0xd9, 0x19}, 0x4}, {{&(0x7f0000002080)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000002380)=[{&(0x7f0000002100)=""/142, 0x8e}, {&(0x7f00000021c0)}, {&(0x7f0000002200)=""/214, 0xd6}, {&(0x7f0000002300)=""/83, 0x53}], 0x4, &(0x7f00000023c0)=""/4096, 0x1000, 0x81}, 0x3}, {{&(0x7f00000033c0)=@generic, 0x80, &(0x7f0000003940)=[{&(0x7f0000003440)=""/255, 0xff}, {&(0x7f0000003540)=""/205, 0xcd}, {&(0x7f0000003640)=""/240, 0xf0}, {&(0x7f0000003740)}, {&(0x7f0000003780)=""/186, 0xba}, {&(0x7f0000003840)=""/213, 0xd5}], 0x6, &(0x7f00000039c0)=""/6, 0x6, 0x7}, 0x6}, {{&(0x7f0000003a00)=@can={0x1d, 0x0}, 0x80, &(0x7f0000003c40)=[{&(0x7f0000003a80)=""/223, 0xdf}, {&(0x7f0000003b80)=""/183, 0xb7}], 0x2, &(0x7f0000003c80)=""/74, 0x4a, 0x4}, 0xfffffffffffeffff}, {{&(0x7f0000003d00)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000003e80)=[{&(0x7f0000003d80)=""/225, 0xe1}], 0x1, &(0x7f0000003ec0)=""/223, 0xdf, 0x9}, 0x1}, {{&(0x7f0000003fc0)=@ipx, 0x80, &(0x7f00000053c0)=[{&(0x7f0000004040)=""/143, 0x8f}, {&(0x7f0000004100)=""/228, 0xe4}, {&(0x7f0000004200)=""/4096, 0x1000}, {&(0x7f0000005200)=""/200, 0xc8}, {&(0x7f0000005300)=""/130, 0x82}], 0x5, &(0x7f0000005440)=""/10, 0xa, 0x100000000}, 0x7}], 0x7, 0x100, &(0x7f0000005640)={0x77359400}) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000005680)={@dev={0xfe, 0x80, [], 0x14}, @dev={0xfe, 0x80, [], 0x1a}, @loopback, 0x6, 0x3f, 0x1, 0x100, 0x6, 0x10010, r4}) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000000)={0x5}, 0x4) 10:10:10 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:10 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xe503}], 0x18}], 0x49249249249276c, 0x0) 10:10:10 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:10 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x6101}], 0x18}], 0x49249249249276c, 0x0) 10:10:10 executing program 5: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x2, 0x200000) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000040)=0x61, 0x4) r1 = socket$inet6(0xa, 0x803, 0x6) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000100)='trusted.overlay.redirect\x00', &(0x7f0000000180)='./file0\x00', 0x8, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1133.672067] binder: 11126:11139 ERROR: BC_REGISTER_LOOPER called without request [ 1133.684951] binder: release 11126:11139 transaction 3761 in, still active [ 1133.698802] binder: send failed reply for transaction 3761 to 11126:11139 10:10:10 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1133.737370] binder_alloc: binder_alloc_mmap_handler: 11126 20001000-20004000 already mapped failed -16 [ 1133.791636] binder: BINDER_SET_CONTEXT_MGR already set 10:10:10 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x9d01}], 0x18}], 0x49249249249276c, 0x0) 10:10:10 executing program 5: ioctl(0xffffffffffffffff, 0xe2ad, &(0x7f0000000000)="0a5c2d023c080000008070") r0 = socket$inet(0x10, 0x2, 0xc) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1133.812163] binder: 11126:11139 ioctl 40046207 0 returned -16 10:10:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x3f000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1133.894045] binder: undelivered TRANSACTION_COMPLETE [ 1133.901415] binder: undelivered TRANSACTION_ERROR: 29189 [ 1133.996113] binder: 11169:11172 ERROR: BC_REGISTER_LOOPER called without request [ 1134.030009] binder: release 11169:11172 transaction 3763 in, still active [ 1134.039261] binder: send failed reply for transaction 3763 to 11169:11172 [ 1134.063890] binder_alloc: binder_alloc_mmap_handler: 11169 20001000-20004000 already mapped failed -16 [ 1134.085794] binder: BINDER_SET_CONTEXT_MGR already set [ 1134.103991] binder: 11169:11172 ioctl 40046207 0 returned -16 [ 1134.137165] binder: undelivered TRANSACTION_COMPLETE [ 1134.142894] binder: undelivered TRANSACTION_ERROR: 29189 10:10:13 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x1000000) 10:10:13 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x6801}], 0x18}], 0x49249249249276c, 0x0) 10:10:13 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='memory.current\x00', 0x0, 0x0) ioctl$KVM_SET_XCRS(r1, 0x4188aea7, &(0x7f0000000100)={0x2, 0x400, [{0x8e, 0x0, 0x8}, {0x7}]}) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r3 = dup(r2) connect$vsock_stream(r3, &(0x7f0000000000)={0x28, 0x0, 0xffffffff, @reserved}, 0x10) 10:10:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x48000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:13 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:13 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:13 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xe903}], 0x18}], 0x49249249249276c, 0x0) [ 1136.684912] __nla_parse: 13 callbacks suppressed [ 1136.684923] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1136.704244] binder: 11185:11191 ERROR: BC_REGISTER_LOOPER called without request [ 1136.712867] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1136.717272] binder: release 11185:11191 transaction 3765 in, still active 10:10:13 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x40, 0xa9, 0x5, 0x1, 0x1}, 0x2c) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r3, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000664e00000280e8cd840000000000000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0xce, &(0x7f0000000180)=""/206}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xa, 0x4, &(0x7f0000000040)=@raw=[@map={0x18, 0x2, 0x1, 0x0, r2}, @call={0x85, 0x0, 0x0, 0x27}], &(0x7f0000000300)='GPL\x00', 0x1, 0xa7, &(0x7f00000004c0)=""/167}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x6c, &(0x7f0000000380)="a26cce4649a323d7943b7af50023", &(0x7f0000000100)=""/108, 0x8000a0000014fe}, 0x28) r5 = dup2(r0, r0) ioctl$EVIOCGMASK(r5, 0x80104592, &(0x7f00000002c0)={0x3, 0x82, &(0x7f0000000200)="f5fca3c86a0e48c42685e764d59c6b1b9e140b73e13741e2ed2c725a8cdc34d042473a544b669c4a6494309184dea10bc8bb48c4ad851a83c0646900beee7880eb7eff610b0d106496670d39e757555b280ce4f3d9efc836abcb05b6f98b0a570f6f61a10ac5d8eedd2f3f1ba1d8279eac2fa17790973d6b4bb421e5f961d0322a9b"}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x90fd}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000140)={r6}, &(0x7f0000000180)=0x8) [ 1136.731196] binder: send failed reply for transaction 3765 to 11185:11191 [ 1136.740286] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1136.750395] binder_alloc: binder_alloc_mmap_handler: 11185 20001000-20004000 already mapped failed -16 [ 1136.786093] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1136.793082] binder: BINDER_SET_CONTEXT_MGR already set 10:10:13 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}, 0x0}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1136.832519] binder: 11185:11191 ioctl 40046207 0 returned -16 10:10:13 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x5501}], 0x18}], 0x49249249249276c, 0x0) 10:10:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x3000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1136.890067] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1136.907679] binder: undelivered TRANSACTION_COMPLETE [ 1136.912929] binder: undelivered TRANSACTION_ERROR: 29189 10:10:13 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xd203}], 0x18}], 0x49249249249276c, 0x0) [ 1136.987355] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1137.018436] binder: 11224:11226 ERROR: BC_REGISTER_LOOPER called without request [ 1137.020515] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1137.061187] binder: release 11224:11226 transaction 3767 in, still active [ 1137.089740] binder: send failed reply for transaction 3767 to 11224:11226 [ 1137.127752] binder_alloc: binder_alloc_mmap_handler: 11224 20001000-20004000 already mapped failed -16 [ 1137.152334] binder: BINDER_SET_CONTEXT_MGR already set [ 1137.169965] binder: 11224:11226 ioctl 40046207 0 returned -16 [ 1137.241108] binder: undelivered TRANSACTION_COMPLETE [ 1137.246453] binder: undelivered TRANSACTION_ERROR: 29189 [ 1137.300206] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:10:16 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x3f00) 10:10:16 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:16 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xfc03}], 0x18}], 0x49249249249276c, 0x0) 10:10:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x2000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:16 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) setxattr$security_selinux(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.selinux\x00', &(0x7f0000000100)='unconfined_u:system_r:insmod_t:s0-s0:c0.c1023\x00', 0x2e, 0x2) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:16 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1139.860462] binder: 11244:11250 ERROR: BC_REGISTER_LOOPER called without request [ 1139.862304] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1139.874248] binder: release 11244:11250 transaction 3769 in, still active [ 1139.887690] binder: send failed reply for transaction 3769 to 11244:11250 [ 1139.888627] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:10:16 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x6700}], 0x18}], 0x49249249249276c, 0x0) [ 1139.901322] binder_alloc: binder_alloc_mmap_handler: 11244 20001000-20004000 already mapped failed -16 10:10:16 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1139.935643] binder: BINDER_SET_CONTEXT_MGR already set [ 1139.948690] binder: 11244:11250 ioctl 40046207 0 returned -16 10:10:16 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) userfaultfd(0x800) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:16 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x400000) 10:10:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x600, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:16 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x5603}], 0x18}], 0x49249249249276c, 0x0) [ 1140.113844] binder: undelivered TRANSACTION_COMPLETE [ 1140.143542] binder: undelivered TRANSACTION_ERROR: 29189 10:10:17 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) r2 = syz_open_dev$dspn(&(0x7f00000004c0)='/dev/dsp#\x00', 0x8, 0x8000) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000000)='veth1_to_bridge\x00') sendmsg$kcm(r2, &(0x7f0000000840)={&(0x7f0000000500)=@pptp={0x18, 0x2, {0x3, @rand_addr=0x80000001}}, 0x80, &(0x7f0000000700)=[{&(0x7f0000000580)="bdfa22cf60f307562e98370be9227da906f60ecc6861131997b6b4aa3f86c3162c0779d1c95108a6d88d3c56a635112ecdb078116c4b101bf892fce2925f74ad20f45d1a07134ba73ed5b8788f84256ba07402716553bef1a5a53903a5beeeefa1724dc8b54c3a64ab1e5be2a22b5bb8617dc1c04347c64f7aae1c71924124ec66c6c5febbeb72cf4585129491dc0f3fbf2034d27d1790976e6141483726a7ad75aa8c1c5e213018c086d3c6ea8e20939efa17", 0xb3}, {&(0x7f0000000640)="cc801681ff92ddb0632a681549c6be0bde173ec205a5d097f8740ebece2db46a387050bbef0e42e1be3c84d1b7f7d9b90c7b5341e12ae1c3341765afd38b9123246446fd4543b3847ab36b5ac67e86c2b4d5ae5d5b3dc84728c15802d45bc022cf37e87e6b2351536147342101d31ae03bb943e47e79c5a6b80b4fcd029b4602563814246ae7a62ec30d7086b84c77495188f95f9bf948ee901231f966eb3b", 0x9f}], 0x2, &(0x7f0000000740)=[{0xf8, 0x19f, 0x46, "73d70548ea34d0eb4f6f1f0093248419882bbb099ef4148a0d8acffa820edda6b91cf84ba4a0c6b42e17093397af149c73a9c0df224afe020f96cf6d4e589bbd0ebaae92e472ba493dfcb360c38e2039eb9854f3a2521caf3be2b88bc56bcb8e936983b622ee5db80db8b5539ce33ce3ad95f4b72ffee694d4f4027a8335df4e726320def3c0c69fbcb833c402a4d35cd6989e629d0ea4d070251383c789c75fe5a184b22c0fcbc7444e387018d4bfa704920524f424a49ef37564b8b23ef2f37f22442e8228d232f111364d6f6c124c754e7eef996e0bb57c4389fe211a50968be0b68e"}], 0xf8, 0x44}, 0x8000) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) socket$inet6(0xa, 0xf, 0x91) socket$inet6(0xa, 0x0, 0x6) [ 1140.205967] binder: 11277:11286 ERROR: BC_REGISTER_LOOPER called without request [ 1140.232468] binder: release 11277:11286 transaction 3771 in, still active [ 1140.246142] binder: send failed reply for transaction 3771 to 11277:11286 10:10:17 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2b01}], 0x18}], 0x49249249249276c, 0x0) [ 1140.265071] binder_alloc: binder_alloc_mmap_handler: 11277 20001000-20004000 already mapped failed -16 [ 1140.282842] binder: BINDER_SET_CONTEXT_MGR already set [ 1140.301663] binder: 11277:11286 ioctl 40046207 0 returned -16 10:10:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x6, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1140.406637] binder: undelivered TRANSACTION_COMPLETE [ 1140.412236] binder: undelivered TRANSACTION_ERROR: 29189 10:10:17 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2401}], 0x18}], 0x49249249249276c, 0x0) [ 1140.503332] binder: 11305:11306 ERROR: BC_REGISTER_LOOPER called without request [ 1140.511768] binder: release 11305:11306 transaction 3773 in, still active [ 1140.528056] binder: send failed reply for transaction 3773 to 11305:11306 10:10:17 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) getsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000000), &(0x7f0000000040)=0x4) mbind(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x8001, &(0x7f0000000100), 0x3, 0x1) [ 1140.553790] binder_alloc: binder_alloc_mmap_handler: 11305 20001000-20004000 already mapped failed -16 [ 1140.565559] binder: BINDER_SET_CONTEXT_MGR already set [ 1140.591476] binder: 11305:11306 ioctl 40046207 0 returned -16 [ 1140.618781] binder: undelivered TRANSACTION_COMPLETE [ 1140.624008] binder: undelivered TRANSACTION_ERROR: 29189 10:10:17 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb02}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:17 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xcd03}], 0x18}], 0x49249249249276c, 0x0) 10:10:17 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x4800000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1140.862706] binder: 11332:11333 ERROR: BC_REGISTER_LOOPER called without request [ 1140.890527] binder: release 11332:11333 transaction 3775 in, still active [ 1140.900993] binder: send failed reply for transaction 3775 to 11332:11333 [ 1140.911284] binder_alloc: binder_alloc_mmap_handler: 11332 20001000-20004000 already mapped failed -16 [ 1140.948069] binder: undelivered TRANSACTION_COMPLETE [ 1140.953212] binder: undelivered TRANSACTION_ERROR: 29189 10:10:19 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x707000) 10:10:19 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000000)={0x13, 0x100000001, 0xf8c6, 0xfffffffffffffff8}, 0x14) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:19 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xbe01}], 0x18}], 0x49249249249276c, 0x0) 10:10:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x6000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:19 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:19 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1143.145376] binder: 11349:11355 ERROR: BC_REGISTER_LOOPER called without request [ 1143.156965] __nla_parse: 12 callbacks suppressed [ 1143.156975] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1143.181118] binder: release 11349:11355 transaction 3777 in, still active 10:10:20 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x7102}], 0x18}], 0x49249249249276c, 0x0) [ 1143.190756] binder: send failed reply for transaction 3777 to 11349:11355 [ 1143.201367] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1143.208006] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1143.210339] binder_alloc: binder_alloc_mmap_handler: 11349 20001000-20004000 already mapped failed -16 [ 1143.221462] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1143.251245] binder: BINDER_SET_CONTEXT_MGR already set 10:10:20 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:20 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x9, 0x224242) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000040)=0x1) r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) mknodat(r1, 0x0, 0x1144, 0x2) [ 1143.276322] binder: 11349:11355 ioctl 40046207 0 returned -16 10:10:20 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x400000000000) 10:10:20 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3503}], 0x18}], 0x49249249249276c, 0x0) [ 1143.425043] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:10:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x600000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1143.484053] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1143.494030] binder: undelivered TRANSACTION_COMPLETE [ 1143.499577] binder: undelivered TRANSACTION_ERROR: 29189 10:10:20 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a5c2d023c80083b354e8633f2602f3270") ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000000)) r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1143.550302] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1143.586358] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:10:20 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4202}], 0x18}], 0x49249249249276c, 0x0) [ 1143.677868] binder: 11391:11392 ERROR: BC_REGISTER_LOOPER called without request [ 1143.704034] binder: release 11391:11392 transaction 3779 in, still active 10:10:20 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1143.727499] binder: send failed reply for transaction 3779 to 11391:11392 [ 1143.753173] binder_alloc: binder_alloc_mmap_handler: 11391 20001000-20004000 already mapped failed -16 [ 1143.788451] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1143.797923] binder: BINDER_SET_CONTEXT_MGR already set [ 1143.803256] binder: 11391:11392 ioctl 40046207 0 returned -16 [ 1143.859963] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:10:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x100000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:20 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xf303}], 0x18}], 0x49249249249276c, 0x0) [ 1143.913287] binder: undelivered TRANSACTION_COMPLETE [ 1143.918488] binder: undelivered TRANSACTION_ERROR: 29189 [ 1144.025691] binder: 11413:11416 ERROR: BC_REGISTER_LOOPER called without request [ 1144.054313] binder: release 11413:11416 transaction 3781 in, still active [ 1144.062345] binder: send failed reply for transaction 3781 to 11413:11416 10:10:20 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:20 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x40, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x40, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)=0x5) 10:10:20 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:20 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xde03}], 0x18}], 0x49249249249276c, 0x0) [ 1144.076181] binder_alloc: binder_alloc_mmap_handler: 11413 20001000-20004000 already mapped failed -16 [ 1144.155515] binder: BINDER_SET_CONTEXT_MGR already set [ 1144.173243] binder: 11413:11416 ioctl 40046207 0 returned -16 [ 1144.206923] binder: undelivered TRANSACTION_COMPLETE [ 1144.217567] binder: undelivered TRANSACTION_ERROR: 29189 10:10:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xf903}], 0x18}], 0x49249249249276c, 0x0) 10:10:23 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x200, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000040)) sendto$inet(r1, &(0x7f0000000200)="f5861bcfdd7ceb1c1492748be747931dd58b42236df1f044bf3b8d28e33b80fa7b7295bcbf13654ee15504ce6169ab11fbda79edb97ff0252cbfc48315c4171e7bf1ba6264c9f2ab191cfc8f155ceaba870772045773f9084b7426f6f9e48038fbad49d4eda5d32138c18f4307c763f9f916652562aced1132499e14d1a384a24d68ea4672b0d4b0f85e2edb12a44f88cfcab0ff4ec4523943ec1607a07dea112c067f5b4ab10e3aceeffc9bbb5af0c17d947ac9a9799032bef23109f129e7a8dae26f92982fccfbcedbf106b9f7f505028e77c15087be17268c049510fc", 0xde, 0x20004000, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$inet(0x10, 0x0, 0x6) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x74000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:23 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x7300) 10:10:23 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb020000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:23 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:23 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008914, &(0x7f0000000100)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) setsockopt$inet_opts(r1, 0x0, 0x9, &(0x7f0000000200)="aed6c13cf5673f3bdb928566a68c82d66de0edad3a3592b3a686ca6989477137aefcf14b74f6bab65dc8436bcc7591d30a0c33c3a4066f517a08f4b885d0fb344d333043765153a5fe62f6ed0d2f4f951c5bad849906c4db4092d01af4208a564ed2ed98c68740e1970f43726efdcb0f10ddb009876eb091a5456b47181183bf12c4f20b946cd223a7590773f284b1b8655f78eb7264268f0c0a6c48cadfb19d58f0bf5c1bc720cea9d73f325e5b9e9869a91d9ba3db02fda5edd55042320ab34edae0127515fdbf9a855a48660dcdc1ba1e24dfa50618fcc23183a23b2b36409411225aa769e61e622f45e5adbd8c536b46b178a60fe58702969eeab8e97f5eed5cdd2b3ff457cbff387f191f99f48281e1205f50c70ac3dd28fa70ad183c5686663e1b894dd9e13b75507a69d80cc470f2e807531473a4c789cfc3c61726a00dd9fc2f5f5f615f13f79d6e822f498b660b26614d687b3b4dd9456580a65f1b91eb369f8a52feb9e0432147db45a8496d745ff22dd68491381014be18f5969f53f07caf25fba708b92a1579e118865993404c95fac66fa11d66efe5e94c98d0319c724cbded7686befd4c68b118acc7f880b9ce1430ac897c174356553957a48ea5f5c30ce2bb1f60e50b95f253bbe5f7dfa101c8ddf1b467b962f95dd00f4c58e64cc41473352de2f02d84d7ee66116e7ca10233e2f5e8d15269349255e2753678c1aa3f23ba57e9be1c11e107e978e9fb0391bf537de14bceb2d267f02de5e69c0311b3356bbf55c501c2dcfc02355de47e92a5bcf5811faf1eb793c33b0701c2a2ff0859de0e95696dcb9d51e249bba9d5e9bfc665a0c8c6f1d3b6169ff76227481cc88ca356cdd23febf2027dccfc7e9970d41d06a43faaacab8f4d7c57455fc0d3e9e78ce1597b7be133aac8a1ab86b320b5944d2111ade39b4adc4dd38dc484c3e74d6b6e041353fd1539e2b52bde200b5381c9b6188f1740893c6efb9ae6187f5654114398c089b154204867823eaf7d32bd736165cb2c23a77613cda9eaea356e9b00990e6f2c557d0e8975abd1d2bf283a0242374e38f864898cbe012ed8bdc953b09ec01084c89030ed4b1f5414658642215f44bf0e5e44ecbb3852ca0e79a7bc121867a61619df34b2e8030a7ba917cc312ef1d8683ced123d97477f3f25fc8bda58b06495cb751f17a64eb23a490eeee0e1a4345426b41cb0d0a599d414dd169264d948e0106daa9821d9828799e3d250807ec842ed042f5904323b9922bdaefe421a902415839b12ec4a2e6613e75c8c546b283e42f85a4ad67ba7b6128016f46019ae1c65cb9368b3dfb325d22b6288b9474a79d4a4745574a1617dab5e513ba9f93ad6f3853186db6ff9d84556dae54954ad7fa1a7ebc09b58feeed579d9c52c8b7b450e3c2dcfa60df57fe4fcde3d1dfffe5416a115deba111e1d8fad9ec1c13f83b7ea101150843ebbfceded76dc2db50467d901e7d47cf11518214741618144505401b1ffd1b217f3ccd65699717ad1c99f74e9ef800ace50ce901c4df9141e1e5d402a5424ac13e8827207f274abaa1a99272057954e1f0f5d7a6cc945ca9fc045362e9e959acca92b94675bf8de328c1b47009b8f7fbedc933bce4f92a646808a1fea0764b6e8b0ce3fdeb32f1df13847b8d9bea313aeec2d6f6dc66b22bdd9f3dc94dba4067f509175d9e5b7bc270a82d27c6b8bcada27d0ee5eceb8568c87366bd6214151f23ad251c864f67a54a6e566400188cc3b30ccc12de2bc3fc5d08fb34c708c6b220b1ea36ac7fad7da6e178feb89015c6a92b86632674c413153fb6a4f84cb0a98312a71117655d95056c340267e0ceb6a573b5341ffb975ed3eb6bbfa494f56bba1934adebaa3c74d7173fc78c4cc7b9d01293a7257327fe9fd1e1d8273652cdca00ff7cb1f8f31625716c1c9b71325daeca64bc5b79035bc2ee329570ea3b5a33374e3bc8e288a89ae1f8922e9d6e764da22d3507a735f8449a5fb7bb283938a3a85ab07007e847eafbd7832279eab3628d5cacab90cdf828603bdd8f165f1c6e9363c5d4ea80f561200a8f844ac4a9f53646f8c6c4a9105071bef7d158c644d61c0b4c0af4f371fcf753a9b3025738d8c5d90ffc6a6100b79bc680152eed2faa143b41eb93728680313870d96460713d81e9fba5e281485f7d4e223533ce0109064e4c9ba21948caa279fdea4f86c6b16dd88c24c1f4f14274a4972ad5a7be4439c912d27490e226de05da6bae5a755a9760c23a4e72e439380b029476bda701de62519af74327d3e13c032612d764afa2fbc968ce0cfb4194227d31a3b52e1d7d994c2a2e446392308e4102b8a94cabb55bc251e0f6ddadeafd089f49ceddb31b1796cc2f5452924bd8feafcbd51e359caa1f901149da2dcefe8cd56d4b294b89addbd3e64b7fa1bad24156d3f84012363a206a21947d09b482e468ddf79f3cae7ccca854a7d1d204f1c8a0d944b41e09c8f03535595b7aaee5f4100e60e245bcb3c432fe4974853319527a5669cbf2811b17b89dbf5015ce0a763b19dc558a54ef884721a4f1f08ca504daf1e1708e17ec3b28211ad1cc216fec120f6eba63e68a5ecb9c774f5f98d8b4bfa7995abb105c974ea660edeb1202dcd332608b3734de0d31e7bc29d5a226b3a2ba4d66c2984188d66f1a68579a96345fd6bc6a8746b4032eb663126785a68a6df05a6a91c2a1b937b17d285f0de032e5f8246365d063376c8e55ddf4eda2895556f3aef046b24d09f42df43484140024f2999f1f35096c0893377f4b99eb89fe07cae9f3b0460944d7421e5dd440432b822e2b876061f312e2da2f5ef256b181c754354159e38463ee5cfc6c21bcbce0da01f85c68ca48f81d7d44474222087e0ac1c36fa2696f5500e661d4c1009868c962c86f6656e00239932070104d8ec0ffb3c19bc15db64ce031f573af74765da146b78c8953f7201b9317c92fdb22ee693837703ce686c93c9d2edb1628fde39cd7337ef662383ab12ce12f2392dc4143a3ae0d113083efc3201b9713d46bf770bb566d00d4dd3aefa7d50ad1987073d69d7dc85fd2e8d523a7a5870c1cc15015aeae946ae5842dc8a3a3f654d85be1406d7efac6a2ad75ef728f05ffe046f0130e057d62a85d345d1c01e570874a22fc6749421afe622a158e79136e171d3da325d8679cfc6037994ae44eec25530bd4ded9e0d322c3d409c0781a5c0af5fb40a5075068f0afb3c830ef3845105c88c5f84784f6885a6a41e7ab0335def765b9240d5d0d7e3d55a070982cb702677c611984fea996b11196b69cd4f304b66cb89ef070188e061ae4b2040a6568254fa25554c15579893c89771db6bf13fb214f4b8de43401197502b12261f478a3444d68d9c49a1e1ad5fa0132af2999cdf61d992e02fca977a594b520984c28af6dd8e1396e494c0cfe45b174067abdaa7fe281015452beae754c73074e6fb0dc78f97069bee102243a9ea69eb60931bb8e51cba4b3d8d3e485320948313cb392f14d79c09dbeeb7ebc5eb5739c7ba4d720df66fe9ff62e2d289d27f5feb9f8750d880dc7ab19462421a4c199e23f1f1b4b304834ba441a9f4239d7b555ccd5605ceeff955e12a5faa3d1bc75635c55455f1265077c9e5290ed91b13344fecfcd0f30a327bda316c31497bede6c6cfa3de9aa8ca0e5609ca9a3ebc6059f3ba4867dc0fdd05a63acf1e467d12e35b71258ff519aa1cd8bae71a6a9cdbe6fe8b791f5e312ab305d93562a6b7485e3729ce17cb705d8301b7a1054691a7152fcb85acdb9ef24ff50b2e667d79a38c00cb27640b4907dc2b2406c28915d8a93d19d9c13b81a014e3ad977db127b4e1d775d9469502cef6011293ce5578fd5b248d572ff31ffd8b5e45cc3a7b54d906c05a8ab03bc93d6d1729c166e6433c04534fc28bdce5d3f5e62eef350c042bef21b7b588abc26a22280ad73fcd548c7feca8b005bb8bf330b5ce1907eb4c8edb54603d5735af46cf8066fea47cfd391e5faa67841c66ba7227af08ca67c1ad4a15c0bfd6035091ab4ba134e6c5f7bfdba81c00612c8747d84082470a37453d0619a31afd722d84e394b0350ba254719735613ab1ee7991fa855e618b39e54d0f43ed02d5b29f07fb8be8ae8f69af3914cf5da0942963bf471c6cc8bb70b05ff7457a315035caa6f4d8d56cdcb29eb949e28320228a61951d33c4b7ce59faf1439b7ccceeb6f460e354f544e7a8c34ed42962aa1d1d229f1797e3bff26e69a3eff4c16db80986002c55f6bf2586cd5e5ec84b50683e4f602201d8f9a6c1fd83a4b02ef6c0b3edfa1820d11544fd3c7911eb2f7e441fb25e58324b4d81293640ec120761952275d631bdf4176c2780d0a1a68e90522ed2b922be3751c390d33701d8ad1d757a8b4fbad40a82919de62198ea9d119857dfcb4240ade34f32de95e3cd99d0b465b0d3eb19ea766ba8b29b9ad46fa8e9ec6c82650df35b722769aba75d89b62bd73ff05adfae6c3ba74d1a9dfc3fbef6dfe41ae12df71af70a569500e4733c3a3df3711551e6070677d10a53b28ee20e6012cf4c2ea7f4b25ac58115bb0812153b347e6ed71bde226b35e0efcf159c2a1fe1a765bc8957ea9ef12285fdf779758e7aa6a0cf39e80684167fd2ba7a6e4856fcd5f537845c3c9f295a5f29f0b05bb1452b8c46089b82bc9aa7c0be89ef32425301dec5b74fc66cb21e5187c5751347eea85f6bc619a2f926916579693754b51f0135768a2f92c1018790fb303ecc1b6b40d04b809d3706ccd88a509a39f95a4d8036e8c4408e96c8d543509f26bc5bc102f44c18ecb1a3be5e828c7e9f8c3f59e088ba33f162b8368ef0fb12c7dd98333b02cb0b98d77061870b51c40dd39192b1180ae879d4fd5497305dbc16c146708f668261dddfefca323e1ce4d468c284ccb29899f13e4cb5d723f6cc8c543be4f563fd63b39607cc5db676f5b9018fcd2e03cc39a61807b94524ddd2ea4ec927dc324e6a19c09ad805f2e39d8ca3d94dc1c30d98f459b7e30dc54deccba312fdf0aecaa4600fdb59733de24a123abd46625f50fdd7f47dadde423d8a78a527a33755d30a9ff88aba8648b331e29336e60640432bb9880c9d168626e72240dbb54c572b35afb5601f5f4fdc4c997c1b7c8d41a944275f348a7088b9475bece65565a108fd093dcb0fdac172cfe4466fb91a343f999916e7e3aa7089ed13c102158a9e7dd19f19e388d8347e8b64f5af5155fa3a1dcf28aaa76260b96f39875ee14c86228d7917ba1eed81cd6f546ea112b3cf1366b010be85aeffd8ed983a189570e59d0f049af1e84fac939eb678c0be4a035758d6db00b273ba402d21914180280eb139754e65225641639bc8ca32e4080a2a6862231730d8e9651fd8c9964b6313aa159e6c2ac137c0532ffa2bb6e2491e55be56bbd45c6e2f45f5604e6e3bb43a7a2f1f432a5e9dae57d9b59886cf09f3df2bf53eeaad40833f2da7710edd87d6792c313d9e8b6fd001952f793cb1ab84db88724fdeba7f89408ca74ac24708d44a44c7e3fadb4a2f12a8799d40e8332b5857c475efea606286e8e32c35171985fb593c933d794924dac142c8e0044b0028ac64611b6a19d365bc588061f022a07ad854d5f58332b2fbf26894d5df17344a621c0fe090613d21f32caf2fa30600e7001754ce1c073a7d7779d894f81e2b188e71bcd17fd84abe5a7c4eabfcc1150fef2f463c88bec57e4d00b323f29833f62b0d72a2fd52b4fd7a5d0f3bc24a8b6c084852ee496ef5ce3a879b4e62fe", 0x1000) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x2000, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000001e00)={'team0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000040)="b714e569ae6d6b1723dafb06f63c", 0xe, 0x0, &(0x7f0000001e40)={0x11, 0x16, r3, 0x1, 0x5e, 0x6, @dev={[], 0xa}}, 0x14) 10:10:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x6602}], 0x18}], 0x49249249249276c, 0x0) [ 1146.562733] binder: 11447:11456 ERROR: BC_REGISTER_LOOPER called without request [ 1146.590535] binder: release 11447:11456 transaction 3783 in, still active [ 1146.598276] binder: send failed reply for transaction 3783 to 11447:11456 10:10:23 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1146.668352] binder_alloc: binder_alloc_mmap_handler: 11447 20001000-20004000 already mapped failed -16 [ 1146.691487] binder: BINDER_SET_CONTEXT_MGR already set [ 1146.705450] binder: 11447:11456 ioctl 40046207 0 returned -16 10:10:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xd201}], 0x18}], 0x49249249249276c, 0x0) 10:10:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x20000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1146.757608] binder: undelivered TRANSACTION_COMPLETE [ 1146.762941] binder: undelivered TRANSACTION_ERROR: 29189 10:10:23 executing program 5: r0 = socket$inet6(0xa, 0x881, 0xa) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000004c0)={0x3, 0xfffffffffffffffe, 0x9, 0x8, 0x13d0}, 0x14) io_setup(0x0, &(0x7f0000000040)=0x0) io_destroy(r1) r2 = socket$inet(0x10, 0x7, 0x100000000) r3 = getpid() syz_mount_image$nfs(&(0x7f0000000100)='nfs\x00', &(0x7f0000000180)='\x00', 0x0, 0x4, &(0x7f00000003c0)=[{&(0x7f0000000280)="0cebf956df4fe93b801f3253a0e71fba51d30d063a9b684ad845998116ff38798d912891397ced1f979cfcb8a85544a9b456d623502ca001f7fb32de18daed9ee87734b8d55f946f79bbc07042c790907f1f2452e8fe21ee915ef11c1806d79c4947e26775a0", 0x66, 0x5}, {&(0x7f0000000300)="44d371ae79cc435844f45aaf9c9e58e45610fbeb53124690376f45abf0bae96fad4953b0e516490c5a64c86d2cc0c11c03bfefd90542", 0x36, 0x100000001}, {&(0x7f0000000340)="daafaa586ba4ecb7f8ef24bf4b", 0xd, 0x8001}, {&(0x7f0000000380)="5634a134a045602188f06563a22f8776616e23d5704a6b1d322a363afd70f972413bda8af79b12d289e2f17fd5a02301053b763ecf29b136fea8274180", 0x3d, 0x3}], 0x20, &(0x7f0000000440)='filter\x00') r4 = syz_open_procfs(r3, &(0x7f0000000000)='net/sockstat\x00') sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x4000000) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r4, 0x80045301, &(0x7f0000000480)) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f0000000200)={'filter\x00', 0x4}, 0x68) 10:10:23 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1146.883429] binder: 11488:11491 ERROR: BC_REGISTER_LOOPER called without request [ 1146.911368] binder: release 11488:11491 transaction 3785 in, still active 10:10:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4501}], 0x18}], 0x49249249249276c, 0x0) [ 1146.934419] binder: send failed reply for transaction 3785 to 11488:11491 [ 1146.956209] binder_alloc: binder_alloc_mmap_handler: 11488 20001000-20004000 already mapped failed -16 [ 1146.972207] binder: BINDER_SET_CONTEXT_MGR already set [ 1147.005903] binder: 11488:11491 ioctl 40046207 0 returned -16 10:10:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x7400, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1147.092030] binder: undelivered TRANSACTION_COMPLETE [ 1147.097609] binder: undelivered TRANSACTION_ERROR: 29189 [ 1147.175940] binder: 11514:11517 ERROR: BC_REGISTER_LOOPER called without request [ 1147.207739] binder: release 11514:11517 transaction 3787 in, still active [ 1147.215217] binder: send failed reply for transaction 3787 to 11514:11517 [ 1147.224862] binder_alloc: binder_alloc_mmap_handler: 11514 20001000-20004000 already mapped failed -16 [ 1147.234739] binder: BINDER_SET_CONTEXT_MGR already set [ 1147.241195] binder: 11514:11517 ioctl 40046207 0 returned -16 [ 1147.241916] binder_alloc: 11514: binder_alloc_buf, no vma [ 1147.253137] binder: 11514:11519 transaction failed 29189/-3, size 0-0 line 2973 [ 1147.272849] binder: undelivered TRANSACTION_ERROR: 29189 [ 1147.279266] binder: undelivered TRANSACTION_COMPLETE [ 1147.284511] binder: undelivered TRANSACTION_ERROR: 29189 10:10:26 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x7100) 10:10:26 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:26 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000040)=0xc1, 0x4) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000000)={'veth1_to_team\x00', 0x4}) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x903}], 0x18}], 0x49249249249276c, 0x0) 10:10:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x300000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:26 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4600}], 0x18}], 0x49249249249276c, 0x0) [ 1149.643443] binder: 11527:11530 ERROR: BC_REGISTER_LOOPER called without request [ 1149.654726] binder: release 11527:11530 transaction 3790 in, still active [ 1149.671833] binder: send failed reply for transaction 3790 to 11527:11530 [ 1149.688755] __nla_parse: 14 callbacks suppressed [ 1149.688768] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1149.690233] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1149.696139] binder_alloc: binder_alloc_mmap_handler: 11527 20001000-20004000 already mapped failed -16 [ 1149.722764] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1149.750097] binder: BINDER_SET_CONTEXT_MGR already set 10:10:26 executing program 5: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x80000000, 0x40000) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x1, 0xffffffff, 0x6, 0x7}) r1 = socket$inet6(0xa, 0x803, 0x6) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = socket$inet(0x10, 0x2, 0x13) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x1f02}], 0x18}], 0x49249249249276c, 0x0) 10:10:26 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1149.773014] binder: 11527:11530 ioctl 40046207 0 returned -16 10:10:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x4c00000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1149.846216] binder: undelivered TRANSACTION_COMPLETE [ 1149.860911] binder: undelivered TRANSACTION_ERROR: 29189 10:10:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2d02}], 0x18}], 0x49249249249276c, 0x0) [ 1149.957068] binder: 11566:11567 ERROR: BC_REGISTER_LOOPER called without request [ 1149.965582] binder: release 11566:11567 transaction 3792 in, still active [ 1149.975518] binder: send failed reply for transaction 3792 to 11566:11567 [ 1149.976511] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1150.010098] binder_alloc: binder_alloc_mmap_handler: 11566 20001000-20004000 already mapped failed -16 [ 1150.034620] binder: BINDER_SET_CONTEXT_MGR already set [ 1150.037308] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1150.041167] binder: 11566:11567 ioctl 40046207 0 returned -16 [ 1150.111085] binder: undelivered TRANSACTION_COMPLETE [ 1150.116602] binder: undelivered TRANSACTION_ERROR: 29189 10:10:29 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0xffffffff00000000) 10:10:29 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x10000, 0x0) socket$inet(0x2, 0x5, 0x100000001) ioctl$void(r0, 0xc0045878) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x800) fcntl$getown(r0, 0x9) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) setsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000100), 0x1) syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2, 0x101000) 10:10:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x400000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:29 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2e02}], 0x18}], 0x49249249249276c, 0x0) 10:10:29 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:29 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:29 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x8703}], 0x18}], 0x49249249249276c, 0x0) [ 1152.710808] binder: 11585:11595 ERROR: BC_REGISTER_LOOPER called without request [ 1152.725833] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1152.729858] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1152.751320] binder: release 11585:11595 transaction 3794 in, still active [ 1152.771560] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1152.778245] binder: send failed reply for transaction 3794 to 11585:11595 [ 1152.790563] binder_alloc: binder_alloc_mmap_handler: 11585 20001000-20004000 already mapped failed -16 [ 1152.809351] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:10:29 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x1000000000000) [ 1152.821271] binder: BINDER_SET_CONTEXT_MGR already set [ 1152.840251] binder: 11585:11595 ioctl 40046207 0 returned -16 10:10:29 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x4c000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1152.896838] binder: undelivered TRANSACTION_COMPLETE [ 1152.902200] binder: undelivered TRANSACTION_ERROR: 29189 10:10:29 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0xffffffffffffffff, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:29 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x6b03}], 0x18}], 0x49249249249276c, 0x0) 10:10:29 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0xff600000) [ 1153.059259] binder: 11619:11625 ERROR: BC_REGISTER_LOOPER called without request [ 1153.072467] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1153.138602] binder: release 11619:11625 transaction 3796 in, still active 10:10:30 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xbb00}], 0x18}], 0x49249249249276c, 0x0) 10:10:30 executing program 5: r0 = socket$inet6(0xa, 0x801, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x8000, 0x0) ioctl$KVM_SET_NESTED_STATE(r1, 0x4080aebf, &(0x7f0000000200)={0x3, 0x0, 0x2080, {0x10000, 0x6004, 0x3}, [], "4da3a0a14e8e87130b1014756a0b4b3a49ec37e6bfccd518bec49fdda9c5dba64deb6a617a6d88fb7508a960b0700058f8d82d2830ebe619d1d2b2b1780292912474310538b1a29da5a88bbfc746f52376728e22a4c339115e8feba229bb2c0048717b35ae0d45f64d0feba89675c610b46ac6a213642a401f43cc6e6009513cddb5e1624b07a525a3e0ed7b89100eeecc8493037ccf81beb27d61b5830bbf51c4e352aaa69e628b3322793c04a1d615d37987bc3ee4db8e1bbe766b97ca4998c72ca3acb7e4d4586a029fe615b5b80cef7ccd208285e68503ad944691f994becdb7857f039357c608014369fe77d3eb1bc202e0bddd676279fff5e6cb7af6e6da945802f812aeffbfeba79c4375d46462495fa564cb9f35993d76bf0b899fbf2e6924544c9943cce14d961efa8182ccd9bc9eec314e0d5f0fc9812bff18c36bb212596649f03448349593102f9316c134d691f4a7aa842a52b406ab11abb0937021b03ac668e1169281e7de70cacf7c026013a324276c4e683432ca7f5d34224fbe03168c748ea7ad2708782acedd9acde1f697d20a9473c3c4bfbc3cf4b121e87faf9c7c1eeb4919c528fdbd316b33ab0bff01fe80d36b9f3e6fa821ace1a1aab74351dbcdccda86187007f18f4fba86cfc80db284a35e35eaa05ce2bcf20530ae4eace756c8b69d657fb9f099b11dacb0f0f721cda97680552be0fd19b6e5a8b51c9b113d1e762e8d2b1b43ac493464c7ff87a1d28544f58f7f1ffe1bc31c913c6ac202f969e827b148faf25a3381d464019979e86a0a13da529cb1aac3bad71f67aacbb1d68d7f5570fa1da97d18f48b5a34159f88df6fcfd30e63ccac6365d577df822fbd903b662970b65ce5f980a80770079c809fda315e91a44b711d686dc28e11ac22e1561195e23a7fb52dfb7ce73402738e607a60d9817bbc60010fffe62f4875a8391b4f8387033217289377a2535fb6304ad9056752b8e932b3a42641ae0e4377207a8ae6051ee8bc960c715956b6060eeb1d5386d11042cb2c6f6832131458a9463f2365296df0aabe8ac4b2cb7b69157b34ff1a02c4b0eb7501fe5b97968458dc98fa922f82d42f8a5e2f715b7fedcb3935a5f8c2e58d4410610774b66b752bf047957695d5b728b3995f5ced47e97f6d95bcf8d9f38719013959e4042cd1af730b564451148596de7cd90024873314508d743b3b75148f58ac4c8d5347c39e48cb166c168438310eacc47adbaa216457ceb12634f9561b1463a4fc54094a6862ed7150591326184bd9075af3dc1e0b32aad83d94fbfdea674054e3302436bbc2f50d700814917e95d7a0f38ed9cd9ffaed21fb9532b3c5884944b268bc41ccc2cbc0e3d71d87653513b8c965d57a91df54ac546662530b0c540f87e6cb44adbc1326cbb0a0eddc990d66ff051da9cb6c0affdfa21d1e12933e3a602fe967b22e405cfcd73430e39681010059186aeff81a08a2b4db6376da41a2814d294cc75252a5ace9523547cbe02a15273b0fd460dbe7f15951c7bc5961e70b43430f9f1dd21576e873a5a5c5b2295105d2d64730c93636426aca6b3e9499751162a5a942ddb88f7fe7be48f31facd42e25cc0893d84a366a324755c24a17867dd4140a8c0816ab188f2dd7ef78643e763d74547b3c3f0e0104d6e0ef6a41b126a5b3ab8b881ad25a3d7816dff29a89f8cfad152a92c81cd4d5c0f4e36a4e8076bd975dda611792b1f118ad463051b4b9043ce1a7f32a5287238ea5cda2d646da12f85ce8f1e98f8fe6178006893b44895959a5281ceca7466d00efec99f496487bc6e2e7bb8e87e3d43546a50ae08ec0e519b18b34a7afb5c066e388bdc2af0e9c908b6a82010dc19c98f9824b9bf937533737e5a5d877bc2c1e61b733133d2a7fe455148340105f4afc86471e13b387ac588bd31cec183b995f1ba6c40dc1e88a2bb2e02a5c65b9179954ca6e06f4f4ff2edfdee7d57a750c2ccfaafb936340a450bd4f284edf0c215bfaef22a704ce665381a04800ef9f9fa82f10495c696a47ede760d2819022879ab55cc96a663859b90339ffc456476eccd0c22c80edd0bc6ef6e141fedfa00d06cea1a8e42a2a9822ef2b8c874b8c080d2d11ea2da6be036d9ece19438465ae3bda7ed5fdca23f81e2b06c02e7e8a8dd17fc15b6c6b69c0141b9a368df5bbd8ec95c78c8d8270151ac0d009b724b9979abe90e9bc494a01b2db7d4c187fcc3d269cf740862785892e6fdf16d7677014a7a54e92d381c47c01f34b0b718917aa09b76f1e33195bd34a51601463e32e7d5c8fc4817e429cee5f87cb2f19c44c6b7cf69ca7c467d9527923cde8cd10411c8d73966cf0541d40c781318493bfccaa54f8b0d410bb9e4f79b198361aa831d4deb45cd72deb48de057053b5bee96344456ee13a9a623c418e1db09609c4fbecf2d949f63e7cc9de03fce1f18f433e05b7c0f06e00af139dc502ce2c786811e763c919b82e62ff3fa2aef742379fdab9dffda67628a3e33258e9db0d2745883c8e2b44c086236fd6a4a9b4219389bb03a3b0725be4653b16d63fad635262ca7bcdd0ff150c03400773f521e89b6915d244e0eee29e754e87e25acfa89f9fa35be2f43ecd86613a7de51761c9a6674e8794ae2e89d65dda1e22291037b3b8f71799f55163b47b9421b6310cef9b46b863c4019aa4103f28b6a0ebbc73dfce85b34e05b35f57d30369dde3a6cff68eadda160fbf316627a75578ac270afb4febea0c0b2bc4123b3a82a58e34d94779f22e5a26d26f8ab498a169d88d40cef982c260eb32effc83ec67f46f480cfcc2db9541bc484fea327bf7bde2e3b76c044f6ad562bc84d14154635a152a1d0c848a6ce252ebc0bdfcc852c043f7f831d63f83e9f04602e093ebd11ab8bb5d9e4acd22f1ebf4ae27bf7d29dadda87877daf788d465dcf249b521a90db781ab42f26fd04a6e78e440379b62f69f81a8332771230056cb1c885c78bb26b174132c054ddf3561c93c97a95a58a9ecd88f4731f41f0756099af53f1def3abc609d2c6e91e3ad6081dee62590afe1863bc31355dd522154eb56ee5a40da911e38d4f3ab0bab4f46453a87dc5d32d9bdfa7e3666a3547f64a293b22ba4a948c3b8989313faf4a27b2a5fdd6d0e84d306a398bc75f74ebe1ea851b226a3f7293508a6041b64ffb8fd93f756d6d5668bc158161d3ede6909d72938a308734278ef67777638afa3628536cd3f6f90cd15f34c45c53d5869213e2918ab05dbcec314f9b5e1951b85f1cb2be1651cd479eeca4fc4219936bffc3be1322bf09e8125bbcf38bbb6e0af49c4d4dda25c53e7acdbe3f91454dad3996327a7463f763e11eee1b8480ee15020a6ccf3c06c8ed1a502be9b58b441dc0a79214f600780fe015d0d6b19033498cf7ab1ee003056f42ee720b2fff6e95eb4ad768de1262c04a4036fd62c29282233103689cc3ce2233561c7d7749607ed9f8e13cc9bc15a42493a87a1e584ee3703aeee79f08d49c6d358fb6b518b2b93e9f3dfdfda718fc4b6e0f63edf74d9bc4f58c3b890dadc44e3e5a8e87589ceb3046b5ceacb5a3fb34a31914ea5ca19f579c80990604b5decef9ff962c76223bbaf8e49490879f2365c49cc93bfb76cb28ff4aeb3cd43a644a75154c7af64577b7023ba27645284c9e936d74c86fd2e787c458bcc65a7e85c6309723b3c0a20b5110549a51ef6c0adfcd6f8ef7e9fc1bc258423e4a40f92378208e6128f8891ca4166a9ad87ab3da989605f5ce525d733c7ff28490fdd305adcaad58545108b09feac6dfba322da63abaf9363a46fc633cd2c91b6c57d8923a326aca3fe9e4c2879fe2dbfe544f808d4a974f3dcc2753c4e69caab76f619032e22cacfd2daa4f58d0c49e3b90e7c838333f628dae26fd8f46bd1c5046b20714bf1a40994bcc7fb103bafb113d1b56e631bb99b9380341ef94aa6e3c6288d197145afc7b5481f98591b5cbbbb05f5a6b0a8388d76c156c537d9ed27b616fec53cffe28909b7052ad1374561da713bcf79b0f858e214640f78041b11fd39b90f8b414cf48a6566374fa67d2fd4d9ea604bca80e974ecae833b48d38814afc3d5a1481cbd2dd708e3fb4f9dcfea7fde564b7bbec8a7aa0d82956c470fc95c252b73d92581f61ce5d46ea8325439ad5e5615ace2913b25bfd5cdd2890f58f609863f8fa9a8b87e426097f5d4d8f63bbc9a1284dff4b1dfee6cce45f2ed2c74169e0b9345cda81e9e80b670b82bb2f6f51b613c8de3d2077273703ffb49140f02ab6ba3e5f61ec34123856af9b3ec3170c574bac8d133bcdffa0c47c47beef5f4eacf2af32d329b6ed4ac0d1641a4206bd654f8e6954ca380224648944c4905cbc9ffac148919a15540b916b8c89846dab5a6323ec1fde373558294efd63cb7b51eb522986de2b1c7697bd5efe66c3ded04411c90f1bfa35bdf005837de7a31c6da00452d484b98a85d128591db0207e5201f6ddcdb75998997d7aa036a1391c385a79f436d2dff257ea65094ab614e250e624b25ac7e24946219f97498fb2109c26088e81f9b5cdbd1db1677a80519a4055d377f2747793b68e5bada78e888723ea3f9976e7d43aa2fd378f27a98691da0fe6bef2bf38051657fdfb9c809e350d1c537c2d3f45e107020dd3b9e6bef73ae5bff078a65e5f70e501721be31755513ec205dc66f80e458f93907aac0e7fec994441ed0efa8d8bd3d77b98d38be249af91ec7b96ff1990e2f8f2b4d5bc6894ffcf5d4ee6b887a49ac8adcbc34b9b726a74b3cd27ec5de8490324603a7f226193a6ebd2cee17cfc1b421b8b60ff9565e49f1e4453ade3cb5fb5c14f3e370d8778238d3a309a25edf3600ac48f200cd212002f6e5937bc45bce1d0cdddb4e613d36a0f82581920e9e83c26291e51b5eb050af40b012e55ce40996284971e582558de1715d0b49e01719ae9f8c57c9ee454e7af5acfe4f5d37b8828ac4f7c6dfbdba61c23f198bc63f9c1a87bcd6be95917924ece547d954bf0eb233f375673a667ea8c8fef9b433de42a9ec93957476b33d04a7bf08a8468e0324ef17faee106798cb150fa65eecb39eec27331fd6850a5dd911c6ee8e288f2df6a26b832dd985d686029ac0e164094d2ad83f5d5e71f4f3e2ebf3b2acabffb3a53ec8eea47e2ce06f1d6f8e5dc0ebcc55ad35f99cdcf6432e9cf0c75ceb7bceca635dd77ad0aa56308631e9ba0083fd8fa95ef8af39d72397c2ec455ee217f6efc9458eccb573545ec3f4c906d047efbef34895916d165fce0ddad649fc8a7472a8cecfd21f9fcce0a1ff546dc55d3d4075a37a38bf829aba29bcf5b3a7f29cab89a1933ce90eb32a566b4688e735e1bbed9d56bb4b865dfdcfef3e3e0a6d9030c6e90afcccf8dd9fd06b0adc3b6db9834a2f147f2a9aee66c7635ad4850ef4ba52f1ac397ad4ebbc2cef3944112b49dd9cd8a06d2cb4602f3a9352508ec02c9166c09d3d7684754d04044640f4a86ee7bfab4fd4ff9ebd9959f6f8d05285e689c9442fd10ccdf4fa6c51d8aabbfb17d5646f3e43b86a4d3e368cef73b6b924d3ff6d1cf765703a61fe8c98a01a29f387589b1bfb14c9c91ee9f62282c82f1328dd052481fe36ccf8852e75bfa88fa2d2acfdfe46f35cbf903042b9a88a617936c29a3abbaaa8851cfbfbf1a60ab0ab2c28b8c725316991b126dbdd9122c0b95233581453af42bb6e5e335f5393def249f37ba1605e0910aa10e9e60ae3b652ee99c9ecb7f88226552351824ddd8d2ff2c2ab0468ad1da71e50e25166c14404e2cc", "d4b77b60c4d2ad3aeb9fbc9446a9bb9b7fc84ee0692b3f967bc9add4a2949e7f2be715226f531e198f2adab34d3d7e32cff0a861334cdd9b00035aa2da3413893b7d46859752ab2caf942fd31d5eb8a5844ad19cba75f91f39bf2007ed5e5d4eaa5036624ddcebdc2754a64c061e43a201c34a4c28ed1ac02f482096f3dbc8f481eb4fccb8aad7868b165aeb683a639676f218b8eb37db21bf5c34e09a9aa27c72d3ccdc00bf9f799356b6266bbb3617b1eed6210dc358dd22d97b0e8aff3297d0879a18e20f95de14205063b02c074d2ad3d97d5ba392416a89cdbb8e824857d4b268d49ed9efb751d37546362e5a5ace58503430fa9b7ed75100d8c1917e24087afd491ea55016c3ff85798647f4d4196e72a41db986542d874b4635dae5a4aa33f3a44cafb327cb5d859a71f850ea0688e4e512ad922886205ba19c57394b2bac8f78cd3d281908b986a5d1efb33e242ae40ee9f227313ba34e81c4ca9833796f06fe8bf3ba0a4a829cbddf8ecb8a020b8071f5a02c799c54e50c0ca35cba2677104e506f2d0f699e2fdf4243b0c7933e85a9c2b17a290c729f2330980c70636bed8509c4e2961dd6319850d9dd5be7bf120368f0335533b82ab69388b29c88ec4fd4ada56372071561d3aaa6fb47609aa6830e04925d0e27482d69d5ae0683f6cb5eabd0633ad10d5c7ab98cc83bb49343981658827a18ca0a37e071ea050253754c3022a0a62f837e299088b7af8d992b2425fb3673d77d51b9d29a9aa416d4ddd0d87c0d1a3220d13fc2d73a43aebadd048d32ba97dd1e4b1f635eaf496c2ddd073695fb70b5b6131d4da1c0e768d2cae05b1ea4ea5e0d9c5261e68687f59f8aa8e1962d12d0f838952a7f6517fcc7507029cb8a35d4f7573f517d0df671182eefc514b9bca47707324a8ad62baaced8439a2e0a2d12c4400a1455cdeb45dac41cfc6edd2abe3b45bc81e93d90ba3507a7fa03e31b553dde1ff7ae2888ab1e225fdf53cd5baad90430d5d72ab45fd23878c1c86693ba28ab55af729b7d33b0665e2de68b1d746813b168cc6b24f89cafb69686f1229605edf7155c093b0f816f4358b6d115d1cff175f217889cf3d874820f88ffc27faa910929c320873727b20d33bada4b9327e101e5d9e7c477f05138746abe78a400dc5fc20a2f0ff6168f7bdd7de90c6b5264814ebeb87da1bd610e01d113d2c2b68ed4aecbc5c861661ce985ab3568e9e387229955bb9ff66744a76267eb5a9a1c3e6d6f1024104aef6c9c1fddf256925992c837a168147e56fe419d573c40ddff18a48a83d501d83a47a680c34813e7986912fac893f11529e8ad0e239f18cd0cbc0a86191cb7ffc133939ab50d2d9ef2fabdadc3392b932b8f18ff0ccd69af8fe611d43191502b702089e7eed7cf31ea07ed985f3a2ebcb8592910a80f9790138c4349743ccf8fe521b87a781d0ef9c89e3ed0f3b7f1fb2184d8338c0c05cefb8684fda5b4118843ad222773fb07d7e17e3caf240a8022deabc011c518e873db554ad793df6bbb434efd08d7a48f85007a95eb8b46e4a239afa5d45ff802d7758a45f338c3bad116099130a178435540df1f5d667b52628d8a41e5bc1e0ce63b9d59bc34f9d174d3381d236f821e7a6b5b0045a953d3cb28f3facfda75d074de78f526e7ead4415c5d34d698c8f2f7f01d65454b6b3dd4a21aa2c525ada62183eacaf980508991a0d2c9443c36701006a2e68aec31187e50315d5e25eae225f5314c3bbab9ab43c21b542cb9c871e1b7c2309bab5d3b1f04b3bbb7f21ce99472f51b43654a7f0980d45597edd2ced2d5d00e2d8705f704978c1cbb5d93724cd7e796edf87b630f1d81632c01e7b6ded22b5b5b275914e3c0bc6fea8d06b52f83362dae4aa23e31883cd9a69de38c51878dbe1742b8d8076af9e583fafa3b9573f88ff2f4c65665117c085ba675c9d2c8eb7c5d7cd4b7934598191a3064f7ede74a08e27dedb37a159abefcbf08b133c83d8233a4f871c1c60bad87e2e7261e56ca1d0b74b84ae95aa4d178b8e6e123d95fc6b4de658c92a36a5f06ea6b8aa985c4cc310a14cca4f18ca04efa8e978aa8a58420b42046f1d64734312f96d18c4f7311f6affc7c08ebec503b517b7d3cb7bd68eda4cf38014103b8ac69faa571fa5b4db471ad357566ab347e00050382fd84efe4d75760a8f12ee3793606a0da8edf5627493e05b8382a27d1c98b32654695945926230f8f9f368170f96a9646c4e3008dec788584044aa35dc25d37a03771ce8ce9795ef68ab14d82b63473a0ddcad733541248be2922745ea008f30333b1c882a9e5c178e9eab09467ab43c4584de921128d5dfb4068bf8c15373cd86b23f92dedfe109126d6ac8415a87b8d89121416130fb4b410c314842c716c2799ecb6a851585b839900783170bbbd56ad1e53ff789936a29c359b017e2dc1cb88a52132ad5d77592e32715d6d0674d2270162b81a86951a29f36ba3b44e113ce84fb9bb4a82c7a4fbe5bb2bb021ef5bb5ade450d87910955f76da50745cf1968e60a1981faf81d88f0970592ca626866dc87d703460e9007abb721fafa617a67d756a435962bd55e996894dbbacb0279692d14f13d167d1aaf3633b386b4c4d08f57facea28978a38bf02967aacf1a99553b434d76882decbe0483a5584064970ebf75e384b17df4a45ded2f11355cbeaca9ec1fe0cf5dff94d16b17b1e8916f0b4a8117b26711eb7af524c92cb67bf0f99d243cf2b2f98ceff7c4968a2fa021b472a57cfeb171eaef5460e7e6706df1f29deab6fa8be6d00a15b1ea6398d85422a7ccfd42f2c7b3ab54fcb65761ba91590889f2061d88cf4ec2e30651f393c0faa3506b18c475b26d77b4d8ada6c6807055b2d73946c2248cd5d74119145c9bb7c61c3b5640bb300be7dc4bbff05775a5a92acadec53726430586ae7c331cf2cf2e932917b51bf48afeda2b68033661a8e6c1940d56aa8413ad1dac839e867e5ff80751e4cd3a9d562a0cc35dedc46a956a9f1591f9dfe356c3d029c7d2eee2e84378b8c3811740cae5a7f41f55f9529c713419c3d04500a7216a85d23789b617e23c5e50e9b94167abe101c12644efaf142958901ab76685b0d15a9ca6b9f30dd26bbbd2d22ba491b81337ddb42d7cdf27b7e6918a940412354e717726a3a91e8ac88913120a857b035c3c9eafde6d22b4b8e5d312b6de3f9416502a14f87cc0ebe759d30f2fe62a07144d8e1adc34f23c048166540581e3a5ba7bff7020654beaead86cf180522c0fece2fcee8f2e70e7bd95ceb06a7e99bbffcf27cca8d1c7c8d3f09244582a5d58dc5705c9658d18eaa03b826957bb3b452a1f0c7bd1bb6d349b69b0879668efd6582fcb8949d14c94f59ee2ee13220afb2142927756aa74aefc8a1dbf72d07a5c56aa8c3049cb7acf56bec75398c307fce0a25589cdc0a930b6da35992ede693bfd2540e4b0f2e32cd36964ce0468879b6f77b69606d437a9d2cbd218be3366af288c19b7400f2e512fd243f0ced9b9256d6b88425b3c3c551b3c980f7f48620f545fb6c3d540430a9aa95861119f56e62b1e25300ee9b7b3cc7b5ce50e31d3646d4306a615e209f528da1ccc8c0fedfead9e6d3e4c80b797b90332d84ee4e6549da0fc5d7212f33691d55443c18a77edea507bd542a1c64de50098967415c386624730d25df1ea41bada0e2b0396fd405f3e5aa98a50206945c8f0081bc522f02dd7c5d2fc5211101bd4b072ac233ec71761441814f1a768d04befae2e2f09e746e132e9fd0c539f69cb4f54d5b5d5f0fad2dd992308ea0de86e63e35823b1d21848b59bfb76a76ac4b420d02d428b86e880c3c76300faea8eb8269f6b5a82846ecd557b00ac3ed6bf64c5b1fc04f746c8e05f089a2852a719e3635b4199bf51198cc171a4e7ad707edf1cdd002679dc8536974089ed228f58eb8311b2794b47e7fc446a2fadfdd11c6c96145b83f2b4cf09e9c09923c465b10bbc38612dc801367b528aab1bb86f7e4a8dd6ec511a24c604d79006809dbbbfb4e75ec93c9dd42a88f05a4275668f23b8134f74b3a9e9d69c6c295f2eedc1ab9de93e113dae018ded4926de7c9c34eaac1d058a0f7aed7c2d57e638483cfbf888c630d4d8232baa145fc34695e954feaf0c5a1cb7eb09a66ebdebcbb4c527800c0fa77f330eb257f09c33263be39a496ac7cbae9368dbe114c4874768bb42d4853bc7490d28d3a6b40a0da8afa5e08971a649c16655a3c6f144ac25754b2b60cd14488266615de1551098c414e7a965e136fc1e49869ff37f069f424e28545aa4784bbb796276f1c61b48336d1a05f8cdb9877a3a14babf9e824b3e6747c0acfe754457b2331b30e8b129dfc774e447f50c7b021a53357cbecdadb6e770c3ac165a0d2f4e507e848cd8bcd0599b3865182608fe2012b8f24fb8ff33fa39330a809d11815818173ced32721b592416abc85a654dff2c4b9feb1b95b7861445382d846bfa6054089e688ac9f93b8eded14ccc87bb5cb61d7c15f9a2750cd3ce558735706fe04e4d50d7411bedb60680019e37134e6c736de0b2aa1693569529533972e380d18396b3a6e7c0e96878d7178507e7fa77d44044eadc1f0f4008763c691fd478db4d9c8509eb31a87904b4e6b011f9fe68675c20befe33a1be12d007c9c48f2fc02baee8a90b0205f9b8fd188b84a59e36f04af7c58d7e592e5798ce1f6d14e1fcbe7378150982e76d3e072562a061595ef8fbfb9fe15b52226e9ec7bb404e14c17b7cb23e3062956467efa2b8f36a23991ad5a52bcd529a02d8e413f829d87249680ab536a9d8ad21cb459f9094f8a5740ce71116addb95dfced52257f0cb9305f062c6e275c6b16ff5829fb5f460bd14952a1d65f8815a96e73e93c8ab95c44920e0967c703c17eb9c077678d6ba2419ca24e9bd00903acb87b21deadc4850fc6e014b39d978932f8b8fd5703efce30bceffb40b9d20092654715fddc5ecb01d937e64a4be12a4e8a5071548b32c8c53d4f40b42e5b6f67da094c0f657912d0d1acf5cccf2147f85485c4adf95732288ac1cc3ad30526ac13c9d824442cdb2b71aa70ef1c3262dff1ed10a64692e8b37a08574bcc12ef832989ec449ab22d7baacda510c38b56049dbc4700eb75e97ab616eebc8dd72b0bdc8b2942b04bed386001c9bc063f0bfb418c1a1dd8fa41286f417994771e83fe4e2683414d4fcaad88f4dcfd2407d931ac416ca2ed302e5e63b7d1184903cbe223391a8e9c313bf1d8319a6f612d8dae5df5c56b9c199c5e70213205f7ba426511e9688139a58024c20f7022c3f1bf96ee2237a78501a378d380dfc66cf910ea774c3ad69dc396d37045d683ec5965b880535be2c658139763b1f945e47332f88b6fa8e5ab9230cda9135db4c5ec36cfd0da222f819a5fda07b0b71f6e3857b14beab95bdb32644a62f5fb3bb6e29bae39854128a2c4d4586f75f91db10d27636655b3a2a38d1f9d8d4358f6fee79a80cf77f4ee633a98b3f16dd895f4fda738329e39e449dd72eb34a4a17f6cae36c69bad13e28c092e5d3d0f7d2294ecd2f075cd6e11ef26190c10a7c2ca2da69457dfc17dae4763e4b93d47aeda13da2aff1a99bc21a6cf7c45152fdab41f725912611e65aac43e6bcc9e338356448bcebb3d9f344809243e32de1c759da2818d5f196be272d0c4fcc1f23421dbff7c4fbc834048b6b43e32037e00ee0623d8100f43a0489a1ca994df25121c350c0102d42c6990e59b239da6a56c18c149a6f1ebb802d736504dd3"}) 10:10:30 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1153.191037] binder: send failed reply for transaction 3796 to 11619:11625 10:10:30 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x8, 0x2) creat(&(0x7f00000001c0)='./file0\x00', 0x11) syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x1, 0x2) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x4}) socket$inet(0x10, 0x2, 0x2) sendmsg(r1, &(0x7f0000000180)={0x0, 0x2c7, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1, 0x0, 0xfffffffffffffedd}, 0x0) [ 1153.249232] binder_alloc: binder_alloc_mmap_handler: 11619 20001000-20004000 already mapped failed -16 [ 1153.322134] binder: BINDER_SET_CONTEXT_MGR already set [ 1153.355746] binder: 11619:11625 ioctl 40046207 0 returned -16 [ 1153.391138] binder: undelivered TRANSACTION_COMPLETE [ 1153.396297] binder: undelivered TRANSACTION_ERROR: 29189 10:10:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x6800000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:30 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xba02}], 0x18}], 0x49249249249276c, 0x0) 10:10:30 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:30 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000100)=0xc) r3 = syz_open_dev$cec(&(0x7f0000000400)='/dev/cec#\x00', 0x0, 0x2) r4 = openat$cgroup_ro(r3, &(0x7f0000000180)='memory.current\x00', 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000200)={r4, r0, 0x8931}) ioctl$KDGKBMETA(r4, 0x4b62, &(0x7f0000000440)) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r5 = socket$inet(0x10, 0x2, 0xc) getrlimit(0xe, &(0x7f0000000240)) setsockopt$IP_VS_SO_SET_EDITDEST(r5, 0x0, 0x489, &(0x7f0000000280)={{0x32, @local, 0x4e22, 0x0, 'wrr\x00', 0x1, 0x1, 0x30}, {@broadcast, 0x4e22, 0x4, 0x2, 0x100000001, 0x6d1}}, 0x44) sendmsg(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f0000000300)=@assoc_id=0x0, &(0x7f0000000340)=0x4) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000380)={r6, 0x2}, &(0x7f00000003c0)=0x8) [ 1153.542320] binder: 11662:11667 ERROR: BC_REGISTER_LOOPER called without request [ 1153.571062] binder: release 11662:11667 transaction 3798 in, still active 10:10:30 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000fff000/0x1000)=nil) shmat(r1, &(0x7f0000ffe000/0x2000)=nil, 0x6000) socket$inet(0x10, 0x2, 0xc) sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000), 0x10000052}, 0x0) 10:10:30 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xe402}], 0x18}], 0x49249249249276c, 0x0) [ 1153.588095] binder: send failed reply for transaction 3798 to 11662:11667 [ 1153.600211] binder_alloc: binder_alloc_mmap_handler: 11662 20001000-20004000 already mapped failed -16 [ 1153.611146] binder: BINDER_SET_CONTEXT_MGR already set [ 1153.618011] binder: 11662:11667 ioctl 40046207 0 returned -16 10:10:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x6c00000000000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1153.668533] binder: undelivered TRANSACTION_COMPLETE [ 1153.674403] binder: undelivered TRANSACTION_ERROR: 29189 [ 1153.781138] binder: 11688:11689 ERROR: BC_REGISTER_LOOPER called without request [ 1153.792019] binder: release 11688:11689 transaction 3800 in, still active [ 1153.799919] binder: send failed reply for transaction 3800 to 11688:11689 [ 1153.819428] binder_alloc: binder_alloc_mmap_handler: 11688 20001000-20004000 already mapped failed -16 [ 1153.829845] binder: BINDER_SET_CONTEXT_MGR already set [ 1153.837119] binder: 11688:11689 ioctl 40046207 0 returned -16 [ 1153.880798] binder: undelivered TRANSACTION_COMPLETE [ 1153.885941] binder: undelivered TRANSACTION_ERROR: 29189 10:10:32 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x730000000000) 10:10:32 executing program 5: r0 = socket$inet6(0xa, 0x400803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") gettid() pwrite64(r0, &(0x7f0000000000)="d0fc5f774d6f0da21066f547e385097b7ed7fe845716c21119e3b16ded1e240fb5db4c8b84766841", 0x28, 0x0) r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:32 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x9202}], 0x18}], 0x49249249249276c, 0x0) 10:10:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x4c00, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:32 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:32 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1156.164575] __nla_parse: 5 callbacks suppressed [ 1156.164585] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1156.202472] binder: 11699:11704 ERROR: BC_REGISTER_LOOPER called without request 10:10:33 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x100000000, 0x40) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f0000000300)={'nat\x00', 0x0, 0x4, 0xd8, [], 0x3, &(0x7f0000000040)=[{}, {}, {}], &(0x7f0000000200)=""/216}, &(0x7f0000000100)=0x78) ioctl(r0, 0x5, &(0x7f00000009c0)="0a419c45bb097c285ca104da2a313a12e572c319e6549ff39d6938d3ac8e20311a9a564d96ccaaf463912084b3ca0b942482d2626701a988d470108e33123604ee2108820889c67057abf1ae6d0a6ede153bb0890f9197bee496870aab464dd78f1b93a71050ba86822ffbfba808b67f4e9a2811a8496bbdbdc17787159c66bde80bf2da967bfefb60ea4e6bc618a402be9190adb68a68379de33cd261c625ea32707f9fbfdee83c75a6ef") socket$inet(0x10, 0x2, 0xc) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100000085680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0xffffffffffffff27}], 0x1, 0x0, 0x25b}, 0x0) write$binfmt_aout(r1, &(0x7f0000000380)={{0x1cf, 0x4, 0x80000000000000, 0x1cc, 0xa0, 0x80, 0x73, 0x9}, "d3a9f41f7840850d768811087b3f0f9ded0c2e7f6cbe9f4c5e568928359dd1c7c201c6275d4a4dcc2236e352f022e3e29250fad646ca8b032d0e09c3d2fc8495206234cef4af5fc4ec2615bd3022e05e6488b836072e8865096107b328845e8b05277fb77409ea710da18db50a7c5554c41763dae6e07b412c1f82526a0c830def6bc548c6fefbbe0e5e2ba41bad687235da9125d610aeffd6952c2d63a8194e9685b7b0fd", [[], [], []]}, 0x3c5) [ 1156.231657] binder: release 11699:11704 transaction 3802 in, still active [ 1156.245361] binder: send failed reply for transaction 3802 to 11699:11704 [ 1156.255253] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1156.256133] binder_alloc: binder_alloc_mmap_handler: 11699 20001000-20004000 already mapped failed -16 [ 1156.274384] binder: BINDER_SET_CONTEXT_MGR already set 10:10:33 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xb502}], 0x18}], 0x49249249249276c, 0x0) [ 1156.288399] binder: 11699:11704 ioctl 40046207 0 returned -16 [ 1156.303131] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:10:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x7a, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1156.335769] binder: undelivered TRANSACTION_COMPLETE [ 1156.350124] binder: undelivered TRANSACTION_ERROR: 29189 10:10:33 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:33 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2903}], 0x18}], 0x49249249249276c, 0x0) 10:10:33 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x2) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1156.456034] binder: 11731:11735 ERROR: BC_REGISTER_LOOPER called without request [ 1156.488118] binder: release 11731:11735 transaction 3804 in, still active [ 1156.516410] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1156.530776] binder: send failed reply for transaction 3804 to 11731:11735 [ 1156.535702] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1156.547345] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1156.561520] binder_alloc: binder_alloc_mmap_handler: 11731 20001000-20004000 already mapped failed -16 [ 1156.598944] binder: BINDER_SET_CONTEXT_MGR already set [ 1156.618590] binder: 11731:11735 ioctl 40046207 0 returned -16 [ 1156.669104] binder: undelivered TRANSACTION_COMPLETE [ 1156.674336] binder: undelivered TRANSACTION_ERROR: 29189 10:10:36 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:36 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3c02}], 0x18}], 0x49249249249276c, 0x0) 10:10:36 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x200, 0x0) ioctl$UI_DEV_DESTROY(r2, 0x5502) 10:10:36 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x100000000000000) 10:10:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x700, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:36 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6400000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1159.268819] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1159.272001] binder: 11757:11759 ERROR: BC_REGISTER_LOOPER called without request [ 1159.300363] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1159.309156] binder: release 11757:11759 transaction 3806 in, still active 10:10:36 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x8302}], 0x18}], 0x49249249249276c, 0x0) 10:10:36 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = dup3(r0, r0, 0x80000) ioctl$VHOST_GET_FEATURES(r1, 0x8008af00, &(0x7f0000000000)) r2 = socket$inet(0x10, 0x80000, 0x4) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:36 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1159.316101] binder: send failed reply for transaction 3806 to 11757:11759 [ 1159.324721] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1159.338824] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1159.351956] binder_alloc: binder_alloc_mmap_handler: 11757 20001000-20004000 already mapped failed -16 [ 1159.362017] binder: BINDER_SET_CONTEXT_MGR already set [ 1159.438422] binder: 11757:11759 ioctl 40046207 0 returned -16 10:10:36 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000040)=0x4) 10:10:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0xffffff7f, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1159.483218] binder: undelivered TRANSACTION_COMPLETE [ 1159.489415] binder: undelivered TRANSACTION_ERROR: 29189 10:10:36 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x6e02}], 0x18}], 0x49249249249276c, 0x0) 10:10:36 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1159.566320] binder: 11794:11797 ERROR: BC_REGISTER_LOOPER called without request 10:10:36 executing program 5: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x400000, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x20000, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x8a20a0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000='version=9p2000'}, {@cachetag={'cachetag', 0x3d, ']'}}, {@dfltgid={'dfltgid', 0x3d, r2}}], [{@audit='audit'}]}}) r3 = socket$inet6(0xa, 0x803, 0x6) ioctl(r3, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r4 = socket$inet(0x10, 0x2, 0xc) sendmsg(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:36 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2403}], 0x18}], 0x49249249249276c, 0x0) [ 1159.648106] binder_alloc: binder_alloc_mmap_handler: 11794 20001000-20004000 already mapped failed -16 [ 1159.663577] binder: BINDER_SET_CONTEXT_MGR already set [ 1159.670600] binder: 11794:11797 ioctl 40046207 0 returned -16 [ 1159.752557] binder: release 11794:11797 transaction 3808 in, still active [ 1159.761826] binder: send failed reply for transaction 3808 to 11794:11797 [ 1159.808008] binder: undelivered TRANSACTION_COMPLETE [ 1159.824804] binder: undelivered TRANSACTION_ERROR: 29189 10:10:39 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x202, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x38, r3, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8001}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7ff}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x4044080) 10:10:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x68000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:39 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x5b03}], 0x18}], 0x49249249249276c, 0x0) 10:10:39 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x9300) 10:10:39 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:39 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb02000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1162.326069] binder: 11826:11830 ERROR: BC_REGISTER_LOOPER called without request [ 1162.330765] __nla_parse: 7 callbacks suppressed [ 1162.330775] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1162.342398] binder: release 11826:11830 transaction 3810 in, still active [ 1162.354205] binder: send failed reply for transaction 3810 to 11826:11830 [ 1162.357623] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1162.373582] binder_alloc: binder_alloc_mmap_handler: 11826 20001000-20004000 already mapped failed -16 [ 1162.389226] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:10:39 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x7903}], 0x18}], 0x49249249249276c, 0x0) [ 1162.418523] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1162.427351] binder: BINDER_SET_CONTEXT_MGR already set [ 1162.436548] binder: 11826:11830 ioctl 40046207 0 returned -16 10:10:39 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:39 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f00000016c0)={0x7fff, {{0x2, 0x4e24, @loopback}}, 0x0, 0x5, [{{0x2, 0x4e21}}, {{0x2, 0x4e23, @loopback}}, {{0x2, 0x4e23, @multicast1}}, {{0x2, 0x4e23, @multicast1}}, {{0x2, 0x4e24, @loopback}}]}, 0x310) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x200803, 0x0) ioctl$DRM_IOCTL_MAP_BUFS(r2, 0xc0186419, &(0x7f0000001680)={0x9, &(0x7f0000000040)=""/179, &(0x7f0000001580)=[{0x80000000, 0x85, 0xbf3, &(0x7f0000000180)=""/133}, {0x1, 0x10, 0x2, &(0x7f0000000100)=""/16}, {0x6, 0x1000, 0x0, &(0x7f0000000240)=""/4096}, {0x0, 0x44, 0x6df7, &(0x7f0000001240)=""/68}, {0x404000000000, 0x8e, 0x7, &(0x7f00000012c0)=""/142}, {0x0, 0x32, 0x70, &(0x7f0000001380)=""/50}, {0x2, 0xa, 0x20, &(0x7f00000013c0)=""/10}, {0x7, 0xac, 0x527, &(0x7f0000001400)=""/172}, {0xfffffffffffffffa, 0x9b, 0x9, &(0x7f00000014c0)=""/155}]}) 10:10:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x6000000, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1162.519224] binder: undelivered TRANSACTION_COMPLETE [ 1162.533072] binder: undelivered TRANSACTION_ERROR: 29189 10:10:39 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xc502}], 0x18}], 0x49249249249276c, 0x0) 10:10:39 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x4, 0x14102) getsockopt$inet_dccp_buf(r1, 0x21, 0xcf, &(0x7f0000000040)=""/47, &(0x7f0000000100)=0x2f) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000180)={0x14, 0x0, 0x101}) 10:10:39 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1162.636269] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1162.653959] binder: 11863:11866 ERROR: BC_REGISTER_LOOPER called without request [ 1162.656627] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:10:39 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xdb00}], 0x18}], 0x49249249249276c, 0x0) [ 1162.722551] binder_alloc: binder_alloc_mmap_handler: 11863 20001000-20004000 already mapped failed -16 [ 1162.758829] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:10:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x4048634b, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1162.819217] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1162.829691] binder: release 11863:11866 transaction 3812 in, still active [ 1162.837071] binder: send failed reply for transaction 3812 to 11863:11866 [ 1162.847610] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1162.858907] binder: undelivered TRANSACTION_COMPLETE [ 1162.902531] binder: undelivered TRANSACTION_ERROR: 29189 [ 1162.910294] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1162.916173] binder: 11885:11889 ERROR: BC_REGISTER_LOOPER called without request [ 1162.949079] binder: release 11885:11889 transaction 3814 in, still active [ 1162.965250] binder: send failed reply for transaction 3814 to 11885:11889 [ 1162.980008] binder_alloc: binder_alloc_mmap_handler: 11885 20001000-20004000 already mapped failed -16 [ 1162.992933] binder: BINDER_SET_CONTEXT_MGR already set [ 1162.998686] binder: 11885:11889 ioctl 40046207 0 returned -16 [ 1163.040655] binder: undelivered TRANSACTION_COMPLETE [ 1163.046106] binder: undelivered TRANSACTION_ERROR: 29189 10:10:42 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x930000) 10:10:42 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xcf02}], 0x18}], 0x49249249249276c, 0x0) 10:10:42 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) r2 = open(&(0x7f0000000340)='./file0\x00', 0x0, 0x8) faccessat(r2, &(0x7f0000000380)='./file0\x00', 0x4, 0xf00) get_robust_list(r1, &(0x7f0000000240)=&(0x7f0000000200)={&(0x7f0000000100)={&(0x7f0000000040)}, 0x0, &(0x7f0000000180)}, &(0x7f0000000280)=0x18) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r3 = socket$inet(0x10, 0x2, 0x9) setsockopt$IPT_SO_SET_ADD_COUNTERS(r3, 0x0, 0x41, &(0x7f00000002c0)={'raw\x00', 0x3, [{}, {}, {}]}, 0x58) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:42 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:42 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:42 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x7d01}], 0x18}], 0x49249249249276c, 0x0) [ 1165.456622] binder: 11899:11902 ERROR: BC_REGISTER_LOOPER called without request [ 1165.482805] binder: release 11899:11902 transaction 3816 in, still active [ 1165.492297] binder: send failed reply for transaction 3816 to 11899:11902 10:10:42 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000000)='veth0_to_bond\x00') ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) r1 = socket$inet(0x10, 0x2, 0x5000000000000000) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1165.505721] binder_alloc: binder_alloc_mmap_handler: 11899 20001000-20004000 already mapped failed -16 [ 1165.515996] binder: BINDER_SET_CONTEXT_MGR already set [ 1165.523724] binder: 11899:11902 ioctl 40046207 0 returned -16 [ 1165.537351] binder_alloc: 11899: binder_alloc_buf, no vma [ 1165.543849] binder: 11899:11911 transaction failed 29189/-3, size 0-0 line 2973 10:10:42 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2102}], 0x18}], 0x49249249249276c, 0x0) 10:10:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:42 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) socket$inet(0x2, 0x800, 0x3ff) [ 1165.620093] binder: undelivered TRANSACTION_ERROR: 29189 [ 1165.626428] binder: undelivered TRANSACTION_COMPLETE [ 1165.640606] binder: undelivered TRANSACTION_ERROR: 29189 [ 1165.722243] binder: 11930:11932 ERROR: BC_REGISTER_LOOPER called without request [ 1165.762249] binder: release 11930:11932 transaction 3819 in, still active 10:10:42 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x5001}], 0x18}], 0x49249249249276c, 0x0) [ 1165.786659] binder: send failed reply for transaction 3819 to 11930:11932 [ 1165.806886] binder_alloc: binder_alloc_mmap_handler: 11930 20001000-20004000 already mapped failed -16 [ 1165.818824] binder: BINDER_SET_CONTEXT_MGR already set [ 1165.848762] binder: 11930:11939 ioctl 40046207 0 returned -16 [ 1165.914986] binder: undelivered TRANSACTION_COMPLETE [ 1165.920773] binder: undelivered TRANSACTION_ERROR: 29189 10:10:45 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x507000) 10:10:45 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000000200)=""/4096, &(0x7f0000000000)=0x1000) r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) readv(r1, &(0x7f0000001780)=[{&(0x7f0000000040)=""/31, 0x1f}, {&(0x7f0000001200)=""/221, 0xdd}, {&(0x7f0000000100)=""/20, 0x14}, {&(0x7f0000000180)=""/46, 0x2e}, {&(0x7f0000001300)=""/172, 0xac}, {&(0x7f00000013c0)=""/218, 0xda}, {&(0x7f00000014c0)=""/208, 0xd0}, {&(0x7f00000015c0)=""/203, 0xcb}, {&(0x7f00000016c0)=""/137, 0x89}], 0x9) 10:10:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:45 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xa400}], 0x18}], 0x49249249249276c, 0x0) 10:10:45 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000100)=r0, 0x4) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(r0, 0x8188aea6, 0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180)='/dev/uinput\x00', 0x0, 0x0) 10:10:45 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:45 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x9b03}], 0x18}], 0x49249249249276c, 0x0) [ 1168.550449] __nla_parse: 4 callbacks suppressed [ 1168.550459] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1168.571617] binder: 11955:11963 ERROR: BC_REGISTER_LOOPER called without request [ 1168.577345] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1168.585534] binder: release 11955:11963 transaction 3821 in, still active 10:10:45 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x600000, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000002c0)=0x6b37) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = socket$inet(0x10, 0x8, 0x3) ioctl$FIGETBSZ(r2, 0x2, &(0x7f0000000300)) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) recvfrom$inet(r2, &(0x7f0000000000)=""/5, 0x5, 0x20, &(0x7f0000000040)={0x2, 0x4e22}, 0x10) getsockopt$inet_buf(r2, 0x0, 0x4, &(0x7f0000000200)=""/174, &(0x7f0000000100)=0xae) [ 1168.602594] binder: send failed reply for transaction 3821 to 11955:11963 [ 1168.622430] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1168.630285] binder_alloc: binder_alloc_mmap_handler: 11955 20001000-20004000 already mapped failed -16 10:10:45 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0xfeffffff00000000) [ 1168.658318] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1168.663916] binder: BINDER_SET_CONTEXT_MGR already set [ 1168.708730] binder: 11955:11963 ioctl 40046207 0 returned -16 10:10:45 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:45 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xac02}], 0x18}], 0x49249249249276c, 0x0) 10:10:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1168.829765] binder: undelivered TRANSACTION_COMPLETE [ 1168.835139] binder: undelivered TRANSACTION_ERROR: 29189 10:10:45 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xe400}], 0x18}], 0x49249249249276c, 0x0) 10:10:45 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xffffffffffff7fff, 0x90800) write$UHID_DESTROY(r2, &(0x7f0000000040), 0x4) [ 1168.927618] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1168.940675] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:10:45 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1168.979994] binder: 12003:12005 ERROR: BC_REGISTER_LOOPER called without request [ 1169.015666] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1169.018379] binder: release 12003:12005 transaction 3823 in, still active [ 1169.049716] binder: send failed reply for transaction 3823 to 12003:12005 10:10:45 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4402}], 0x18}], 0x49249249249276c, 0x0) [ 1169.083881] binder_alloc: binder_alloc_mmap_handler: 12003 20001000-20004000 already mapped failed -16 [ 1169.095444] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1169.130839] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1169.168070] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1169.183283] binder: undelivered TRANSACTION_COMPLETE [ 1169.189075] binder: undelivered TRANSACTION_ERROR: 29189 10:10:46 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) r3 = syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x2, 0x2) ioctl$BLKGETSIZE(r3, 0x1260, &(0x7f0000000180)) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:46 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x2280, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000100)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000200)={{{@in=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@loopback}}, &(0x7f0000000180)=0xe8) write$eventfd(r1, &(0x7f0000000400)=0x1ff, 0x8) setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000300)={{{@in=@multicast2, @in=@remote, 0x4e24, 0x100000000, 0x4e22, 0x0, 0x2, 0x20, 0x0, 0x33, r2, r3}, {0x9, 0x80, 0x100000000, 0x4, 0x5, 0x4b800000, 0x9, 0x4}, {0x0, 0x38e, 0x1ff, 0x101}, 0x20, 0x6e6bb9, 0x0, 0x0, 0x1}, {{@in6=@mcast2, 0x4d5}, 0xa, @in=@local, 0x3503, 0x4, 0x3, 0x9, 0xbb, 0x8, 0x100000001}}, 0xe8) r4 = socket$inet(0x10, 0x2, 0xc) sendmsg(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:46 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1169.367632] binder: 12029:12031 ERROR: BC_REGISTER_LOOPER called without request [ 1169.381587] binder: release 12029:12031 transaction 3825 in, still active [ 1169.391347] binder: send failed reply for transaction 3825 to 12029:12031 [ 1169.419717] binder_alloc: binder_alloc_mmap_handler: 12029 20001000-20004000 already mapped failed -16 [ 1169.449031] binder: undelivered TRANSACTION_COMPLETE [ 1169.458457] binder: undelivered TRANSACTION_ERROR: 29189 10:10:48 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x8000000000000000) 10:10:48 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2703}], 0x18}], 0x49249249249276c, 0x0) 10:10:48 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x8, 0x40000) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000040)) 10:10:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:48 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:48 executing program 0: r0 = syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) ioctl$FIBMAP(r3, 0x1, &(0x7f0000000180)=0xffff) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x2000000000, &(0x7f0000000240)={0x0, 0x0}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e24, @multicast2}}, 0x3, 0x0, 0x1, 0x1, 0x8000000080}, &(0x7f0000000080)=0x98) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000340)={r5, @in={{0x2, 0x4e21, @rand_addr=0x100000000}}, 0x3, 0x39, 0x7ff, 0x9f, 0x40}, &(0x7f0000000400)=0x98) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1171.798903] binder: 12055:12063 ERROR: BC_REGISTER_LOOPER called without request [ 1171.807184] binder: release 12055:12063 transaction 3827 in, still active [ 1171.814926] binder: send failed reply for transaction 3827 to 12055:12063 [ 1171.823880] binder_alloc: binder_alloc_mmap_handler: 12055 20001000-20004000 already mapped failed -16 [ 1171.838709] binder: BINDER_SET_CONTEXT_MGR already set 10:10:48 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x5500}], 0x18}], 0x49249249249276c, 0x0) 10:10:48 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x400, 0x2) sendmsg$kcm(r1, &(0x7f0000000100)={&(0x7f0000000200)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x1, 0x2, 0x0, 0x1, {0xa, 0x4e22, 0x2}}}, 0x80, &(0x7f0000002500)=[{&(0x7f0000000040)="b294a6df3312ebea2391478a8bde2e781d6f7480f7d7377d0238844da7", 0x1d}, {&(0x7f0000000280)="21d823506e48781a68f77922fe4172e2172d7c35a78241d4f020469dadfec8fe4d7c0e9a100791ec5354a479a2c394f6615870bce6e4e21e50bca5e2de52f901019e2db567c18ede1e84704112933927f87e1ed6589c24b1078a00823389d5df8149139f0cb5e5cf32982df7f793a048e879961b531b09303a973fd8b81b4234fa0345c6177f3c85e3486cc3b6087f0805f600ca61843f10d0eddea0469475", 0x9f}, {&(0x7f0000000340)="74699024e63941ce3ad1c462d113e54593834f8a64075648fbc3cdf10d68559018e39e359c89dddfed42e9c047569524c4f785435f3f4f4d6cd366a04d3c159f226677b1fd38ac1de0f8638db75d72a3a7fef532a35ca5ed3f3d918fd0a2642a922d6f8752a8fa4b3aaf85ed765c2c619ee8f774a3c87b496afe39f1c9a933eb9232b810f57caa4082e66462ab69a01f4dd166ad1345c25dcb2777ec8ad6bd27f26e0f83167e57d203b1ddb8390cc441cff4ffe6c00ec13bc68de63d9a59476fa62ca92046d86ec2c4dad7ecfaf8a8270d529f4aa76fc630fa89695d3a98a1f2557729c3dea007ad556504215222ec7d777aa1549e13412fbb024f81f9f3a44731ec98d6c29c65c04eda9612d9636921c0f1a0d4e401c854240e41cc91bafec673712daab7455066f071e81573ddee03597f85a60c55109e2fc56653b9ec4cb7f44511b5d0effb1fb4ea24aeacbb5d84b73bc576fd2f9db23cf5bebb3bdfb384dc55c2bd1138ff12dc38bfceca82d814e77153738c6a6964802f515162ca7c99030cc7147cbacb6ee3caf40c754db49887aa635e204a8ec4976f3c7c805efd47fe80e3519836d60ae85606a665a84531a7ea45470019b7dc1fab9a62585be5e7923d3d770128053b5ec4ce591fb286c3a54eaeeaf537f8b55f71d8a0ea4775b6c21d5a3036fac36aaa9d4dfe539bf012af3b5b0ce22f5cad8f34b7fd2254c11932de3c3032bd97b271ce9588a8f171c31e8a89bc87ca27654282636cf15aad7cc0cca686a41799f54b1ba1e2157a3395e2c68d37dbf2dd8f3ea98d2a496ee033ca71fec12bf09d7d62e5cde55bbfe34d8256ca50c5a1ddd9c0fa7f99f8a684d1ee475fabb03ffdd88301578fcf202446082bdf27c46880fad6a92acc371f13f1f786a7f0fd694a57a769ef98a8f7ef4091894f2654cb0737424a6b42488becd6ffff5b6196cc676ebdfafcf4daf301a446f4b387ad3d2316487ae6d748cad2d85f177198f0fa65f28ba59911bf85bc83cf89b2e0407c72703a97b69802539e19f65d5ea4679f777b9bc4d484098a66c28828ca6d75f9588e92218ad7d410c3e380bebf728b39015f5e6decf00ae696900d31c5fc3ef4f95d3f570b30e1f06118efc8aacf95f58ceb401a6e5d649a82bacf5f164ef56b47947fb478dc7ab76c890d0b8a6bd7e39f33f443cae04d36eb58ae6bc59dd46d1f5980b166c7d9ff07143a1a2c8ced2a612cb3570c58fd62c845c38f1c44ad799322e6c4cee949cee698b736d5976c15ce716cbebf9eaa25236c707c2cb3450e08791d0dbca985f5aee386a23e20164febbb2166f817fda50fa412c4765990347ea4647bb637d38d77defa08b1c4bfad4fff4f0749b15a21deba49b38afd02595ee521ddf6fbdc3c1fc090969d2e9a0beb553b2ea32ce5b7eb25c35abc7eeef6640eead74054e307d264436b7a62a34c0341e599c7f07f1a426bcdc505bf8b4215210bf9d0454cefce28ce4aa9c625442f57220eb12be368b406669eb3a0078eabeb5d19bb58a5d95044d72a904d49b8d5f132ccb3cc786bc91bc469186c9a34902f67ac41ec340e4f1d36ea9bf75b6b1f9028153a0fb84ac3259ec3d6b457148fa4ae17c3feb2abdf88116a15c15c476ede3d88a6e3637c64c85e446db0894aa50d1af9e8090c8b59eddd6f3e57a4e38b6b5eeaf318686842303951f303c2f328abb6a000f1be8277fdeb727026988e0d01a5bc0a8657f8d48009da2f762c40a725a979d480d06d12d640f0a388674db1064f11769ff2cb7db049e0bdf1f9a2432da0a670ecb7d28deb241fbb534a56642109e7cb1b47e4ac1859f6f227a0c6624bbbcb700fba52f2a2823e5ef5baf034a1c6a40b90ca09729eb1802be94397b469efd9a6b47e8182ab63c4431a407e0946b0319dc5e30b9bd96da2970547a1466813bda487dc3b4e49da84dca3a69c94ee9c549d4bd3ca9f5d4efce6daec54c95fe833461c001963b3ed49936baae300d0bf1c7527983565afe828b80a2ca4dbee93b664219acf0671d4e9b04593287d9950e5da363ff7e40759a30d12c5c33d0c1dc5b1cc186f7d7d4a66dee02e2420db02c3f9fd5486c83b8c08b71d9f2bb0f3c673a553543e908bb6df719c8bfbb114e368177fa5f4da82526ca4e99670c6ce130cbafb94a0af04538701d441e45e659499bd6e91c6769faf9a794b87c9fac89cc01e9fa8bfc3a6210abbb1d4efc6b252047ccb30980c3c550d3c614f19d6567fbd9fe8cceac902354faec5f52fedf09893058c6b6aa7460520433110a48df41ef08680ccb670de44e7053b524ae22b02daad24a11fa61b0fdf4367e5bcbd9fe76d99e93aa1f36ea8f8c30b1e1bacec6e9a5f2984b420c951a0ea9af955cf5de97a751a00e97a3dd9787601c302960ebb4682dc8c64ebcadbec554b7a2357e44691d10e458e151af1f59a687ee454652257d56a17db941c40211a35f5bec9cef3c5c2aca8330fd9a5a2c913640e0aed7b6d5708d0b907efd0248ffae63108cc0ecc72240bfee2b8f290c448cc22db24b807242264d7d1e955468bc3c869901406948a7cf109c461111fc111d995cba085a74676977c3fcc805181e8f27c15702b27844d38436e4d2cf995a3ae001f2567f55c92b3499a13e2f241a867395d8d97087fbc5ef856cc65c1738e8875c597dbea0ccd6579cec9d5370fa502b4969ef773ea677694c229596dd5fd581a5e8444f3fd64f2ad3fa4eed3e206a2d3859bc5144edeab075f848e95bb2a18039c7f8f874058269cc2e7e0717ebda30a6ba9cc5fce5f18daadc54eb790fce70e12f439e3dda4d9e4ec6417d7cf87bc47443d986873d5847a8e8266d38dc519f58e88eb68ec5be10ee2f8025dacf5b740fc9da4e08ef2d8d62bdcd8816a232364cb58b1e803b11bef053b5bffa38a0c092ef8ea6ad43d92e1541b4f3427bae8e84592d8ff91de02b9445169c83c603d898892142afa9bb52808f6abf2ee0ce4a391f9d943a62a4113c6c1bad1e22b1474ce333121f0f033634dee9ae3c7828dc59ef12654761183d4980566de0dfb57823e6257f989b48d2820f0d391e8e495c866e9a2743e1a0083d0173696ce25172e70dd41e4dbca4fbcb075f49d98d73690c31d2ecaa1b949524d65a4d1c6cccea6f7ba7015080c0e967a07cee5acd00886366d8379836f7fbef5bca5921f75b8a5aef962d3cc1846cc52945cdae3eea36834b2d7f892f889a444e023506d871ae85378036082ed455b4bbc70785f70f84d4eb8e427bc1a56c4a106c92ecce4477b4911ea83f748403009f731f667216f616e5050bfd4ec1827fd943d6a6a1c79b1b738589aab3a121192e9f333dca16f487704ff6c33cb54bd17d91a3becd43dec709fc64b67b12924cbb8527f19ae4eef99873b564454c7044ca33526a78feb1ddaa486b1d1671a4836a92528f0e7902323c3099e702131cdf5a041547ada60aa38921027c1775e6fd1fd11cb397d253654d7d29d768f13e9cf936835450010931d5a26ad87ffb19f1fb32717604e41943ed2a57ce36d86dd5f503edd8bae859e242de06ee1fa0341e74f2a7b9078901729f2ed5f38bfc5867141673ee186c12804f9c726d63dffe928d375df7a868ab768e2ff44b8a88908432b2def35037a63f71a18b287d5f5048af0be592bb3f3597082f4c827d02d2c9520ce007d2469b39f07b9c3945967a7a96468ca2f8312073aa2a045f68d48f4099447a02993e16ce51ce48e5e0ca27f99f05a855e103908452188c9fc83a02f5f26b7f50926b87ce883f20f93d6361c209bd75ce1907831b0b3a31890d3205f9aa07262892e7019b537ee043925493ac3a1932f615e7ef2a311d5b652038a24318bcef3f74df1f46986f9c38ea9f261d86a772fb7d3c6ae8544af9cbe0bd34aa486913413b8d180f695cc2e317096a6cd33e127c12077ec88c7a11f89e27ed4591ee5f9a0a7a700f46ad6c829877b76fb65deff161716854632c468df1f904c4fcca43cab482d8271d8f70751c73f040f1111d9c03d89b0d07b949b220793eac12f83ddcee359a153d255c0e06e9d80c0f1fbb2ef208d9d6676ff4bbb1efdab87cdb4d6524a6c65803e0223323be994b07a0da71021e12f24ca44a1a8b5d04486621f2769a68b821a30a47f113db3aa26901d1f17788726cd3842c6fcacfd34b05d0641795a412f69084d4f52a2e5b3498dd34e03f876e81db5a321cf8ee36113dedc7f049f4aef91695d3c687c2756dc830ae8a2453d8a7ba4dc3e1856ad3e040d901ebea3f0a1520bf58004d9530af3caae821ba3dbf54300343c50633d8c470e885b0222cbaf7e98ef6396e7514fd16ae91f76c6defbd8c7084c573d714a09639b240026ab34e06ce04b6791bfb0ff76e4058becdd6b541655db75d7a49e554def9c8845dcaeddb1e9759625487b3aebab13555ffb829340318e80a6f40fc1272fdc39b14992972d9cd689bb08257efdac2e5cdc01d4477f82bbccbc432cc0de6a42aa8b84d94a3c7ccc769db95a3444bb4ada5cfffb040ef8cc4f3f6949cbf5919a44802b262e86fcd7206353a798192835c48b627cd1094d44dd9b97ef48912efce2e4655c050243022d720d7c516e633b8f3da890101a335abf08ab877d9479140e5ac2260e6db470144f72cedadb6a71af37d4a054f62385542538edaa662c37b08cbc912d31046e62999d012dda3eeaba81146fc1534f4267210b83da9f5ee16d67ba4881d28a96f6499e49b4809253f8c6d5307890099e573bdb643691aaf7bd5c6cd3012045874b0c7d71d23675b0bdff3165767fd0725814faa29a20e44bbbfd5fefec69085b15fb1cf074a02745f34f368fc45b967cf61a0758f2233957778a5e73ad3f86d3820bc1533ed1b82a80343b5554ded89ed30a887a8ab8228a2e33fe53cd5acfd93bedbf2a3ac6a780bad21d929d2ed2b7f61d0fda744cef7a8030f0e2bad32c807fc630486a55383f1ec41489264aa3ecb8feb693df7095cde11bbfc2c0b599459773b2d1189ab4908c9681905e5134b01c1283232be01de3ccf0663ea9a145762839d9827b7eb52f302775d947d153d4fc45fab1df095a428a0570a6d91e90b7be8f77e707e5880027abf236ed5e10a3eca388a257459f51f7e867283c6e110e78aa46cf2ee414c69a9852b0d4355d95ea8998c5805a9277d388afaffd66e36759aa63cb0d84405b129af838b6f4b660988646265310c5286c9e8417fca5a7fe0db5ca07ced628c44454f5b389031afbaa27aa16a02d6e40705de319073d546ec41c86c36636cc78e929b69193ffe84f7f30fc805269a2e0320364b4c03a055b72ff438ed7217b4c56810538613d8ff93cc3f3f026d498e3caa29e5ec6a316198a7259ead89abb7029e117c4d0b982e98401bc7dc7aa34f811b8bdb0165a29551470b91c3c5316e16f2e6d3747f7e62311bf292113aa7a981495837adb8ad381460ac24c1f4345ea80329581c00c7850c06916f47b80f9965be9d100a4a1cf25f25f71637dc1b74e88cc89bb1f5ff46533b198f0355a1bc552572a7fe1d8a3c02f888ac59fbe454df8e8f770034da84a88642d3d6b6b65adc2cde27a0b418baca936d0fba6e663bdef42cffda70643fe3ae819009979cee621b028f6d4cf8a660728997c4d15de2b3fa1c25a99d7b0ac83bfbe20e44b8187754918a2fb9c5bfd4b9c2071217aaf96306993291056b7fb767a5736b21179f2d6b5f4b277e8101104fe1631c2deff191806f8f23d9f42e92413ece4a2fa25e9a42834e51e9f92bdd6432bf7446f", 0x1000}, {&(0x7f0000001340)="2f4a5adee9122072234b2e692cce96125f10270b747765e9420793774cea985d281fa9c47f778c7ffc9da1bdb41026053ff555365a5110c4723b2f8e3011852cdd7a3052d952ec3876839d439ba5833fef0a335d65d61c9f0c33146eeb8a4becc731715035aca0062a396acff901cf52688ed08f940566d9004c3423f36c8c59b503cfd91ce5785032d9274145385ba6576b0b6bb814bca980b748e4ae3f687f7360fc2c326475efa0ed1ad7e08db2b4ef51c0c07c3f0956e68acba424a694216d82cf97b1fcf38491c274", 0xcb}, {&(0x7f0000001440)="1c35b58090ceb755c4b14082260ddbd5bd46cb697eb692e3bb39ae14b65f301e6f76fc1fff30920d0705aad7531a6e720e125ab9c8e406ef12edd3c47e60e6505df230e40b95e444851fb6b12350e4782518189872659a6db428dd322e680f30b43bfb87e54ddb9901fed9e6753b78253a081c03c60fb943d51181f002d9c228223ee98e908b7b2e675cf293bff15a7c14b2ac27512a4488e8dcc82e46bee9849ee1", 0xa2}, {&(0x7f0000001500)="fc24b6f2aac87659ad14e38102e7e94fdd08e4c5d0f0f4c8b41c89c8762ab6a871a941d7d7c29557e9f894c12730138a6b601e476d4170eda2007392c0a9f342d5d0f294fd7a668dd81c2d859aab5f550e69c7c86e8424f5370ad2696104e88d11225da62a558d695be5a3925e04b2289612b68fadca411c9fdbc1f76e6fc23d4e40f8ebe4d22b61cc3e5b5e113956b9d7e03f90c6c4cbbb9e9cf6e7582bfdb4643f043aaf0e44e5f8107d80c68659f4614cdfbb0077ec6434c9d74eda0dca0f5a75ac72b23e0ef40d682849bb33eec5848fc4bd15eabd89706161c9623c012266a1771a193d78347104b2f45289446d7a9d9ba18aa720fcebbff08f74c2d432c6a1a9712ae45ca593a881e1c60019078c74b035ef4869340ebd3be9c1f73d20a92e19a9380c1f83f8c6a2b6a5f05a0882c4957a4e5a5fd9f28e7cd3b0316371ef417dbd54a055dfd82d4c5f5af11b43788270f8be37e53586daec7fee297cefe913d0a0c8bbb847e8a3972b1e65d3c1a9f69badd9037cceaf93404ae9c9101ee0aace5f0f641225cadf44406acf6bef6fb3b5e88cd1ec02425af0104d62f9173517ea967750906fdf44301855dafb9466613388cb7182c6cb9b2cb236471628acb61190fb839df93f09861e1a438c80a13e31e620c7f56e252cd79f45db331f579296ca68ec3ed7f8e26f74231b04e62855b365edddbbd91bc161a5243694da51bf23ba573cca71e164e409a70c3539cd3456d24f5c13c5b5c35dbddd4ee566e22576ae0ed6bea5ac33f74306c5bd4cdaed042a2a290ff94621e9e0a03481e584b02bf26ce11a50336fa22e7fd7838db57729598683e714c85ccb2dcf9cfe18682e741ac13491934a6a5cee67d77859f8ced9a091bd836d63726c0d55d50d456bebce736f6e5b65c74354677afc537b7ffff23ba08052b5263d7204ea5e1241bf6147b363f25ec51f6fdf8abbadb80780fcdf591a9b46c779b1ad911c3d680cb7c4085ede59dbddac6f2d8ab6e96fac3b6245be5b3d9f3dd40001f58ddd81dac19a2a15b84c29c2ac818ae9d99c940b0097235d8f33a7dc73efcac8a020d069262c8f627332c2b4e99842282b7e2bf626307a233243a0ff3ab8b2bf16721c8faf79a609115d51202dde0c18f1cb136af6a7e38b99cc5f2e060efc5a7f07e723ee51071e68a35e81fdf8153b6ae5a1fb831f51b6998cdd061024fe16f1530a492f5ee9533de3297abd4a3e922de8a48a8c196464632b68a05085531de5a5f82288117711adb1407b33062912feb0de8f0900651ccecf474df343160599de6d43bdfcbc46dcf65f2be3739dccf505a28ac3305a05eb4828e5a00befcdb3379da11b509da714d2e32f6b10dcccf6f0ff12035271e1625a278a71ecba1654c608505709c155226e63691d18406cc4f9ccf08d7782b6e7a54e6b1c9c91d84bd2b3ca22ea2e9aad1fa38620a40820a29bb537ca5ab55bd4f6f88e50164a796f42a7d7ac37c176a7cf3ddf09c1d6cd03a2f3becee060c7d006cc764c057e52f424ea6bfc8d724c77d7a358117682207584ee1079a2b6f5fb247c7a435f9d3a72febff2bba7daa9f364febe6af42da623268dd77d863138b050a8de3e1a071be0134f87b002c7733a21d015d348c959e2a3f2d2108c3ca23bbcaa879d1ce7c9468096624035f2d1fde8207bbc967296dd1c6c22bbe65543cac30b2787aea06c69f41e0ab8384b1c3a7ddb7250fcf956a52c909670f4f12f65973f47a2d71e32a104356bfed1c5e14fbdc0eecec6543413a842874f494562d5752389a78f1d2acad63a8c52d42be5a8466b6ddafc274c8603da33c701444836f4e61d38ce35255e0ba76cfbd3b893b4b0d4a4fe7da10162dfefe239f2f61cb3460d12e00ab663aa847db458f8f61813f9c979f7d7ee57ee8830ea0320ea017f1fb41748db3e234046ed153c08042a27bed866138588c9b89df5e62235cb0ced936439771db444183fb63c51248f42960171d6bd4b33f8e7f47d452e948e613f9a4fd723d0a24961cac7e02417aaa445993da87fb25851afe77c198192eb8c5edbef309fbbac63eae7659b81a43a9326f33ec872c641ce540d7faa231c9cae47a21d2cf8a319dffc9e4f18a7e8069ee0a613734dcbe91de27f943f6b63ed94b1970bb432e5cced1280ebff830c90225934a006fc455b13306c60fdbcadd9172ed02b0b79cacadb8423a5f68464a9581b1a23512e159b2c155e1daabf6db41aeedc3a4591b894f5c86a2f46ecfb47188a16b02a2b21767b5c76750a2cdaaeddbe6265e61688b03a2aa25352d531bb972023a6d5bb50fce1bef57db86ff264d921204d297c5efff70b5f74a11ee3ab72dc2a736dfa4deab7e60bfd841db1ec5f486378bddb3b9d271dd15f7ad2a0e00539e3f2604ea6f018cd50da4082da0da6c8c21380081dedca506ed937c15c3bdef15d9a5a25cc61d08a77bfe322b2ddeae4cfd27de279e122e1a4942fadeb8fd6cf18b8f075c1fdfc82ee705fa5e38b415b8b2db19034952f9e78e2d4745e35eb7cd212c74aa47ba90a7ea3a6e6d94f5ae6645c28b59db1c4074e77183507c913940a437c077221700715ba16ea75930ef05b61c5294d483d314bc91b7c854f04d8afca090ce6eda79d0af27f8f315d1d8eaea058ba484b40519702c7de57c057242acf40e33dd5363e05d61a541979f28b0641dea3f1755aec6662798b27861989f5c44ba61d5f61d7fa42ae9414005eb8ea3c5377b1b1953b63c0557c14caff5912dc6f95ca928cb04ebc629abda26024edfb3b3c8dc9315fbb65174887053465a128260690e6a5674554fc6d8c69287255961177da10790f40b41008b1f474ec55a58fc81672c8165feac3c43b4dce701fefdcc1180a5ec749cf94775088d0db9933ad64e88644161b92646660eb94c66c02b282f7076691701a254b206d764e242dceeef76b06d287f99a35d1b510b6b2373b1f21511d0e572e61fef11474b404ceae91126a2abdc58b347f6919009be363fceed8d400288809768b2053b7512eb49c9d165b7cacb194bf75b86eef285035490aad18595ae3fb5a7ffd71950caf586ff43f1e8bb80a1021e63f4275f5c43b56043b1327cc06412ea9dc2d8a7569156774ed2c0e0bb16eec302bf28961bff8f2f84504bc2e04a091935655c283cac3b78b386f8826dd74d40aad612654b2caa5840588f205dce772e018fe4653e5c3915f6291f7850dc5d2c2f4113dd7641381ca663e909a76d9bd64a44187b263803e82b130d8afa189526f84f75193ee1a3ccb51b2d7b3f05353c0a23eddf161c6287fe4c792de50543cd8280b514620a21048d0194daa67b7a686c4a885286fa3acfc1c1ed40c7fb6d445893270ffe2b55ee3274109a39f9aff93b55496d2aeabaea16981de7ecc2fef4fdb7a3a1bae566a394eda63cb23cacac63ecc03f96ccc3dbb2b1e206f14fae6d0120c62f16d7481bc3c7c4fd681258ca735441b24c0cd473cf1e3b031bf86d15f07f9bb3815c1cfb0c02e7ea50e794c44f18316b331ffdb2fcd7c42c1051ef5ab0d48e1c9c4a966a800925bee8956fffc90c6ea1b19fd71c3e4675fed478a7c86e077b7308f393a4210f7cd5b466341e68df46b4fb3d4a84b5df3efde56d9747a06046674ad9ebccb4ce2909314b8d2d975b95cf3bb1520cdb1f7191c07ecc0e02acab03287723d02905ed7d293615ceecc9df8a7ecb06a26ba992fac942a7be2d49318a4184b64c5077be51ddb142e24ce5a0d09338f19476a6b58243603005f7e4a1b02d5602ea5a8d0134e99f27a10bc52c85e487c4461a555adeac4beff9c7c4f83b531a7eb5f0d492c779d76f8d7e487c066bf1c06942767391462b6a5f6c036dffe88bdbb1f10f10c393b3511f1b3be4be9edb25ee50c3ddb2f3acdee05b3e0ac66e97b09894827d626bc5f9df21da3549022349da6c68c4b66ffab3d3f3f06bbaf566f01acd60c34662e753358b36aed2045f7ae286f1e037ec932936dd916562a48a5ccee501922f37fe86dcacfc98831376429f53ad4096d08e8c37f3a9b0e0ebd619a2655a4fcf5047accd8de701d96f518d1a09487e3e498652351ff0a745cba6d7ad1654b33a686528f1f235b457b2456ce16f6df2a87a72d83b21c1fedfc236f5a6af9411e48778ac4a39e5b3b7cc8fedf126d3bae63a2d6caa31c0e98e90159c4147af2ff14a16b45c3440177f258dda4087ee255ab2e71bc82095586a31b1eff2dd6310bd8ae62495a4b57098ea9365e25a1ef70d8692b85ed6ceddaf93f57ecadc07008fef905942dd1b6da1832263735a76997eb20a22fb0fe7f94c105a4f0da221563cc8c8c5272835a2b7c7d9eacf38f863df4ec00d53b526ea302e115a76f56eec412f7167785f0efca882924d59a6a92da271274937b12b0924dda9e0d2a8896c393c407e5544625b7280c2f247e8eb59144808000ad5096a0add0305be29761e32a47d94cb1456a5a283163b9d7c4542a8a7ffacc962489d0f31ae1221bf986733e407907f96c7812a912443d0c61135d2635386aee6d4f8ec3ef06017070450e41c5ffc4964014b684996b7f7faeaa9e943f1d4d19575da5903dbca3ac8463ff31bf5c968adc175eb933356669992e5541dcafc2c7a46759dfefd7dc07f5b43e0acae33b423f354c237684b991026d5acdbdf9a1107c556c0bc01e86447fd4e13462197a1437bfe554dd0b3818415b2ac582318213a96358b33938bdbde59bc07929fef189f99d5790b440fab4ad311dffe0e51c2a659d55b30333ad1ec241b99786af67b01e6640b4817844d4b6d3fcc23e0147245a02d50e970edbfa8ac31cc0bab4d9b4183db6e6a47f58cb019be0ad5cdb4725c79c95a2cefd5209f1e747a973ecc59b5fadba085843d65def02f47b2703f942947a86d00aac6a93b05e0962a00110495e8be684dcc1a695f75429a6a6e950c4a1b57171f1143de4cbe15125e6cf3d71749dd9c9e70cd3998baeeba75f430fb2aac91382298e9f5faab877cdcba0526023e0e422decfea4a42a417e0e094875751d71e4e7c3b9934840182fc3903bde611f447c5e964260427d47f0fa61e9b8469be620173dd380e494c34d927cb8cce6ab2f202ea975e5eac567429a4afec5e77d39797e8a0edbb24b63017047413ede140b588da3a695587592dd93ab6606630b2284659725367ea1aa0894e9074cb7e867e52ac44016b81c8b709c08fef2b22bb4098fb4cefafb9c5add8c3d46037149124bec7a398bc9ccc0e591e0667d74cf2fa95a6656e5ff3b395b8830d5740684ba292ff2e2bf94842a289e2a1ae61dfff38b6b438a33ef7db7e7180f39a962ffbdda2d4abec0239f56cd01fb36561fa4491f3ab0927cc1fffed2b21663c7b2bbc7326c6669a017308deac06358ec0afb1a3d328df3f5a8f50e5dce0a52bc86c075bb8b9fcbb47df2396c119861c1443b78485828c10ab6826063f6b3da8779bc8789536d947d13d9f8e1088e9933135c492e1d9c79e5412ea603f0de0f12b93c4f70d1ba232ef287f83ee10a5858f434d4b76a6607fe829688e8ff2b4cb972616070651918b94c214df22bad1a31e2fd739b78b6901e6074142e108b118e8c97a4cf4d8f6009ce1d7c58ebedffec6d56a4528f275c25afd5564950986b7853e8da67c0eeb3a2533f075d4bacb32b1423d593aa0db29b6bc65025c3dbb55c69e95e5dd360d03a5dad888db4dc7196133c49eaba026b5dde9819fdfbce44fc40fb54ce937816617ce147b152f1ba9d1f6b18d7dd231fa4b5f7c6a7fae167e", 0x1000}], 0x6, &(0x7f0000002840)=ANY=[@ANYBLOB="080100000000000002010000090000008cc53169cd7dde784dccf7e1862830487d9057f791b21c816b9155259c5953ce65837bf05241af4aa124d639f289b56d59b0db4ab71219e670b1c311e1f82acb41d494384203b2127349b4d6b6f1ab7bbcf1cd8c97838a1235dacd65a6bda97834ad8e38345689187ae48aa0d4e1f6ee07ee479f0ed122d9244fe9c8ae3d7c6be690f41090bc60113595c5b1245211efc902d1cddf068af31f635bca49b32b2f9e4c6aece83866d3ffef6153243fd37ac3642f97b037e38f067fa247aa7f736fc2ec2ce67882df2ee12a25bdbd6b88b04cafadff2ef35883654f39e351a9f8dbbee524bc9bb60a4bf34fa5e15aca64cdff23865b1107000000000000000000000401000004000000064d000000000000200000000000000010010000010000006d122e2a768060c898c85a804df9000058000000000000000901000000000000102c75b921459c477fefccc0f61b0fb4d51008bed7acfb6861738f3e9bfa69b5ed0f4ff01ea131de07ace6005ca44a5e6acc6f04fbb6d9886d95430ee2cf4e081094c1000000000060000000000000000b00000000010000002b5bdd746f0676f08278f5d26303b3ecee3eda989dbb78c7811fa354b46e2dd7c7b5daa4d600006e8860102c52019a80e244f4b241ba2253170212fe3f6d24917af615391ff53594084dc68871000075db1193e1a70e8ee4449daafa295d8659df89cb144b3f3887ca55389d4f77d4e568d5b4e6a8905e4309752417f3d16182f8bbdde9459a0a773e99c1fb5d66052174ae96e39b1b73bd4c80bac7a8222c47aedcd0f059175dae0a7692edcd9c32a841030a372966e70f8a0e2be7909f3682dfc527ce5a286acddd50cdd983c2ac37c3508a24e62105fdec3b9f94eccf73a1e9e788d3219b296c5f62a84783476f43258d1e"], 0x1f8, 0x48080}, 0x4000) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000180)) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = getegid() stat(&(0x7f0000002580)='./file0\x00', &(0x7f00000025c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setregid(r2, r3) r4 = socket$inet(0x10, 0x2, 0xc) sendmsg(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:48 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1171.848603] binder: 12055:12063 ioctl 40046207 0 returned -16 [ 1171.895973] binder: undelivered TRANSACTION_COMPLETE 10:10:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:48 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x4000) [ 1171.923945] binder: undelivered TRANSACTION_ERROR: 29189 10:10:48 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1172.040650] binder: 12082:12087 ERROR: BC_REGISTER_LOOPER called without request [ 1172.057994] binder: release 12082:12087 transaction 3829 in, still active [ 1172.066304] binder: send failed reply for transaction 3829 to 12082:12087 10:10:48 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x60ff) [ 1172.103928] binder_alloc: binder_alloc_mmap_handler: 12082 20001000-20004000 already mapped failed -16 10:10:48 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x7c01}], 0x18}], 0x49249249249276c, 0x0) [ 1172.148913] binder: BINDER_SET_CONTEXT_MGR already set [ 1172.171187] binder: 12082:12087 ioctl 40046207 0 returned -16 10:10:49 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x100000000) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000000), &(0x7f0000000040)=0x4) 10:10:49 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1172.302789] binder: undelivered TRANSACTION_COMPLETE [ 1172.309630] binder: undelivered TRANSACTION_ERROR: 29189 [ 1172.432693] binder: 12125:12127 ERROR: BC_REGISTER_LOOPER called without request [ 1172.486493] binder: release 12125:12127 transaction 3831 in, still active [ 1172.499001] binder: send failed reply for transaction 3831 to 12125:12127 [ 1172.522706] binder_alloc: binder_alloc_mmap_handler: 12125 20001000-20004000 already mapped failed -16 [ 1172.536949] binder: BINDER_SET_CONTEXT_MGR already set [ 1172.549834] binder: 12125:12127 ioctl 40046207 0 returned -16 [ 1172.582123] binder: undelivered TRANSACTION_COMPLETE [ 1172.587482] binder: undelivered TRANSACTION_ERROR: 29189 10:10:49 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100)=0x4, 0x4) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:49 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4302}], 0x18}], 0x49249249249276c, 0x0) 10:10:49 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:49 executing program 5: r0 = socket$inet6(0xa, 0x80001, 0x20000000000006) r1 = socket$inet(0x10, 0x2, 0xc) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x100, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) openat(r0, &(0x7f0000000100)='./file0\x00', 0x202000, 0x4) 10:10:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0xffffff7f00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:49 executing program 5: ioctl(0xffffffffffffffff, 0x2, &(0x7f0000000100)="0a5c2d025e108700008070") openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x2, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x400) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000140)={0xffffffffffffffff, r1}) r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x35c, &(0x7f0000009ff0), 0xda}, 0x4000) 10:10:49 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x7a00}], 0x18}], 0x49249249249276c, 0x0) [ 1172.730664] binder: 12142:12147 ERROR: BC_REGISTER_LOOPER called without request [ 1172.743315] binder: release 12142:12147 transaction 3833 in, still active [ 1172.754817] binder: send failed reply for transaction 3833 to 12142:12147 [ 1172.765439] binder_alloc: binder_alloc_mmap_handler: 12142 20001000-20004000 already mapped failed -16 [ 1172.778080] binder: BINDER_SET_CONTEXT_MGR already set [ 1172.783650] binder: 12142:12147 ioctl 40046207 0 returned -16 [ 1172.874496] binder: undelivered TRANSACTION_COMPLETE [ 1172.879923] binder: undelivered TRANSACTION_ERROR: 29189 10:10:52 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x7fffffffefff) 10:10:52 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:52 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2600}], 0x18}], 0x49249249249276c, 0x0) 10:10:52 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") getsockopt$inet6_udp_int(r0, 0x11, 0x0, &(0x7f0000000040), &(0x7f0000000100)=0x4) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/attr/current\x00', 0x2, 0x0) r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:52 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x400000) write(r1, &(0x7f0000000340), 0x10000014c) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x210400, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1175.241683] __nla_parse: 21 callbacks suppressed [ 1175.241693] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:10:52 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2803}], 0x18}], 0x49249249249276c, 0x0) [ 1175.282455] binder: 12174:12182 ERROR: BC_REGISTER_LOOPER called without request [ 1175.297953] binder: release 12174:12182 transaction 3835 in, still active [ 1175.311488] binder: send failed reply for transaction 3835 to 12174:12182 [ 1175.321200] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:10:52 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x8, 0x9) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1175.334069] binder_alloc: binder_alloc_mmap_handler: 12174 20001000-20004000 already mapped failed -16 [ 1175.345842] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:10:52 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1175.403775] binder: BINDER_SET_CONTEXT_MGR already set 10:10:52 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1175.425941] binder: 12174:12182 ioctl 40046207 0 returned -16 10:10:52 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xed02}], 0x18}], 0x49249249249276c, 0x0) 10:10:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1175.500313] binder: undelivered TRANSACTION_COMPLETE [ 1175.505687] binder: undelivered TRANSACTION_ERROR: 29189 [ 1175.544256] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1175.567009] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1175.582967] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1175.614714] binder: 12214:12218 ERROR: BC_REGISTER_LOOPER called without request [ 1175.641341] binder: release 12214:12218 transaction 3837 in, still active [ 1175.656654] binder: send failed reply for transaction 3837 to 12214:12218 [ 1175.696431] binder_alloc: binder_alloc_mmap_handler: 12214 20001000-20004000 already mapped failed -16 [ 1175.712934] binder: BINDER_SET_CONTEXT_MGR already set [ 1175.725408] binder: 12214:12218 ioctl 40046207 0 returned -16 [ 1175.743466] binder: undelivered TRANSACTION_COMPLETE [ 1175.749148] binder: undelivered TRANSACTION_ERROR: 29189 10:10:55 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x730000) 10:10:55 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @multicast1}}}, &(0x7f0000000000)=0x84) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000040)={r2, 0x3}, &(0x7f0000000100)=0x8) 10:10:55 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3b01}], 0x18}], 0x49249249249276c, 0x0) 10:10:55 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:55 executing program 0: syz_open_dev$cec(&(0x7f0000000500)='/dev/cec#\x00', 0x3, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) io_setup(0x8001, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f00000001c0)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x5, r0, &(0x7f0000000280)="61bd41d148b4b8f0492d711bc792eff4af5f3d51264f2b47e80b75040cc63c1e86a2570f48baa93f4c1dd8fdb92e7b86a07b757fba16146818db166bd8cfd0b1331402c833fd0d38b2cf57cf36f70312d453365431b927efa9d54c313efef5b147e2d324bf743258fc47c58113eafb46901ef7c3d3dc21c2549620ff8be850c19e6bc7387aff6b0b2969d70b502a22331ef9236940fb863bad2a1b1a3e692fd2d6fe0bcbfe241cd314fe36540dad2e5b20a2a7ad326d48a29f87da5613c777e492442ffa055504d3fbb5f00bfb9530fd", 0xd0, 0x4, 0x0, 0x2, r1}]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f0000000080)={0x0}) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f00000003c0)=0x6, 0x4) ioctl$DRM_IOCTL_NEW_CTX(r0, 0x40086425, &(0x7f0000000380)={r4, 0x2}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1178.319468] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1178.337497] binder: 12233:12240 ERROR: BC_REGISTER_LOOPER called without request [ 1178.354629] binder: release 12233:12240 transaction 3839 in, still active [ 1178.361988] binder: send failed reply for transaction 3839 to 12233:12240 10:10:55 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xb702}], 0x18}], 0x49249249249276c, 0x0) [ 1178.369369] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1178.377263] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1178.380643] binder_alloc: binder_alloc_mmap_handler: 12233 20001000-20004000 already mapped failed -16 [ 1178.404099] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1178.411015] binder: BINDER_SET_CONTEXT_MGR already set 10:10:55 executing program 5: r0 = socket$inet6(0xa, 0x20000000803, 0x6) ioctl(r0, 0xffff, &(0x7f0000000000)="0a084d5e0060408f6b96fe") r1 = socket$inet(0x10, 0x2, 0xc) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000100)={0x79, 0x0, [0x2, 0x80000001, 0x1, 0x1]}) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1178.425924] binder: 12233:12240 ioctl 40046207 0 returned -16 10:10:55 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1178.504183] binder: undelivered TRANSACTION_COMPLETE [ 1178.509764] binder: undelivered TRANSACTION_ERROR: 29189 10:10:55 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c2d023c12629f7180702403d8c9c59d93fa4de559b0e57933f413067d049172a0a40cf61470eb46b7274ec13545") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:55 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xa102}], 0x18}], 0x49249249249276c, 0x0) [ 1178.621095] binder: 12265:12267 ERROR: BC_REGISTER_LOOPER called without request [ 1178.632456] binder: release 12265:12267 transaction 3841 in, still active [ 1178.657497] binder: send failed reply for transaction 3841 to 12265:12267 [ 1178.688075] binder_alloc: binder_alloc_mmap_handler: 12265 20001000-20004000 already mapped failed -16 [ 1178.698616] binder: BINDER_SET_CONTEXT_MGR already set [ 1178.708526] binder: 12265:12267 ioctl 40046207 0 returned -16 [ 1178.756027] binder: undelivered TRANSACTION_COMPLETE [ 1178.761402] binder: undelivered TRANSACTION_ERROR: 29189 10:10:58 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x60ffffffffff) 10:10:58 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200)='/dev/hwrng\x00', 0x0, 0x0) r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video36\x00', 0x2, 0x0) ioctl$VIDIOC_OVERLAY(r2, 0x4004560e, &(0x7f0000000040)=0x81) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000300)={{{@in=@broadcast, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f0000000400)=0xe8) lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) chown(&(0x7f0000000240)='./file0\x00', r3, r4) r5 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x5, 0x60000) syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x2, 0x800) setsockopt$packet_fanout_data(r5, 0x107, 0x16, &(0x7f00000002c0)={0x3, &(0x7f0000000280)=[{0x100000001, 0x3, 0x0, 0x10}, {0x4, 0x3, 0x7fff, 0xd89}, {0x8, 0x3, 0x1ff, 0x100}]}, 0x10) 10:10:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:58 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2000}], 0x18}], 0x49249249249276c, 0x0) 10:10:58 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000001, 0x0, 0x0, 0x2}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x8, 0xffffffffffffffff, 0x0, 0x2}, &(0x7f0000000200)={r3, r4+30000000}, 0x0) readahead(r2, 0x60, 0x100000001) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:58 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1181.393501] __nla_parse: 5 callbacks suppressed [ 1181.393617] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1181.411491] binder: 12286:12296 ERROR: BC_REGISTER_LOOPER called without request [ 1181.424230] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1181.426348] binder: release 12286:12296 transaction 3843 in, still active 10:10:58 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x5c02}], 0x18}], 0x49249249249276c, 0x0) 10:10:58 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2000, 0x0) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f0000000040)={0x1, 0x100, 0x8}) [ 1181.439247] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1181.455359] binder: send failed reply for transaction 3843 to 12286:12296 [ 1181.476027] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1181.491030] binder_alloc: binder_alloc_mmap_handler: 12286 20001000-20004000 already mapped failed -16 10:10:58 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x930000000000) [ 1181.544618] binder: BINDER_SET_CONTEXT_MGR already set 10:10:58 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1181.567158] binder: 12286:12296 ioctl 40046207 0 returned -16 [ 1181.582577] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:10:58 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2502}], 0x18}], 0x49249249249276c, 0x0) 10:10:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1181.641880] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1181.659049] binder: undelivered TRANSACTION_COMPLETE [ 1181.664220] binder: undelivered TRANSACTION_ERROR: 29189 10:10:58 executing program 5: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) r2 = getpid() syz_open_procfs(r2, &(0x7f0000000040)='fdinfo\x00') sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:10:58 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3a01}], 0x18}], 0x49249249249276c, 0x0) [ 1181.773923] binder: 12326:12333 ERROR: BC_REGISTER_LOOPER called without request [ 1181.781187] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1181.795455] binder: release 12326:12333 transaction 3845 in, still active [ 1181.830689] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1181.843713] binder: send failed reply for transaction 3845 to 12326:12333 10:10:58 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:10:58 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3b02}], 0x18}], 0x49249249249276c, 0x0) [ 1181.873206] binder_alloc: binder_alloc_mmap_handler: 12326 20001000-20004000 already mapped failed -16 [ 1181.897333] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1181.945057] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1181.996105] binder: undelivered TRANSACTION_COMPLETE [ 1182.001578] binder: undelivered TRANSACTION_ERROR: 29189 10:10:59 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000300)={&(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0], 0x7, 0x3, 0x2, 0x4}) r1 = syz_open_dev$adsp(&(0x7f0000000400)='/dev/adsp#\x00', 0x3, 0x17ffd) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000340)={0x3f, 0xbc78, 0xfffffffffffffffc, 'queue0\x00', 0x1000}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:10:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:10:59 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x1003}], 0x18}], 0x49249249249276c, 0x0) 10:10:59 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0xffffffff, &(0x7f0000000140)="0a5c2d023c1262806b6970") r1 = socket$inet(0x10, 0x2, 0xc) getsockopt$EBT_SO_GET_INIT_ENTRIES(r1, 0x0, 0x83, &(0x7f0000001200)={'nat\x00', 0x0, 0x3, 0x1000, [], 0x3, &(0x7f0000000000)=[{}, {}, {}], &(0x7f0000000200)=""/4096}, &(0x7f0000000040)=0x78) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x80040, 0x0) ioctl$VIDIOC_G_JPEGCOMP(r2, 0x808c563d, &(0x7f0000001280)) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1182.252045] binder: 12361:12366 ERROR: BC_REGISTER_LOOPER called without request [ 1182.270537] binder: release 12361:12366 transaction 3847 in, still active [ 1182.285048] binder: send failed reply for transaction 3847 to 12361:12366 [ 1182.299381] binder_alloc: binder_alloc_mmap_handler: 12361 20001000-20004000 already mapped failed -16 [ 1182.310321] binder: BINDER_SET_CONTEXT_MGR already set [ 1182.321356] binder: 12361:12366 ioctl 40046207 0 returned -16 [ 1182.354761] binder: undelivered TRANSACTION_COMPLETE [ 1182.360007] binder: undelivered TRANSACTION_ERROR: 29189 10:11:01 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x3f000000) 10:11:01 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2={0x1f, 0x0, {}, 0x0, 0x0}, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:01 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x5101}], 0x18}], 0x49249249249276c, 0x0) 10:11:01 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000000), &(0x7f0000000040)=0x4) 10:11:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:01 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000000040)=ANY=[], &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='debugfs\x00', 0x0, &(0x7f0000000100)="2188f694663b4e64eeb98fef3cb54f9a57d6059fe751ef350d847addb585b055e20100766f074d49dbc2e2604e5954174fa257cdee8377ac519ea9a894f10c476261a371df72f5") r4 = open$dir(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r5 = open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) getdents64(r4, &(0x7f00000002c0)=""/126, 0x7e) getdents64(r5, &(0x7f00000005c0)=""/116, 0x1a9) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:01 executing program 5: io_setup(0x1, &(0x7f0000000000)=0x0) r1 = syz_open_dev$rtc(&(0x7f0000000040)='/dev/rtc#\x00', 0x8, 0x200000) io_cancel(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x3, 0x2, r1, &(0x7f0000000100)="808a0cbd3834739bddcfe0b54b8538331162158718b111fd2a21048a3b0b5e35772d39f239808bca6d654146e56ad09e8ace53234498cbb2b733525bd41565", 0x3f, 0x4, 0x0, 0x2}, &(0x7f0000000200)) r2 = socket$inet6(0xa, 0x803, 0x6) ioctl(r2, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r3 = socket$inet(0x10, 0x2, 0xc) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:01 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x9601}], 0x18}], 0x49249249249276c, 0x0) [ 1184.740688] binder: 12385:12393 ERROR: BC_REGISTER_LOOPER called without request [ 1184.753105] binder: release 12385:12393 transaction 3849 in, still active [ 1184.761255] binder: send failed reply for transaction 3849 to 12385:12393 [ 1184.773026] binder_alloc: binder_alloc_mmap_handler: 12385 20001000-20004000 already mapped failed -16 [ 1184.794799] binder: BINDER_SET_CONTEXT_MGR already set [ 1184.825114] binder: 12385:12393 ioctl 40046207 0 returned -16 10:11:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1184.905542] binder: undelivered TRANSACTION_COMPLETE [ 1184.911313] binder: undelivered TRANSACTION_ERROR: 29189 10:11:01 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xa200}], 0x18}], 0x49249249249276c, 0x0) 10:11:01 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1185.058340] binder: 12414:12418 ERROR: BC_REGISTER_LOOPER called without request [ 1185.070642] binder: release 12414:12418 transaction 3851 in, still active [ 1185.078426] binder: send failed reply for transaction 3851 to 12414:12418 [ 1185.087242] binder_alloc: binder_alloc_mmap_handler: 12414 20001000-20004000 already mapped failed -16 [ 1185.097133] binder: BINDER_SET_CONTEXT_MGR already set [ 1185.102739] binder: 12414:12418 ioctl 40046207 0 returned -16 10:11:01 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x6501}], 0x18}], 0x49249249249276c, 0x0) [ 1185.137825] binder: undelivered TRANSACTION_COMPLETE [ 1185.143040] binder: undelivered TRANSACTION_ERROR: 29189 10:11:04 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x3f00000000000000) 10:11:04 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") write$binfmt_aout(r0, &(0x7f0000000200)={{0x107, 0x5, 0x2a57e1c6, 0x3d7, 0x35c, 0x3, 0x237, 0x691b}, "0e9f3a17ef92c3cd6f78db1ed19d97d97fa5bfb7a45b790f29826bfb81465b1b671fce38b06ac7", [[], [], [], []]}, 0x447) r1 = socket$inet(0x10, 0x2, 0xc) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x200100, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:04 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xcb02}], 0x18}], 0x49249249249276c, 0x0) 10:11:04 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x2, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:04 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x20003600, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:04 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xb301}], 0x18}], 0x49249249249276c, 0x0) [ 1187.826470] binder: 12440:12444 ERROR: BC_REGISTER_LOOPER called without request [ 1187.838002] __nla_parse: 10 callbacks suppressed [ 1187.838010] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1187.847943] binder: release 12440:12444 transaction 3853 in, still active [ 1187.870251] binder: send failed reply for transaction 3853 to 12440:12444 [ 1187.895457] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1187.907084] binder_alloc: binder_alloc_mmap_handler: 12440 20001000-20004000 already mapped failed -16 10:11:04 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008915, &(0x7f00000002c0)="0ac62d023c126285718070417d33cfd66d6e5cb6f6b3f5e05b9f2c1e0a9a128f033f4711484fd070f133e7854cb22cca68b1977c7d03bd21f80267ec331c2a8187ad6a82f6aeb5a556639aa41947512bc8f2b816b1d47bfb715412fc7498135cee096aa84af27d400bafa3b372e8b59b614e72348a0cba91606432a0d4581cce1bf539d8390f4c7330e05200000000000000000000000000") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1187.924027] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1187.952275] binder: BINDER_SET_CONTEXT_MGR already set [ 1187.971152] binder: 12440:12444 ioctl 40046207 0 returned -16 10:11:04 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x7fffeff4, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:04 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x1d00}], 0x18}], 0x49249249249276c, 0x0) 10:11:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1188.069294] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1188.084998] binder: undelivered TRANSACTION_COMPLETE [ 1188.108497] binder: undelivered TRANSACTION_ERROR: 29189 10:11:04 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x40, 0x0) ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000200)={0x3, 0xa, 0x4, 0x2001, {0x77359400}, {0x4, 0x2, 0x1, 0x9, 0x0, 0xffff800000000000, "8d9c33ca"}, 0x8, 0x0, @fd=r2, 0x4}) r3 = socket$inet(0x10, 0x2, 0xc) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1188.175564] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1188.219930] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1188.234919] binder: 12479:12482 ERROR: BC_REGISTER_LOOPER called without request [ 1188.255860] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1188.268152] binder: release 12479:12482 transaction 3855 in, still active [ 1188.280968] binder: send failed reply for transaction 3855 to 12479:12482 [ 1188.290082] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1188.309801] binder_alloc: binder_alloc_mmap_handler: 12479 20001000-20004000 already mapped failed -16 [ 1188.330066] binder: BINDER_SET_CONTEXT_MGR already set [ 1188.336182] binder: 12479:12482 ioctl 40046207 0 returned -16 [ 1188.378843] binder: undelivered TRANSACTION_COMPLETE [ 1188.384157] binder: undelivered TRANSACTION_ERROR: 29189 10:11:07 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0xfeffffff) 10:11:07 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xd602}], 0x18}], 0x49249249249276c, 0x0) 10:11:07 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0xc, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:07 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x803, 0x6) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:07 executing program 0: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0, 0x0}, &(0x7f0000000480)=0xc) syz_mount_image$hfsplus(&(0x7f0000000300)='hfsplus\x00', &(0x7f0000000340)='./file0\x00', 0xffffffffffffffff, 0x2, &(0x7f0000000400)=[{&(0x7f0000000380)="0e843138e395c0836a8ea00442e7c55127c205", 0x13, 0xffffffff}, {&(0x7f00000003c0)="89aa1f678b76d08c7e4b5f36cfbf9874ff1ee0fba11f0af4a8db033aea0abb58", 0x20, 0x2}], 0x80d1, &(0x7f00000004c0)={[{@nobarrier='nobarrier'}, {@part={'part', 0x3d, 0x800}}, {@uid={'uid', 0x3d, r1}}, {@nls={'nls', 0x3d, 'cp860'}}, {@umask={'umask', 0x3d, 0x878}}, {@creator={'creator', 0x3d, "c9cc8222"}}, {@barrier='barrier'}], [{@obj_user={'obj_user', 0x3d, '%{'}}, {@subj_user={'subj_user', 0x3d, '/dev/cec#\x00'}}, {@context={'context', 0x3d, 'user_u'}}, {@pcr={'pcr', 0x3d, 0x39}}, {@permit_directio='permit_directio'}]}) syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r2 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r4, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000100)=0x0) wait4(r6, &(0x7f0000000180), 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ptrace$cont(0x9, r0, 0xf, 0x4) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000280)={0x341, @time={r7, r8+30000000}, 0xf58e, {0xfffffffffffffffb, 0x19}, 0x200, 0x1, 0x1}) [ 1190.913954] hfsplus: unable to parse mount options [ 1190.921062] binder: 12497:12507 ERROR: BC_REGISTER_LOOPER called without request [ 1190.935571] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1190.956763] binder: release 12497:12507 transaction 3857 in, still active 10:11:07 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x8700}], 0x18}], 0x49249249249276c, 0x0) 10:11:07 executing program 5: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x80400, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000040)=r1) r2 = socket$inet6(0xa, 0x3, 0x6) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl(r2, 0x130940eb, &(0x7f0000000200)="0a5c2d123c126285718070f8f169e8b4b9515b897edbf894405a18426cbb03839388281b140e78397c2b04b5820fe47b527cffa5d194237d068519d2338b90e7d7c5d4fe5f6f5fab1145cd6bc2671802910f079b8003459f3cb052990aad02a36433900cfb9309da79da4d0cd9a729e12af2af07af3a4a26be7000000000000000000000000000") r3 = socket$inet(0x10, 0x2, 0xc) remap_file_pages(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xb, 0x100, 0x0) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) getsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000180), &(0x7f00000002c0)=0x10) [ 1190.957033] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1190.975763] binder: send failed reply for transaction 3857 to 12497:12507 [ 1190.993249] binder_alloc: binder_alloc_mmap_handler: 12497 20001000-20004000 already mapped failed -16 [ 1191.012479] binder: BINDER_SET_CONTEXT_MGR already set 10:11:07 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x3bf, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1191.044708] binder: 12497:12507 ioctl 40046207 0 returned -16 10:11:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:08 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4902}], 0x18}], 0x49249249249276c, 0x0) 10:11:08 executing program 5: r0 = socket$inet6(0xa, 0x800, 0x1000000000000006) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x8000, 0x0) getsockopt$netlink(r1, 0x10e, 0x0, &(0x7f0000000440)=""/44, &(0x7f0000000480)=0xffffffffffffff2c) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f00000004c0)) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x7) sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000200)={{0x9, 0xffff}, 'port1\x00', 0x9c, 0x10440, 0xffffffffffffffc1, 0xffff, 0x81, 0xe094, 0x7f, 0x0, 0x6, 0x2}) setxattr$security_smack_transmute(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000400)='TRUE', 0x4, 0x1) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000140)={{0xa, 0x4e22, 0xffff, @mcast1}, {0xa, 0x4e23, 0x10001, @local, 0x10200000}, 0x40, [0x4, 0x69, 0x94b, 0x7, 0x5, 0x400, 0x80, 0x7fffffff]}, 0x5c) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000040)={0x0, 0x101}, &(0x7f0000000100)=0x8) ioctl$KVM_SET_DEBUGREGS(r1, 0x4080aea2, &(0x7f0000000300)={[0x5000, 0x6000, 0x102000, 0x6000], 0x4, 0x80, 0x6}) setsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000002c0)=@assoc_value={r2, 0x6}, 0x8) [ 1191.163175] binder: undelivered TRANSACTION_COMPLETE [ 1191.168789] binder: undelivered TRANSACTION_ERROR: 29189 [ 1191.262731] binder: 12535:12538 ERROR: BC_REGISTER_LOOPER called without request [ 1191.291425] binder: release 12535:12538 transaction 3859 in, still active [ 1191.318939] binder: send failed reply for transaction 3859 to 12535:12538 [ 1191.328995] binder_alloc: binder_alloc_mmap_handler: 12535 20001000-20004000 already mapped failed -16 [ 1191.339652] binder: BINDER_SET_CONTEXT_MGR already set [ 1191.345383] binder: 12535:12538 ioctl 40046207 0 returned -16 [ 1191.352558] Unknown ioctl 19459 [ 1191.356838] Unknown ioctl -1062710496 [ 1191.361585] Unknown ioctl 1082175138 [ 1191.396248] binder: undelivered TRANSACTION_COMPLETE [ 1191.401870] binder: undelivered TRANSACTION_ERROR: 29189 [ 1191.428647] Unknown ioctl 19459 [ 1191.429128] Unknown ioctl -1062710496 [ 1191.453549] Unknown ioctl 1082175138 [ 1191.697716] hfsplus: unable to load nls mapping "cp8./file0" [ 1191.712593] hfsplus: unable to parse mount options 10:11:10 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x705000) 10:11:10 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xae01}], 0x18}], 0x49249249249276c, 0x0) 10:11:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:10 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x40000002, 0x2) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:10 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r2, 0x40106614, &(0x7f0000000100)) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:10 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1193.985937] binder: 12568:12577 ERROR: BC_REGISTER_LOOPER called without request [ 1194.020888] __nla_parse: 4 callbacks suppressed [ 1194.020896] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:10 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3002}], 0x18}], 0x49249249249276c, 0x0) [ 1194.021437] binder: release 12568:12577 transaction 3861 in, still active [ 1194.031520] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1194.037193] binder: send failed reply for transaction 3861 to 12568:12577 10:11:10 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:10 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1194.114132] binder_alloc: binder_alloc_mmap_handler: 12568 20001000-20004000 already mapped failed -16 [ 1194.156849] binder: BINDER_SET_CONTEXT_MGR already set 10:11:11 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2500}], 0x18}], 0x49249249249276c, 0x0) [ 1194.186714] binder: 12568:12577 ioctl 40046207 0 returned -16 [ 1194.204954] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1194.229279] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1194.262111] binder: undelivered TRANSACTION_COMPLETE [ 1194.267237] binder: undelivered TRANSACTION_ERROR: 29189 [ 1194.269330] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:11 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000000)={0x9}, 0x4) [ 1194.381795] binder: 12615:12617 ERROR: BC_REGISTER_LOOPER called without request [ 1194.399217] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1194.410525] binder: release 12615:12617 transaction 3863 in, still active [ 1194.418873] binder: send failed reply for transaction 3863 to 12615:12617 [ 1194.432096] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1194.449638] binder_alloc: binder_alloc_mmap_handler: 12615 20001000-20004000 already mapped failed -16 [ 1194.494430] binder: BINDER_SET_CONTEXT_MGR already set [ 1194.510188] binder: 12615:12617 ioctl 40046207 0 returned -16 [ 1194.533801] binder: undelivered TRANSACTION_COMPLETE [ 1194.540033] binder: undelivered TRANSACTION_ERROR: 29189 10:11:13 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0xfffffffe) 10:11:13 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x1a01}], 0x18}], 0x49249249249276c, 0x0) 10:11:13 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:13 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xc00, 0x0) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r1, 0xc0905664, &(0x7f0000000200)={0x0, 0x3, [], @raw_data=[0x100000001, 0x5, 0x1, 0x6850, 0x0, 0x1, 0x20, 0x5c, 0x5, 0xae, 0x0, 0x80, 0x7, 0x5, 0x9, 0xffff, 0x8, 0x9, 0x4, 0x5, 0x3, 0xffffffffffffff01, 0x9, 0x8001, 0x5, 0x0, 0xffffffff, 0x81, 0x0, 0x6, 0x8, 0x8000]}) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = socket$inet(0x10, 0x2, 0xc) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:13 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x1, 0x2) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(r2, 0x8188aea6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f0000000180)={'ip6gre0\x00', {0x2, 0x4e24, @local}}) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x1b, &(0x7f00000000c0)={0x9, 0x3, 0x0, 0x0, 0x9000001, 0x1}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x1}, &(0x7f0000000100)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000200)=[{&(0x7f0000000500)}], 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) [ 1197.094083] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1197.095547] binder: 12634:12635 ERROR: BC_REGISTER_LOOPER called without request [ 1197.127150] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:11:13 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xc00}], 0x18}], 0x49249249249276c, 0x0) [ 1197.137922] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1197.180210] binder_alloc: binder_alloc_mmap_handler: 12634 20001000-20004000 already mapped failed -16 10:11:14 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") pipe2(&(0x7f0000000040), 0x0) r1 = socket$inet(0x10, 0x80003, 0xf) fstatfs(r1, &(0x7f0000000200)=""/160) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000000)) 10:11:14 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:14 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xf00}], 0x18}], 0x49249249249276c, 0x0) 10:11:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:14 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setpipe(r0, 0x407, 0x0) r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1197.343572] binder: release 12634:12635 transaction 3865 in, still active [ 1197.351292] binder: send failed reply for transaction 3865 to 12634:12635 [ 1197.363243] binder: undelivered TRANSACTION_COMPLETE [ 1197.370752] binder: undelivered TRANSACTION_ERROR: 29189 [ 1197.433347] binder: 12672:12674 ERROR: BC_REGISTER_LOOPER called without request [ 1197.445460] binder: release 12672:12674 transaction 3867 in, still active [ 1197.455486] binder: send failed reply for transaction 3867 to 12672:12674 [ 1197.483575] binder_alloc: binder_alloc_mmap_handler: 12672 20001000-20004000 already mapped failed -16 [ 1197.496071] binder: BINDER_SET_CONTEXT_MGR already set [ 1197.502195] binder: 12672:12674 ioctl 40046207 0 returned -16 [ 1197.537573] binder: undelivered TRANSACTION_COMPLETE [ 1197.542742] binder: undelivered TRANSACTION_ERROR: 29189 10:11:16 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0xffffffffff600000) 10:11:16 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2100}], 0x18}], 0x49249249249276c, 0x0) 10:11:16 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:16 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000000)) 10:11:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:16 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) write$nbd(r0, &(0x7f0000000280)={0x67446698, 0x1, 0x3, 0x4, 0x2, "8038ac7ca4b680150d6a0c3e2a0848a092a2923ddcfacbd0e44fc94b49da55cd2537e569fcc3dc7503132738e37d3f4ad3572f29038ef12f8cb5c5bfb821fc752c9bd74dc5bd81df0e16c2137cffc521da95082d7ce82596195cc622837031ed9f8288d9435f71c335477cb410d662f1b772ed86db97bcfb2228331884e97c33bd5186048f73d72014ad6a6a557a4d2892d2699603697ca532259781a389de8389a9331befd2474b4f40e1144b82e2f6"}, 0xc0) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1200.114292] __nla_parse: 4 callbacks suppressed [ 1200.114302] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1200.115472] binder: 12692:12696 ERROR: BC_REGISTER_LOOPER called without request [ 1200.133243] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1200.149340] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:16 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x103}], 0x18}], 0x49249249249276c, 0x0) 10:11:17 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x3, 0x1f) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1200.160990] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1200.175721] binder_alloc: binder_alloc_mmap_handler: 12692 20001000-20004000 already mapped failed -16 10:11:17 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:17 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x7701}], 0x18}], 0x49249249249276c, 0x0) 10:11:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1200.339069] binder: release 12692:12696 transaction 3869 out, still active [ 1200.361414] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:17 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x40000, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{0x0}]}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r2, 0xc010641d, &(0x7f0000000200)={r3, &(0x7f0000000180)=""/42}) connect$inet(r1, &(0x7f0000000240)={0x2, 0x4e22}, 0x10) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1200.384570] binder: undelivered TRANSACTION_COMPLETE [ 1200.400766] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1200.409233] binder: release 12692:12696 transaction 3869 in, still active [ 1200.430494] binder: send failed reply for transaction 3869, target dead [ 1200.439851] binder: 12727:12731 ERROR: BC_REGISTER_LOOPER called without request [ 1200.456086] binder: release 12727:12731 transaction 3871 in, still active [ 1200.491158] binder: send failed reply for transaction 3871 to 12727:12731 [ 1200.510851] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1200.523633] binder_alloc: binder_alloc_mmap_handler: 12727 20001000-20004000 already mapped failed -16 [ 1200.539146] binder: BINDER_SET_CONTEXT_MGR already set [ 1200.544785] binder: 12727:12731 ioctl 40046207 0 returned -16 [ 1200.615693] binder: undelivered TRANSACTION_COMPLETE [ 1200.622431] binder: undelivered TRANSACTION_ERROR: 29189 10:11:19 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:19 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2400}], 0x18}], 0x49249249249276c, 0x0) 10:11:19 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0xffefffffff7f0000) 10:11:19 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0xbc, &(0x7f0000000200)=[@in={0x2, 0x4e22, @multicast1}, @in6={0xa, 0x4e21, 0xfffffffffffffbff, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x16}}, 0x9}, @in6={0xa, 0x4e22, 0x47, @empty, 0x2}, @in6={0xa, 0x4e21, 0x8, @mcast1, 0xffffffff80000000}, @in6={0xa, 0x4e24, 0x4, @local, 0x4}, @in={0x2, 0x4e23, @rand_addr=0xfffffffffffffffd}, @in={0x2, 0x4e24}, @in6={0xa, 0x4e20, 0x3, @loopback, 0x1f}]}, &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000002c0)={r1, 0x81, 0x200, 0x6}, 0xc2) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r2 = syz_open_dev$admmidi(&(0x7f0000000180)='/dev/admmidi#\x00', 0x1be, 0x100) setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f0000000300)={0x0, 'vcan0\x00', 0x1}, 0x18) r3 = socket$inet(0x10, 0x2, 0xc) r4 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x0, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000a00)=ANY=[@ANYRESDEC=r3, @ANYRES64=r4, @ANYRES32, @ANYPTR64=&(0x7f00000003c0)=ANY=[@ANYRES16=r3, @ANYPTR=&(0x7f0000000500)=ANY=[@ANYRESHEX=r1, @ANYRESHEX=r1, @ANYRESDEC=r1, @ANYRESDEC=r0], @ANYRESDEC=r0], @ANYPTR64=&(0x7f0000000680)=ANY=[@ANYRES16=r1, @ANYPTR=&(0x7f0000000580)=ANY=[@ANYRESHEX=r0, @ANYPTR, @ANYRESHEX=r1, @ANYPTR, @ANYPTR64, @ANYRES32=r3, @ANYRES64=r1, @ANYBLOB="95ddcb275c0b745ad7c7435f07f95d7fc98c2eb55f4416fbb1fb6b0e53885ef31dbec3f8a074113f4df5b0f1e131195162af4358e3fbab7763b86425eb2ce7f7f6d3c37c561d67ecb57919645cf305a547646c1bd093d6e3e71f12fe1ff843efb1e40dee0ecd8a68fb255544c5b0ba5c246dd292e5bec73f54f3a7a20095b481ed36b3863f0e73ef00e4eb1fe6d974d7655343d73ec0fec668", @ANYPTR64], @ANYRES16=r1, @ANYPTR64], @ANYRESOCT=r3, @ANYPTR64=&(0x7f0000000740)=ANY=[@ANYRES64=r3, @ANYPTR64=&(0x7f00000006c0)=ANY=[@ANYPTR64, @ANYRES16, @ANYPTR, @ANYPTR, @ANYRESDEC=r0, @ANYPTR], @ANYRES32=0x0, @ANYRESOCT, @ANYRES32=r0, @ANYRESDEC=r1, @ANYPTR=&(0x7f0000000700)=ANY=[]], @ANYRESOCT=r1, @ANYPTR=&(0x7f0000000900)=ANY=[@ANYBLOB="0bb83b008d93859f67f4d94a5f21e31a9dece462134884db0cd24d50e4cb25047a4047b0375b792102669a5ae5ab05a612b2d87bfc90a09371755b79ebd2ed938de1a7dac413553ff9c4d11282bf9e9b205ef94ab9a5db48df363f2f2b7b818e13d4a8d9299d96dfb121b84a07f132cefbc3807e6b0cc251c4fed7824f09cee8fef0a36b4fe89b16af78cfe5a20ab3084e13e754acf9bd39524d7b9b49216069dd0462afc1793f2ca013b9fb8f4266db0e4ea7e73fa9f5488ea1705cccd785", @ANYRESDEC, @ANYPTR64=&(0x7f00000007c0)=ANY=[@ANYRES64=r1, @ANYRESDEC, @ANYRESDEC, @ANYRESOCT, @ANYRESDEC=r1], @ANYPTR64=&(0x7f0000000840)=ANY=[@ANYRESHEX=r1], @ANYRESHEX=0x0, @ANYPTR=&(0x7f0000000880)=ANY=[@ANYRESHEX=r3, @ANYRESDEC=r1, @ANYRES64=r3, @ANYRESDEC=r3, @ANYPTR64, @ANYRESDEC=0x0]], @ANYRES32=r0], 0xffffffbd) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:19 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) fadvise64(r1, 0x0, 0x9b, 0x7) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:20 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xda02}], 0x18}], 0x49249249249276c, 0x0) [ 1203.154363] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1203.177622] binder: 12750:12753 ERROR: BC_REGISTER_LOOPER called without request [ 1203.194332] binder: release 12750:12753 transaction 3873 in, still active 10:11:20 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000000)="5585da8b6997ec2d9f9539f693a84b41ad498063a8040ee444f9b71496dec203efcf41ba84e3e5ef805b65647fc6739ec6ae11c7457d0000") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1203.222406] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1203.226621] binder: send failed reply for transaction 3873 to 12750:12753 [ 1203.244561] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1203.248825] binder_alloc: binder_alloc_mmap_handler: 12750 20001000-20004000 already mapped failed -16 10:11:20 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1203.304415] binder: BINDER_SET_CONTEXT_MGR already set [ 1203.327263] binder: 12750:12753 ioctl 40046207 0 returned -16 10:11:20 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xb500}], 0x18}], 0x49249249249276c, 0x0) 10:11:20 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x5, &(0x7f0000000180)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:20 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1203.473606] binder: undelivered TRANSACTION_COMPLETE [ 1203.479261] binder: undelivered TRANSACTION_ERROR: 29189 10:11:20 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xcc02}], 0x18}], 0x49249249249276c, 0x0) 10:11:20 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x9, &(0x7f0000000180)="0a5c2d023c126285718070") r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x88000, 0x0) openat(r1, &(0x7f0000000200)='./file0\x00', 0x0, 0x80) r2 = socket$inet(0x10, 0x2, 0x8000) syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x4ca200) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r3 = syz_open_dev$adsp(&(0x7f0000000240)='/dev/adsp#\x00', 0x5, 0x0) ioctl$BLKDISCARD(r3, 0x1277, &(0x7f0000000100)=0x80) [ 1203.586331] binder: 12794:12797 ERROR: BC_REGISTER_LOOPER called without request [ 1203.596130] binder: release 12794:12797 transaction 3875 in, still active [ 1203.604025] binder: send failed reply for transaction 3875 to 12794:12797 [ 1203.615341] binder_alloc: binder_alloc_mmap_handler: 12794 20001000-20004000 already mapped failed -16 [ 1203.649152] binder: BINDER_SET_CONTEXT_MGR already set [ 1203.689925] binder: 12794:12797 ioctl 40046207 0 returned -16 [ 1203.789036] binder: undelivered TRANSACTION_COMPLETE [ 1203.796394] binder: undelivered TRANSACTION_ERROR: 29189 10:11:23 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockname(r0, &(0x7f0000000180)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, &(0x7f0000000200)=0x80) ioctl$sock_inet_sctp_SIOCINQ(r1, 0x541b, &(0x7f0000000280)) io_setup(0x9, &(0x7f00000002c0)) io_setup(0x4628, &(0x7f0000000300)) io_setup(0x6, &(0x7f0000000340)=0x0) io_submit(r2, 0xfffffffffffffe85, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x3, &(0x7f0000000080)={0xa, &(0x7f0000000000)=[{0xe78, 0x2, 0x0, 0x6}, {0x81, 0xbf, 0x787, 0x8}, {0x8, 0x20, 0x1, 0x1}, {0x2, 0x8000, 0x3cee, 0x1}, {0x5, 0x2, 0x100, 0x8001}, {0xac, 0x8, 0x8}, {0x401, 0x8, 0x0, 0x7f}, {0x3, 0x1, 0x4, 0x101}, {0x6, 0x5, 0x99fe, 0x5}, {0x5, 0x7ff, 0x8000, 0x81}]}) tkill(r3, 0x10) ptrace$cont(0x18, r3, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x1c6) epoll_ctl$EPOLL_CTL_DEL(r4, 0x2, r0) ptrace$cont(0x1f, r3, 0x0, 0x0) 10:11:23 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:23 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) r2 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffb000/0x3000)=nil) shmctl$IPC_RMID(r2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3f00}], 0x18}], 0x49249249249276c, 0x0) 10:11:23 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000008c0)=@broute={'broute\x00', 0x20, 0x3, 0x6a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000200], 0x0, &(0x7f0000000000), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x7, 0x7, 0x1c, 'bcsh0\x00', 'veth0_to_bridge\x00', 'veth0_to_bridge\x00', 'eql\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, [0x0, 0xff, 0xff], @random="0e5d90627e64", [0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x148, [@helper={'helper\x00', 0x28, {{0x1, 'irc-20000\x00'}}}, @devgroup={'devgroup\x00', 0x18, {{0x1, 0x6, 0x2, 0xfffffffffffffff8, 0x40}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x5, 0x1, 0x8001}}}}, {{{0x19, 0x5, 0x89fd, 'syzkaller1\x00', '\x00', 'rose0\x00', 'rose0\x00', @broadcast, [0xff, 0x0, 0x0, 0x0, 0xff], @local, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xa8, 0xd8, 0x108, [@cluster={'cluster\x00', 0x10, {{0x6a4, 0xb6c, 0x9}}}]}, [@common=@redirect={'redirect\x00', 0x8, {{0xfffffffffffffffe}}}]}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x1b, 0x50, 0x880f, 'bond_slave_1\x00', 'syzkaller0\x00', 'veth0_to_bridge\x00', 'ip6tnl0\x00', @empty, [0x0, 0xff, 0x0, 0xff, 0xff, 0xff], @remote, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0x320, 0x380, 0x3c8, [@bpf0={'bpf\x00', 0x210, {{0x9, [{0xfffffffffffffff7, 0x3ae, 0x34a, 0xfffffffffffffeff}, {0xff, 0x9, 0x7, 0x1}, {0x101, 0x974b, 0x1, 0x1}, {0x8, 0x2, 0x4, 0x2}, {0x0, 0x0, 0x42f3, 0x9}, {0x9, 0x5, 0xffffffffffffffff, 0xdcb}, {0xa90f, 0x6, 0x80000001, 0x7}, {0xfffffffffffffff7, 0x3, 0xffff, 0x1}, {0x6, 0x9, 0x779a, 0x4}, {0xffff, 0x2, 0x5e2d2f2c, 0x9}, {0x80, 0x8, 0x7, 0x5}, {0x7fffffff, 0x4, 0x5, 0x4}, {0x5, 0x1, 0x91b6}, {0x3, 0xfffffffffffffffc, 0x10000, 0x8}, {0xffffffffe25c5e90, 0x1, 0xfffffffffffffffa, 0x400}, {0x1f, 0x0, 0x2f5c, 0x4}, {0xadb, 0x7, 0x6, 0x9}, {0x0, 0x2, 0x800000000000000, 0x1}, {0x100, 0xfff, 0x7}, {0x9, 0x4, 0x2, 0x7f}, {0xfffffffffffffff8, 0x8, 0x688b2429, 0x6}, {0x2eaf743e, 0x8, 0x7f, 0x3}, {0x200, 0xe7b, 0x6}, {0x3, 0x3, 0x8, 0x77}, {0xfffffffffffffff7, 0x3, 0x101, 0x10001}, {0xffffffffffffffe0, 0x80000000000000, 0x1, 0x35}, {0x5, 0x9, 0x401, 0x8}, {0x80000000, 0x2, 0x0, 0x4}, {0x8, 0x1, 0x1, 0x3}, {0x7, 0x8, 0x1, 0x3}, {0x3, 0x9, 0x1ffc000000, 0x9}, {0x8000, 0x0, 0x3ff}, {0x0, 0x1, 0x1, 0xffffffff80000001}, {0x2e, 0x7, 0x7ff, 0x6c0000000}, {0x1, 0x4, 0x0, 0x5bfb}, {0x9, 0x0, 0x544, 0x10000}, {0x10000, 0x0, 0x8000, 0xf}, {0x20, 0x9, 0x5, 0xe4}, {0xfffffffffffffffd, 0x40, 0x7fffffff, 0x3}, {0x2ed, 0x2, 0xff, 0x80000001}, {0x3, 0x4, 0x2, 0x80000000}, {0x0, 0x9, 0x3f, 0x3}, {0x22, 0xfffffffffffffffa, 0x7, 0x3ff}, {0x1ff, 0x4, 0x7f, 0x4}, {0x48, 0x100000000, 0x17, 0x1}, {0xef19, 0xed9, 0xfff, 0x1f}, {0x1ff, 0x100000000, 0x3}, {0x914, 0x1000, 0x7ff, 0x10001}, {0x5, 0x2, 0x285, 0x3}, {0x7fffffff, 0x1d84000000, 0x1, 0x3}, {0x6, 0xc79f, 0x9110, 0x7fffffff}, {0x0, 0xe26f, 0x40, 0x6}, {0x10000, 0x7fffffff, 0x20}, {0x9, 0x20, 0x1, 0x100}, {0x8, 0x6, 0x4, 0x1}, {0x8, 0x9c, 0x3, 0x3ff}, {0x2, 0x9, 0xc4c7, 0x192}, {0xe539, 0x6, 0x2, 0xde2}, {0x80000000, 0x8, 0x3, 0x2121}, {0x2, 0x70000000000000, 0x8, 0x7fffffff}, {0x7ff, 0x7fff, 0x3f, 0x7}, {0x9, 0x0, 0x6, 0xe73d}, {0x8cac, 0x0, 0x0, 0x80000000}, {0x1, 0x0, 0x5, 0x101}], 0x40}}}, @ip6={'ip6\x00', 0x50, {{@mcast1, @local, [0xff, 0xffffffff, 0xff, 0xffffffff], [0xffffff00, 0x0, 0x0, 0xffffffff], 0x2d505a1a, 0x29, 0x1, 0x46, 0x4e20, 0x4e24, 0x4e21, 0x4e20}}}]}, [@common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x9}}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x9}}}]}, @common=@ERROR={'ERROR\x00', 0x20, {"7d6202b43bc9d15aff7121b5091a9ae4b5db200c87ef5804d886e1395a42"}}}]}]}, 0x720) 10:11:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2b02}], 0x18}], 0x49249249249276c, 0x0) [ 1206.230468] __nla_parse: 6 callbacks suppressed [ 1206.230479] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1206.263768] binder: 12817:12826 ERROR: BC_REGISTER_LOOPER called without request [ 1206.270427] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 10:11:23 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x2, 0xc) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x10000, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000012c0)={0x3, 0x0, [{0xf002, 0x1000, &(0x7f0000000200)=""/4096}, {0xf001, 0x21, &(0x7f0000000100)=""/33}, {0x2, 0x92, &(0x7f0000001200)=""/146}]}) ioctl$KVM_DIRTY_TLB(r2, 0x4010aeaa, &(0x7f0000000040)={0x678, 0x3fc00000}) 10:11:23 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x11) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) [ 1206.305245] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1206.307210] binder: release 12817:12826 transaction 3877 in, still active [ 1206.326307] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1206.331807] binder: send failed reply for transaction 3877 to 12817:12826 10:11:23 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1206.412816] binder_alloc: binder_alloc_mmap_handler: 12817 20001000-20004000 already mapped failed -16 [ 1206.449954] binder: BINDER_SET_CONTEXT_MGR already set [ 1206.460693] binder: 12817:12826 ioctl 40046207 0 returned -16 10:11:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x9700}], 0x18}], 0x49249249249276c, 0x0) 10:11:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1206.493098] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1206.528492] binder: undelivered TRANSACTION_COMPLETE [ 1206.534187] binder: undelivered TRANSACTION_ERROR: 29189 [ 1206.558261] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1206.567061] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1206.604047] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4e02}], 0x18}], 0x49249249249276c, 0x0) 10:11:23 executing program 5: r0 = socket$inet(0x2, 0x4000000000000003, 0x8000000000008) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@nat={'nat\x00', 0x19, 0x1, 0x90, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f0000000000), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {}]}, 0x108) [ 1206.648001] binder: 12865:12867 ERROR: BC_REGISTER_LOOPER called without request [ 1206.684955] binder: release 12865:12867 transaction 3879 in, still active [ 1206.717733] binder: send failed reply for transaction 3879 to 12865:12867 [ 1206.739587] binder_alloc: binder_alloc_mmap_handler: 12865 20001000-20004000 already mapped failed -16 [ 1206.753413] kernel msg: ebtables bug: please report to author: bad policy [ 1206.754117] binder: BINDER_SET_CONTEXT_MGR already set [ 1206.773121] binder: 12865:12867 ioctl 40046207 0 returned -16 [ 1206.812674] binder: undelivered TRANSACTION_COMPLETE [ 1206.817947] binder: undelivered TRANSACTION_ERROR: 29189 10:11:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xe701}], 0x18}], 0x49249249249276c, 0x0) 10:11:23 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:23 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$netlink(0x10, 0x3, 0x8000000004) sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001500add427323b470c458c560a067fffffff81004e220000000058000b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a10004104deff0000fcff", 0x58}], 0x1) 10:11:23 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_SUBDEV_S_EDID(r0, 0xc0285629, &(0x7f0000000180)={0x0, 0x3f, 0x5, [], &(0x7f0000000100)=0x6}) syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) arch_prctl$ARCH_GET_CPUID(0x1011) shmget(0x3, 0x2000, 0x0, &(0x7f0000ffd000/0x2000)=nil) 10:11:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:23 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xe900}], 0x18}], 0x49249249249276c, 0x0) [ 1206.935394] binder: 12882:12889 ERROR: BC_REGISTER_LOOPER called without request [ 1206.954735] binder: release 12882:12889 transaction 3881 in, still active [ 1206.970261] binder: send failed reply for transaction 3881 to 12882:12889 [ 1206.986328] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1206.991934] binder_alloc: binder_alloc_mmap_handler: 12882 20001000-20004000 already mapped failed -16 [ 1207.021997] binder: BINDER_SET_CONTEXT_MGR already set [ 1207.031639] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1207.032006] binder: 12882:12889 ioctl 40046207 0 returned -16 [ 1207.093401] binder: undelivered TRANSACTION_COMPLETE [ 1207.098674] binder: undelivered TRANSACTION_ERROR: 29189 10:11:26 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) getpeername$unix(r0, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:11:26 executing program 5: clone(0x1001fd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() socket$netlink(0x10, 0x3, 0x20000000016) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x2000000000011) r1 = socket$netlink(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_generic(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x14, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0xa}}, 0x14}}, 0x0) 10:11:26 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2503}], 0x18}], 0x49249249249276c, 0x0) 10:11:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:26 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fanotify_init(0x4, 0x0) [ 1209.492070] binder: 12914:12918 ERROR: BC_REGISTER_LOOPER called without request 10:11:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x6503}], 0x18}], 0x49249249249276c, 0x0) [ 1209.544395] binder: release 12914:12918 transaction 3883 in, still active [ 1209.562216] binder: send failed reply for transaction 3883 to 12914:12918 [ 1209.574339] binder_alloc: binder_alloc_mmap_handler: 12914 20001000-20004000 already mapped failed -16 [ 1209.585727] binder: BINDER_SET_CONTEXT_MGR already set [ 1209.592103] binder: 12914:12918 ioctl 40046207 0 returned -16 10:11:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xb801}], 0x18}], 0x49249249249276c, 0x0) [ 1209.654146] binder: undelivered TRANSACTION_COMPLETE [ 1209.659542] binder: undelivered TRANSACTION_ERROR: 29189 [ 1209.702570] binder: 12946:12947 ERROR: BC_REGISTER_LOOPER called without request [ 1209.713261] binder: release 12946:12947 transaction 3885 in, still active [ 1209.721017] binder: send failed reply for transaction 3885 to 12946:12947 [ 1209.733937] binder_alloc: binder_alloc_mmap_handler: 12946 20001000-20004000 already mapped failed -16 [ 1209.744416] binder: BINDER_SET_CONTEXT_MGR already set 10:11:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4101}], 0x18}], 0x49249249249276c, 0x0) [ 1209.766671] binder: 12946:12947 ioctl 40046207 0 returned -16 [ 1209.791462] binder_alloc: 12946: binder_alloc_buf, no vma [ 1209.805165] binder: 12946:12947 transaction failed 29189/-3, size 0-0 line 2973 10:11:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:26 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x1d02}], 0x18}], 0x49249249249276c, 0x0) [ 1209.852067] binder: undelivered TRANSACTION_ERROR: 29189 [ 1209.859275] binder: undelivered TRANSACTION_COMPLETE [ 1209.882981] binder: undelivered TRANSACTION_ERROR: 29189 [ 1209.957966] binder: 12960:12962 ERROR: BC_REGISTER_LOOPER called without request [ 1209.982065] binder: release 12960:12962 transaction 3888 in, still active [ 1209.989236] binder: send failed reply for transaction 3888 to 12960:12962 [ 1209.998459] binder_alloc: binder_alloc_mmap_handler: 12960 20001000-20004000 already mapped failed -16 [ 1210.035985] binder: undelivered TRANSACTION_COMPLETE [ 1210.041263] binder: undelivered TRANSACTION_ERROR: 29189 10:11:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:29 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x32) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:11:29 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x9203}], 0x18}], 0x49249249249276c, 0x0) 10:11:29 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) pipe(&(0x7f0000000100)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:29 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:29 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008911, &(0x7f0000000640)="0a5c2d00929c2adaa91ff06b8054b1f917992a2700000000000002") r1 = socket$packet(0x11, 0x2, 0x300) r2 = gettid() getresuid(&(0x7f0000000300), &(0x7f0000000340)=0x0, &(0x7f0000000380)) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000480)={{{@in=@rand_addr, @in6=@mcast2}}, {{@in6}, 0x0, @in=@dev}}, &(0x7f0000000580)=0xe8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0, 0x0}, &(0x7f0000000400)=0xc) setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000440)={r2, r3, r5}, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'bridge_slave_0\x00'}) [ 1212.572892] binder: 12975:12980 ERROR: BC_REGISTER_LOOPER called without request [ 1212.595768] binder: release 12975:12980 transaction 3890 in, still active [ 1212.603533] binder: send failed reply for transaction 3890 to 12975:12980 10:11:29 executing program 2: unshare(0x30000100) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x8003) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0xfffffffffffffffe, 0x200000) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000140)={0x0, 0x0, 0x100000001, 0x8}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000001c0)=@assoc_value={r2}, &(0x7f0000000200)=0x8) clone(0x25016000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000280)={0x0, 0x0, 0x5, 0x0, [], [{0x4a74, 0x2, 0x9, 0xff8, 0x6, 0x7fff}, {0x800, 0x81, 0x45, 0x3b4, 0x9, 0x2}], [[], [], [], [], []]}) tkill(r3, 0x10) ptrace$cont(0x18, r3, 0x0, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x200000, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r3, 0x0, 0x0) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000480)) 10:11:29 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x1002}], 0x18}], 0x49249249249276c, 0x0) [ 1212.614363] binder_alloc: binder_alloc_mmap_handler: 12975 20001000-20004000 already mapped failed -16 [ 1212.615207] bridge0: port 1(bridge_slave_0) entered disabled state [ 1212.624108] binder: BINDER_SET_CONTEXT_MGR already set [ 1212.641186] binder: 12975:12980 ioctl 40046207 0 returned -16 10:11:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1212.677974] __nla_parse: 2 callbacks suppressed [ 1212.677988] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1212.682995] binder: undelivered TRANSACTION_COMPLETE [ 1212.717054] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1212.761002] binder: undelivered TRANSACTION_ERROR: 29189 10:11:29 executing program 2: socketpair$unix(0x1, 0x81, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x309000, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000040)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000000280)={{0xa, 0x0, 0x20, 0xb87e, 'syz1\x00', 0x6b3c5115}, 0x2, 0x601, 0x7, r3, 0x1, 0x9, 'syz1\x00', &(0x7f0000000080)=['\x00'], 0x1, [], [0x0, 0x9, 0x2, 0x6]}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) r5 = shmget$private(0x0, 0x4000, 0x4, &(0x7f0000ffa000/0x4000)=nil) shmctl$SHM_INFO(r5, 0xe, &(0x7f0000000140)=""/193) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x10) ptrace$cont(0x18, r4, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r4, 0x0, 0x0) ioctl$KDSIGACCEPT(r2, 0x4b4e, 0x2a) 10:11:29 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:29 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x803, 0x3) ioctl(r2, 0x1000008912, &(0x7f0000000180)="0a5c2d023c126285718070") sendmsg$alg(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000500)="c5d8c8f9f890", 0x6}], 0x1}, 0x0) recvmmsg(r1, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000000)=""/84, 0x54}, {&(0x7f0000000780)=""/98, 0x62}, {&(0x7f0000000280)=""/112, 0x70}, {&(0x7f0000000340)=""/249, 0xf9}], 0x4, &(0x7f0000000440)=""/45, 0x2d}}], 0x4000000000000e9, 0x0, &(0x7f0000000640)={0x77359400}) 10:11:29 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xcc01}], 0x18}], 0x49249249249276c, 0x0) [ 1212.805394] binder: 13006:13007 ERROR: BC_REGISTER_LOOPER called without request [ 1212.879765] binder_alloc: binder_alloc_mmap_handler: 13006 20001000-20004000 already mapped failed -16 [ 1212.935672] binder: BINDER_SET_CONTEXT_MGR already set [ 1212.947113] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1212.947822] binder: 13006:13007 ioctl 40046207 0 returned -16 10:11:29 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$DRM_IOCTL_RES_CTX(r1, 0xc0106426, &(0x7f0000000280)={0x1, &(0x7f0000000080)=[{}]}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x10) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r2, 0x0, 0x0) r3 = memfd_create(&(0x7f0000000000)='\x00', 0x1) ioctl$VIDIOC_DBG_G_CHIP_INFO(r3, 0xc0c85666, &(0x7f0000000140)={{0x2, @addr=0x10000}, "9b79087b33ccfeb0e48d4f072c8584b8b51d0b705fe3cc1c6a559dc7d90b4034", 0x2}) 10:11:29 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x701}], 0x18}], 0x49249249249276c, 0x0) [ 1212.982400] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1213.039926] binder: release 13006:13007 transaction 3892 in, still active [ 1213.061461] binder: send failed reply for transaction 3892 to 13006:13007 [ 1213.110293] binder: undelivered TRANSACTION_COMPLETE [ 1213.130216] binder: undelivered TRANSACTION_ERROR: 29189 10:11:30 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) sync_file_range(r3, 0xe37, 0x3, 0x7) write(r3, &(0x7f0000000340), 0x10000014c) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) ioctl$ASHMEM_PURGE_ALL_CACHES(r3, 0x770a, 0x0) write$FUSE_NOTIFY_POLL(r0, &(0x7f00000001c0)={0x18, 0x1, 0x0, {0xfff}}, 0x18) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000280)={r6, @in={{0x2, 0x4e20, @loopback}}}, 0x84) ioctl$LOOP_SET_DIRECT_IO(r4, 0x4c08, 0xfffffffffffffff8) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:30 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:30 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3700}], 0x18}], 0x49249249249276c, 0x0) 10:11:30 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) dup2(r1, r0) 10:11:30 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) io_submit(0x0, 0x0, 0x0) r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video36\x00', 0x2, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(r1, 0x0, 0x40000003, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) tkill(r1, 0x10) r2 = socket$inet(0x2, 0x80004, 0x9) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000080)=@assoc_value={0x0, 0x5c4}, &(0x7f0000000140)=0x8) ptrace$peek(0x3, r1, &(0x7f0000000200)) getsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000180)={r3, 0x5b, 0x1, 0x9}, &(0x7f00000001c0)=0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:11:30 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x6, &(0x7f0000ffb000/0x3000)=nil, 0x5) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:11:30 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) dup2(r1, r0) 10:11:30 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3900}], 0x18}], 0x49249249249276c, 0x0) [ 1213.370074] binder: 13053:13063 ERROR: BC_REGISTER_LOOPER called without request [ 1213.396300] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1213.401328] binder: release 13053:13063 transaction 3894 in, still active [ 1213.451255] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1213.461689] binder: send failed reply for transaction 3894 to 13053:13063 10:11:30 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:30 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) r0 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x6, 0x400000) ioctl$KVM_ARM_SET_DEVICE_ADDR(r0, 0x4010aeab, &(0x7f0000000080)={0x5, 0x5000}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fe) io_submit(0x0, 0x0, 0x0) clone(0x80000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x10) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x1a, r2, 0x100000000, 0x0) [ 1213.515063] binder_alloc: binder_alloc_mmap_handler: 13053 20001000-20004000 already mapped failed -16 10:11:30 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") pipe2(&(0x7f0000000040), 0x0) r1 = socket$inet(0x10, 0x80003, 0xf) fstatfs(r1, &(0x7f0000000200)=""/160) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000000)) [ 1213.629287] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1213.664738] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1213.715503] binder: undelivered TRANSACTION_COMPLETE [ 1213.720821] binder: undelivered TRANSACTION_ERROR: 29189 10:11:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:30 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200), 0x0) getpeername$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000180)=0x1c) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:30 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xb001}], 0x18}], 0x49249249249276c, 0x0) 10:11:30 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:30 executing program 2: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) ptrace$pokeuser(0x6, r2, 0xfffffffffffffffc, 0x6) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x10) ptrace$cont(0x18, r3, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f0000000080)=""/59) ptrace$cont(0x1f, r3, 0x0, 0x0) 10:11:30 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") pipe2(&(0x7f0000000040), 0x0) r1 = socket$inet(0x10, 0x80003, 0xf) fstatfs(r1, &(0x7f0000000200)=""/160) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000000)) [ 1213.968846] binder: 13103:13106 ERROR: BC_REGISTER_LOOPER called without request 10:11:30 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") pipe2(&(0x7f0000000040), 0x0) r1 = socket$inet(0x10, 0x80003, 0xf) fstatfs(r1, &(0x7f0000000200)=""/160) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000000)) 10:11:30 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xe603}], 0x18}], 0x49249249249276c, 0x0) [ 1214.011483] binder: release 13103:13106 transaction 3896 in, still active [ 1214.027162] binder: send failed reply for transaction 3896 to 13103:13106 [ 1214.042700] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1214.049833] binder_alloc: binder_alloc_mmap_handler: 13103 20001000-20004000 already mapped failed -16 [ 1214.053618] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1214.062751] binder: BINDER_SET_CONTEXT_MGR already set [ 1214.077199] binder: 13103:13106 ioctl 40046207 0 returned -16 10:11:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:31 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1214.148714] binder: undelivered TRANSACTION_COMPLETE [ 1214.154369] binder: undelivered TRANSACTION_ERROR: 29189 10:11:31 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") pipe2(&(0x7f0000000040), 0x0) r1 = socket$inet(0x10, 0x80003, 0xf) fstatfs(r1, &(0x7f0000000200)=""/160) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:31 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x1501}], 0x18}], 0x49249249249276c, 0x0) [ 1214.242315] binder: 13134:13136 ERROR: BC_REGISTER_LOOPER called without request [ 1214.298521] binder_alloc: binder_alloc_mmap_handler: 13134 20001000-20004000 already mapped failed -16 [ 1214.309307] binder: BINDER_SET_CONTEXT_MGR already set [ 1214.326175] binder: 13134:13136 ioctl 40046207 0 returned -16 10:11:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1214.366663] binder: release 13134:13136 transaction 3898 in, still active [ 1214.374355] binder: send failed reply for transaction 3898 to 13134:13136 [ 1214.413202] binder: undelivered TRANSACTION_COMPLETE [ 1214.443086] binder: undelivered TRANSACTION_ERROR: 29189 [ 1214.452249] binder: 13152:13153 ERROR: BC_REGISTER_LOOPER called without request [ 1214.490052] binder: release 13152:13153 transaction 3900 in, still active [ 1214.501902] binder: send failed reply for transaction 3900 to 13152:13153 [ 1214.530104] binder_alloc: binder_alloc_mmap_handler: 13152 20001000-20004000 already mapped failed -16 [ 1214.561681] binder: undelivered TRANSACTION_COMPLETE [ 1214.566812] binder: undelivered TRANSACTION_ERROR: 29189 10:11:31 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:31 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") pipe2(&(0x7f0000000040), 0x0) r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:31 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xf102}], 0x18}], 0x49249249249276c, 0x0) 10:11:31 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000005c0)=0x7fe) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000340)={&(0x7f0000000440)=ANY=[@ANYBLOB="3000df2500000000000000000000000000000000", @ANYRES32=r4, @ANYBLOB="00000d00f7ff00000700f1ff04000a0004000a0004000a001396f14f3cbda6151db35613a31e7cfa88744835181955d24b045705805da698ebfc18b12f4186675b159aeda65903ddce3701568f9ce13aba80f22477475ee2ed47ba3fa7886ba72cfc31d4be475692b0aab0e5c943b1bd7848019b1882078d9b45b49fdd1a58328a9dbf662ba75a2251b6826916d44a397c899da6e6f7edf9ab2378ce4ab70750015a"], 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) fsetxattr$trusted_overlay_nlink(r3, &(0x7f0000000180)='trusted.overlay.nlink\x00', &(0x7f00000001c0)={'U-', 0x9}, 0x28, 0x2) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x3f, &(0x7f00000003c0)="d262f5660bb8b3c53a35f3ddae4788e32d01d0ebcbdce88c69df30fc3d7946e6194d70a77bc7541c22a1b8715ceeef0fb36ead6890f6b156106ad1c7e3c19e41ebad69", 0x43) 10:11:33 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") pipe2(&(0x7f0000000040), 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:33 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x9b01}], 0x18}], 0x49249249249276c, 0x0) 10:11:33 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x2) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r1, 0x0, &(0x7f0000000140)=""/220) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:11:33 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:33 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) pselect6(0x40, &(0x7f0000000100)={0x1, 0x5, 0x6, 0xffffffffffff8001, 0x100, 0xfc4, 0xfffffffffffffff7, 0x2}, &(0x7f0000000180)={0x3f, 0x8, 0x20, 0x5, 0xc3, 0xffff, 0x4, 0x9}, &(0x7f00000001c0)={0x1, 0x101, 0x80, 0xe6, 0x0, 0xfff, 0x6, 0x5}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={0x7}, 0x8}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:33 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1217.019620] binder: 13184:13192 ERROR: BC_REGISTER_LOOPER called without request [ 1217.035119] binder: release 13184:13192 transaction 3902 in, still active [ 1217.046633] binder: send failed reply for transaction 3902 to 13184:13192 [ 1217.057275] binder_alloc: binder_alloc_mmap_handler: 13184 20001000-20004000 already mapped failed -16 10:11:33 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x7d03}], 0x18}], 0x49249249249276c, 0x0) 10:11:33 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1217.068241] binder: BINDER_SET_CONTEXT_MGR already set [ 1217.073826] binder: 13184:13192 ioctl 40046207 0 returned -16 10:11:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:34 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x10) ptrace$cont(0x18, r2, 0x2, 0x0) r3 = dup2(r0, r1) ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) getpeername(r1, &(0x7f0000000000)=@ethernet, &(0x7f0000000080)=0x80) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ioctl$VIDIOC_G_OUTPUT(r0, 0x8004562e, &(0x7f0000000140)) ptrace$cont(0x1f, r2, 0x0, 0x0) [ 1217.157972] binder: undelivered TRANSACTION_COMPLETE [ 1217.167872] binder: undelivered TRANSACTION_ERROR: 29189 10:11:34 executing program 5: socket$inet6(0xa, 0x803, 0x6) r0 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:34 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x6703}], 0x18}], 0x49249249249276c, 0x0) [ 1217.237610] binder: 13214:13216 ERROR: BC_REGISTER_LOOPER called without request [ 1217.305284] binder_alloc: binder_alloc_mmap_handler: 13214 20001000-20004000 already mapped failed -16 [ 1217.339449] binder: BINDER_SET_CONTEXT_MGR already set 10:11:34 executing program 5: socket$inet6(0xa, 0x803, 0x6) r0 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:34 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x9103}], 0x18}], 0x49249249249276c, 0x0) [ 1217.357911] binder: 13214:13216 ioctl 40046207 0 returned -16 10:11:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1217.423277] binder: release 13214:13216 transaction 3904 in, still active [ 1217.434571] binder: send failed reply for transaction 3904 to 13214:13216 [ 1217.483635] binder: undelivered TRANSACTION_COMPLETE 10:11:34 executing program 5: socket$inet6(0xa, 0x803, 0x6) r0 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1217.511795] binder: undelivered TRANSACTION_ERROR: 29189 [ 1217.544907] binder: 13241:13242 ERROR: BC_REGISTER_LOOPER called without request [ 1217.563050] binder: release 13241:13242 transaction 3906 in, still active [ 1217.587064] binder: send failed reply for transaction 3906 to 13241:13242 [ 1217.617161] binder_alloc: binder_alloc_mmap_handler: 13241 20001000-20004000 already mapped failed -16 [ 1217.648294] binder: undelivered TRANSACTION_COMPLETE [ 1217.653624] binder: undelivered TRANSACTION_ERROR: 29189 10:11:34 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r0, &(0x7f0000000100)='security.selinux\x00', &(0x7f0000000180)='system_u:object_r:policy_src_t:s0\x00', 0x22, 0x2) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1, 0x0) 10:11:34 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x2402}], 0x18}], 0x49249249249276c, 0x0) 10:11:34 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r0 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:34 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0xffffff7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1218.015861] __nla_parse: 7 callbacks suppressed [ 1218.015867] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1218.055015] binder: 13266:13268 ERROR: BC_REGISTER_LOOPER called without request [ 1218.064258] binder: release 13266:13268 transaction 3908 in, still active [ 1218.072238] binder: send failed reply for transaction 3908 to 13266:13268 [ 1218.082613] binder_alloc: binder_alloc_mmap_handler: 13266 20001000-20004000 already mapped failed -16 [ 1218.093659] binder: BINDER_SET_CONTEXT_MGR already set [ 1218.099213] binder: 13266:13268 ioctl 40046207 0 returned -16 [ 1218.122410] binder: undelivered TRANSACTION_COMPLETE [ 1218.127627] binder: undelivered TRANSACTION_ERROR: 29189 [ 1218.138361] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1218.154793] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:37 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x100, 0x0) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:11:37 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r0 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:37 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x8a03}], 0x18}], 0x49249249249276c, 0x0) 10:11:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:37 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:37 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_RUN(r1, 0xae80, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0)='nbd\x00') sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x204002}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x20, r3, 0x100, 0x70bd25, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xa3}]}, 0x20}, 0x1, 0x0, 0x0, 0x8040}, 0xc4) write(r2, &(0x7f0000000340), 0x10000014c) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(r4, 0x40086432, &(0x7f0000000100)=0x8) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:37 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r0 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1220.299705] binder: 13282:13289 ERROR: BC_REGISTER_LOOPER called without request [ 1220.323132] binder: release 13282:13289 transaction 3910 in, still active [ 1220.337348] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:37 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xdf02}], 0x18}], 0x49249249249276c, 0x0) [ 1220.343472] binder: send failed reply for transaction 3910 to 13282:13289 [ 1220.362754] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:37 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) r2 = memfd_create(&(0x7f0000000000)='keyringkeyringnodev]:]ppp0\x00', 0x4) ioctl$RTC_EPOCH_SET(r2, 0x4008700e, 0x401) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) [ 1220.394124] binder_alloc: binder_alloc_mmap_handler: 13282 20001000-20004000 already mapped failed -16 [ 1220.410802] binder: BINDER_SET_CONTEXT_MGR already set [ 1220.424551] binder: 13282:13289 ioctl 40046207 0 returned -16 10:11:37 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:37 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1220.548437] binder: undelivered TRANSACTION_COMPLETE 10:11:37 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xda03}], 0x18}], 0x49249249249276c, 0x0) [ 1220.582316] binder: undelivered TRANSACTION_ERROR: 29189 [ 1220.598381] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1220.617186] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:37 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1220.662943] binder: 13322:13328 ERROR: BC_REGISTER_LOOPER called without request [ 1220.692146] binder: release 13322:13328 transaction 3912 in, still active [ 1220.701859] binder: send failed reply for transaction 3912 to 13322:13328 10:11:37 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xb802}], 0x18}], 0x49249249249276c, 0x0) 10:11:37 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1220.718111] binder_alloc: binder_alloc_mmap_handler: 13322 20001000-20004000 already mapped failed -16 10:11:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1220.807285] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1220.838481] binder: undelivered TRANSACTION_COMPLETE [ 1220.843749] binder: undelivered TRANSACTION_ERROR: 29189 [ 1220.856910] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1220.919471] binder: 13352:13354 ERROR: BC_REGISTER_LOOPER called without request [ 1220.942159] binder: release 13352:13354 transaction 3914 in, still active [ 1220.953677] binder: send failed reply for transaction 3914 to 13352:13354 [ 1220.964086] binder_alloc: binder_alloc_mmap_handler: 13352 20001000-20004000 already mapped failed -16 [ 1220.978599] binder: BINDER_SET_CONTEXT_MGR already set [ 1220.984162] binder: 13352:13354 ioctl 40046207 0 returned -16 10:11:37 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:37 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xa202}], 0x18}], 0x49249249249276c, 0x0) 10:11:37 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1221.031653] binder: undelivered TRANSACTION_COMPLETE [ 1221.036851] binder: undelivered TRANSACTION_ERROR: 29189 [ 1221.165193] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:40 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) setxattr$security_evm(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.evm\x00', &(0x7f0000000140)=@v2={0x5, 0x2, 0x0, 0x81, 0x7e, "6fea613f273bd1827ff4c4a8f7c108e0fff5e0d3a47892322be9a2905da702294369de8a868f19c82d279dd58bd2639e28ef8d105a963402516e625f08711611c59bff901384b1a3a40c0a87313760a4c855931ace0a5bd49aeb3d8086c13cc204c2e32876951d2c5d0e2cbbd482cb95e9a752750c993929f7f997a86c7d"}, 0x88, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x10) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r2, 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x2) 10:11:40 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f0000000100)={0x9, 0xda}) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) r2 = creat(&(0x7f0000000040)='./bus\x00', 0x0) r3 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x2007fff) fcntl$setstatus(r2, 0x4, 0x44000) io_setup(0x8, &(0x7f0000000180)=0x0) io_submit(r4, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x1000000}]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000, 0x0, 0x0, 0x3}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:40 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4a01}], 0x18}], 0x49249249249276c, 0x0) 10:11:40 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:40 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1223.516595] binder: 13380:13387 ERROR: BC_REGISTER_LOOPER called without request [ 1223.534179] binder: release 13380:13387 transaction 3916 in, still active [ 1223.541610] binder: send failed reply for transaction 3916 to 13380:13387 [ 1223.556247] __nla_parse: 1 callbacks suppressed 10:11:40 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xf502}], 0x18}], 0x49249249249276c, 0x0) [ 1223.556256] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1223.556729] binder_alloc: binder_alloc_mmap_handler: 13380 20001000-20004000 already mapped failed -16 [ 1223.569351] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1223.584703] binder: BINDER_SET_CONTEXT_MGR already set [ 1223.601477] binder: 13380:13387 ioctl 40046207 0 returned -16 10:11:40 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:40 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:40 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_setup(0x1, &(0x7f0000000000)=0x0) io_submit(r1, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x10) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r2, 0x0, 0x0) [ 1223.632446] binder: 13380:13395 ERROR: BC_REGISTER_LOOPER called without request [ 1223.642777] binder_alloc: 13380: binder_alloc_buf, no vma [ 1223.651503] binder: undelivered TRANSACTION_COMPLETE [ 1223.659320] binder: undelivered TRANSACTION_ERROR: 29189 [ 1223.660302] binder: 13380:13387 transaction failed 29189/-3, size 0-0 line 2973 10:11:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) [ 1223.683171] binder: undelivered TRANSACTION_ERROR: 29189 [ 1223.774024] [ 1223.775712] ====================================================== [ 1223.782023] WARNING: possible circular locking dependency detected [ 1223.788338] 4.20.0-rc3+ #122 Not tainted [ 1223.792385] ------------------------------------------------------ [ 1223.798707] kworker/0:1/1996 is trying to acquire lock: [ 1223.804096] 00000000cef242c9 (&sb->s_type->i_mutex_key#9){++++}, at: __generic_file_fsync+0xb5/0x200 [ 1223.813489] [ 1223.813489] but task is already holding lock: [ 1223.819468] 000000009fe4d73f ((work_completion)(&dio->complete_work)){+.+.}, at: process_one_work+0xb9a/0x1c40 [ 1223.829670] [ 1223.829670] which lock already depends on the new lock. [ 1223.829670] [ 1223.837986] [ 1223.837986] the existing dependency chain (in reverse order) is: [ 1223.845604] [ 1223.845604] -> #2 ((work_completion)(&dio->complete_work)){+.+.}: [ 1223.853837] process_one_work+0xc0a/0x1c40 [ 1223.858597] worker_thread+0x17f/0x1390 [ 1223.863094] kthread+0x35a/0x440 [ 1223.867028] ret_from_fork+0x3a/0x50 [ 1223.871276] 10:11:40 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x9302}], 0x18}], 0x49249249249276c, 0x0) [ 1223.871276] -> #1 ((wq_completion)"dio/%s"sb->s_id){+.+.}: [ 1223.878408] flush_workqueue+0x30a/0x1e10 [ 1223.883091] drain_workqueue+0x2a9/0x640 [ 1223.887687] destroy_workqueue+0xc6/0x9c0 [ 1223.892389] __alloc_workqueue_key+0xe56/0x10a0 [ 1223.897612] sb_init_dio_done_wq+0x37/0x90 [ 1223.902370] do_direct_IO+0x503a/0xc110 [ 1223.906866] do_blockdev_direct_IO+0xc30/0x9db0 [ 1223.912066] __blockdev_direct_IO+0x9d/0xc6 [ 1223.916934] ext4_direct_IO+0xbe6/0x2230 [ 1223.921556] generic_file_direct_write+0x275/0x4b0 [ 1223.927023] __generic_file_write_iter+0x2ff/0x630 [ 1223.932483] ext4_file_write_iter+0x390/0x1420 [ 1223.937714] aio_write+0x3b1/0x610 [ 1223.941779] io_submit_one+0xaa1/0xf80 [ 1223.946188] __x64_sys_io_submit+0x1b7/0x580 [ 1223.951110] do_syscall_64+0x1b9/0x820 [ 1223.955500] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1223.961200] [ 1223.961200] -> #0 (&sb->s_type->i_mutex_key#9){++++}: [ 1223.967892] lock_acquire+0x1ed/0x520 [ 1223.972208] down_write+0x8a/0x130 [ 1223.976252] __generic_file_fsync+0xb5/0x200 [ 1223.981160] ext4_sync_file+0xa4f/0x1510 [ 1223.985863] vfs_fsync_range+0x140/0x220 [ 1223.990430] dio_complete+0x75c/0x9e0 [ 1223.994759] dio_aio_complete_work+0x20/0x30 [ 1223.999690] process_one_work+0xc90/0x1c40 [ 1224.004426] worker_thread+0x17f/0x1390 [ 1224.008910] kthread+0x35a/0x440 [ 1224.012809] ret_from_fork+0x3a/0x50 [ 1224.017018] [ 1224.017018] other info that might help us debug this: [ 1224.017018] [ 1224.025135] Chain exists of: [ 1224.025135] &sb->s_type->i_mutex_key#9 --> (wq_completion)"dio/%s"sb->s_id --> (work_completion)(&dio->complete_work) [ 1224.025135] [ 1224.040381] Possible unsafe locking scenario: [ 1224.040381] [ 1224.046414] CPU0 CPU1 [ 1224.051070] ---- ---- [ 1224.055710] lock((work_completion)(&dio->complete_work)); [ 1224.061430] lock((wq_completion)"dio/%s"sb->s_id); [ 1224.069047] lock((work_completion)(&dio->complete_work)); [ 1224.077256] lock(&sb->s_type->i_mutex_key#9); [ 1224.081928] [ 1224.081928] *** DEADLOCK *** [ 1224.081928] [ 1224.087984] 2 locks held by kworker/0:1/1996: [ 1224.092455] #0: 00000000f034fddd ((wq_completion)"dio/%s"sb->s_id){+.+.}, at: process_one_work+0xb43/0x1c40 [ 1224.102410] #1: 000000009fe4d73f ((work_completion)(&dio->complete_work)){+.+.}, at: process_one_work+0xb9a/0x1c40 [ 1224.112976] [ 1224.112976] stack backtrace: [ 1224.117485] CPU: 0 PID: 1996 Comm: kworker/0:1 Not tainted 4.20.0-rc3+ #122 [ 1224.124580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1224.133921] Workqueue: dio/sda1 dio_aio_complete_work [ 1224.139106] Call Trace: [ 1224.141726] dump_stack+0x244/0x39d [ 1224.145348] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1224.150582] ? vprintk_func+0x85/0x181 [ 1224.154461] print_circular_bug.isra.35.cold.54+0x1bd/0x27d [ 1224.160151] ? save_trace+0xe0/0x290 [ 1224.163858] __lock_acquire+0x3399/0x4c20 [ 1224.167994] ? mark_held_locks+0x130/0x130 [ 1224.172257] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 1224.178174] ? ret_from_fork+0x3a/0x50 [ 1224.182079] ? find_held_lock+0x36/0x1c0 [ 1224.186181] ? depot_save_stack+0x292/0x470 [ 1224.190524] ? lock_downgrade+0x900/0x900 [ 1224.194674] ? zap_class+0x640/0x640 [ 1224.198374] ? do_raw_spin_unlock+0xa7/0x330 [ 1224.202795] ? trace_hardirqs_on+0x310/0x310 [ 1224.207191] ? print_usage_bug+0xc0/0xc0 [ 1224.211252] lock_acquire+0x1ed/0x520 [ 1224.215050] ? __generic_file_fsync+0xb5/0x200 [ 1224.219616] ? lock_release+0xa00/0xa00 [ 1224.223595] ? perf_trace_sched_process_exec+0x860/0x860 [ 1224.229041] ? __bpf_trace_file_check_and_advance_wb_err+0x30/0x30 [ 1224.235364] ? zap_class+0x640/0x640 [ 1224.239079] down_write+0x8a/0x130 [ 1224.242628] ? __generic_file_fsync+0xb5/0x200 [ 1224.247192] ? down_read+0x120/0x120 [ 1224.250912] ? file_write_and_wait_range+0x72/0x100 [ 1224.255910] __generic_file_fsync+0xb5/0x200 [ 1224.260321] ext4_sync_file+0xa4f/0x1510 [ 1224.264395] ? ext4_getfsmap+0xd70/0xd70 [ 1224.268447] ? ext4_release_io_end+0x1b1/0x250 [ 1224.273056] ? rcu_read_lock_sched_held+0x14f/0x180 [ 1224.278110] ? kmem_cache_free+0x24f/0x290 [ 1224.282331] ? ext4_release_io_end+0x1b1/0x250 [ 1224.286895] ? ext4_finish_bio+0xb60/0xb60 [ 1224.291151] ? var_wake_function+0x150/0x150 [ 1224.295568] ? ext4_getfsmap+0xd70/0xd70 [ 1224.299640] vfs_fsync_range+0x140/0x220 [ 1224.303689] dio_complete+0x75c/0x9e0 [ 1224.307488] dio_aio_complete_work+0x20/0x30 [ 1224.311887] process_one_work+0xc90/0x1c40 [ 1224.316104] ? mark_held_locks+0x130/0x130 [ 1224.320337] ? pwq_dec_nr_in_flight+0x4a0/0x4a0 [ 1224.324996] ? __switch_to_asm+0x40/0x70 [ 1224.329040] ? __switch_to_asm+0x34/0x70 [ 1224.333105] ? __switch_to_asm+0x40/0x70 [ 1224.337170] ? __switch_to_asm+0x34/0x70 [ 1224.341251] ? __switch_to_asm+0x40/0x70 [ 1224.345298] ? __switch_to_asm+0x34/0x70 [ 1224.349364] ? __switch_to_asm+0x40/0x70 [ 1224.353402] ? __switch_to_asm+0x34/0x70 [ 1224.357445] ? __switch_to_asm+0x40/0x70 [ 1224.361491] ? __schedule+0x8d7/0x21d0 [ 1224.365363] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1224.369925] ? lock_downgrade+0x900/0x900 [ 1224.374065] ? zap_class+0x640/0x640 [ 1224.377777] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1224.382528] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1224.387096] ? lock_acquire+0x1ed/0x520 [ 1224.391068] ? worker_thread+0x3e0/0x1390 [ 1224.395200] ? kasan_check_read+0x11/0x20 [ 1224.399347] ? do_raw_spin_lock+0x14f/0x350 [ 1224.403665] ? kasan_check_read+0x11/0x20 [ 1224.407800] ? rwlock_bug.part.2+0x90/0x90 [ 1224.412018] ? trace_hardirqs_on+0x310/0x310 [ 1224.416414] worker_thread+0x17f/0x1390 [ 1224.420382] ? __switch_to_asm+0x34/0x70 [ 1224.424432] ? process_one_work+0x1c40/0x1c40 [ 1224.428960] ? zap_class+0x640/0x640 [ 1224.432669] ? find_held_lock+0x36/0x1c0 [ 1224.436731] ? __kthread_parkme+0xce/0x1a0 [ 1224.440963] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 1224.446046] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 1224.451153] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1224.455730] ? trace_hardirqs_on+0xbd/0x310 [ 1224.460071] ? kasan_check_read+0x11/0x20 [ 1224.464229] ? __kthread_parkme+0xce/0x1a0 [ 1224.468457] ? trace_hardirqs_off_caller+0x310/0x310 [ 1224.473545] ? trace_hardirqs_off_caller+0x310/0x310 [ 1224.478646] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 1224.483804] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1224.489346] ? __kthread_parkme+0xfb/0x1a0 [ 1224.493568] ? process_one_work+0x1c40/0x1c40 [ 1224.498046] kthread+0x35a/0x440 [ 1224.501402] ? kthread_stop+0x900/0x900 [ 1224.505379] ret_from_fork+0x3a/0x50 [ 1224.517976] kobject: 'loop3' (0000000067cd768c): kobject_uevent_env 10:11:41 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video37\x00', 0x2, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x800, 0x0) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) [ 1224.524428] kobject: 'loop3' (0000000067cd768c): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1224.541187] kobject: 'loop5' (000000006dfee5f4): kobject_uevent_env [ 1224.547783] kobject: 'loop5' (000000006dfee5f4): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1224.567079] kobject: 'loop1' (0000000095a04eae): kobject_uevent_env 10:11:41 executing program 0: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1224.576425] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1224.584462] kobject: 'loop1' (0000000095a04eae): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 1224.604948] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1224.616734] binder: 13422:13427 ERROR: BC_REGISTER_LOOPER called without request 10:11:41 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x4a03}], 0x18}], 0x49249249249276c, 0x0) [ 1224.631390] kobject: 'loop4' (000000002b755afc): kobject_uevent_env [ 1224.638969] kobject: 'loop4' (000000002b755afc): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1224.643526] binder: release 13422:13427 transaction 3919 in, still active [ 1224.654654] kobject: 'loop2' (00000000b92a15a8): kobject_uevent_env 10:11:41 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:41 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1224.684557] kobject: 'loop2' (00000000b92a15a8): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1224.704321] kobject: 'loop0' (00000000ddec2d1c): kobject_uevent_env [ 1224.712470] kobject: 'loop0' (00000000ddec2d1c): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 1224.716882] binder: send failed reply for transaction 3919 to 13422:13427 [ 1224.723058] kobject: 'loop4' (000000002b755afc): kobject_uevent_env [ 1224.735777] kobject: 'loop4' (000000002b755afc): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1224.763444] kobject: 'loop3' (0000000067cd768c): kobject_uevent_env [ 1224.764810] binder_alloc: binder_alloc_mmap_handler: 13422 20001000-20004000 already mapped failed -16 [ 1224.774432] kobject: 'loop3' (0000000067cd768c): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1224.792528] binder: BINDER_SET_CONTEXT_MGR already set [ 1224.795748] kobject: 'loop5' (000000006dfee5f4): kobject_uevent_env [ 1224.798758] binder: 13422:13427 ioctl 40046207 0 returned -16 [ 1224.811423] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1224.819328] kobject: 'loop5' (000000006dfee5f4): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1224.823813] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:41 executing program 5: socket$inet6(0xa, 0x803, 0x6) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r0 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:41 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xed01}], 0x18}], 0x49249249249276c, 0x0) [ 1224.860822] binder: undelivered TRANSACTION_COMPLETE [ 1224.866077] binder: undelivered TRANSACTION_ERROR: 29189 [ 1224.889942] kobject: 'loop1' (0000000095a04eae): kobject_uevent_env 10:11:41 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1224.919104] kobject: 'loop1' (0000000095a04eae): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 1224.962066] binder: 13462:13463 ERROR: BC_REGISTER_LOOPER called without request [ 1224.974236] kobject: 'loop3' (0000000067cd768c): kobject_uevent_env [ 1224.997255] kobject: 'loop3' (0000000067cd768c): fill_kobj_path: path = '/devices/virtual/block/loop3' 10:11:41 executing program 5: socket$inet6(0xa, 0x803, 0x6) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r0 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:41 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xf500}], 0x18}], 0x49249249249276c, 0x0) [ 1225.004284] binder: release 13462:13463 transaction 3921 in, still active [ 1225.029900] binder: send failed reply for transaction 3921 to 13462:13463 [ 1225.045205] kobject: 'loop5' (000000006dfee5f4): kobject_uevent_env 10:11:41 executing program 5: socket$inet6(0xa, 0x803, 0x6) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r0 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1225.054624] kobject: 'loop5' (000000006dfee5f4): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1225.058877] binder_alloc: binder_alloc_mmap_handler: 13462 20001000-20004000 already mapped failed -16 [ 1225.074827] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1225.095373] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1225.095944] kobject: 'loop4' (000000002b755afc): kobject_uevent_env [ 1225.142227] binder: BINDER_SET_CONTEXT_MGR already set [ 1225.146000] kobject: 'loop4' (000000002b755afc): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1225.162003] binder: 13462:13463 ioctl 40046207 0 returned -16 [ 1225.174890] kobject: 'loop5' (000000006dfee5f4): kobject_uevent_env [ 1225.186087] kobject: 'loop5' (000000006dfee5f4): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1225.220719] binder: undelivered TRANSACTION_COMPLETE [ 1225.225876] binder: undelivered TRANSACTION_ERROR: 29189 [ 1225.228296] kobject: 'loop3' (0000000067cd768c): kobject_uevent_env [ 1225.249903] kobject: 'loop3' (0000000067cd768c): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1225.260808] kobject: 'loop1' (0000000095a04eae): kobject_uevent_env [ 1225.267622] kobject: 'loop1' (0000000095a04eae): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 1225.278098] kobject: 'loop5' (000000006dfee5f4): kobject_uevent_env [ 1225.284586] kobject: 'loop5' (000000006dfee5f4): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1225.455203] kobject: 'loop0' (00000000ddec2d1c): kobject_uevent_env [ 1225.461745] kobject: 'loop0' (00000000ddec2d1c): fill_kobj_path: path = '/devices/virtual/block/loop0' 10:11:44 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) clone(0x1fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:11:44 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:44 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3e01}], 0x18}], 0x49249249249276c, 0x0) 10:11:44 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x0, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:44 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r2, &(0x7f0000000340), 0x10000014c) sendto$inet(r0, &(0x7f0000000100)="3fc9534b7a969632c987", 0xa, 0x4040, &(0x7f0000000180)={0x2, 0x4e23, @multicast2}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0xffffffffffffffe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 1227.659323] kobject: 'loop2' (00000000b92a15a8): kobject_uevent_env [ 1227.661188] binder: 13492:13498 ERROR: BC_REGISTER_LOOPER called without request [ 1227.665802] kobject: 'loop2' (00000000b92a15a8): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1227.692788] binder: release 13492:13498 transaction 3923 in, still active 10:11:44 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xc202}], 0x18}], 0x49249249249276c, 0x0) 10:11:44 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x0, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1227.707694] binder: send failed reply for transaction 3923 to 13492:13498 [ 1227.719800] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1227.734011] binder_alloc: binder_alloc_mmap_handler: 13492 20001000-20004000 already mapped failed -16 [ 1227.735660] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. 10:11:44 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1227.758836] binder: BINDER_SET_CONTEXT_MGR already set [ 1227.767765] kobject: 'loop4' (000000002b755afc): kobject_uevent_env [ 1227.777723] binder: 13492:13511 ioctl 40046207 0 returned -16 [ 1227.778235] kobject: 'loop4' (000000002b755afc): fill_kobj_path: path = '/devices/virtual/block/loop4' 10:11:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:44 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x0, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:44 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x8201}], 0x18}], 0x49249249249276c, 0x0) [ 1227.827214] binder: undelivered TRANSACTION_COMPLETE [ 1227.831384] kobject: 'loop5' (000000006dfee5f4): kobject_uevent_env [ 1227.832653] binder: undelivered TRANSACTION_ERROR: 29189 [ 1227.851303] kobject: 'loop5' (000000006dfee5f4): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1227.865121] kobject: 'loop3' (0000000067cd768c): kobject_uevent_env [ 1227.872637] kobject: 'loop3' (0000000067cd768c): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1227.905113] kobject: 'loop1' (0000000095a04eae): kobject_uevent_env [ 1227.926121] kobject: 'loop1' (0000000095a04eae): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 1227.956626] binder: 13526:13530 ERROR: BC_REGISTER_LOOPER called without request [ 1227.969223] kobject: 'loop4' (000000002b755afc): kobject_uevent_env [ 1227.978217] binder: release 13526:13530 transaction 3925 in, still active [ 1227.983742] kobject: 'loop4' (000000002b755afc): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1227.996061] binder: send failed reply for transaction 3925 to 13526:13530 [ 1228.001771] kobject: 'loop5' (000000006dfee5f4): kobject_uevent_env [ 1228.007657] binder_alloc: binder_alloc_mmap_handler: 13526 20001000-20004000 already mapped failed -16 [ 1228.017503] kobject: 'loop5' (000000006dfee5f4): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1228.019817] binder: BINDER_SET_CONTEXT_MGR already set [ 1228.035854] binder: 13526:13530 ioctl 40046207 0 returned -16 [ 1228.044134] kobject: 'loop0' (00000000ddec2d1c): kobject_uevent_env [ 1228.050853] kobject: 'loop0' (00000000ddec2d1c): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 1228.062377] kobject: 'loop4' (000000002b755afc): kobject_uevent_env [ 1228.069244] kobject: 'loop4' (000000002b755afc): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1228.081636] binder: undelivered TRANSACTION_COMPLETE [ 1228.086798] binder: undelivered TRANSACTION_ERROR: 29189 [ 1228.102343] kobject: 'loop1' (0000000095a04eae): kobject_uevent_env [ 1228.108949] kobject: 'loop1' (0000000095a04eae): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 1228.664433] __nla_parse: 1 callbacks suppressed [ 1228.664441] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1228.701009] kobject: 'loop3' (0000000067cd768c): kobject_uevent_env [ 1228.707486] kobject: 'loop3' (0000000067cd768c): fill_kobj_path: path = '/devices/virtual/block/loop3' 10:11:47 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x2, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r1, &(0x7f0000001740)="4aa5ee61aa4c3aef43f0c8168c14150000888cfa88848872d71f013445c269df2cc5bb201bab10b36a48dd079fd6a7a0a1e683d5c4a3e2256f4eda104f9f46e19ace757c0000009fa806c1200d96b1da840f9d97911f6d021df6bca28c3fda7c3b7051a6d6ee362baede4c97ce5f17933d3738cb9f60e5c663ff4da1abab9c1a274f55c1e6120542b090312ef54d0a", 0x8f) sendmsg$kcm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000180)="be0544b60306a388c3b3d65c341f20ad0278b594951d9e222c04307da31ce0e0d0503d6815234b46b9188e3df652050ef3617ce0e47cfb465783837aed14f88c50f5b5b673e83007a2b662091bc50fce7e", 0x51}, {&(0x7f0000000280)="3ba165775946e61da25f0fdac11c9905884c98b03bd71f266d8cc67ebd271f4d4bff3116b3225a44126687c314e0d272e3673b7048fa229396760c569a5b262d08af886188a293b42e63f1dd13e7854f", 0x50}, {&(0x7f0000000100)="79125179e8baca4da8bbb62f6d10d0577f9dec5e1f906ca18f6634ba14a92968e5d34b5a82b32fd1fe114782c61e3039c2d2c906c5734eaaf96761", 0x3b}, {&(0x7f0000000300)="ce1c0015c81ead80e0012d5f9c3e39cbd29a3601ff141b6f27a820e9eb8f25f412046d46513feeb65c52db8b0797e5eb96cc7f659f4cec599d5d7b83f3e82fddad1ad932f1d27f858c426ea43fa06902ce0c96892a024f8db1e63b", 0x5b}, {&(0x7f0000000380)="e460212049accce31a14247d2a8403a0b6da9f054af302d2d1fa87422029fdbaaf4905cb8cd9a0e8ab6ee54f265daa3f98d888a6ce5131143284f41580cea1dac78b4a0021e9835e89735b06bf0082532089680165380c6249c54a9c994b4dd86267d8afacf6efc289ad34dad4f98fd22b0010f0cda24bc55a8cc0ba291001b12d4403ae2e31e60dbfc437a686b47e6537d73d3f72c49f55445cc83e5b8c35f2e2c2485b4750a0c3ce04468af50eff780c419b55c1b3363e33e8cd81156499c5680b765a9dfa961ab58f1ffc23e05c6cbf58832b1a2210b2332cfb57bf1d12c0d002e77dae7ee433575f44f5", 0xec}, {&(0x7f0000000740)="92c13a1d766e24ad8769b14e13aae916189fc5af71e3e8df31dd601a2921876dc6cd5f837c41919ab78ce6c6763c30c9b9a4bd7e28c9fdc95f06f11b354599de9250cde827f8910a1d8bc84ec51f769b1354bb24cf5fe7e06e0a848a0309e24a82bf44879157a56dfe4c9e6be757b4b639c709b970a31c9a157e0fd4191b59ca9e1304cc5008f3dc0c64e9bc0e9cf092955a7799c12ca4c27133e7533e77512f4ffd2c761a62508c2a20264bfabb6686f1499e12ae886de733ebba681ed8b7b263fb924aa9e3e9e454f131f6239ddd934e2a4e7d1567122c1ef8fd35763ccc9306d53862f6f78a59b5aa2130af63579b7115e9c168fe667c936662fdfa68079fd8de003ba9507785a9a6a50a3e5c0de892ed8f561e8b36435a0849b37c73462750e4715fe672e3fdfba104083a130c1792bbe064f1c293d1886de939a10143c7afa53a89fd8e6849b6b8a34f97b938820e6ffde7c15ae96489a3180abc6a5f17041523c8bb5889e92ffcbc6bc6b28cce2fe2e065d03d23888712701c966c5a556c13660e0463a6ef6c100651f54219147ae819cf5929a8db887a4a38e26c46302a6de21d67125db8f4f628fdd30c192cf7da482c9804e6af169e7b2d0afa3ebaa67bb2a078e694cf30f83657026a268f15cad341f7a0d2ab6d01250bca1d2dafbe4f3a3f4ab7b3d887aab8b75f863e7ec04bd9e79127dd981879e2c8b663e2bdd2485329342d9ebbc0ef2fa158869efa829a265c82faf03a53aeec2f004c5c85f4d388e518d1c1747743d5cbc9e00c0b8f5b5accfde009fdb28ac1012c1b6f79d7eb3e0b7f13d34604b46940f8be130398b18cb8377c739ba116fd99fa2181cb43498d7355e60771cd3bf12cb4a68178b6cac494aca338bbc69016e68c4d20529c8f665da762d7db156ed8e758c63513f92a918fd7012d05f65e2c3b968e21ab6547d040c8ea34c66750c80f5859075984e692b17d4ef2ccc379802b06b6569beb3c62da833d71e4fbb50a6384bfb17781b03522439581aa4d40cd4f735c34c5a31996234aea7ddf1057be34a7bbb0c20a36e8fb6bef79250c6efdf62fb0b58d7bedc2f449e2b408b83fc4dc841dead307715b02b1a115d1a77b584e7a0f3901f514e5d03f6bde452c84a410cddde0aaaf42519e4d2bfee06d75794c07957313e1c7be51c38839bea8d4ba716584b6e08fc0ada709e59066ac67b163a8005dece198ec3609af011d4146203cf6070913b8d39fabff8c2a627917ee6e9ffbcdd15c2829aa078fa1335dcb9851f99965b20e7cf3581f3a346049fea779e89b8de5b834b38f1d404be4be9aadc3f4cf112f1b632f929bb14fbd697f5b857ab7710c6fa7ae4d0a073822c980e447de9284857dcca13217a7c6f9f66cd1a0cfde141d8be8be3985e984edba5391c2928c71afadbce9ef4df3c605595a8fa1a1eeebda30ec53500ec9a86e1b346bd10348dcad68c4195bf83091cba6346ccfd7c2d7914fb911d3e8457146caddd25ab8a09f4fcbc956dc7012174c4751906e2efa8c9efaea819c560004858a252dd9d24613345fbbaf4f78a12152378a9d71d448428928e3eae1d4a8a15056dc080aea46fadf8708f46f31f9ea55cb2e762188528dfee741b9b77dc101a1a64fe2b74eac075c2db7f5278b108c54be1ecdc56d69133c9e4c87726bf2803814b23ea037fc9f259645eceb0c90dbecfabc33a8e5769a5578a8d78579a3231df85bac102bfc2f28d7333b5bf142c2feb3df667094fee52114e4294995ef83db67cf542a6705f20e481c77963bb3ef7b4ce68f2851b337d6f67dfdb1da81b92d56226ae7faa94870c1c29ed19f01956ce79c6072875ae3c8e9ca9e9d9869148d81b097f08f883a594184dc55696aefbf86972d45b6ed66426962eda0c7edf127a30686382adebc96d4e2e6ec8ccf2510f4881c5c8988d48f2121aff8322daad992fc67218ebf1b49fb83e59b83ea7a48ccae2a821a2348f0f46cd934da0f3f16da6f3e43fe69fd3c4038df06e37ba16e161f9bea4dc2bfe924ec08b9b0c5ce3529798f324a244aa2fd4cf39158fb592da0c616e7a195e980be827bf59b0eae1d331bf829b0ef8953291854d611a3069d34e7c94b0bf9ce8c5001de42ea927620c94c31600afab1f39d083c4983c94fccda0f483dc6f5eaab43fbac95d68697ad15f9aa84f862e3523a25109963293f23adb2a8e59f6bb6b717700fa9d9d7245fedcbe33f040cdf61958bfdb6455f620bfa525167cfa4a6c54100be623fee58aa13175abfd2279c13ff52513a948df34b8132a7272715b9ec832833f4b6343e414560591fa566353c533b7ca729c3f9510efecc3ee466506b030d57cee1f43044259f09e323b97214b94b494a46f25b87686ade6d3d8b07f726c2d43507e7012c9443f96e3160f61ea4d33c815ad11706c0c6ea647a8cad7386e72dc839f94caf0aa8d0012e9b757089b3f2adef8563794ba93c817b3ded7194e2d0d2981345acec179f17f71255fb4445286a5377e7353e96119ec91d36503f247ba83b0402647f18b08039651b81f02fe7b826b273916a48a18ffa93b85bfb11ab893c8746377e59c2d4e1ce938deb53cb00ec9cd5d73f533c783dea2df446bfd493a6c83bcadb4e7db86dc1b2eee2b997f9152e69a491a240ab7209fe9291fc042cbc4dbb4a6eec1aa2d06f867aaf22fad2f54ca125dda6d2e17a892f1e07f2d915113e517a02a6ef5bc71ebf92efdf62c138d1b3b6db52e5c0d089fcdc76a6eb10383819ff8deea3094bfa22dcda0daf60052df7f5b5b1a083f605f0174054cc6eaf05aba90327e8792496d6a9f76c82b1b2b342195e352beb25768b69dd63e8ccbc2f9c3de98aec3bea78792eaa74e9b34e3a815ccc8701ecd9b7fb7ae84dfed82f21ac10aecec95bc314bf339c33b6d4a49432a32a9600511623e6d9046c2582c7d4d0a6ad6272517e84e6e1744fe8bd2c42247b1f48a5cdcdaf5be48eca96b59363bc9f2370b44672efdecafd8208585df69515d9248b43ad586df5ea8f4f6e7facdc7e9d3b27380e555c38b8a1956855fb7168fc17d1b90d87279deabfccd3a91aab8ef0c1e5d7ed59ebc4a905a81e7573494bcd540ebe006de30192ad41a1af907bc6ce3611b7e76d9dfb2ec8e17f9e2c839b323416ca1f04e7a6050d016595436e3d550ed145e92b424452bdfbf532a857b9a8cf66ccdf7502d9b64e3b63a5e2f767b867184ea4988a45b426ad2fbe18b604a8c8f72ac7f270a0f07faaf19a4f66169fc5f5324dd0d6a04d24cf59aa47286dd7993344e87187461acafbf0cdf0433d4bfb972eec8b94708df61915072a4e1b4feae3ed8f6cf67bc4442180d072ef1092be609ce023aba02ab735e92c7a98fb36350f7d63a93f1def792b435d605a152e8aa5c5a9c8d95d25d1477520f33e46c73fcb22cbc6b15749642ad2ef9c33f0c2bfebb388a11413f1b5c0b86f7ff1eae22d3a23c11a4e31837e984ee7b03e259a4a0c7b80b35cc6ba2aa757d018350d690fe184c0e6ff2ff833f49dcd5976f2874dd6e739a57e96c900dff7b137684ce327f04bcf194a49362bd30c338323595f982b2dea9f07f1b8191073355999d3ba9d27e9d8a17401eba037e567d81844f34bd14224e9cf4aae9fe0af1e92451cc84048ec383de716f41a927e5f55f12b94bf1357dbbe1a7eb29d7baea31009a27277e6bda478f571d375c3d645a46837a63b25ce66099aa0efadf770ba52cebb9894aa3a53dc9d93ed2990640bd98b47caff90d29123dcdb51a54dcfd78f0384ab2edbbbe98fa2ddca4b530e4af099eca8399149a6b2a825a63121571513185238678cb962e486a3de876b531b2b1e145a9673ad129fe54cb48bd6f5447dc61849258ebad4eda8465509982703ac97d3489047f0da1c1fb8d08e9b4a993fc273095906e46e6143695595d489115cc5590dc9fedda5baddf44fdf4a48807dcff0ae6d572b9bcea09a9ffabbbf04b0206809cc540f56759ca3c9cd20d511eb734a790a15f0470b90d558af0475f38cd09b2b998632187a813ad4f010c427b60e99fafb8bf2cddd97d1cded0121919b77c20a8bc58b552fbdaa9880a482effca810ff9e66ecc0d7aa8a1f999e92bf21686d808ec7f70a297cebb7bc823aab334662e1fd447944196af7a64c951bc01bcd4e80435cc8477dff2fd4e4615b39980ce8d68c2720b59d2d6c6ac8b2f1c90423ab1099036ddc0e84b05a137197ceb32754496a14d75651bdd4c5dfcf33559f92f4a2eeeb3783ad4bce179c7fb91a42f35e1213b313b78c73681cfb608ae7cd2f8432f50c8f868374341e154d43080246a88648ecc0f8f4ec6172e72e32f8bfa26a3bbae9d8dff7945bc447518cd73abd8a77eb5114f656a495d6be6bee2f88defb974ff14f95c5a159d538a7b6ac5cd9b3c31be5554b62c4b865a7fd43474a106e3226287692d4cf50ebdd61367b2a6f325f32749d2cc931a94bcf660c5a07409c5cd1e18ad69021582aff49bd25053d30aec97a0035f24070054a3be28f9c5edb21f45520375e971c9421fa392bcabe3fc5660001403ceed2a597bba7ffa2d0b324fc5b8e29503d1d1a62396d4397c0bb40bbd357497aa271daea777c715afbf154da3da6fa332d0e7a12aea7c358243e227da9d4c6258b161a6babcaaab32e9c97a45d59c660b21a9a3e53769eff2068ebbfaf6f730d2652bc8a69686f2617a13efaf5fe5fdd40a0ed48dd72afbed7ec90c975bdc5873ee9655d6e55386f0d061bbfdc2c31150f75237208042df1fce7549e3460b1d82ef7eeaac1b81272b6e77cc2f88a1028571397b0ef7dc1173bbedb8952c445336f6f4ba69c66e69b9379feb342cb13c86cfb766ca578f7ce51b9a672c12895666579072f753c49f5a068ca34fb927ab72c1460150e62999e3659d7ade722fdcf30650a95438bd5a28cc8ca8bf15531fee787534a19aaa3a8b3d0518ae91c65d4da5db6b9f4f98eac05414a07b3de80c5655a2e5c2523b0b8bcdcee985381bf642bd45b102d6ec290a7a4817f46f151c5555ffb7cc7e563b69c0529bfc513f7f4cc1ce34d2f1c7bc1aa3001ef2c8c7df7bd80652d21371c967b610c53d14b501db20680bc7c331242b379da7b00f86b11565686e51688982bcd201aced394b8a57e2b7184fdefd25d752fdd602dbae3250c4d0c3ceecabb591b3d2f6982f17efc8ac9fbc5e2e83c64817679c46131bbd98e34b69d3274a0a4260b654fc83821b85d43b9e15ad400d5cae90998c256ee37c03bb1aee5229923a96484af8946f53e6f91bb5e5956ada90c687fff2479f7cd1f1b426cccbeb644d5ebfa3f291d1f62a73356b95674b1e4450fa13215bfac872c055d007619feccddb30ac408e8d0c0366ba4693fb4c00e93ded144b88be05781bff5564a583981d06d0b8180872e4098fbf7b623c687336ac101844def633511e67e1dba73b43b7deaecd54676062069976bddaa93911888cf3b49f9cc7f7e2b2d182e633f8b3680d5f78450c71ef72870c132afc03cc7c765c4772899f46bc0196ac4fa9beff2c561ee8ccfa1c70a78c9d775a55df1d2fb59372467e2cebf9d7712d83892a71350113fef8227b9fac3f49224f26be3adab41ca427bfa4d302d81b5c2e688c5fdbd1e873ef8732f1c2eafe57367f8954f0a26267d399a6f4d520742abdb1b6ee868e8f2d2c469ac673d6bc2dfd2b25a49bed39f3d0a3de68b5e1d9ffc314e42039eec81625bab2611013434d23cc00e9f35a7e8055782a0fcd59780b3ccd853f7676a8bb867b65a10bc8c", 0x1000}, {&(0x7f0000000480)="1ffbc5499af9fdd6b28515c7eb451060c66f3a04bb4ceaa0b2c33d92c8a07316491fba7dc7f29fb4c73c6c7a97f490015a4b4ef476678fcbb931aa52873d469d26d033da01553d75a18d735723ec88171277d8ccf0248a8a1f8ec187a46699e1755d9923c7501b184d98858adef7f9adc1f46c3407ad096fb7ff81c51d338e0b4ad55a8d2b8d40e7ed39105049d9a8ad8b97b1cec50f9ed6349fcc5c9e05b2b2b8e53b2c9a7fb4f9dc993c6a3bebd33d2252b08c398fa96eb896f9164dcd2593187fef5ee2ad530480423b9cf408f55473578055232367752cf544ce18fffad032", 0xe1}], 0x7, &(0x7f0000000600)=[{0x30, 0x109, 0xfff, "f5d5e3b803b957724c4dc1108e91f5da097a826060e76aaf325f"}], 0x30, 0x4000080}, 0x40000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:47 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:47 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4001fe) io_submit(0x0, 0x0, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x4b}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 10:11:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:47 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:47 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xfd03}], 0x18}], 0x49249249249276c, 0x0) 10:11:47 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:47 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x3001}], 0x18}], 0x49249249249276c, 0x0) [ 1230.706819] binder: 13546:13551 ERROR: BC_REGISTER_LOOPER called without request [ 1230.708257] kobject: 'loop2' (00000000b92a15a8): kobject_uevent_env [ 1230.725101] binder: release 13546:13551 transaction 3927 in, still active [ 1230.735238] kobject: 'loop2' (00000000b92a15a8): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1230.739360] binder: send failed reply for transaction 3927 to 13546:13551 [ 1230.751876] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1230.759905] binder_alloc: binder_alloc_mmap_handler: 13546 20001000-20004000 already mapped failed -16 [ 1230.763596] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1230.781017] binder: BINDER_SET_CONTEXT_MGR already set [ 1230.787066] binder: 13546:13551 ioctl 40046207 0 returned -16 [ 1230.791504] kobject: 'loop4' (000000002b755afc): kobject_uevent_env 10:11:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:47 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) [ 1230.808881] kobject: 'loop4' (000000002b755afc): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1230.818585] binder: undelivered TRANSACTION_COMPLETE [ 1230.826294] binder: undelivered TRANSACTION_ERROR: 29189 10:11:47 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:47 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x5a00}], 0x18}], 0x49249249249276c, 0x0) [ 1230.853751] kobject: 'loop5' (000000006dfee5f4): kobject_uevent_env [ 1230.867768] kobject: 'loop5' (000000006dfee5f4): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1230.882451] binder: 13572:13574 ERROR: BC_REGISTER_LOOPER called without request [ 1230.891443] binder: release 13572:13574 transaction 3929 in, still active [ 1230.898852] binder: send failed reply for transaction 3929 to 13572:13574 [ 1230.908868] kobject: 'loop1' (0000000095a04eae): kobject_uevent_env [ 1230.915660] binder_alloc: binder_alloc_mmap_handler: 13572 20001000-20004000 already mapped failed -16 [ 1230.922340] kobject: 'loop1' (0000000095a04eae): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 1230.929793] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1230.954904] binder: BINDER_SET_CONTEXT_MGR already set [ 1230.959472] netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. [ 1230.960969] kobject: 'loop3' (0000000067cd768c): kobject_uevent_env [ 1230.978870] binder: 13572:13574 ioctl 40046207 0 returned -16 [ 1230.985536] kobject: 'loop3' (0000000067cd768c): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1230.995927] kobject: 'loop4' (000000002b755afc): kobject_uevent_env [ 1231.002723] kobject: 'loop4' (000000002b755afc): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1231.012297] binder: undelivered TRANSACTION_COMPLETE [ 1231.017740] binder: undelivered TRANSACTION_ERROR: 29189 [ 1231.021043] kobject: 'loop5' (000000006dfee5f4): kobject_uevent_env [ 1231.030405] kobject: 'loop5' (000000006dfee5f4): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1231.040392] kobject: 'loop4' (000000002b755afc): kobject_uevent_env [ 1231.046869] kobject: 'loop4' (000000002b755afc): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1231.056735] kobject: 'loop3' (0000000067cd768c): kobject_uevent_env [ 1231.063191] kobject: 'loop3' (0000000067cd768c): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1231.073773] kobject: 'loop1' (0000000095a04eae): kobject_uevent_env [ 1231.080955] kobject: 'loop1' (0000000095a04eae): fill_kobj_path: path = '/devices/virtual/block/loop1' 10:11:48 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r2, &(0x7f0000000340), 0x10000014c) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000280)) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) r5 = getgid() setregid(r4, r5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r6+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 10:11:48 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)) r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 1231.568149] kobject: 'loop0' (00000000ddec2d1c): kobject_uevent_env [ 1231.577551] kobject: 'loop0' (00000000ddec2d1c): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 1231.600974] kobject: 'loop5' (000000006dfee5f4): kobject_uevent_env [ 1231.607566] kobject: 'loop5' (000000006dfee5f4): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1232.209211] kobject: 'loop0' (00000000ddec2d1c): kobject_uevent_env [ 1232.215688] kobject: 'loop0' (00000000ddec2d1c): fill_kobj_path: path = '/devices/virtual/block/loop0' 10:11:50 executing program 2: r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x100) ioctl$VIDIOC_SUBDEV_G_SELECTION(r0, 0xc040563d, &(0x7f0000000200)={0x0, 0xec, 0x100, 0x1, {0x3, 0x40, 0x0, 0x6}}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) io_submit(0x0, 0x0, 0x0) r2 = accept(r1, 0x0, &(0x7f0000000000)) setsockopt$ALG_SET_AEAD_AUTHSIZE(r2, 0x117, 0x5, 0x0, 0x2) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) ioctl$sock_inet6_SIOCDELRT(r2, 0x890c, &(0x7f0000000140)={@mcast1, @local, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x19}}, 0x4, 0x805, 0x8c4, 0x400, 0x9, 0x40, r3}) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x10) ptrace$cont(0x18, r4, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000280)={[], 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4b}) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000000300)={{0x9, 0x0, 0x3, 0x1, 'syz0\x00', 0x3}, 0x2, 0x10000400, 0x3, r4, 0x4, 0x5cc, 'syz1\x00', &(0x7f00000000c0)=['keyring$#vmnet0@\\lokeyringsecurity[keyringselinux\x00', '%mime_type}+-eth1bdev\x00', 'user\x00', '!\x00'], 0x4f, [], [0x200, 0x1, 0x3, 0xffff]}) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r4, 0x0, 0x0) 10:11:50 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0xb102}], 0x18}], 0x49249249249276c, 0x0) 10:11:50 executing program 3: r0 = socket$inet(0x10, 0x400000000000003, 0x6) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000002c00)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000003180), 0x0, &(0x7f0000003200)=""/233, 0xe9}}, {{&(0x7f0000003580)=@l2, 0x80, &(0x7f00000036c0), 0x3bf, &(0x7f0000003700)=""/139, 0x8b}}], 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="1b0000001200030207fffd946fa283080f00190000000000000031", 0x1b}], 0x1}, 0x0) 10:11:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000080)=[@fda, @fd, @flat={0x73622a85, 0x0, r2}], &(0x7f0000000240)=[0x38]}}}], 0x0, 0x0, 0x0}) 10:11:50 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)) r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:50 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, 0x0) write(r2, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x9, 0x800000000000000, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$DRM_IOCTL_AGP_RELEASE(r0, 0x6431) 10:11:50 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)) r1 = socket$inet(0x10, 0x80003, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000020907041dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:11:50 executing program 4: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000008c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x0, &(0x7f0000000100)=[@assoc={0x18, 0x117, 0x8200}], 0x18}], 0x49249249249276c, 0x0) [ 1233.768880] kobject: 'loop2' (00000000b92a15a8): kobject_uevent_env [ 1233.775332] kobject: 'loop2' (00000000b92a15a8): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1233.797146] binder: 13606:13612 ERROR: BC_REGISTER_LOOPER called without request [ 1233.806929] binder: release 13606:13612 transaction 3931 in, still active