4, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)='\x00', r1}, 0x10) io_setup(0x200, &(0x7f00000001c0)=0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000003c0)={{{@in=@dev, @in6=@loopback}}, {{@in=@local}, 0x0, @in=@loopback}}, &(0x7f00000004c0)=0xe8) io_destroy(r3) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000140)={[], 0x7fffffff, 0x8, 0x0, 0xffffffffffffffcc, 0xffffffffffffff80, r2}) r4 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r4, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000280), &(0x7f00000002c0)=0x14) [ 758.015382] binder: release 2190:2201 transaction 409 out, still active [ 758.044204] binder: 2242:2244 ioctl c018620b 0 returned -14 [ 758.053838] binder: 2241:2243 ioctl c018620b 0 returned -14 09:38:24 executing program 3: r0 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r0, 0x0) lsetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=@random={'user.', 'lo*securityuservmnet1self%keyring.keyring\x00'}, &(0x7f0000000140)='keyrin\t\x00\xb7\xc4\xce\x98R\x9f\x02\xd4\x86\xe0\xb4\x03y\xca\xd1\xbcs\xda\x9e2\xd8{\f\xa1\xd8\xeb\x174\xde\x17\xa3\x13\x0f\x9f%f\x94\r\xb4\"\xbd(\x15\xd4\xca=E\x16\xbekq\xdc\x1e\xff\xc4o)\xe5b\xfe\xecK\x87f\a+U\xcb\xae:\x94\"\v\f\xdb?W\xba\xa9\xab\xa9m\xaf\xbc\xb6\x92.\xf3HF\x8aZ\xf0\xda', 0x66, 0x2) [ 758.107054] binder: 2248:2249 ioctl c018620b 0 returned -14 09:38:24 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000040)={'veth0_to_bridge\x00', 0x9}) r1 = dup2(r0, r0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000100)=0x40000000000b6dd, 0x4) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x2c, &(0x7f0000000080)={0x0, 0x0}, 0x10) 09:38:24 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:24 executing program 4: inotify_init() perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) connect(r0, &(0x7f00000001c0)=@in={0x2, 0x4e20, @local}, 0x80) sendmmsg(r0, &(0x7f00000002c0), 0x4000000000000d7, 0x0) flock(r0, 0x4) 09:38:24 executing program 3: r0 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x4, &(0x7f0000000000)=0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/snmp6\x00') io_cancel(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0xb48, r0, &(0x7f00000000c0)="31eb9cbd1cf4d70c95a01aec08ac758dfecfa746a55793a6f470cc83709f0b405d07afc0f175abf79c5a763128aded964bad", 0x32, 0x356, 0x0, 0x1, r2}, &(0x7f0000000180)) fcntl$getownex(r2, 0x10, &(0x7f0000000100)={0x0, 0x0}) perf_event_open(&(0x7f0000000280)={0x5, 0x70, 0xfffffffffffffffd, 0xfffffffffffffff9, 0x8, 0x10000, 0x0, 0xffffffff7fffffff, 0x3100, 0x1, 0x6, 0x10001, 0x3f7, 0x8, 0x46, 0x0, 0xffffffffffffffc1, 0x3, 0x100000001, 0x4b, 0x6, 0x40, 0xffffffffffffff81, 0x2, 0x9, 0xffffffff, 0x7, 0x1, 0x244, 0x5, 0x2a, 0x9, 0xb4eb, 0xfffffffffffffff8, 0x7f, 0x4, 0x100000000, 0xf704, 0x0, 0xaa9b, 0x1, @perf_config_ext={0x6f, 0x3}, 0x4081, 0x8001, 0x1, 0x9, 0x7fff, 0x3, 0x4}, r3, 0xffffffffffffffff, r0, 0xa) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r0, 0x0) [ 758.174449] binder: 2248:2257 BC_ACQUIRE_DONE node 422 has no pending acquire request [ 758.204054] binder: 2265:2266 ioctl c018620b 0 returned -14 09:38:24 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:24 executing program 4: r0 = socket$inet6(0xa, 0x5, 0x2) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000)=0x80) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) [ 758.257539] binder: 2265:2281 BC_ACQUIRE_DONE node 428 has no pending acquire request 09:38:24 executing program 5: ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000001c0)=0x0) chroot(&(0x7f0000000140)='./file0\x00') perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) getcwd(&(0x7f0000000080)=""/16, 0x10) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) [ 758.310347] binder: 2287:2290 ioctl c018620b 0 returned -14 [ 758.371592] binder: 2287:2300 BC_ACQUIRE_DONE node 431 has no pending acquire request 09:38:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:24 executing program 3: r0 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x2f, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r0, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x2, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x601, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xe72}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x4004) r3 = getpid() syz_open_procfs(r3, &(0x7f0000000280)='net/ip_mr_cache\x00') 09:38:24 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sync() r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x100, 0x0) getsockname$packet(0xffffffffffffff9c, &(0x7f00000000c0)={0x11, 0x0, 0x0}, &(0x7f0000000180)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x201}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)=@deltclass={0xc8, 0x29, 0x8, 0x70bd28, 0x25dfdbfc, {0x0, r4, {0x0, 0x2}, {0xfff1, 0xe}, {0x6, 0xfff3}}, [@tclass_kind_options=@c_atm={{0x8, 0x1, 'atm\x00'}, {0x64, 0x2, [@TCA_ATM_EXCESS={0x8, 0x4, {0x5, 0xfffe}}, @TCA_ATM_FD={0x8, 0x1, r0}, @TCA_ATM_EXCESS={0x8, 0x4, {0xffff, 0xe}}, @TCA_ATM_FD={0x8, 0x1, r1}, @TCA_ATM_FD={0x8, 0x1, r0}, @TCA_ATM_HDR={0x38, 0x3, "8fca099b6ee50e216822083e2bd660bc493c4a53f53905b985a5dfaa23bb018f5f5054ef429117f4d6769c3a336937b26c3c8c"}]}}, @tclass_kind_options=@c_dsmark={{0xc, 0x1, 'dsmark\x00'}, {0xc, 0x2, @TCA_DSMARK_MASK={0x8, 0x4, 0x8}}}, @TCA_RATE={0x8, 0x5, {0x6, 0x200}}, @TCA_RATE={0x8, 0x5, {0x4, 0x8001}}, @TCA_RATE={0x8, 0x5, {0x3, 0x2}}, @TCA_RATE={0x8, 0x5, {0x401, 0x4}}]}, 0xc8}, 0x1, 0x0, 0x0, 0x24000800}, 0x40000) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0xff}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r0, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x0) 09:38:24 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) prctl$PR_SET_NAME(0x25, &(0x7f0000000240)='subj_role') fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x8000, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f00000002c0)={0x0, @aes256}) utimensat(r2, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)={{0x77359400}}, 0x0) syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f0000000040)='./file0\x00', 0xe0, 0x1, &(0x7f0000000100)=[{&(0x7f0000000080)="78241680fc051ae005a29974c70569a7b4fc627f1d2fb3d8d43975262948244128423fc064cc93", 0x27}], 0x1000, &(0x7f00000001c0)={[{@fat=@nfs='nfs'}, {@nodots='nodots'}], [{@subj_role={'subj_role'}}, {@uid_gt={'uid>', r1}}]}) open(&(0x7f0000000300)='./file0\x00', 0x400, 0x4) [ 758.842720] binder: release 2241:2250 transaction 423 out, still active [ 758.851452] binder: release 2242:2251 transaction 418 out, still active 09:38:24 executing program 3: r0 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) alarm(0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0x0, r0, 0x0) [ 758.894146] binder: 2308:2313 ioctl c018620b 0 returned -14 [ 758.901568] binder: 2307:2314 ioctl c018620b 0 returned -14 09:38:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x7fff, &(0x7f0000000240)="0a703dd94eb71c11fe78623aff103b9e5285f10d11d7a69adb34dc4805c722155fb71aab1634679710294b2eaa49fe24cd925933d5336178239119f3b1b7c00c377ef358afedac49fd70b1f71ac7802de6d99aebe256f54eb9b47cc70c638be416b133f7aa6aead3cdd1b749933838d227b3d570444a892220786637d6782e57e686f109124802cb4398197d5fda8466797f8044c7a641f04aef8f8ae8523eb91ca9eae05606ddc492d44cb77ada20980871a71be0bf1af1962db534fd5b968e39b539a60143c4eeed1e087d9cf71581717f2675f67bea2a798cf13c82a619dd578b1d01e6eda19d6ff3c66d1ce9970bd91aa8bff4e30b234f9e28a1bbe617da67f1f09b0f3bb0eb2d506240244c666eb00232e87edf29daf4573b2f41ba18cc3558b5f2719a040a54ca3df88479c8f633542a588dad12b73ef614976731e0fc99be2b18fa9b6bce") clone(0x41fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000080)=0x0) r2 = fcntl$getown(r0, 0x9) rt_tgsigqueueinfo(r1, r2, 0x34, &(0x7f0000000100)={0x3, 0x3ff, 0xffffffffffff8001}) r3 = getpid() rt_tgsigqueueinfo(r3, r3, 0x16, &(0x7f0000000000)) ptrace(0x10, r3) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000180)={0x1, 0x8}, 0x8) open$dir(0x0, 0x0, 0x0) ptrace$getregset(0x4205, r3, 0x2, &(0x7f00000000c0)={&(0x7f0000004540)=""/4096, 0x1000}) 09:38:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:24 executing program 3: perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 758.953556] binder: 2307:2326 BC_ACQUIRE_DONE node 434 has no pending acquire request [ 758.976732] binder: 2308:2332 BC_ACQUIRE_DONE node 437 has no pending acquire request [ 758.993857] binder: 2334:2337 ioctl c018620b 0 returned -14 [ 759.053277] binder: 2334:2342 BC_ACQUIRE_DONE node 440 has no pending acquire request 09:38:25 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbf"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:25 executing program 3: r0 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r0, 0x0) r2 = getpgid(0x0) perf_event_open(&(0x7f00000000c0)={0x3, 0x70, 0x5, 0x0, 0x3, 0x790abc2f, 0x0, 0x20, 0xdf80b, 0xc, 0x3, 0x4, 0x783a, 0x7, 0x2, 0x5, 0x3, 0x5, 0x6, 0x200, 0x1, 0x7, 0x80000000, 0x9, 0x6, 0x7, 0x10001, 0x0, 0x7, 0x0, 0x2, 0x7, 0x650, 0x48, 0x7, 0x5, 0xffff, 0x0, 0x0, 0x8, 0x5, @perf_config_ext={0x8, 0x8}, 0x800, 0x1, 0x5, 0x3, 0x100, 0x1, 0x9}, r2, 0xffffffffffffffff, r1, 0x3) 09:38:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:25 executing program 5: r0 = socket(0x13, 0x80000, 0xff) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000000)={@in6={{0xa, 0x4e22, 0x1, @mcast1, 0x6}}, 0x0, 0x47f691c6, 0x0, "2dbedb729062f66fb7aa79ffc3ff842e1fcdf86a8882dddd6e9a81d2e478ab118ed6af18158b05a9776852707d9beec01dca08b3fd10125f8b5a3d11876b49c03336f64e903ba150fffeb2d911077a17"}, 0xd8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x0, 0x0) ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f0000000140)) mmap(&(0x7f00005a1000/0x200000)=nil, 0x200000, 0x1fffffe, 0x408031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x20000200000011, r1, 0x0) [ 759.112031] binder: release 2287:2290 transaction 430 out, still active [ 759.126689] binder: unexpected work type, 4, not freed [ 759.139904] binder: 2347:2352 ioctl c018620b 0 returned -14 09:38:25 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) fsetxattr$security_capability(r0, &(0x7f0000000000)='security.capability\x00', &(0x7f00000000c0)=@v1={0x1000000, [{0x8189, 0x7ff}]}, 0xc, 0x1) 09:38:25 executing program 3: r0 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f00000000c0)={0x3, 0x70, 0x3, 0x0, 0x3ff, 0x0, 0x0, 0x6, 0x4000, 0x8, 0x7, 0x91c, 0x7f, 0xffffffff, 0x8, 0x7f, 0x9, 0x0, 0xffffffff, 0xfffffffffffffffa, 0x401, 0x6, 0x7, 0x0, 0x2, 0x3d, 0x800, 0x44b8, 0x1, 0xac8, 0x4, 0x1, 0x8, 0x4, 0x7, 0x2, 0x1, 0x0, 0x0, 0x0, 0x6, @perf_config_ext={0x4, 0x6}, 0x8000, 0x0, 0x73, 0x6, 0x1, 0x1, 0x662f}, 0x0, 0xb, r0, 0x8) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r0, 0x0) getsockopt$inet6_tcp_buf(r2, 0x6, 0x21, &(0x7f0000000140)=""/87, &(0x7f0000000000)=0x57) r3 = accept$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000280)=0x1c) r4 = dup3(r1, r1, 0x80000) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f00000003c0)={0x0, @multicast2, @multicast1}, &(0x7f0000000400)=0xc) getsockopt$inet6_buf(r3, 0x29, 0x44, &(0x7f00000002c0)=""/114, &(0x7f0000000340)=0x72) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$KDADDIO(r5, 0x4b34, 0xffff) 09:38:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 759.143579] binder: 2345:2353 ioctl c018620b 0 returned -14 [ 759.161432] binder: 2349:2357 ioctl c018620b 0 returned -14 [ 759.183088] binder: undelivered TRANSACTION_COMPLETE [ 759.189820] binder: 2347:2363 BC_ACQUIRE_DONE node 443 has no pending acquire request [ 759.199157] binder: 2345:2365 BC_ACQUIRE_DONE node 446 has no pending acquire request [ 759.234657] binder: 2373:2375 ioctl c018620b 0 returned -14 [ 759.289218] binder: 2373:2378 BC_ACQUIRE_DONE node 452 has no pending acquire request 09:38:25 executing program 4: inotify_rm_watch(0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000440)=0x0) perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0xe65, 0x2, 0xfff, 0x9, 0x0, 0x8, 0x82001, 0x4, 0x1, 0x0, 0x8, 0x5, 0x0, 0x776, 0x9, 0xffffffff, 0x0, 0x7f, 0x7f, 0x4, 0x3b, 0x3, 0x100, 0xffffffffffffff00, 0x0, 0x8001, 0x9, 0x3, 0xfffffffffffffdfa, 0x2, 0x100000000, 0x1, 0x101, 0xc00, 0x0, 0x1, 0x0, 0x6, 0x3, @perf_bp={&(0x7f0000000000), 0x2}, 0x800, 0x7, 0x3, 0xd, 0x3f, 0x8000, 0x1}, r1, 0xc, r0, 0x3) openat$apparmor_task_exec(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x441, 0x0) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x272, &(0x7f0000000280)={0x8}, 0x8) r3 = dup2(r0, r0) prctl$PR_GET_NO_NEW_PRIVS(0x27) sync() r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r4, 0xc004743e, &(0x7f00000002c0)=""/246) ioctl$BLKBSZSET(r2, 0x40081271, &(0x7f00000004c0)=0x5) r5 = memfd_create(&(0x7f0000000140)='^\x10', 0x0) getresuid(0x0, 0x0, 0x0) write$ppp(r2, &(0x7f0000000500)="64e4f7eade00add7bbb976a79061415d5fd44c402555b387b6894cf978ab21393a4e97e68c088699d41493bd8e5d75583e9b3695115c52c55b844c1f38d11e36e48063119c3a82d426f695e08c81a67ebfc8daf45012fc1c4c266d75cc8c524f4a2e00724a3dd0e8ddefbf43533b0169117b415a7943697db3ff5e05cc36a09b550c2738f55a4094dd068f1544ec5c599a2d83ca19d9e5ecd74972b9f2db1ee23b69fc47262dab5c2cae447424712380594d9231f2fe1b19a6da40514a671ce4584821a20243d1dcabccb9517657779d58d6b83ccbf9545aa81fe8e199f5b2c6ba8026ec630a7383fd43ab4f32470d89e8cdfd49487032ff", 0xf8) setresuid(0x0, 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, 0x0, &(0x7f00000003c0)) pwritev(r5, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r4, r0, 0x0, 0x57865343) mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0xfffffffffffffffc, 0x0) r6 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r6, &(0x7f00000001c0)='cgroup.procs\x00', 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{0x0, 0x0, 0x0}, 0x7ff}], 0x1, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f00000000c0)={@remote, 0x80000001, 0x1, 0x3, 0x5, 0x5bad, 0xffffffff}, 0x20) 09:38:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:25 executing program 3: r0 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r0, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f00000000c0)={0x7, 0x70, 0x477a1f5d, 0xffffffff, 0x9, 0x94c0, 0x0, 0xffffffff, 0x11004, 0x6, 0x10000000000, 0x7, 0x2, 0x6, 0x0, 0x45, 0x7ff, 0xff, 0x400, 0xa322, 0xdf, 0x6, 0xffffffffffffff78, 0x0, 0x40, 0x9, 0x4, 0xfff, 0xb91600000000000, 0x6, 0x4, 0x3, 0x1, 0x8, 0x34fb, 0x4, 0xb191, 0xffffffff, 0x0, 0x7ff, 0x2, @perf_config_ext={0x80, 0x81}, 0x8, 0x7ff, 0xffffffff7fffffff, 0x7, 0x7c0, 0x1, 0x7}) [ 759.792898] binder: 2382:2384 ioctl c018620b 0 returned -14 [ 759.850336] binder: 2382:2389 BC_ACQUIRE_DONE node 455 has no pending acquire request 09:38:25 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:25 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x0, 0x0) ioctl$KDSETKEYCODE(r0, 0x4b4d, &(0x7f0000000200)={0x5c4, 0x6}) r1 = open(&(0x7f0000000240)='./file0\x00', 0x400000, 0x1ef) r2 = openat$cgroup_ro(r1, &(0x7f0000000280)='cpuacct.\x18\x00\x00\x00\x00s\x00\xb6\xd2z9\xbb{\xfc\x9fv>\xe8\xa5/\x97\xea\x19\xcb*\x1e\xa8E\xfa\x1cp\xfep_\xb2\xd6\xf1\xd1!\xc5\x7f^[V\xb1\xd1\x11h\xe5?<\xbdL\xb8\xa04&\v\x96V\'_\xa6\x95\x1c\xc6\x84^A\xcaj\xb5\xb0=\x95\x8d\xd4$?\xa8&\xae\a\x98F\x86\x17\x00', 0x26e1, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f00000000c0)='io.stat\x00', 0x7a05, 0x1700) ioctl$TUNGETFILTER(r3, 0x801054db, &(0x7f0000000300)=""/200) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x4000, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000000)='nv\x00', 0x3) ioctl$PERF_EVENT_IOC_PERIOD(r3, 0x4030582a, &(0x7f0000000040)) getsockopt$IPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x43, &(0x7f0000000140)={'icmp\x00'}, &(0x7f0000000180)=0x1e) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40086602, 0x400007) 09:38:25 executing program 3: r0 = getpid() ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x44) times(&(0x7f0000000000)) r1 = dup(0xffffffffffffffff) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f00000000c0)=[0x7, 0x908]) ioctl$ASHMEM_GET_NAME(r1, 0x81007702, &(0x7f0000000100)=""/158) arch_prctl$ARCH_SET_CPUID(0x1012, 0x2) r2 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7fffffff80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r2, 0x0) 09:38:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:25 executing program 4: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000140), &(0x7f0000000180)=0x10) setxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000000c0)={0x0, 0xfb, 0x4d, 0x3, 0x7, "f2406a4d34bdfe2cf7818d56356b0920", "274fcaaefd443d5960d892401d40ac9db1edde56e504e1dbce74ef541a6be94d5059d81f02e2bccd54562f05bc9d961fe24f15cefe74259e"}, 0x4d, 0x2) r1 = open$dir(&(0x7f0000000000)='./file0\x00', 0x240, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) 09:38:25 executing program 3: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap$perf(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2, 0x21130, r0, 0x0) r1 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x4, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r1, 0x0) 09:38:25 executing program 4: perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1003f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) prctl$PR_SET_NAME(0xf, &(0x7f0000000300)='em1ppr0ScpusftsysL\xc5\xf9z') r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000040)=0x5, 0x4) [ 759.961304] binder: release 2349:2367 transaction 448 out, still active [ 759.986122] binder: 2396:2400 ioctl c018620b 0 returned -14 09:38:25 executing program 5: unshare(0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000200)={'mangle\x00', 0x2, [{}, {}]}, 0x48) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(r0, &(0x7f0000007e00), 0x3ffffeb, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt(r0, 0xffff, 0x6, &(0x7f00000000c0)=""/222, &(0x7f00000001c0)=0xde) sendmmsg(r0, &(0x7f000000ac80), 0x66, 0x0) [ 760.013814] binder: 2403:2405 ioctl c018620b 0 returned -14 [ 760.046125] binder: release 2373:2375 transaction 451 out, still active 09:38:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:25 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) sendmsg$nl_generic(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0xfffffffffffffeec, 0x16, 0x100000000409, 0x0, 0x0, {0xa}, [@nested={0x0, 0x5d, [@generic="51cb87664b2896023e83bdd5a5133fc907fddb7b6cf58e73888b0e4d4f38b97ee18e5110b075c358896c5fb189489e6cebe660d1898f689f5e2527f151066d1223d9ebcb2df43a0c853700e9d76d59d899f0b07b4982d3edf14ec236f0608731cdb12adcd0fa71af5b52012bd92f4fdede2e27eba11a13a63162115940d54ec3bcc28ac95f123fb888b8f54a42a29a884fa3672a931fa54cfb", @generic="88dd31deba57b8896eaab323388d61c07babff14d9be8cb70a318d54583957fe70e1fcf1a826e978cf33fc5b5c16ef4e7048dccb887b506ffa4cabe1bc18b6bffda5c3da29e59615cb34d05bf399b630e770b24adf6f50605b5b6488e1d1e08b341b64cfdc8a0c1fc684160886db264dfebe88f5115d3ae6cc07c76eb7952de795d1c7", @generic="1cdfbba57bb2d57ecb4571c3fcb1d183d6f58ca0592d3365e931cbaccd10c87af2e94f9278e1d3358fe5ea8e2b8a551500a33eafd9703728eb140e86ce7c72c2133dedd8b217d99c9cb71e929649c98beb48288c2b0656d00f5074eb721656ce1dc1a17bbfb7a736500d53cffbe50338bd36f7e2afaaba2847f2711a21a35b458b0b1dd489f281b899147a096a87132561d9a0a6d203eee78aa6fed40bd8a619dbcc63a8e37b32ae1e5be04cb070e1fc4055621d8356347b19d20b3d9c33fa8e38ee05192efbf68a162ae49bed7410f68211dd08b64b567667d912227ffb264b1d2e60a6a9f901531a7acabfbc6ac5172d29fb965910a22104b4a7afd5043648adfb80332c77c2ae465054be7b2de8a95b061a9c7858e35fac01d6d5cc9db0b33b628466e9d7c4910b80dccbbb29cd98c3f14fed7f9dc403541fcf8d277c56dc7b4ccbd4b218f4f5fe91284d50d67a4d3d80337b4b3ba2e8eaebf0d71178d81a9c9cbeece5b573b681989912575efdb69fa7510a1a1eddcf28a214c1e11ebeee04ea2b32ef35e1ba121f5fcaf2ba940bc1d58ef1c17b4144ee8974013b37393e0232d311562d55ef1264d64eb3ea06ce047de7764f15dd44085e302e0f6c326bc69f67a2d50c0e29c65b74a5c5ebd662b8cb0eab652a95de0d9e08157aa8ccc97ff0bb912cefd8b837e285113658bab2022860eefb013258518b5bc7b06490af8ffd5df7f2b627917074fc847a5e7f87b8a7482b14e88f796d43f61799a5137ebe263bebf86bf19a8f9371881fab0c011497bee9efcaa9a41c3f9c419a98b3d9b7897665f60578eb5053de588338d990c34753934269ad22dd9363efe1da85962df925ae2e21b96d2d5bafec89e2fbae0f293d171a181a5de74c44662320d9f0a0ef3ac9eced536cb413313f4b3734bf91429a05a3275ecdcf21a62e46657ca748aead40089b17ddfb0d1b0a4b04c325872bbefe18adfd6540874f49650ab8248fa6f8a62ef64c2d525b2e2c1413a5f0a2bd81174c8f35561b377695492131626dd6a0989ee6e22ef288a8739d8dce2da21f978d941ad6635f36b791eadd72957f66d143692eaf51b432d70b389161d004f21ae04e263241647bb299b775ecb775bec176270a72a5a351dfe48ca99b958f9c2ff1364ee25974a2b6f08446f72a2f743e67e2f01ec31fe7ff58ac60afe003b220d07698277d9ff702b35cb981878c437a7f0a0517f3733252de1cca83e09c48959e071180656e03317c893a963711948f27eedea925ddc418008ff0b89ce2f0dcb967b0f0a88c83a058bba214b00b5d164c1d981d5c5ef76ff604c0b3ba277b2af97bab8302c9ebe42c82231f5fc14518a3b38b637ffdda9aa6a762c158cce1b012c40bc575d0661d0f4ad301a9dacdf0714c2e4a47757a02684fde2cf237fbc76113df2ad1b8678ae3abd6ccd05f7531edbbea0ae9c735846b7bf0ab761267dc20594673b7afe561e7786bfd27706c94efec5c4ff89cd82178848ed7a583836926a0bce88044ab66598c59731a864b2d5be00f07193cf9b4ed493ef9fa538f6239681549704e7aaeb0bd3c0f3fde60aa12879e2a98f19c7c7c11db403a2ed46f8f68997e8437694aeb8330484207d8338d09f9ac10f9e08c5027963baacecf7e7ef29883c5657906b29843c96f255956d3bfdf9b40fb6adc23919532d7f75ff059b5cbbafaf0c2e650d08956e0b34d2a581b3518b15d79d86e0f7ed22e88ff5c32bbcee84bcc4240bdc78052624806aa9c0018787a8801a569467f9293ec75d29398aafb19691ba848cecc8575a1e53cd0fc2bbd26ded372d5e86efb53fc1e73499ab8504b71177ee97634153b1d0b0e0b16a674c513de1175fa1e5b9fe5f183e17f21b26a30126e6b99b6f0457c231b080d83ebdb09ec1f03e75a86153a1ed8c276b772664ff48b9ecabbd4796024d3cc681866fda22686e7421e0d1331f941f838b9df8e14a43533f2fe93b6f8ef4b9699db3e22d5164dd6951fc5d8de36c96adcec5220b3afd011961fc06a1f0c36616e105ba2ac64d2b2134824cd224629cc6be75c3b38fd1e38dd131cbe1a72dffb5ecdbe2d2c42a0031b536af32948eb326a9b9a87b48ef561a8a6b6e3c318264b1064f3c60fe442d0ad7f1c355225c0124df0c005fe295a610b5b2f9ef102c1ef2bb5075a10d811ad098186adf1ccdeb77b802d8612c300f5f907cebd9814c127d5fe384d250bbe264c378ce11ccd1ed217dc1b442b30ed5c48fcc8366cd663d00fc96928e5327bbe49c5a9284043852fe73754a34293d0cad9b32be68a6b0b93ad81a13a9bd45f068f7532e7e03d442c12dbd016e2040eff533f467d80c6e92d5588b27c67351cbac1c9a317396216eb53815b83cd3c6fda3008394c230c91aa79e3068f1a679c1a4f8f1913f982469f76b780aa1c5b1490ee2287022ecd59b16a957f4ed7b47a30141e4d4b928a014894dd52f596762e2433639671cb5cd6f52b16ac936741df1df8e35084b3429618e3932a59401597db1377ee428ea8f880f1e931bc70da4cebf63d3227fee15b77bae6b0f71cf729e23760623afb1c24f9ed94318b00ea311073cb3557bcf5467df5bd49049066c885a69f99d4e8c76a1eeb8f57a445d19934dbdb8fb4ab3e69fc7b0be3d2448e7b498acf3b4a0d7d14815aa45e3277b469b839d5062705feb4a64cfdcc12511abed63aa5b14ff2ee485bd287a0e3f4f379091daede2c6f04a7684f08f3e28fd5a1b670b20e1f3a556a236f3e5c646fec405734b61e746afccf0762ec4a5583a50667d524087a38cc4eafb7ddb523d0a34356affc36b9fb6fc5916a4a2493f20ce86d2ea7d4463bdd209b23d3ff280ce44dc443f93c75a795c7b2e17e365f433852763cb94e6f91e9a305283f35d7bd13c7aa2338451188b87563674e2569ba8f132aff13fb4d9addddba447913dc39bdfa4436a1538b83e64e8e95871be519f54cd9b62aaff96fe24157e1e98458e8d3377604c3d4ecf9a9d9b80eac9555cd9f33a58f0a7981b76d2e95b28265f3aa553c84cb117d2c16ec358f02872b70f577a962bf07929f3bc62689a4854bf11e0f400a0dc687cd1d10c15f38eecbcc14e24fc205e6e54a02d2d4b732b931d8150a93ea7b19db4f63c084525bc3e29ff840b71a0a5f9da9df76907c880326e629e3ab95dd070be9b87cf9618b87f39727dea29696f579b77fe49d1b1a1dc68bc90fc6aa37d2be0ea952c9731d7e56cd647cbe7dcd7d455f8139404096e70d51c6e052a20556cc48f2d88919bda9e95233d2a3b6cdab3a73dee269dff9e69dfc1e35bf27484d5f8ed79c267198966faa5268e22da7cc121fe859dc7aa5411b8327f91244bd06ae623b06fa25eb0c42c56e7fae4aeef3066394f129cba2406805301a8b2ae2c232786313e4e97b627982ead33873e42d4c78483be6222433122b5a27871d2df55f4e9482431c47ee89db57e695e7aaa79b6f94882eacef8f93119eae162a9d959b90896ccf50c2158b756790541ebab764e9cc7842def7baf6595361f8f0ef1187a2a7941ddd7955167800e7b9e63a8e57fed700d7cce82b6be88aa0e8c0457422e8bb274dec230dff56606ac5365d46f2f964147639b27ae3c6baa5d3f333ebf1b05c5141a22ce13d91f6cc4727c60ed10514408740f672ccb9f6762952b2036436e2a473d32a1e7a900807a2edcf1c939a6cf837494598be7b8f9f2d2627e441bab5af0cbdf8dba15ebb796f4ffd0c76404cdf0b236421e300d9362ad28333058f1b0a55901ac7aa239443448b3dde0fcc5640ce28628f3eb340e5176e1438b9cf5f97ca7ba93f192c21a7013d47ddefce31d6da2505cc4772af8f5d99ab7f9495196d403d5984e460b1d153a635171652fdb80181d2280936cba3141f3037e37ad502074466222aecd0fcc3b8f782b0c369ce1ec262c446358841f2c7adc25b740e99600fbbb4f87fcada62eda72abf24bb90df7fa554e61560f4554150389556b9e866d2fd9419db0671bfdd52d194d127eccdcaa653c76774a262242fd1f889810ea112c7ea09f398980dbf482bbae41a7fbf8ef0f1a9449fcfb1d9c08e2b3cec366c54c79b6523f74d1cfaa36d44c3f3f5f0a3a5052d673e0e1b75a6ca546818d5f8c9cc4e7317d27cecf77ebda6e37184ea4f77b7c3c858546a8dd89c6de7687cb166bfd23a911c2213bf3b2758a1293b116fbdc5c3402534ebbf44f6402bd42cfbc5324892b5f25ed94b8db2e229864239e27dc28a147b3dfb3669678f7966e2a17de44cabf40a0316f94d7cb02cb6bc242b77784e8514581af1ae57d14545adea66b0eba09e1b1d299c6f4831f0fc3d454f9e4ec6962ee105008342bb48908be0a19531ca4da5b5130ff8b42162cefcc75d8cf3ee6c3dff61afefda743c6644c9461fbdcbc84f2e889db386cfcf8a59da8a3e32d29493815952336a14760c676ce39bf0470aaf64060e1fb2878f51626f1eceab6220c8cb4050e6951da01434981d85e39723348636e18477cf69a9a016ef3b98086a8dfccf9efbe3f38987e558146df148cccffb4239a96c37d9df9fc5f6fe7e4ec93149483aa47de20e5135f9094b5e237fba9583e9cbbb368c0ae05060e616486bec1c305c7e9241fd33dcd353aa27e51f57c0c839147833e5ba340a040d2300ebd922712b32074b0fc38037cd6b91a56f2c159661cf9d25021c1fd3ef32f75d4f2d79b6d51b03dd4b5e3c7b9fd483af786881873a179a95b901920db3ca9e6895f1bad54347db2ff764d5402e80b6e0be6900b859319f9dde0a84062b0b66f2530a41f6365f0ffbde68ea69963e37b29c6ef66e007cf28fd006ebe712388205a8ff04a65647b5084177b7346cb3e887699187a993227b67458ce2fe3f704d4a0cc697ab65b37c0051774bb2ddda458ca0029abb17cab6c80e09467348051735e79b81d502c7d4a924104bf48d9264a146174d44eba7e841d60441d99e0f78c6628dd50a2ab31f244f6203a91dae5a2d1be8d814af1a2575b3811d2b4a0b6ef03e73c24da1d581609c616b9acad747b41c0dece2ac538ba8744bd4eff5932fd2cba418d4da580fc8fa2f17e40538c4ad4fad07c44487fe2d648d971ff8615f982ab563b7f1a2a714fb9ba210f1007692729808b323bff708e5b38801b8a6ce3cf51783f266b002e5e28bf4eab617ac050e7034de667e91fff71cae3a08e405cde07e74f6f242383b205be78d7d4402d0ab5d12149e0b6918d63e3f15c160a154c469f336986e96b7cd8956291efd3c16993a4f355eec834c8aaa52d5f110add91f225cedef82df2cd476752a0f394c21e44ca290f4b54f64fa877f6ac338f4846a11589e2a81c588550a9c5e5e81a69cfbe8c4b78ea18388cdef78f3e5b5b6c4bb17b7770f920eaefd98d931993c533ac039b6fbf70d0d5b3f3b276299482510e565552786293699faaa44dd3a54b6ae8c602701a0958e9cd2db7f78cb1c8030996cde6443d7c9fb604161ebca20467fefea7e9ccc69d68cce2fa6a71d1400616c950a34e62a0b07cb65eb566d4a4c3e690aade5c103d60401025fe41dae75fc32872709fa6a5cdc5d34974d0e8b937d366206af0e8dd7f13cb3699a581bad97c16533555b7a3a607dac7e6d95784160bec4214d68380b75c2518f823484ef9020db3185946de761b47514e81428c34a4816915c6ae212b033c05e8862913ff420e9f2f8d7aabd91dbb1bbec1eabbf5d15f2baecc0a5e80a153809dccfacccb2629294296b0aa2d40018a156cd2a4257c755d3cf41c65a1cb7", @generic="37b0723bd6410eb8c3ccb6316b8b30b4f4fdea6b2833aa41ce6e6a0c9d3b84e3ecb3", @generic="616a52b5bfbadefed5849c2725499c1872808d7f684d7c7c7d6cacf6381185f3b2381f724dc972ee3aca707e64c91c6f5877b78871d380529f55e0e9"]}]}, 0x1c}}, 0x4) 09:38:25 executing program 3: r0 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x80000000000000}, 0xffffffffffffffff, 0x0, r0, 0x0) 09:38:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 760.062946] binder: 2396:2417 BC_ACQUIRE_DONE node 458 has no pending acquire request [ 760.071477] binder: unexpected work type, 4, not freed [ 760.075245] binder: 2403:2423 BC_ACQUIRE_DONE node 461 has no pending acquire request [ 760.106755] binder: 2421:2430 ioctl c018620b 0 returned -14 [ 760.115759] binder: 2427:2432 ioctl c018620b 0 returned -14 [ 760.135274] binder: undelivered TRANSACTION_COMPLETE [ 760.156332] binder: 2421:2433 BC_ACQUIRE_DONE node 464 has no pending acquire request [ 760.165533] binder: 2427:2435 BC_ACQUIRE_DONE node 467 has no pending acquire request 09:38:26 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:26 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x0, 0x0) getsockopt$inet6_int(r3, 0x29, 0xffffffffffffffff, &(0x7f0000000180), &(0x7f0000000080)=0x4) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r4, &(0x7f0000000200), 0x44000) ioctl$HDIO_GETGEO(r2, 0x301, &(0x7f0000000100)) mmap$perf(&(0x7f0000ff9000/0x7000)=nil, 0x7000, 0x1, 0x11, r3, 0x0) ioctl$BLKROSET(r2, 0x125d, &(0x7f0000000000)=0x9) recvmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000240)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)=""/237, 0xed}, 0x7}, {{&(0x7f00000003c0)=@un=@abs, 0x80, &(0x7f0000000540)=[{&(0x7f0000000440)=""/122, 0x7a}, {&(0x7f00000004c0)=""/121, 0x79}, {&(0x7f0000000740)=""/4096, 0x1000}], 0x3, &(0x7f0000000580)=""/47, 0x2f}, 0x6}], 0x2, 0x40012001, 0x0) 09:38:26 executing program 3: r0 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() perf_event_open(&(0x7f0000000280)={0x3, 0x70, 0x0, 0x42b1519, 0x5, 0x4, 0x0, 0x4, 0x20, 0x8, 0x9, 0x2, 0x40, 0x1, 0x5, 0x61a, 0x7, 0xc19, 0x0, 0x0, 0x765, 0xc28, 0x4, 0x40000000000000, 0x8, 0x7fff, 0x427, 0x100000000, 0x7, 0x100, 0x7, 0x260e, 0xfffffffffffffffd, 0x1, 0x6, 0x1, 0x16, 0x8, 0x0, 0x101, 0x2, @perf_config_ext={0x1f, 0x6}, 0x1, 0x8, 0x3ff, 0x8, 0x8, 0x9, 0x7}, r1, 0xd, 0xffffffffffffffff, 0x0) accept4(0xffffffffffffff9c, &(0x7f00000000c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, &(0x7f0000000140)=0x80, 0x800) getsockopt$IP_VS_SO_GET_TIMEOUT(r2, 0x0, 0x486, &(0x7f0000000180), &(0x7f00000001c0)=0xc) sendfile(r0, r0, &(0x7f0000000000), 0x8) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r0, 0x0) 09:38:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:26 executing program 5: unshare(0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000200)={'mangle\x00', 0x2, [{}, {}]}, 0x48) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(r0, &(0x7f0000007e00), 0x3ffffeb, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt(r0, 0xffff, 0x6, &(0x7f00000000c0)=""/222, &(0x7f00000001c0)=0xde) sendmmsg(r0, &(0x7f000000ac80), 0x66, 0x0) [ 760.801073] binder: release 2403:2405 transaction 460 out, still active [ 760.810304] binder: unexpected work type, 4, not freed [ 760.825931] binder: undelivered TRANSACTION_COMPLETE [ 760.836718] binder: 2441:2443 ioctl c018620b 0 returned -14 09:38:26 executing program 3: r0 = perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10001, 0xb7, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x8) r1 = accept$inet(0xffffffffffffff9c, &(0x7f0000000100)={0x2, 0x0, @empty}, &(0x7f0000000140)=0x10) setsockopt$inet_tcp_buf(r1, 0x6, 0x1b, &(0x7f0000000180)="20ec77f5ebb044bb85289422f8d8823d95e3d79be1adda8d4474c639021c5465e5b025ce56746b7ca7bff68bc1130e6cc650522c50776f4196675224df3b84af7b31fb1faed068337ad13bbd90896fd452c185c30a6d8aa3bd387bdc0abc2f2d82801650", 0x64) perf_event_open(&(0x7f0000000040)={0xfffffffffffffffe, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r0, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x4a0000, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x7, @empty, 0x6}, 0x1c) 09:38:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 760.851320] binder: 2446:2447 ioctl c018620b 0 returned -14 [ 760.887040] binder: 2441:2453 BC_ACQUIRE_DONE node 470 has no pending acquire request 09:38:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x24, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:26 executing program 3: unshare(0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000200)={'mangle\x00', 0x2, [{}, {}]}, 0x48) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(r0, &(0x7f0000007e00), 0x3ffffeb, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt(r0, 0xffff, 0x6, &(0x7f00000000c0)=""/222, &(0x7f00000001c0)=0xde) sendmmsg(r0, &(0x7f000000ac80), 0x66, 0x0) [ 760.908630] binder: release 2427:2432 transaction 466 out, still active [ 760.916848] binder: 2446:2459 BC_ACQUIRE_DONE node 473 has no pending acquire request [ 760.926211] binder: unexpected work type, 4, not freed [ 760.936888] binder: 2458:2462 ioctl c018620b 0 returned -14 09:38:26 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 760.941440] binder: 2463:2465 ioctl c018620b 0 returned -14 [ 760.982556] binder: undelivered TRANSACTION_COMPLETE [ 760.997576] binder: 2471:2474 ioctl c018620b 0 returned -14 09:38:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 761.003721] binder: 2458:2472 BC_ACQUIRE_DONE node 476 has no pending acquire request [ 761.096919] binder: 2471:2480 BC_ACQUIRE_DONE node 482 has no pending acquire request 09:38:27 executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r0, 0x107, 0x15, 0x0, &(0x7f0000000000)) fsetxattr$security_evm(r0, &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@v1={0x2, "1aba4de591323d634459fda17c01115fdd"}, 0x12, 0x3) openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x101800, 0x0) 09:38:27 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) write(r0, &(0x7f0000000100)="62595b46a3db40", 0x7) signalfd4(r0, &(0x7f0000000000)={0xcb73}, 0x8, 0x80800) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) timerfd_settime(0xffffffffffffffff, 0x0, &(0x7f0000000080), 0x0) 09:38:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:27 executing program 3: syz_mount_image$vfat(&(0x7f0000000040)='vfat\x00', &(0x7f0000000080)='./bus\x00', 0x80, 0x723834f1e37f5f56, 0x0, 0x200000, 0x0) 09:38:27 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0) [ 761.731647] binder: release 2458:2462 transaction 475 out, still active [ 761.756409] binder: unexpected work type, 4, not freed [ 761.771696] binder: undelivered TRANSACTION_COMPLETE [ 761.778609] binder: release 2463:2473 transaction 478 out, still active 09:38:27 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @multicast1}, 0x10) r1 = inotify_init1(0x0) fcntl$dupfd(r1, 0x5, 0xffffffffffffffff) 09:38:27 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xc000, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000180)={{0x1, 0x0, 0x20, 0x0, 0x2}, 0x2, 0xfffffffffffffffb, 'id0\x00', 'timer1\x00', 0x0, 0x400, 0x10001, 0xffffffff, 0x18000000}) fchmodat(r0, &(0x7f0000000100)='./file1\x00', 0x104) lseek(r0, 0x2, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x1) 09:38:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x24, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:27 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0x0, &(0x7f0000000700)="2ba063fb30"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 761.807176] binder: release 2471:2474 transaction 481 out, still active [ 761.814338] binder: unexpected work type, 4, not freed [ 761.819618] binder: undelivered TRANSACTION_COMPLETE 09:38:27 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xc000, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000180)={{0x1, 0x0, 0x20, 0x0, 0x2}, 0x2, 0xfffffffffffffffb, 'id0\x00', 'timer1\x00', 0x0, 0x400, 0x10001, 0xffffffff, 0x18000000}) fchmodat(r0, &(0x7f0000000100)='./file1\x00', 0x104) lseek(r0, 0x2, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x1) [ 761.856196] binder: 2508:2511 ioctl c018620b 0 returned -14 [ 761.858111] binder: 2510:2513 ioctl c018620b 0 returned -14 [ 761.862894] binder: 2509:2512 ioctl c018620b 0 returned -14 09:38:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:27 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xc000, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000180)={{0x1, 0x0, 0x20, 0x0, 0x2}, 0x2, 0xfffffffffffffffb, 'id0\x00', 'timer1\x00', 0x0, 0x400, 0x10001, 0xffffffff, 0x18000000}) fchmodat(r0, &(0x7f0000000100)='./file1\x00', 0x104) lseek(r0, 0x2, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x1) 09:38:27 executing program 5: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = epoll_create1(0x80000) r1 = dup(r0) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0xffffffffffffffff) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000080)={r1, 0x50}, 0x10) fcntl$lock(r2, 0x7, &(0x7f0000027000)={0x1}) fcntl$lock(r2, 0x7, &(0x7f00000004c0)={0x2, 0x0, 0x2, 0x2}) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000100)="0bc11d81c79695b2b2d36666947fbdeb", 0x10) 09:38:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 761.953062] binder: 2508:2523 BC_ACQUIRE_DONE node 485 has no pending acquire request [ 761.991504] binder: 2527:2528 ioctl c018620b 0 returned -14 09:38:27 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xc000, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000180)={{0x1, 0x0, 0x20, 0x0, 0x2}, 0x2, 0xfffffffffffffffb, 'id0\x00', 'timer1\x00', 0x0, 0x400, 0x10001, 0xffffffff, 0x18000000}) fchmodat(r0, &(0x7f0000000100)='./file1\x00', 0x104) lseek(r0, 0x2, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x1) 09:38:27 executing program 5: ioctl$SNDRV_TIMER_IOCTL_GSTATUS(0xffffffffffffffff, 0xc0505405, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) write$binfmt_elf64(r0, &(0x7f0000004000)=ANY=[@ANYRESHEX], 0x12) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f00000001c0), 0xa198) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) 09:38:27 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xc000, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000180)={{0x1, 0x0, 0x20, 0x0, 0x2}, 0x2, 0xfffffffffffffffb, 'id0\x00', 'timer1\x00', 0x0, 0x400, 0x10001, 0xffffffff, 0x18000000}) fchmodat(r0, &(0x7f0000000100)='./file1\x00', 0x104) lseek(r0, 0x2, 0x0) [ 762.053999] binder: 2527:2536 BC_ACQUIRE_DONE node 494 has no pending acquire request 09:38:28 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xc000, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000180)={{0x1, 0x0, 0x20, 0x0, 0x2}, 0x2, 0xfffffffffffffffb, 'id0\x00', 'timer1\x00', 0x0, 0x400, 0x10001, 0xffffffff, 0x18000000}) lseek(r0, 0x2, 0x0) 09:38:28 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xc000, 0x0) lseek(r0, 0x2, 0x0) 09:38:28 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) 09:38:28 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:28 executing program 5: pipe2$9p(&(0x7f0000000040), 0x80000) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x70d) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpu.stat\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200)=0x3, 0x12) socketpair(0x0, 0x0, 0x1000, 0x0) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000000)={0x1, 0x2, [@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @remote]}) getpid() setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000040)=0x6, 0x4) openat$cgroup_int(r0, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x1ff) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$void(r2, 0xc0045c79) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) gettid() preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 762.657276] binder: release 2509:2520 transaction 490 out, still active [ 762.668506] binder: release 2510:2518 transaction 487 out, still active [ 762.696880] binder: 2559:2561 ioctl c018620b 0 returned -14 09:38:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:28 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0x2, 0x0) 09:38:28 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0x2, 0x0) [ 762.802230] binder: release 2527:2528 transaction 493 out, still active [ 762.812643] binder: unexpected work type, 4, not freed [ 762.817927] binder: undelivered TRANSACTION_COMPLETE [ 762.845624] binder: 2567:2573 ioctl c018620b 0 returned -14 [ 762.852351] binder: 2572:2576 ioctl c018620b 0 returned -14 09:38:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x12, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d45"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 762.902077] binder: 2567:2579 BC_ACQUIRE_DONE node 500 has no pending acquire request [ 762.927751] binder: 2572:2581 BC_ACQUIRE_DONE node 503 has no pending acquire request 09:38:28 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0x2, 0x0) 09:38:28 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) [ 762.963202] binder: 2584:2589 ioctl c018620b 0 returned -14 [ 762.969813] binder: 2587:2588 ioctl c018620b 0 returned -14 [ 763.024761] binder: 2584:2595 BC_ACQUIRE_DONE node 506 has no pending acquire request 09:38:28 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) 09:38:29 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 763.504743] binder: release 2559:2564 transaction 496 out, still active [ 763.516593] binder: 2602:2603 ioctl c018620b 0 returned -14 09:38:29 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) mkdir(&(0x7f0000508ff6)='./control\x00', 0x0) r0 = inotify_init1(0x7fc) r1 = gettid() fcntl$setown(r0, 0x8, r1) fcntl$setsig(r0, 0xa, 0x20) lseek(r0, 0x2000, 0x3) inotify_add_watch(r0, &(0x7f0000000080)='./control\x00', 0xa4000960) open(&(0x7f00003f5000)='./control\x00', 0x0, 0x0) 09:38:29 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(r0, r2) 09:38:29 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) 09:38:29 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = getpgrp(0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$PPPIOCDISCONN(r1, 0x7439) r2 = gettid() rt_sigprocmask(0x0, &(0x7f0000000100)={0xfffffffffffffffe}, 0x0, 0x8) rt_tgsigqueueinfo(r0, r2, 0x7, &(0x7f00000001c0)={0x0, 0x0, 0x30005}) signalfd4(0xffffffffffffffff, &(0x7f0000000080), 0x8, 0x0) r3 = memfd_create(&(0x7f0000000240)='#em1#+\x00y\x1f\x8fn?\n|\x9c\xe3\xe7\xdb\xbc\\y,\x8d\t\x89{W\xc5\xbcB9pE\xdb\xd01\x9a\'%n\xdf,\xfeQT\x8a^\xc6\xf2\x13\x9akhJ\xfe\xc0\x14\x04\xc2\xa1\xd7\x7fQ3+H\xd0t\xbd\xa7\xceN\xc5\xcf\x85z\xaa\nI\xdde\a\r\xcep\xd5\x89\xf8\x92\xd0\x8f|d\x86\n\v\xda\x91\xf3f\xf4\xb2\xf7\x18\xde\xf3w\x03\x98\xa9\x8fv83\x9cg\xfa\xe1F+S#\xa0\xbcc\xf4\xe2\xb1)yx6\xc0v\xd9q\b`\xcf\x13\x9f(l\xe1\xe1R\xa6\xe8^\xd0\x14FbV\x9a\xde]\xfb\x9d\x7f\xed\xfb\xd8\xdb=\xb8f\x9f\x7fj\xbd\a\xab\xab~bH\xb9\x15>\xc7g\xb1\x96hj\x86\xe7\xba)kq\x16I\xb9\x97g\xf0%\xdc.\xf3\xb9\xbcm\x88/\xf5\x8d\x87*y\xa2,X\xd1-d\x83T0r\xbb\x9c\xe8n\\;\\\x1eS\x9d', 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000140)) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x0, 0x1d, r3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x187) openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0) r4 = socket$inet6(0xa, 0x4, 0x0) r5 = dup(r4) bind$inet6(r4, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @rand_addr, 0x8000000000000000}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_int(r4, 0x6, 0x19, &(0x7f0000000180)=0x6, 0x4) sendmsg$TIPC_CMD_SET_NETID(r5, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10004}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x302, 0x70bd2b, 0x25dfdbfd, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0x7}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0xc004}, 0x40080d0) r6 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x7fff) sendfile(r5, r6, 0x0, 0x8000fffffffe) 09:38:29 executing program 3: mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) 09:38:29 executing program 3: mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) 09:38:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:29 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x28}}, 0xfffffffffffffdfb) setxattr(&(0x7f0000000340)='./file0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="e874553872d9a59b"], 0x0, 0x0, 0x2) unshare(0x40000000) r1 = socket(0x0, 0x0, 0x81b3) getsockopt$sock_int(r1, 0x1, 0x27, &(0x7f0000000200), &(0x7f00000003c0)=0x4) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f00000000c0)) r3 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0xffffffffffffff56) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r3, 0xc0046686, &(0x7f0000000240)={0x3, 0x61, "8bc3783cdb0075b4dbeebe311f600603d570a9a1e119eda69dece8b6f13683be68cf37c5b1bbe18e6c8555132c4627873a6f49b7fb86f998730fd90e00540e0abd27d7b83eaa6975f8d1f3c211827e008efd5e098eed07696f4944654cdede71bf"}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000380)='/dev/zero\x00', 0x84000, 0x0) ioctl$TUNSETVNETBE(r4, 0x400454de, &(0x7f0000000000)=0x10401) socketpair(0xd, 0x0, 0x7fffffffe, &(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2e, 0xffffff84}}, &(0x7f0000000180)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2'}, 0x48) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', r7}, 0x10) close(r5) r8 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000600)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$cgroup_int(r8, &(0x7f0000000640)=0xa, 0x1e) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') creat(&(0x7f0000000100)='./bus\x00', 0x0) write$binfmt_elf64(r8, &(0x7f0000000700)={{0x7f, 0x45, 0x4c, 0x46, 0x7, 0xafbc, 0x5, 0xffff, 0x7, 0x3, 0x3, 0x6, 0x33e, 0x40, 0x37c, 0x1, 0x8, 0x38, 0x2, 0x7ff, 0x80, 0x5}, [{0x4, 0x1, 0x3, 0x7, 0x1ff, 0x10000, 0x8, 0x4}, {0x7, 0x10001, 0x100, 0x9, 0xab6, 0x1000, 0x7ff}], "c9a9e83b0151aba22a6f7326c8241ff41d8659a9a79405cb8066df2e179332e63cb745c6815b9ce0b4d4680fade5a6aacc3fb2ddcf58781673e6cf299e5e8a46948583089772b2291f4679f394ba0b2c652b0e6c4edb0bc30b6315da643c3b46e985f7691cce6eaa4b92caccf9d93f809206694668b2"}, 0x126) 09:38:29 executing program 3: mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) [ 763.765985] binder: release 2587:2593 transaction 508 out, still active [ 763.787383] binder: release 2584:2589 transaction 505 out, still active 09:38:29 executing program 3: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) [ 763.812517] binder: 2624:2627 ioctl c018620b 0 returned -14 [ 763.814136] binder: unexpected work type, 4, not freed [ 763.814139] binder: undelivered TRANSACTION_COMPLETE [ 763.834377] binder: 2628:2631 ioctl c018620b 0 returned -14 [ 763.897344] binder: 2628:2639 BC_ACQUIRE_DONE node 515 has no pending acquire request [ 763.905338] binder: 2624:2636 BC_ACQUIRE_DONE node 518 has no pending acquire request [ 763.932409] device lo entered promiscuous mode [ 764.163167] Y­4`Ò˜: renamed from lo 09:38:30 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:30 executing program 3: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) 09:38:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:30 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(r0, r2) 09:38:30 executing program 3: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) 09:38:30 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) [ 764.323942] binder: release 2602:2605 transaction 511 out, still active [ 764.354582] binder: 2652:2655 ioctl c018620b 0 returned -14 [ 764.364881] binder: 2651:2656 ioctl c018620b 0 returned -14 09:38:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 764.420824] binder: 2651:2663 BC_ACQUIRE_DONE node 524 has no pending acquire request [ 764.430428] binder: 2652:2662 BC_ACQUIRE_DONE node 521 has no pending acquire request [ 764.475748] binder: 2667:2670 ioctl c018620b 0 returned -14 [ 764.529062] binder: 2667:2672 BC_ACQUIRE_DONE node 527 has no pending acquire request 09:38:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x12, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d45"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:30 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) [ 764.601422] binder: release 2624:2627 transaction 517 out, still active [ 764.628164] binder: 2678:2679 ioctl c018620b 0 returned -14 [ 764.648864] binder: unexpected work type, 4, not freed [ 764.654159] binder: undelivered TRANSACTION_COMPLETE [ 764.734140] Y­4`Ò˜: renamed from lo 09:38:30 executing program 5: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = dup(r0) getsockopt$inet_buf(r1, 0x0, 0x0, &(0x7f0000000100)=""/161, &(0x7f0000000000)=0xa1) keyctl$session_to_parent(0x12) mknodat(r1, &(0x7f0000000040)='./file0\x00', 0x100, 0x12731210) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) close(r2) accept4(r3, 0x0, 0x0, 0xfffffffffffffffe) futimesat(r1, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={{0x77359400}}) dup2(r2, r2) 09:38:30 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:30 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(r0, r2) 09:38:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbf"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:30 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) 09:38:30 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) 09:38:30 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) [ 764.830376] binder: 2687:2690 ioctl c018620b 0 returned -14 [ 764.845098] binder: 2691:2693 ioctl c018620b 0 returned -14 09:38:30 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) r1 = dup(r0) getsockopt$netlink(r1, 0x10e, 0x1, &(0x7f0000000000)=""/204, &(0x7f0000000100)=0xcc) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x20000001) 09:38:30 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x7c) lseek(r0, 0x2, 0x0) [ 764.887722] binder: 2687:2701 BC_ACQUIRE_DONE node 533 has no pending acquire request 09:38:30 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x7c) lseek(r0, 0x2, 0x0) 09:38:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:31 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x7c) lseek(r0, 0x2, 0x0) 09:38:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 765.435255] binder: release 2678:2685 transaction 529 out, still active [ 765.464660] binder: 2720:2721 ioctl c018620b 0 returned -14 [ 765.519470] binder: 2720:2723 BC_ACQUIRE_DONE node 539 has no pending acquire request 09:38:31 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:31 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) write$P9_RLOCK(r1, &(0x7f0000000080)={0x8, 0x35, 0x2, 0x2}, 0x8) r2 = getpgid(0xffffffffffffffff) r3 = syz_open_procfs(r2, &(0x7f0000000380)='net/raw\x00') preadv(r3, &(0x7f00000017c0), 0x1be, 0x400000000074) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00') getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) getsockopt$inet_mreqn(r3, 0x0, 0x20, &(0x7f0000000300)={@rand_addr, @empty, 0x0}, &(0x7f0000000340)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000240)={'team0\x00', r5}) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x16a00000}, 0xc, &(0x7f0000000540)={&(0x7f00000005c0)=ANY=[@ANYBLOB="50010000", @ANYRES16=r4, @ANYBLOB="08002dbd7000ffdbdf250000000008000100", @ANYRES32=r5, @ANYBLOB="4400020040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r6, @ANYBLOB="080007000000000008000100", @ANYRES32=r7, @ANYBLOB="e800020038000100240001006e6f746959795f70656572735f636f036e740000000000004ee525ea93585e3166c93e050000000000000000080003000300000008000400a00000003c00010024000100656e61626c656400000000000000000000000000000000000000000000000000080003000600000004000400080006007107bbbca5b1a63990d18458de0cabdcd879341efd40cdb63b2c312200c0", @ANYRES32=r8, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400f09b000038000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000080003000300000008000400310c0000"], 0x150}, 0x1, 0x0, 0x0, 0x8000}, 0x4) 09:38:31 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x7c) lseek(r0, 0x2, 0x0) 09:38:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 765.637531] binder: release 2687:2690 transaction 532 out, still active [ 765.664030] binder: 2728:2732 ioctl c018620b 0 returned -14 [ 765.678693] binder: 2733:2735 ioctl c018620b 0 returned -14 09:38:31 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) [ 765.681989] binder: unexpected work type, 4, not freed [ 765.681993] binder: undelivered TRANSACTION_COMPLETE [ 765.682062] binder: release 2691:2704 transaction 535 out, still active [ 765.715848] binder: 2729:2737 ioctl c018620b 0 returned -14 09:38:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:31 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0x2, 0x0) [ 765.733164] binder: 2728:2739 BC_ACQUIRE_DONE node 542 has no pending acquire request 09:38:31 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f00000000c0)=0x2, 0x8b, 0x0, &(0x7f0000000080)={0x0, 0x989680}, 0x0, 0x0) 09:38:31 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0x2, 0x0) 09:38:31 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 765.774594] binder: 2729:2744 BC_ACQUIRE_DONE node 545 has no pending acquire request [ 765.777781] binder: 2733:2746 BC_ACQUIRE_DONE node 548 has no pending acquire request 09:38:31 executing program 5: r0 = open(&(0x7f0000000240)='./file0/file0\x00', 0x20001, 0x8) openat$cgroup_subtree(r0, &(0x7f0000000280)='cgroup.subtree_control\x00', 0x2, 0x0) mkdir(&(0x7f0000000500)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x808000000000002, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) mkdirat(r1, &(0x7f0000000540)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) mkdir(&(0x7f0000000440)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000140)=0xc) sendmsg$nl_netfilter(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="341600000501000129bd7000fcdbdf2502000005e0147d0008002800000000006624a1b04ce3ffd478e39370859fde4df640cd6f064524f233187b2ca941a576ccedae880dac584b68b94f0f31e099e8388dd9013d9e1be32965d1b721897c0b5333c8168e91c0e8dcbe238b473eeb2ae4d277076852b4796d402d447ebb4a0bdd0f4fb63c8f30722d19e783c54967a34c0e1d9c9daf9974d8f63436b5b5d104b0f2a9231eda1f0ddbdecb742f30e904182537761493eb376ce95a5ad7cf30a5a20ba8338123109926acc15d75a75ea310b9904ddc1900e7f46579535e06602eef251f95cb2fd0c1130147a25ff0fe52f701123caf9ed8f112deef9f1001bf1ec6c44048709e1122c620279ebfe0bdd65eb720cb95916be24a75c40e320ef915047cf94f4c5eab1282e548cc31899602aa946040435a0d5e0cf7531d70bb73391845a8762d1f13d0f42bf75eeea2afa6d78f0547f2a4b77bc394eacdf6e8ebb99533700b56bf1a783b484a7c60c6839156ccec434cb1aa14bf94e856882355c2a2bff20610881b9fdd9c2141a45afa63e8bc8422fabc95d426ba42679f60e53d1998b63e0179dad185fdbfa9b2e0310fc275690ddfa6f4dc20e2751fe0f31bc53a24c83d6db239e47b0c7e1c40c630c2f1c6d552dde35e350013eb51c3e2c480cb2ae0481ce0bf3f544554dab977f3fc969a0018c7551c24899f0bc5579128e0b33665e50f63455ca37ff002feebf8b3e5a520b59721c2d9444ef35c4d9260080d34042054c64e97ded62b7873fc61a87e3782afb27fe6172cf3b93fcb6cb6908f528c6fbcc9b6d2bc3ecffc4a2f85a955412afa8d6760e1d05e72d0a35131f46bc23d5e341d1f9db84b81acad754139fd8b52fbcc63a16cec2caca98265cfaf7fb3d2518862b5d5b5c68e697ab4d6d76d33bac9c016aa89cfcab10652af5075d4312c9d2fbd5e481b69ddff002142fe87f6230357ddd83187bf4171f1f79f348c9826e5e00604b5ed264946cf3ea764f681eb6d83ef581cced27d5661341ee0bcd6a32cc5d84c2208ed61915df4a421157fd29690440537fefdd75213097179cb8cf6860629a1c4423b6b2513171f20c040e6327602458b99367f0e094c0c84e46d1ac7133b327b69922a0d5d3486c58260930b8083b573b773a25b49350f62ef219772ad0576e82a69a35818bc7f95802f638e2fda8f7a1304af6e0e6cf5a528424b51984d471db72f16929c5e222e89fc2d20a8a9e12ecfc64596b12a6f91855c36657db1ac6e9e75c3af5417c60ff3d9c1305e80b6d2457039c881bf5d4d058c468abeeb0d0878717957dde2b4986878e9a861c4a82c3f0455979434914e5547109b3e9f2755914e42d2c8bde3e2803e423aa474ef5b3d117c0ce98f31ad747e9d8b4b20119ac028cde13f1db941db796c78537f1bb4c269d29faaf6aae3228e5aa31b8e03aeeade2fe61589737e587281d3a6e99fc0a53656316038e05d8d727acaae828062cb60674100d0225f62c8cb50c82726833f4c56aad98715cfe26320d260c5d88f2c2f679ff1e4352829443ebcfb4c103b3fbb91830b4f2264a5e375bf31aecb9178fefd6254e68f054a48f8e3735a268c6cab8b6325fc662f638e1d82e6f741c004fb3fb89313d2eec8080be9e464c8d86157b58f1b0ba755617f497df914537211156d83f70768b28e3087d4f11fcdde67ea421ca90fd61f5ba5d71dc580626177c0b1020dd66d8fdaa843dcffe00c13823ef7c437976d6396538fcb9d5a4aa421cb7af6c1bf679ee02f485ea1f5a9e164722e1f9090928d7307179b36b2c8361ea068d3c0edf432d94592b181f4c08a6d2c5020deb4bdff177e5761daab9e8ce7ef7c2670079dd6df79e0fdba069e4e3548b6c8761eb1de3506f5902914492f71a0ddb49f7da82a4eb4f9b01666fdd68d03817ba9635d00b520ca44e59d115276aae1a59b2b6fe3a58c15ebc1773965c8f80d06af616b747264100c1ea6d6901e96b8e898acc2e990f7999d069c6af834a75689eea275c10f607ab8ee5b4cf24205b0cd4c9ba12785c40e7858888f6677c0847cf0ecac91f5da811f21393d840d7d7dde7bcb3e601c89c580c7a7ae3127bd57632c7c67f3eb100dc08eab4eab8945ed4cdcfda6603d5783ed4c532d90155b93fcb51e0d6c2b27b9064aaefe2252ddc90c024428fa065cb0785fdede073b7337fd07523c4979eae1d051a84951d8b0fe18dec1963e3d5ab9fbd6c906dc9d63fb66b6a1b512547c052c1dcca15f760229f6e52f608c58a17f491044c90c98434088aa4960cbb9a958153f1914e8b4bdea96051ce2b57236f4712e845db689cddb41dd7b89fd561f56c46d41da04c52f3a0dd7d1c0ce3d3eb5d833442a16dd75419170ae7ba44cb0c9fa63df2c97279c46476d23ca9f064e1c7605fe968baed388bc1d6e00460afa843f26241a07657423d86380f2f6d9edbdf57a48c5a92f99e1a2dbe1faa2ee390cac780868b32d6776ea76fe6b30fbf7faf2245784b0023fd40958835308e086d57d029fc53ea583df8b031ed19b9cb2fbab26178d650d95fa731cd96483a0de7a75f8c13f56c7ec7645d375e116f2bcc7e1b15ebccb8fd07436af4c252c91cd265656206d28a81759bc261d3f96419cdba622c7ad05d1a521b98678bdd3946f3db5fbd87be7ac001600769f7c3a114b5ad909ffa4821404dec84ac21bf933c997ce1dcc1045a605f44b497a516876361c11ca0c900f4d7cf8b02c88b0f5d532cfdeed7d739bb7bb2ae10f19d9ca594661e06060b5ba9ba817efabca247fc0d192011316510d358f7823e78c52a5d220e545b76089e3ff737bd239cef4655beaf9db9b50d8e440e8827a4e9dcb8b9988d71248e3009c5b83f1648decbf7a9076afe84d714ac6b5b30d20a4f9abd8cdeffe2d0691063cff29ffcf77afb0c6761ed21ce5639b9ae38a74753e5a39800d655f411da7f367131e50a2c23b69cc26ff7d558cff0946117d1d513456ad628415bb72a983b083843c130fdb33896bbdfba3255520ea00e39bb224feaf73c42f44e79c94dae0b65be4fe1e53b2e9f524f21cac8253517d33131dbc8ae1015954edc56d9824a9aea8a26caaecfe8da6e57c623add6b6c07117772dee08c140997547be022b6890cdef743d52a6fe49373b25ba0fa75496a77863e1d0b8d8097b6b442c08671cddadb11d0569f708aa8c429e4538791654e133a8152a3f99d31a310c22d1fc567b6598279f228ca42173b63833af2747a2738a1cb5e87588bc5c8acecb4e7e4fcf89a3e6f2a8fa440b5d2512f255221996cb12202624f6aa68ab333144c64aa0ccb33c52c4f5739fc28ba1912d749855b20cf8909c6a12d6b64c321f1a2ac11b00c85e58675d4885f8de85993bd126fc2560663c7172eaccf261eb9a6c93ce286f795de0fcefd623313a2a9b9e05ed330a7a3d129d19334c8dbb2ebd3cd0a3f1fe14ea84acd09af0d93277a441b8e064c51c6025f92c72c95ce43c02284028b713eac3330f9569d5fa978d40a77b99d9e360df5f8b974a7aaf5dece8c659f9ff85d6f554e89e02787b4614d835f8d96b673e0cf5d19d1f1d901dee13baf5f18a0b2cb0beaaddb54ef726472efafaa93611e718463880c02949b5e9c43e49ba72f15d050917629acd84c975bae00cb39f23188136256b7e14912d6b897e685db0599e02cf53b3044cf0174ad0eaf9d3d8f4db3b53f7aed23c495b1912c5aba4921b6a4c0ed96b261a8fbdb73093f13f7d865bf93062a6f7f612c7de687994f19acc27f05333fc6de724545f0d58b2cd77c6a8109544d2837e3407901ebd788523b44c6f374eb0dfc01efda304060cd1485305e6bf97f24b61191a9e2eded9e3f89d18dda113ac6519852c9e6e578a5ec8b55da5f572fa8ca628fed60719e519954fa1a0b134b6c5e9dcee8fb7a0eb8f11c2b718c12d96ae180dba126bb1b8337455e154d794a185e97be7d411c191bcc1fb2293deaca3af05d87c7df531266349f3f15b4598ef8f195074eb93d3e59e412a69b0f6e9c03a9438e01d91c34729814cd43596a01c741890d3cbb0b1f78ea2a18d3617f9935ce75721236da2e7504f3e9cf2da868442f3bfff934cb1ecf34715a586f1e75ee3e2770a8c828f1230fef73a32ebd96cfaf35347eac0cd9bbe8865de5826783a96c682678593d3a3639a3b02fad59ac86255f9e598bd9345ce4730acdcfba15187861c511ccd3ed727d200b16e4e1cd078344faeb3ca0005d61958f3554f13fe69577b60c70b0215a2ce32134e92d5592dcdd0439a741d0728241f8cc43dda77f35394fb9bcc9844ed7d26ad3bc5a1b897875a756e5424a21d0880b6174df4177ad2ddb7e9fc61ea48d0acbe55a3740689999d65bd1570cb0056aac340e6ecd35a29c8806caf50d06e674d6da1edddd524281fcea984ec48b5da5dc8439aacb280cf59da0733bf2a04268ef776a6b37189df524bd0e5aed2540dae502e685c2d622646d33b5b46bd9cb999c3c1867c6fe4a41abe9e54821c68abecc56c8f42a154178860585757718c20cec159291b5c081668adabd98c7786edcd38709db77c58756656f2846cf4bbb103085e6937e7d9b17cabb666c76c0733c381a0be7e44ae3e09e1c0f504d69b0c1e172d6ef19092315956994b81e59dbbda7e1fbddf9d796642a8936568c761c5706247eca23adc708ec402feaa381251480fa1c9798d30730d6cc3b7ed19b0a1e8a44d3e189aaa216e572afa6920f00f6c264176b0b2fe3e52b3d8ae00aca298736cd70a9a504ff84b84859da2bd271cf7050e9d7cef97eb30e0ec403304466fecb979fbde11087214216eb8b9a8a5ebfaa0b90863756cbc7330e88494b4bad08ba39144db962163819c6c1aea500e11952d97a724bd8a5e6501986e9f165548c97e98b3a8c3fe385d1f0074cb60126fec8f7350b7cdfd954c70973f3663deb8013aeb67fdf6baf57830ed86d760a4ab445fca3b5c8f0d8f386e93155ab9e311c05610c2ff7d4bd870e5cb2de00839d2f6ded4c91d8a0670897fcec3d2486805316e41b32179d87c6128435bd7cec1476e2df59daae96b894d8a6564862054636e154e88f15b9df1d14b79a43021595f55a2a4430421e3ad76bd7b2963b0ac50c6672857298ef5118ce59921cbce8cf632e789de32be7fdcbc895efd91065222b8b39d537aea064516f692a4e7ba5ecbde40ee2c18e691ce89622586239c765dd5f702934134222b0226a4ff1e2e52108d91145c452240e4b468894f6518c75b7f471b658c48d5aa1d1e9674a744e0a3110d193576398348026442cfaecf96a157532626c241ad4fd12d6646119a718d183fa34785602cf1c8a39c2434641a3e7f15d6369b4123183dd6c31521b365cfe72cd553745394d448d94d12af6c28f8945007f01525906f1e35595b4b5936354db1fc093f89ef3ed363bcb040937fc44fbc973d85849ae83503f13cd09d6427f51ec3bcdd9f8997e3a2308e8acb3d77668301a5e3a6633cf40ff8fd0ef16c76dee624f7f4a2f547ca105af1e92d93fd687ad42c091f2efe90cf87f935a3579a226a8d06d0ab6d03a1eabe7fbe986c37701b7ef6b6c3080025b45c8ea713abe274177dc3564f7274dedac4b5abc0c6c58d54abaebc952a9c6939f63bfc8c25ce507dd488451424169b096ec978fdb4dd6c9b08e7568eaba779711d0c6844bb9142005b99ac2efe2080b9b1fafacc6afd20a9748edda6c3ae9e24be86844285bf6c16ccfae425af8829c645522b870c2f4e7fe08e27628be1e3594e0882c1dc058817a0bfbe12caecefa5749fcf2a0147702919e9ffea7f677fb0ea8410f54ec42409f7e3bc8303d346c8193be6b3bf247e15d1c32a2977fa8daec02086b49e24464b5c2f2fea26fcbcc2d3cb357706ade520a95671cd2f66600d6c32c0aa74f22b6e188f1574987c78f6240e298a16b5af60f37e527ead4e5f2b8eeea117f7c1ea145e8328aa608ebd90ddb04f53746259ac7ea7424b50ff6a67fc907428c6f9bd0732de6d2c61e715c82797325eaeee71edc14f725b694b0d2dae4683d7c9831e4ab711ddf84d35099ef730a8eea2818844a3acddce59f04735b8d0294cecf89e34f5c9b12e9b78171764239f4b9df4f6777c4943b9cfbca6b04aec971c2a1d2c57b556b7aaba8e463618ecd819632368ae4e62f16b529c1a45fb962a40a7197713709f4a2cec380b1be52ef83b33bdd9fa309334dfab41ba19ed4aff5c73965153694616befdb0c3cac17f8cafbd32745e3b7154c0593522062e1f147bac445fd129d8d0510bf2ca1cbdbcc6407eb4beb29bae03b05ccd805a22f49b8da20bc4732dc11dec1680e09faa19a9de8f6e44fbca42399be7648ea68decb1bbca43588ea4734a37831b0fb569e5be08262f7481334bfd8c1b02a69dc15d4a89e8d1490ef4a1fadf5f1b25bbad6cdee01f399e9d416de4d5f862e9662dae5444d126a9061809fc404338db1beb5490e0126a5d49e3a25edbbb04a21d4360bfc509ee72db0fc16d77c06ac60579c3ea5bf986a835635223ff5342813183aab533b447fa91ef8be355cc40e652953dc7c2eba25e361ddb7a6cc99279617dfa9fc4a6f524b8d467d517ff6c08c1fb7bb20631d180b892a0e11a11d3443168b5355a151df9841fbd38ea9695ed4925b31c7d69cb29b35fb88bb3b4a0deb2050492cea6a648311783a395999619a84ab22011a63647fa85e6943fb0b020ce4802d5a9a11afa2c508894276261c353b859bf73f1d5163069adf3287be83a9022fa518d9d1048b0860883f8daabead7514f98423ac003600e84d6a1f95dfd207a185554a603c7166cf1c8b72ac317ad5a455d3fada0d7ac6f7d67e9cf61802840cec0c2d0ccd9a475bf6eb38bdc341a721cc6b2dd88744c0dabb3df17d16f571cf412985bb2f693eb7fe4153309d76115b8fbefd3190eac6a333f8ddc0cb8a5537cd185e281c0ed31c50f62e11740e038de88910e8552ec0324fc18a819bb98993b6320e72722feab6da48c1de398880f54e6bbc78ed62cc03de04f2a3000000546af87c397a8e39919e5b2ee9d0f49eb17dc594dbd72e485661bd103738afc4d06e846ba6ef1204cd08b7a8733d5127fca7595aaaa4571863efffcb9809dcab5674c6c781fe638ae7b0ee7b914193b13f90d5388ee2bcf4778895d141b600d9b3337290e3dd0ce442d1434f6e5183f6a05ffb9e34c91a3c818cc1c0fa9678ae791d8784f531abd6a77a3875e50a4cc15d97e9e26ef0fa83ffc9ac0e615417be1d89935e12aedbaed7da522cd3bf2fc8581b1d094e830410abe3911d16d660c24baef04533d5a45e06b042f37d637ffc5319cf6defde5bc17025db0aef357140f26d65f1e82c0dd58c76dfc8d97204a79b4303f0859cfd22b8329fee0ca0193cfcc8f556ba80205d23c3f331219f48d3a12550704858785822402bf8fa1614d298ba680e1dde745451ba4efa7d950cc324561a585b0c49c41ce969f77be80413032baabe21c7a235bb78e052fc8202cb0c4fab37fa1b65fca616c2b8cb0e922744577823aa96eca41a7f82119db68befe019c8c3ff9de980000008000a00ac1414bb38011500d8d71f514eb60ed8c9bd56dcc341a890e305f407239081806ad6f2a189d338465f19fa43b6ad59ce58157929948d84d86b0e76bddd5d67c26ba95a9c5829b63d09544051b6b3e2129c4e208a301944af0fbaa5ac1400840000000000000000000000000000000001bc003a40094e94a16ee552414544b53a733414c15eeb3d310303a0fcee347b4cabb25a910c8f4abc57a6bd75479f59cc865cb029b509e36c4293cb0a29989e7a2ddde4718009ef083caedb3063193a46d2451237d4b4f4d666e0060aafb1c5c582c710e2d9ce36fc91059ded0765e3eb5a9a5894884ca6e6c1849ab83634e2cf9b69ebee067c43a59ef3ad217f6b72db3ba7fdce150293e26c73493f77d3c0c2dcc33e517bdb7eb7703f9b05c752b193e2684d699ff6e4bf80351f1908001100f22e50cd04ff5db842ca265b03743fe03985b873138834a993ba6e59b0febdaaaf64c05b1ac8afa8d67abdb86fd6078b81616ab2aabc685652f1274758890a7483a99a2e7737d944568ce5d9525bf54e0e6f0e470f70752b6525fa1a3dab37ba18ea7a235eaff9bcf256a67406a3bdad4af20e96a37fb1cbb6ff165dff04e4004374cd31d32fd55dc52fd123e846ba41047817099eb6550d365fdd", @ANYRES32=r5, @ANYBLOB='\b\x007\x00', @ANYRES32=r2], 0x1634}}, 0x20000000) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f0000001fc0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0xc000}, 0xc, &(0x7f00000004c0)={&(0x7f0000001cc0)={0x2e4, r6, 0x293758e9d95447e7, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x54, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x4}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x427}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfff}]}, @TIPC_NLA_MEDIA={0x44, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x34}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}]}, @TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x400}]}, @TIPC_NLA_MEDIA={0x88, 0x5, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xad8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xdf0}]}]}, @TIPC_NLA_LINK={0xac, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc150}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffc}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}]}, @TIPC_NLA_MEDIA={0x10, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}]}, @TIPC_NLA_BEARER={0x98, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x99}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffeffff}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @rand_addr=0x7}}, {0x14, 0x2, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_LINK={0x24, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_REF={0x8}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x2e4}, 0x1, 0x0, 0x0, 0x40c0}, 0x40000) ioctl$KDGETLED(r4, 0x4b31, &(0x7f0000002000)) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/current\x00', 0x2, 0x0) write$P9_RSTAT(r1, &(0x7f0000002040)={0x4e, 0x7d, 0x1, {0x0, 0x47, 0x943, 0x1f, {0x80, 0x1, 0x7}, 0x200000, 0x4, 0x7fff, 0x1, 0x1, ')', 0xf, 'broadcast-link\x00', 0x0, '', 0x4, 'eth\x00'}}, 0x4e) renameat2(r4, &(0x7f00000002c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r1, &(0x7f0000000380)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x2) 09:38:31 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0x2, 0x0) [ 765.847342] binder: 2759:2760 ioctl c018620b 0 returned -14 09:38:31 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:31 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) listen(r1, 0xfffffffffffffffd) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x4e22}, 0x1c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20000004, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) close(r2) close(r1) [ 765.905494] binder: 2759:2770 BC_ACQUIRE_DONE u0000000000000000 no match [ 765.966410] binder: 2777:2779 ioctl c018620b 0 returned -14 [ 766.048265] binder: 2777:2784 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:32 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) 09:38:32 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 766.473812] binder: release 2728:2732 transaction 541 out, still active [ 766.481196] binder: unexpected work type, 4, not freed [ 766.490431] binder: undelivered TRANSACTION_COMPLETE [ 766.506149] binder: release 2733:2735 transaction 547 out, still active 09:38:32 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) [ 766.518591] binder: 2793:2796 ioctl c018620b 0 returned -14 [ 766.530718] binder: 2792:2800 ioctl c018620b 0 returned -14 [ 766.530972] binder: 2794:2798 ioctl c018620b 0 returned -14 [ 766.537713] binder: unexpected work type, 4, not freed [ 766.537716] binder: undelivered TRANSACTION_COMPLETE 09:38:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbf"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:32 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 766.578794] binder: 2794:2802 BC_ACQUIRE_DONE node 551 has no pending acquire request [ 766.587665] binder: 2792:2801 BC_ACQUIRE_DONE node 554 has no pending acquire request [ 766.611068] binder: 2793:2810 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:32 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) [ 766.665198] binder: 2807:2814 ioctl c018620b 0 returned -14 [ 766.673195] binder: 2813:2817 ioctl c018620b 0 returned -14 [ 766.680375] binder: 2818:2819 ioctl c018620b 0 returned -14 09:38:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0x0, &(0x7f0000000700)="2ba063fb30"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 766.724235] binder: 2807:2821 BC_ACQUIRE_DONE node 557 has no pending acquire request [ 766.734270] binder: 2818:2825 ioctl c0306201 0 returned -14 [ 766.744203] binder: 2818:2825 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:32 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) close(r0) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x800, 0x0) openat$cgroup_procs(r1, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0xa) r3 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x100) ftruncate(r3, 0x200004) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x68, r4, 0x1, 0x70bd26, 0x25dfdbfb, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x3a, @media='ib\x00'}}}, ["", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x14}, 0x854) openat(r1, &(0x7f00000002c0)='./bus\x00', 0x40000, 0x11) sendfile(r0, r3, 0x0, 0x8000fffffffe) 09:38:32 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) inotify_init1(0x800) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x1000) lseek(r0, 0x0, 0x2) [ 766.777291] binder: 2829:2830 ioctl c018620b 0 returned -14 09:38:32 executing program 3: mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='affs\x00', 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) r1 = accept$inet(0xffffffffffffff9c, &(0x7f0000000180)={0x2, 0x0, @local}, &(0x7f00000001c0)=0x10) connect$inet(r1, &(0x7f0000000200)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) 09:38:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:32 executing program 5: pipe(0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4) r1 = syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x7, 0x0) r2 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x10000) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000140)=0x80000000, 0x4) ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f0000000080)={0x9, 0x668d, 0x1f, 0x9, 0x5, 0x3ff, 0x8}) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x1000000004e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000002c0)=0xda8, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) connect$netlink(0xffffffffffffffff, &(0x7f0000000440)=@unspec, 0xc) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f00000001c0)=0x1, 0x4) 09:38:32 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) eventfd2(0x0, 0x1) lseek(r0, 0x2, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x3) 09:38:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:32 executing program 5: r0 = creat(&(0x7f0000000140)='./file0\x00', 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0x0, r0, 0x8, 0x6, 0x2, 0x4}) fallocate(r0, 0x0, 0x0, 0x4003ff) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x8) fallocate(r0, 0x20, 0x0, 0x10000) syz_mount_image$f2fs(&(0x7f0000000080)='f2fs\x00', &(0x7f00000000c0)='./file0\x00', 0x5, 0x4, &(0x7f0000000400)=[{&(0x7f0000000180)="46cd896f5491df9debcd837ab1d72eb231b1a425c31e07abb5a35786db4ef2a8f0337856f60ed640ce34ea2cda1fd07901da278b8bbae26b7441981002d66db3fb301cf7d0fe8e68dbb803e0fa0f6ae7b3c01485fcb5548a1845b9fb3bd442709b907fd11e52b2d34a7253c047e0ebc2fa7481206fc6637ce406c31ce58b87134aef1023c5ac6764c3ad6fc5216fc3", 0x8f, 0x521}, {&(0x7f0000000240)="a6681932739d2aaee2ac23eeb63691d6646d11e98b76837465e5e5ce449cf8fa70405f2dfc8cd59c74c5a9358bf8be97bf1503d4e7ec9e37d966681704b751515658dc3bc32a676e57007de39ad1bf84b5840306c00728adcc04dc1e33967d1cbd3b06a1003ce1e1b867c2f47d2fe296f8e087387300b0c621bac2a0875c2d2ff65179c27b46dd34", 0x88, 0x1ff}, {&(0x7f0000000300)="b8202632a2778083519cc556aa4d86e6457299fc6cc8f648ed48b3e3d7dd72230ad858acd641ca9a0163c6f41e2bdfa4ffcc0241be4ad93cde714fbf17b1a43afc765de8dc93c80480ca66f09cee11740564957ab1fbc3794b8a417226bad58791034a1e39d57e06fd15dd5ad8080b939e006c1b455b64831b15babc5a159cd05028bf19c54022cfe2f5c7097e576c7ddd76311a9fb424fe90cb24c396df136dedbc16c96b151129d01d0b93d64d46734a0bf5d8651f39910e76b9c1b0ed8456b63f185ad1b29b239e1a562a0939a24bb1d103baf87795040222d2a74ab6a75d0e8c8494805ef236d92c676baef3d8", 0xef, 0xcec2}, {&(0x7f0000000100)="b3de8b27264a1d62019f722a3160ce1797304cde81e2d07836420d34cdb67a1a045115e54a5525513ebd6498b39064ca9917f8dae94c2ad7", 0x38, 0xd66}], 0x80, &(0x7f0000000480)={[{@disable_roll_forward='disable_roll_forward'}, {@whint_mode_user='whint_mode=user-based'}, {@user_xattr='user_xattr'}, {@noinline_dentry='noinline_dentry'}, {@nodiscard='nodiscard'}, {@whint_mode_fs='whint_mode=fs-based'}], [{@rootcontext={'rootcontext', 0x3d, 'sysadm_u'}}]}) [ 767.011367] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 767.029665] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 767.038782] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 767.046602] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 767.059835] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 767.070350] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 767.078101] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 767.085133] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock 09:38:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:33 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 767.457774] binder: release 2813:2824 transaction 559 out, still active [ 767.474813] binder: 2864:2865 ioctl c018620b 0 returned -14 [ 767.494991] binder: 2869:2870 ioctl c018620b 0 returned -14 [ 767.527503] binder: 2864:2871 BC_ACQUIRE_DONE node 566 has no pending acquire request [ 767.548582] binder: 2869:2873 ioctl c0306201 0 returned -14 [ 767.555895] binder: 2869:2873 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:33 executing program 3: socketpair(0x4, 0x8000e, 0x6e, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r3, 0x2, 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80010021}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r2, 0x8, 0x70bd28, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x1) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000280), &(0x7f0000000300)=0x10) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000240)={@loopback, @local}, 0x8) 09:38:33 executing program 5: r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@abs={0x1}, 0x8) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r1, 0x0, 0x42, &(0x7f0000000080)={'ah\x00'}, &(0x7f00000000c0)=0x1e) listen(r0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x0) 09:38:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 767.584794] binder: release 2829:2833 transaction 562 out, still active 09:38:33 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) setxattr$trusted_overlay_opaque(&(0x7f0000000180)='./file0\x00', &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000100)='y\x00', 0x2, 0x2) lseek(r0, 0x2, 0x0) 09:38:33 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x100000001, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x9, 0x0, 0x400000, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) getsockopt$bt_hci(r0, 0x0, 0x2, &(0x7f0000000040)=""/245, &(0x7f0000000140)=0xf5) setpgid(0x0, 0x0) 09:38:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:33 executing program 5: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) getpeername$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @multicast2}, &(0x7f0000000140)=0x10) r1 = socket(0x10, 0x8000000000000003, 0xc) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1400000003028b10dab7022b0fdb730c0ca609f4"], 0x14}}, 0x20000880) sendmmsg(r1, &(0x7f0000000000), 0x40000000000024a, 0x0) accept(r0, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f0000000200)=0x80) 09:38:33 executing program 5: mkdir(&(0x7f00000013c0)='./file0\x00', 0x0) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/enforce\x00', 0x400081, 0x0) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000300)={0x7, 0x3b}) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='tmpfs\x00', 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x15) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0xa8, r2, 0x904, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7f}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'caif0\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'netdevsim0\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x4}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8001}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x5}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8001}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2040000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}]}, 0xa8}, 0x1, 0x0, 0x0, 0x14}, 0x800) chdir(&(0x7f0000000080)='./file0\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) [ 767.627644] binder: 2879:2883 ioctl c018620b 0 returned -14 09:38:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:34 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 768.281653] binder: release 2864:2865 transaction 565 out, still active [ 768.288859] binder: unexpected work type, 4, not freed [ 768.298966] binder: undelivered TRANSACTION_COMPLETE [ 768.316225] binder: 2913:2914 ioctl c018620b 0 returned -14 [ 768.332042] binder: 2911:2912 ioctl c018620b 0 returned -14 [ 768.370255] binder: 2913:2918 ioctl c0306201 0 returned -14 [ 768.376535] binder: 2913:2918 BC_ACQUIRE_DONE u0000000000000000 no match [ 768.384871] binder: 2911:2920 BC_ACQUIRE_DONE node 572 has no pending acquire request 09:38:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:34 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = syz_open_pts(0xffffffffffffffff, 0x2) ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000000)) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0xfffffffffffffffe) lseek(r1, 0x2, 0x0) 09:38:34 executing program 5: r0 = epoll_create1(0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = epoll_create1(0x0) getrusage(0x0, 0x0) r2 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000100)={0x20000001}) timerfd_settime(r2, 0x0, 0x0, 0x0) ioctl$FIGETBSZ(r1, 0x2, &(0x7f00000001c0)) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000021ff4)) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x10000014c) fsetxattr$security_smack_entry(r2, &(0x7f0000000240)='security.SMACK64EXEC\x00', &(0x7f00000002c0)='-\x00', 0x2, 0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000300)='/dev/uhid\x00', 0x0, 0x0) prctl$PR_GET_KEEPCAPS(0x7) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 09:38:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)) dup2(r1, 0xffffffffffffffff) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:34 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000100)='/dev/keychord\x00', 0x400000, 0x0) prctl$PR_GET_UNALIGN(0x5, &(0x7f00000001c0)) ioctl$KDGKBMODE(r0, 0x4b44, &(0x7f0000000180)) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x10, 0x0) r2 = syz_open_pts(0xffffffffffffff9c, 0x8801) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000000)={0x985, 0x6, 0x80, 0x80000001, 0x12, 0x80000000, 0xfffffffffffffffb, 0x4, 0x100009, 0x7db5}) lseek(r1, 0x2, 0x0) ioctl$TIOCPKT(r2, 0x5420, &(0x7f0000000040)=0x3) [ 768.431222] binder: release 2879:2897 transaction 568 out, still active [ 768.463207] binder: 2927:2929 ioctl c018620b 0 returned -14 09:38:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:34 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) unlink(&(0x7f0000000000)='./file0\x00') mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x800) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000100)={0xfffffffffffffffc, 0x3, 0x40, 0x1ff, 0xa, 0x0, 0x7, 0x7, 0x1, 0x635}) [ 768.525038] binder: 2927:2932 BC_ACQUIRE_DONE node 575 has no pending acquire request 09:38:34 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x1) lseek(r0, 0x2, 0x0) [ 768.593237] binder: 2940:2942 ioctl c018620b 0 returned -14 09:38:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 768.654258] binder: 2940:2946 BC_ACQUIRE_DONE node 578 has no pending acquire request [ 768.697009] binder: 2948:2950 ioctl c018620b 0 returned -14 [ 768.770715] binder: 2948:2954 BC_ACQUIRE_DONE node 581 has no pending acquire request 09:38:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:34 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:34 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(&(0x7f0000000000)=@filename='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x2000, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) 09:38:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)) dup2(r1, 0xffffffffffffffff) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 769.117851] binder: release 2911:2912 transaction 571 out, still active [ 769.125607] binder: unexpected work type, 4, not freed [ 769.131087] binder: undelivered TRANSACTION_COMPLETE 09:38:35 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) write(r0, &(0x7f0000000000)="aa229d569d27f551a4a2840f863d0a1090da9cb67e4fb5d1fa07bf5fa7cab193319c1d7af4d5f07a4c36e6b76cabc3cc400104757c19dced96b2605044669dda9a73013f4f4b5761f0bacb78e3c4eb6736", 0x51) 09:38:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 769.167753] binder: 2964:2965 ioctl c018620b 0 returned -14 [ 769.178426] binder: 2962:2966 ioctl c018620b 0 returned -14 [ 769.186922] binder: 2959:2969 ioctl c018620b 0 returned -14 09:38:35 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socket$inet(0x2, 0x3, 0x7f) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000140)='sit0\x00', 0x10) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x1}]}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r5 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$UI_GET_VERSION(r5, 0x8004552d, &(0x7f0000000040)) symlink(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='./file1\x00') lseek(r4, 0x2, 0x0) 09:38:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 769.227101] binder: 2962:2979 BC_ACQUIRE_DONE u0000000000000000 no match [ 769.242562] binder: 2959:2982 BC_ACQUIRE_DONE node 584 has no pending acquire request [ 769.252105] binder: 2964:2985 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:35 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x3102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() prctl$PR_SET_DUMPABLE(0x4, 0x1) wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x7) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x5c, 0x60}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r1, 0x0, 0x0) [ 769.285979] binder: 2989:2990 ioctl c018620b 0 returned -14 [ 769.346556] binder: 2989:2995 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0x0, &(0x7f0000000700)="2ba063fb30"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:35 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clock_adjtime(0x0, &(0x7f0000000240)={0xff, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000040)={0x0, @aes128, 0x1, "34bd40b3f6dfa205"}) 09:38:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)) dup2(r1, 0xffffffffffffffff) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:35 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 769.977923] binder: release 2959:2969 transaction 583 out, still active [ 769.990600] binder: unexpected work type, 4, not freed [ 770.007374] binder: 3004:3009 ioctl c018620b 0 returned -14 [ 770.014814] binder: 3006:3010 ioctl c018620b 0 returned -14 09:38:35 executing program 5: perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000000)={@local}, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r0, 0x0, 0x83, &(0x7f0000000300)={'filter\x00', 0x0, 0x3, 0x6f, [], 0x1, &(0x7f0000000180)=[{}], &(0x7f0000000280)=""/111}, &(0x7f00000003c0)=0x78) clone(0x3ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1f, 0x0, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) r2 = gettid() r3 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000004c0)={r3}) clone(0x40000000, 0x0, 0x0, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) statfs(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000400)=""/181) tkill(r2, 0x8000000000000014) wait4(0x0, 0x0, 0x0, 0x0) 09:38:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 770.016365] binder: 3008:3012 ioctl c018620b 0 returned -14 [ 770.031372] binder: undelivered TRANSACTION_COMPLETE [ 770.056053] binder: 3004:3018 BC_ACQUIRE_DONE u0000000000000000 no match [ 770.087132] binder: 3023:3024 ioctl c018620b 0 returned -14 [ 770.100279] binder: 3006:3020 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:36 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x101100) ioctl$RTC_RD_TIME(r0, 0x80247009, &(0x7f0000000040)) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setsig(r1, 0xa, 0x9) lseek(r1, 0x2, 0x0) [ 770.160347] binder: 3023:3030 ioctl c0306201 0 returned -14 [ 770.173830] binder: 3023:3030 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:36 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000000)) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) chroot(&(0x7f0000000040)='./file0\x00') lseek(r0, 0x2, 0x0) 09:38:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:36 executing program 3: mkdir(&(0x7f0000000280)='./file0/file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) futimesat(r0, &(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000040)={{}, {0x0, 0x7530}}) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f00000002c0)) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) accept4$unix(r2, 0x0, &(0x7f0000000200), 0x800) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000000180)='trusted.overlay.redirect\x00', &(0x7f00000001c0)='./file0/file1\x00', 0xe, 0x1) open(&(0x7f0000000300)='./file0/file0\x00', 0x2, 0x164) lseek(r0, 0x0, 0x4) remap_file_pages(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x6da, 0x0) 09:38:36 executing program 3: ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) syz_open_procfs(r0, &(0x7f0000000040)='net/icmp6\x00') mkdir(&(0x7f00000001c0)='./file0\x00', 0xfffffffffffffffb) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0xfffffffffffffffc, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x101000, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) 09:38:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:36 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000000)) 09:38:36 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 770.823027] binder: release 3008:3021 transaction 586 out, still active [ 770.860584] binder: 3053:3056 ioctl c018620b 0 returned -14 09:38:36 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1018bc, 0x7f) lseek(r0, 0x2, 0x0) [ 770.880841] binder: 3052:3057 ioctl c018620b 0 returned -14 [ 770.941112] binder: 3053:3065 BC_ACQUIRE_DONE u0000000000000000 no match [ 771.659349] binder: release 3052:3063 transaction 589 out, still active 09:38:37 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x5) r2 = open(&(0x7f0000000080)='./file0\x00', 0x2000, 0x9) r3 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f00000000c0)={'nlmon0\x00', {0x2, 0x4e20, @remote}}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6}]}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) sendmsg(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000880)="24000000120007031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e280000001100ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) socket$inet(0x2, 0x80805, 0x7ff) 09:38:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:37 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0xfffffffffffffffe) 09:38:37 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:37 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:37 executing program 3: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0xd) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000180)=""/161) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) mkdirat(r1, &(0x7f0000000000)='./file1\x00', 0x18) [ 772.079775] binder: 3081:3082 ioctl c018620b 0 returned -14 [ 772.093229] binder: 3084:3086 ioctl c018620b 0 returned -14 [ 772.105325] binder: 3080:3091 ioctl c018620b 0 returned -14 [ 772.115794] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 09:38:37 executing program 5: r0 = socket$inet6(0xa, 0x80001, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/checkreqprot\x00', 0x2, 0x0) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r2, 0x0, 0x200000000) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000280)='tls\x00', 0x4) r3 = dup3(r1, r0, 0x80000) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000000)={0x21}, 0x21) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000040)={0x0, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_group_source_req(r0, 0x29, 0x2d, &(0x7f0000000140)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @dev}}}, 0x108) socket$inet_tcp(0x2, 0x1, 0x0) 09:38:37 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) write$P9_RCREATE(r1, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x10, 0x2, 0x8}, 0x1ff}}, 0x18) lseek(r0, 0x2, 0x0) [ 772.127688] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 772.149128] binder: 3081:3095 BC_ACQUIRE_DONE node 593 has no pending acquire request [ 772.162192] binder: 3084:3099 BC_ACQUIRE_DONE u0000000000000000 no match [ 772.170658] binder: 3080:3101 ioctl c0306201 0 returned -14 09:38:38 executing program 5: socketpair$unix(0x1, 0x20000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x800008) r1 = request_key(&(0x7f0000000000)='trusted\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f00000000c0)=',vboxnet1\x00', 0xfffffffffffffffb) keyctl$clear(0x7, r1) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000003080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14) 09:38:38 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x0, 0x0) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000040)={0x1, 0x7, [@broadcast, @local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @random="621fda0c1091", @local, @random="98e12f3de60b"]}) lseek(r0, 0x2, 0x0) [ 772.171103] binder: 3080:3101 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:38 executing program 5: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) setsockopt$inet_buf(r0, 0x0, 0x2c, &(0x7f0000000000)="63d09e937aaad45cd3dfde7a5f4ded9af1c4efad485b39001aed3d70bf0e41d7b15bddf05e8ec03e33b745f6793378d10b888195", 0x34) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000040)="325365bf9194d29c6759637f7d41160a5a693d0c279685d9fdcfb7d596ca42c9b3714b274d037d0dd305833a453e163ddae2599d69b5f4f2623994a62d5bcd6b21045739f94016f77372e097c7cdda9ff4571a8b99697db5b0bfd1049286a21243cb8a4c65875f8481f47e917e2e56adfdee170c939d66f02957d98a95647d473a9cfde6edc7e03f1ab5f86968f061577d0c7040e5c133abcb38eae192d9ea7bab6512d96de53d672bd4bd2940d89d5740db99f03383fdce9cc0e90899aa632ed2b8d321e8ece0c5eb275c446da7bff8bc2a05963192320901c1b9695a2293918f0321f28e173f36501d47db8fc75cf76db7c4bb38366053220542ce2c8c6c78") fsync(r0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000140)={{0xa, 0x4e20, 0x7fff, @local, 0x9}, {0xa, 0x4e20, 0x0, @remote, 0x800}, 0xfffffffffffffffa, [0x0, 0x8, 0x1000, 0x3, 0x4, 0x3, 0x1, 0x2]}, 0x5c) renameat(r0, &(0x7f00000001c0)='./file0\x00', r0, &(0x7f0000000200)='./file0\x00') mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x80010, r0, 0x0) r1 = dup2(r0, r0) truncate(&(0x7f0000000240)='./file0/file0\x00', 0x10001) r2 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4000, 0x41) mkdirat(r1, &(0x7f00000002c0)='./file0\x00', 0x4) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000000300)=0x6) setsockopt$inet_int(r2, 0x0, 0x7, &(0x7f0000000340)=0x1, 0x4) mkdirat(r0, &(0x7f0000000380)='./file1\x00', 0x8) ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000003c0)=""/182) sync() openat$cgroup(r2, &(0x7f0000000480)='syz1\x00', 0x200002, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f00000004c0)) ioctl$TIOCMBIS(r1, 0x5416, &(0x7f0000000500)=0x4) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000540)=0x8, 0x4) personality(0x5000002) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000580)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$KDGKBDIACR(r2, 0x4b4a, &(0x7f00000005c0)=""/101) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000640)={'mangle\x00'}, &(0x7f00000006c0)=0x54) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x2bf8e59f) ioctl$PERF_EVENT_IOC_DISABLE(r2, 0x2401, 0xfd) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000700)={0x0, 'ip6gre0\x00', 0x4}, 0x18) 09:38:38 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) getsockname$unix(r1, &(0x7f0000000180), &(0x7f0000000040)=0x6e) 09:38:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:38 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x400000, 0x8) mkdirat(r0, &(0x7f0000000040)='./file0\x00', 0x100) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) 09:38:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(r1, r2) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:38 executing program 5: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRESDEC], 0x14) ioctl$TIOCLINUX3(r0, 0x541c, &(0x7f0000000040)) 09:38:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:38 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 772.887607] binder: release 3081:3082 transaction 592 out, still active [ 772.896062] binder: unexpected work type, 4, not freed [ 772.907939] binder: undelivered TRANSACTION_COMPLETE 09:38:38 executing program 3: r0 = socket(0x4, 0x0, 0x3) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000000)={@rand_addr=0x8000, @remote, 0x0, 0xa, [@remote, @rand_addr=0xe09, @empty, @local, @dev={0xac, 0x14, 0x14, 0x19}, @multicast2, @local, @rand_addr=0x6, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x11}]}, 0x38) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) [ 772.934255] binder: 3127:3132 ioctl c018620b 0 returned -14 [ 772.943153] binder: 3131:3134 ioctl c018620b 0 returned -14 [ 772.951860] binder: 3128:3135 ioctl c018620b 0 returned -14 09:38:38 executing program 5: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x400000, 0x8) mkdirat(r0, &(0x7f0000000040)='./file0\x00', 0x100) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) 09:38:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 772.982564] binder: 3127:3132 ioctl c0306201 0 returned -14 [ 772.992812] binder: 3127:3132 BC_ACQUIRE_DONE u0000000000000000 no match [ 772.993037] binder: 3131:3141 BC_ACQUIRE_DONE u0000000000000000 no match [ 773.001855] binder: 3128:3146 BC_ACQUIRE_DONE node 596 has no pending acquire request 09:38:38 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0, 0x50) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0xc0000, 0x0) accept4$unix(r1, 0x0, &(0x7f0000000100), 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x8) openat$cgroup_ro(r1, &(0x7f0000000180)='cpuset.memory_pressure\x00', 0x0, 0x0) chdir(&(0x7f0000000000)='./file0/../file0\x00') lseek(r0, 0x2, 0x3) 09:38:38 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='cubic\x00', 0x6) getsockopt$inet6_opts(r2, 0x29, 0x3b, 0x0, &(0x7f0000000180)) [ 773.083030] binder: 3154:3157 ioctl c018620b 0 returned -14 09:38:38 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) 09:38:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(r1, r2) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 773.147021] binder: 3154:3162 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:39 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0xbe) lseek(r0, 0x2, 0x4000000000) 09:38:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000040)) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) recvfrom$unix(r2, &(0x7f0000000180)=""/36, 0x24, 0x10002, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$KDADDIO(r1, 0x4b34, 0xfffffffffffffff8) lseek(r1, 0x2, 0x0) 09:38:39 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x100000000000000) lseek(r0, 0x2, 0x0) r1 = open(&(0x7f0000000140)='./file0\x00', 0x200000, 0x8) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_PUBL_GET(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x128, r2, 0x210, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xff}]}, @TIPC_NLA_MEDIA={0x54, 0x5, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NET={0x58, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x100}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfd}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x40}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xffffffffffffffc0}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xe07}]}, @TIPC_NLA_NODE={0x3c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x160000000}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x82b}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}]}, @TIPC_NLA_SOCK={0x20, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}]}]}, 0x128}, 0x1, 0x0, 0x0, 0x4051}, 0x4000) r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x10000, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x40082406, &(0x7f0000000040)='configfs\x00') 09:38:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffc000/0x4000)=nil) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(r1, r2) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:39 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='efivarfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x80000000000) 09:38:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='cubic\x00', 0x6) getsockopt$inet6_opts(r2, 0x29, 0x3b, 0x0, &(0x7f0000000180)) [ 773.747852] binder: release 3128:3135 transaction 595 out, still active [ 773.755307] binder: unexpected work type, 4, not freed [ 773.773472] binder: undelivered TRANSACTION_COMPLETE [ 773.786174] binder: 3196:3198 ioctl c018620b 0 returned -14 09:38:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:39 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:39 executing program 3: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/status\x00', 0x0, 0x0) unlinkat(r0, &(0x7f0000000040)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='hwsim0\x00', 0x10) lseek(r1, 0x0, 0x3) 09:38:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 773.848022] binder: 3196:3206 BC_ACQUIRE_DONE node 599 has no pending acquire request 09:38:39 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) [ 773.907403] binder: 3214:3218 ioctl c018620b 0 returned -14 [ 773.916428] binder: 3217:3219 ioctl c018620b 0 returned -14 [ 773.921813] binder: 3215:3221 ioctl c018620b 0 returned -14 09:38:39 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x8) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x2000, 0x1) pwritev(r0, &(0x7f0000001500)=[{&(0x7f0000000180)="0fb7ef46bc7ee87fe43c6e379d1546091e97bbbb3d0f47f4acabe8488d574fc3c552bb79f1eec7719ce361808e799431c99da6bb552ac1ad40d95039d52121c758cb4010cb80fcdbd8b4090ddf9004e9d5131a2ff9bd288dcba8b61b6d78fddb28810ce7ec5b4dea70d6136ffe3ecad9634de1b379dd27399238d0ed1617812c504aee9e1d4e29ec90b614a88b6472d095af89202f216edcc356f0e55702cc90367ef846bf1f7ac480420cc14c28bd0f2838c9caeacb2f7c031e263071e953", 0xbf}, {&(0x7f0000000000)="11154253fb6dfe40e7a4cfea6de50463e7b65c950fa11a52990934075780577f32fa08aac0c9ccab7e9eaa2d14f845", 0x2f}, {&(0x7f0000000300)="2009f1b3805c2c42e8bc6a1634addb4d3c918cb48ea966edfa6c85106aaa70095d77af8c67ac23981900f932122b8941e95fd5ea1b2f56ac3cf42159d7d38cdaeb9723554e97ea6674e66be72c365fab827afba0c718f51161d0a039669d88a9b2a6777338756d708e6ddfbbd3bfb62f8108991bca1e9867d54990742224e16998626496531bdb7dc259f2fbab63fa8de7418eae15d4741271a0a5031e780d1b2c93028fe172c5cf1a42d7e7552ff0f5646c8da607269e8d3d27ccab5bfb9bc96d7b656279df0af4916c07439d2a9ad26ac4e95c647d6626ace34c39ac0fbd60cfbf6b53412a20db8dfa8372bab1f18736c2eebf8dc360e95d17ee9de78feb7448771ef13908c0681b7cfdb9b0268a1858da08fbfbe26a7811358aebd9d7ac60c334b8c47016d47a3e4708e64b73ab5463e920dc83fa3ce240213d8df4cee56f8a0c50cb4abd1d274cf0a701eb52a326222586348d76e883f8437a2b91cb024034f1361c6346b5c91c5f8faff155e344279a265bb0a6ac0a85d476fd528f7bf33fc8fc45c6b36625bf250c55c6de9dd3575fd30079b49c6af6578abc98521e4fb7a9efce87660d4a349367fecf5e88d99c286fdb43ea7fa45f1f2badfa705eeab28cfa594ebe420b063a03f52c68e38724bb65d5388d4e09335b466b917ede13af92fe7b94356a7c3e2d0f9d849baddbaef8acfb0955d3ab40ffca192244d220a8a49eb2157da9b8ec2aa8241cdfd6aa93c33c9e3346ca0d90d88c26f27af174e487570b1a2212db6165618a1aebedeeb4bfa1b70558baa364ab2c0d4a322908e9738a3b2f1c0370ea98a1940d27c9ed1a4ad61c76c95cc75560e8edf1faf4c42f13d90791b9b9d03f635aaed96d183ed2c1a6c4c6c933af35a270fa5a615f41bbd7278d08d43ec60b7f078929dcd1645214b218751d60a31ae17ee42853b8896b7ab42298641b1050623eb7f2f8fda0cab249b6e77d776f1ad4ccce9b57083a7f149ca750b15b0d123fdaff6cb1a0e0f34ca8c477e626185597af251a0ed17bea8951b9f1130a11622657f2ce8b0bc5553d40134f0948db1ce4312e1591b7da6fb0878d6ecf24eded18e62048133a368d364aa6d9b30be6dfb9d50320b7a94325f925b57e3e3b5b7a981c29508c4c5b39cde4bb888049bebfad9f0e9ad74bbcae1f12e3e12533489ee71de7bf3bba60cad83217ff8f066188d8368924f89b1265383c102436317844521a99137b134c9f370fd5e9fb31cb06c94e348685cedc738a8516db9a4371f73e88bb6d06b6c32adbb4ab8844b67ee7480dfb580e4b5b71a3e0fdd69244ac93c1e36936cc79daaff1af419980e71354cb8dd082f439329201cfacfc9d4694cfaa84be237f9b30d5a6704c4efcbce1e2883c2d8ee7a4dfa8f0916e78de0ce53d62ec7604b7e129dbbe8acb6d8d7e0068ede2f044ecdbc26e440cc7795d547c6f83e2008d9d6a5303df8ccb78ed73840c19c5e190a7fdedc3878f99641bbf1121e3ae016c033fcdfe8bcf5d42cc476eb7c003ada72ea0fbed374879f1f2fc87ecce4a23aa48b3f9b55a1b1c38b4d0744869003f2c925b6304698b4894a847f28b30fd5269faa22fd5a1d77056ef44c150d0790c1304f0f7d4f64329f7fcd792306854681f7474829b14428a6e963da81d234cd2ee970ea036b516e4c88bb5a01688dc1a2222fc65a647bf56c7325a990d7caed4642a90a9ee88f841fb52512676af7a673d9b330bf338c595752f4d7c3640a4df1f83c05708fc3478208cc3c761e9126609604cf7f35b08078cd88226c7bb4615c9bd414ca390e0222f889ece62a6a5d4e8428da675b7faf445f1cd6e503c517e5795d7ea679f87dc7cd4fb85c4e61832923087f1396b4c07808a3414a9d009c8103e7f29574f44c0714cdeaa940eb2d239b3f4f5392d4b988239ce196b1efc5fb5612222aa3ce889eb5da2be8c2e89495366c9e9994f0f64fca08e27ab60341d0a123dc828fb5755ae914bbe5a6dfac9995f6029c4b8b1cba941ba9640d076ee406a3022a1aef823b0a2dedc8f3b0b0c0ea8f7d97969cc1573ceec3d784c120112bd34619ee257e48df8aa9eec2715c24f77772fe1fd5de23c2c1d58f0c4e300ed0b77a696794fa130b8a144bbbefb12e5d646eb33bca7bcbcd60baa0f6ee56a7555bbbd9ad359df99d18515e8aa257ce14398f03e53d279a3169cf39af07727c921741fa74463f6928b859c18d5fa75fdf3c6ad91d7ebd5d938b5dd0e0114a71a370f30e1cbdac5e68c6f717795470d80f1675ae7e11ab24eef4d469776fff7bf1476623945f5c5f5d6b53d9d4e1e8afd20b42501360760765fe2aed852101af051538d7129e87380bbb1af0a5a62a02149e03b54f7599a22f5ff027e5e1ba1f83a5b4d610d31a3bea6c8a7658af42136f463e67dbcca30d881172645907b379e6a0bfc4304b161bebbc1776e759f7bfbb5ed0a037653add3d1bafb6f653429c73f6f4b25242655de14be4ec0442d0275628e13bbd804bd376e60bf680791eaaaf4777ca04aa06f4871772233ec88088d71bb6204592a2011f36b9292977e8aa772ec86793694cdccf53d12a21458b5c3fc2d68586ddad926df08bcdcbdb51af8be4acea9c54f0c619dff16c720671d07662e038cead2669d68b2362dbdab10cac23e0beac804493bedbeb0ed3c4be7394cbbeb1a343a3ab6c3450679eecc7620d50b1bc48813833471e5a695f184a34a78428cf8be3068fdb4d05b80132372dea173378b99b8cae700a0941131305455ec2f947baca5b4dc8cbf34c562eaa98258170e226545b58e7a3fa455cedace9d6853a54b5269ad014ce26dd8a293a98e397e15065bcc013f1e901468692fce8927693304d7efd09698abfe1e37336e6ca5852fc1b3fcb460154af0fa73139f92a2cef0e56c5f143e35aef06e45ee9ac6c1d35a455c3db818bc9257baa759cd021ea1cd84d618d1f9e94d2ed7851545c13ba3c4e1a70e0b92c823c37bd8d09af03ea97d8b51810be26c470f85ad8bdd73c323c9d6e5c96b37237e9ae153398c5462b37c5ebc41a860d7e059a064641409ae6c63307e2bccc63c605ddb7464ca6ae6829cf3b05eedbcea4ff3a7a9999eda5aa82458d38316f46d2647f0c721a46446fc5a19a54b07ba3447370a1029ef69cb4e69da71719b8b91c95c83e4ece7ca377e18442ac6bc14702818f666e8ca1ff0f5c5ce34c5ea69b3fcedc83a43b5f36e75d20d5ff5eff73f210e72830b2808e475ca40367aad775e40108912586962d08b02ec8be4d435773c8f8175aab20a9e9e11f597ce1ecfffac1d660ec1e950b3ccd7d1980a118ad2b802bdeed0200d716ac7f2aa2bf6e5b7370e7305888aa74f4e5e9ce6654579f2878ccb0cc37a8e67bb4ac72cc1c97c5a8e7afc0db5184f2e2628220106db5fa2b510315fdee1ff40e92cb3f38a0e9d9eea836df81928113716c5d00b5752abcff93d1b918e5d89b4b52c6142bcbf8abc0117140fc7a104095d340e2a3a217fa7a454059bd8eb66a251e7231def86f479e4347456f8623c24b6699e14ac285ed097434b4f5a0cbdd55343a158aefa2ef916be097b093342617dee83fe9cc39f3a0e7d01ebad225666a5006bc62adcf097d33240a3d860143879f177e6ea563a3693057273bcdac279deae673141724f751c915e5b43471b5d43ea635e44d06ab26d85c0f9b74f23cec9d3329d9a492f1ae7216bedbc5a4877a46f9ee17bc18f91b65645a673f42f2c7e0f12999bc65bc3e382ffdeac561d5c58a0b7274000fe2b4afdc0eaa87bda23896b8560b91f98f2fa6fb88b2de000a00e6d02cbc483f7ebccc209823eda63b4fbf86cdf16e91acf927415eb2b7f9c3332407de34e9f2cd2cc86c59fec3a6428d2341ad8967145fd4185a83f282c4e191fb0a365c6505ed5d28598d96a0111a987e7e7c9e07265be2e73b7b01ac4f33f7246f3ff466ae57eedbe67a219e38deb85d5c107159131c582ff45228f116853c1bfa6b7cde41037cfde436993412c63a25362e88176e7049316ea5f5b8612419223d82ded55e2788e12f7472662381022121e2949ae8367a035c004afaabd98a1d632278d928950295aa57715c53ebd41e5a5198ff220cfa13f689d10d5c5bb2e6a9bf66dd13d975365f7a991b6f4bc6e4d3785451000ab49b00c81d4f82fa7fa5a048f7143f250f4b85e89ac3a516a6700182ec2aa3b2ff940c7910ce529b11398ded1248fdca25b5d81d866bae7577dfa6c3fadcbf9bb4dc8937ab83b698a51f53520b3f514fa0e73e58620276d3745d2a32d7363ef49593f7eb1017c39276e58f23e1b8b415efb4904460da479a86bd389b0bfd026e69502cd2e431eedeb209400fb299438d51a879b1e0ef6b4ba3ae4dd963ec25ef56b44343ccccf66e2cc40670e10e0477f48df66456c185c6584347b86281c4ff936978d017a69c4b6fea610bbede8e992e5a1206d26061163980d9d5c037d295c8369fd7dd82afdb7afb8cb9070ca29b4d514b32478d34fa36a969cdc68bd465a29b2c13af1ac1438a6d1ac7c55b0c36d3109aac3d1f7c7f87a2df89ed9a15dd97260a61be3f4b2f5da06e293f0523bf1863fe63a863c12a8c1253179988053c0245a3c2e2f83173ff83422ad3fabf744b90db33cf6925ef2f6d656ee404ce80f6ac6fe126620c87ba4489e68b16b4fbc0b62c2bd8c65303420da370828365ad4d211352fc5aad7ace8e9b7d74feca3f26d5ba2b968a847bf1f3a6c966d6e927a5bc2c6c44a5c10d36ade49a3e69d98317b041e9f3edd78eec9b30a4781769f75f2ff8f81095f58ceac7834c1f10d9a3db79d3aa7e508544a8cc0ad264d1ead6b912ac4b07f8f59d2223fc46b4114b5f93ac7d390bf048e9f0a11a14d0658cebccabf740fab8b14e2c642c38a324b35d46c20f9e79d2abc374ac5fbf52bd91864a2f10d596e8e9069cfac55853062f1863317d7bbe021b2f4db7f2072861122dd31efddf7104bf841135c1c9f4ad617a6251b04cde52340858d30ba68be3f5740f4c58f87352639594dfa66c832329cdcc8c94fab4db78b307cbc776012ec9b49fcd3f3cea3b51644cdfeac5c9704d9b63153ea9beaac0255a6552864a349a8f0bb01d65af5d23398b5555b208c8269a0ee4048e7ebb89456a60e0cbd07d6e6f170fab51f1b7705e646bcf225d2c3d49abff7469d258307c4a23528f39217f42f4084cc7ec5d2f474de8cbbd6bb85f4c8f32c48d2a7334a93b6ffd5022ea00a213d6f039f5f26e65ae07120b22e4dd7169c3104e02807f0991642c9eca682446b6cfa22745161e0bbde5b80e8dd146bfd05c35f34607ff228766c0958035abf75f03195afe6ddd961ada710903cafc5f7f2e51356ca60ee62d7b038845c91304058e656f579f95ce65739ad101882ac884a9f89607ffc1eb48645984069900c0e3d6ee432a0ffad65365e5067b34ede2188e20e7a0ab55ed769fe7844dcebc4fd106e81191f01ebfb8ac90268109a8e61fe6e3dcded53c5296f0b449b6c7491d467ed52ae07b434399e4476bd285692f25433b741844cac25c17ec41a5c2d97a6acf4270b48fd30efad590d78e0360a628be23e34260c9214af4b2228444d004f8abaf0932fb707b47100a2bca0c7d186255b0e427dd814b00eeab9a128cdc3ca162bb30e3f80d69c114a04bafa40bffb08a7a2077da5ab6c7b8b81cd078b80fc28ca74dec3b95214683bd84b6db953fa3dc3c154b4747de3734ef516e80b6c90b766f4bfe1de42b5a59b3a6acf92669d6152cef4203631a7ac52", 0x1000}, {&(0x7f0000001300)="31e64f7a57f9f8ef0f65ed61dbcbc9a35b174026152ac45452f388e556d1d679d52b101066d91fc503f67133859ec31af491e919153b663d5f87792c4431c1a867db83278ef672f327ac1223d6d376ce0951599db6989f6693e4b0f616a589aac39f8ec548015af79b9079246eda5c1e35e3c9fa979011b74a52d745d6beb0c28826c663613d33075aa547690a6baeabadeeef90d3a1dc4bc40daec37dbda99286b94280db7b2ab983bf5b6c00108b64fc6882c15cc9d892464479d13a3e96d2ef70ff80d42567d9711a8af837623d53fb537329709d1b120d4d09143d3e06eb78da91694163217b9b", 0xe9}, {&(0x7f0000000240)="93012364bf2108c2bb461cc7d27858f76f87e1ed14fdd39783c71f5600f20f022d3a0ded552eec13d98b5977e138dc5a6a34cf2362d10771bbc510a22eb4a030f5e70d853ecc1ef524bca47fb465ce216c0afb554a", 0x55}, {&(0x7f0000001400)="700bb5609946deb3d9554a4355f02522b1ef756f11db3358bc173d07da178fc782e9389f13f81b0f467e59d788e52871d3c20c105572fa789db2b747e333f4377cb0af13a345dda0473ece4b50ea2534a02e2a87cc831453ada6d7233c8255dce281a9917ffdacf3393be60024780d75371d007665a980d9311a6cb9fca31577e86811d6c236f2d3dfb31fccdd51fbe2be094c746b86cad51b60a78a544bde2e1a04cdd31ac2be09b7fadecdbcfeffec7883e0fa8f4bdd470e3429f0288a383375ca859d9d6e89a3fb298221ad0f067a", 0xd0}], 0x6, 0x0) lseek(r0, 0x2, 0x3) 09:38:39 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 773.955905] binder: 3214:3223 BC_ACQUIRE_DONE u0000000000000000 no match [ 773.965750] binder: 3217:3225 BC_ACQUIRE_DONE u0000000000000000 no match [ 773.969976] binder: 3215:3227 BC_ACQUIRE_DONE u0000000000000000 no match [ 774.040485] binder: 3233:3234 ioctl c018620b 0 returned -14 09:38:39 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0xcb4) open$dir(&(0x7f0000000100)='./file0\x00', 0x40, 0x80) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) 09:38:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 774.100519] binder: 3233:3238 got transaction with invalid offset (0, min 0 max 0) or object. [ 774.119315] binder: 3233:3238 transaction failed 29201/-22, size 0-8 line 3349 09:38:39 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x400000) ioctl$UI_END_FF_UPLOAD(r0, 0x406855c9, &(0x7f0000000180)={0x2, 0x36b0000000000000, {0x57, 0x1f, 0x100000000, {0x2, 0x3}, {0x20000}, @period={0x58, 0x5, 0x1, 0x10000, 0x3, {0x99, 0xbbf1, 0x8001, 0x1}, 0x2, &(0x7f0000000040)=[0x6509, 0xffffffffffffff30]}}, {0x57, 0x2, 0x4, {0x100000001, 0x1}, {0x6, 0x7}, @rumble={0x10001, 0x2}}}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) 09:38:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='cubic\x00', 0x6) getsockopt$inet6_opts(r2, 0x29, 0x3b, 0x0, &(0x7f0000000180)) 09:38:40 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x7) 09:38:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:40 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000200)='/dev/keychord\x00', 0x4000, 0x0) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000300)=""/222) ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f0000000240)) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x500, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0xe6c, 0x3f, 0xffff, 0x81, 0x0, 0x7fffffff, 0x808, 0x2, 0x8000, 0xfffffffffffffc00, 0x4, 0x80, 0x80, 0x550, 0x8, 0x1ff, 0x200, 0x9, 0xffffffff, 0xfffffffffffffff7, 0x1ff, 0x7b2ae540, 0x7, 0x42, 0xbb, 0x80, 0x9, 0x7f, 0x1, 0x3, 0x40, 0x0, 0x6, 0x2, 0x3, 0x0, 0x0, 0x496, 0x1, @perf_bp={&(0x7f0000000000), 0x1}, 0x0, 0x1, 0x2, 0x4, 0x8, 0xfffffffffffffffd, 0x20080}, r0, 0x9, r2, 0x8) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r3, 0x2, 0x0) 09:38:40 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='cubic\x00', 0x6) getsockopt$inet6_opts(r2, 0x29, 0x3b, 0x0, &(0x7f0000000180)) 09:38:40 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(0xffffffffffffffff, r2) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:40 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(&(0x7f0000000000)=@filename='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='ext4\x00', 0xc000, &(0x7f0000000180)='vmnet1!\x00') mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000200)) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000240)='/dev/zero\x00', 0x2080, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000300)={0x4, 0x9, 0x3f, 0x0, 0x7}) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r2, 0x2, 0x0) [ 774.740429] binder: 3262:3265 ioctl c018620b 0 returned -14 [ 774.749064] binder: 3263:3268 ioctl c018620b 0 returned -14 09:38:40 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 774.796019] binder: 3262:3272 BC_ACQUIRE_DONE u0000000000000000 no match [ 774.811199] binder: 3263:3274 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:40 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x2, 0x0) lseek(r0, 0x2, 0x0) [ 774.875683] binder: 3282:3284 ioctl c018620b 0 returned -14 [ 774.882332] binder: 3285:3288 ioctl c018620b 0 returned -14 09:38:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 774.929758] binder: 3285:3290 got transaction with invalid offset (0, min 0 max 0) or object. [ 774.939792] binder: 3285:3290 transaction failed 29201/-22, size 0-8 line 3349 [ 774.962136] binder: 3282:3291 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:40 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) unlink(&(0x7f0000000000)='./file0\x00') r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$BLKFRASET(r1, 0x1264, &(0x7f0000000040)=0x1) recvmmsg(r1, &(0x7f0000004080)=[{{&(0x7f0000000180)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000001680)=[{&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000000200)=""/182, 0xb6}, {&(0x7f0000001300)=""/131, 0x83}, {&(0x7f00000013c0)=""/130, 0x82}, {&(0x7f0000000100)=""/1, 0x1}, {&(0x7f0000001480)=""/234, 0xea}, {&(0x7f0000001580)=""/12, 0xc}, {&(0x7f00000015c0)=""/130, 0x82}], 0x8, &(0x7f0000001700)=""/119, 0x77}, 0x10000}, {{&(0x7f0000001780)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000001a80)=[{&(0x7f0000001800)=""/123, 0x7b}, {&(0x7f0000001880)=""/168, 0xa8}, {&(0x7f0000001940)=""/118, 0x76}, {&(0x7f00000019c0)=""/65, 0x41}, {&(0x7f0000001a40)=""/48, 0x30}], 0x5}, 0x9}, {{&(0x7f0000001b00)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f0000002b80)=[{&(0x7f0000001b80)=""/4096, 0x1000}], 0x1, &(0x7f0000002bc0)=""/165, 0xa5}, 0xa943}, {{&(0x7f0000002c80)=@ipx, 0x80, &(0x7f0000003080)=[{&(0x7f0000002d00)=""/64, 0x40}, {&(0x7f0000002d40)=""/101, 0x65}, {&(0x7f0000002dc0)=""/85, 0x55}, {&(0x7f0000002e40)=""/134, 0x86}, {&(0x7f0000002f00)=""/73, 0x49}, {&(0x7f0000002f80)=""/161, 0xa1}, {&(0x7f0000003040)=""/30, 0x1e}], 0x7, &(0x7f0000003100)=""/91, 0x5b}, 0x8}, {{&(0x7f0000003180)=@alg, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003200)=""/200, 0xc8}, {&(0x7f0000003300)=""/201, 0xc9}, {&(0x7f0000003400)=""/190, 0xbe}], 0x3}}, {{&(0x7f0000003500)=@sco, 0x80, &(0x7f0000003640)=[{&(0x7f0000003580)=""/147, 0x93}], 0x1, &(0x7f0000003680)=""/230, 0xe6}, 0xb54}, {{&(0x7f0000003780)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000003840)=[{&(0x7f0000003800)=""/48, 0x30}], 0x1, &(0x7f0000003880)=""/41, 0x29}, 0x8}, {{&(0x7f00000038c0)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000003e00)=[{&(0x7f0000003940)=""/157, 0x9d}, {&(0x7f0000003a00)=""/140, 0x8c}, {&(0x7f0000003ac0)=""/210, 0xd2}, {&(0x7f0000003bc0)=""/67, 0x43}, {&(0x7f0000003c40)=""/141, 0x8d}, {&(0x7f0000003d00)=""/79, 0x4f}, {&(0x7f0000003d80)=""/102, 0x66}], 0x7, &(0x7f0000003e80)=""/18, 0x12}, 0xa8}, {{&(0x7f0000003ec0)=@in6={0xa, 0x0, 0x0, @empty}, 0x80, &(0x7f0000004000)=[{&(0x7f0000003f40)=""/161, 0xa1}], 0x1, &(0x7f0000004040)}, 0x757c98a0}], 0x9, 0x10000, &(0x7f00000042c0)) lseek(r0, 0x2, 0x0) [ 775.010655] binder: 3296:3298 ioctl c018620b 0 returned -14 09:38:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 775.062450] binder: 3296:3300 ioctl c0306201 0 returned -14 [ 775.062848] binder: 3296:3300 BC_ACQUIRE_DONE u0000000000000000 no match [ 775.106051] binder: 3303:3304 ioctl c018620b 0 returned -14 [ 775.161721] binder: 3303:3308 ioctl c0306201 0 returned -14 [ 775.172372] binder: 3303:3308 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:41 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000bc0)='/selinux/checkreqprot\x00', 0x0, 0x0) accept$inet(r1, &(0x7f0000000c00), &(0x7f0000000c40)=0x10) lseek(r0, 0x2, 0x0) 09:38:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='cubic\x00', 0x6) 09:38:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(0xffffffffffffffff, r2) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:41 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000009c0)='bin&mt_misc\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000680)='/selinux/mls\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000a80)={{{@in6=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@remote}}, &(0x7f00000007c0)=0xfffffffffffffe5d) r3 = getgid() write$FUSE_CREATE_OPEN(r1, &(0x7f0000000800)={0xa0, 0xfffffffffffffff5, 0x3, {{0x2, 0x0, 0x6, 0x1f, 0x75eb35f5, 0x800, {0x1, 0x8, 0x1, 0x800, 0x9, 0xfffffffffffff000, 0x3, 0x100000001, 0x8, 0xfffffffffffffbff, 0x1, r2, r3, 0x6, 0xfffffffffffffff8}}, {0x0, 0x4}}}, 0xa0) bind$unix(r0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e) r4 = getpid() ptrace$setregset(0x4205, r4, 0x3, &(0x7f0000000980)={&(0x7f0000000900)="60a9a16cb3711b686e9b6d062d37bce9f32fdfab51563cac554289d33fe026b496444fdce50631ec5ceeaaa099930a77bd9de2f738bd7aefe36d9fadde96a680cbcbedb46107021d93143f58200c59d48e47e33ef88a86eee362c348f708067bbbe35da18ba8ccda06faa1ff1ba323e82b6236aa4ba146459fb2b4", 0x7b}) lseek(r0, 0x2, 0x0) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x353002, 0x0) execveat(r0, &(0x7f0000000200)='./file1\x00', &(0x7f00000004c0)=[&(0x7f0000000240)='configfs\x00', &(0x7f0000000280)='/dev/null\x00', &(0x7f0000000300)='%\x9eeth1em0-nodevsystemcpuset\x00', &(0x7f0000000340)='configfs\x00', &(0x7f0000000380)='/dev/null\x00', &(0x7f00000003c0)='\'\x00', &(0x7f0000000400)='\x00', &(0x7f0000000440)='configfs\x00', &(0x7f0000000480)='configfs\x00'], &(0x7f0000000640)=[&(0x7f0000000540)='configfs\x00', &(0x7f0000000580)='configfs\x00', &(0x7f00000005c0)='/dev/null\x00', &(0x7f0000000600)='configfs\x00'], 0x1000) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000008c0)='/selinux/member\x00', 0x2, 0x0) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) setsockopt$packet_int(r5, 0x107, 0x22, &(0x7f0000000a40)=0x40000002, 0x3) getsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000040), &(0x7f0000000100)=0x4) [ 775.569431] binder: 3317:3318 ioctl c018620b 0 returned -14 09:38:41 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 775.628367] binder: 3317:3321 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:41 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x4) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000001c0)={{{@in6=@empty, @in6=@ipv4={[], [], @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast1}}, &(0x7f0000000300)=0xe8) accept4$packet(0xffffffffffffffff, &(0x7f0000000940)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000e40)=0x14, 0x800) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/checkreqprot\x00', 0x404000, 0x0) sendmsg$nl_route(r2, &(0x7f0000000f40)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000f00)={&(0x7f0000000900)=@ipv4_newroute={0x34, 0x18, 0x710, 0x70bd28, 0x25dfdbfe, {0x2, 0x0, 0x10, 0x2, 0xfc, 0x4, 0x0, 0xb, 0x2800}, [@RTA_PREFSRC={0x8, 0x7, @initdev={0xac, 0x1e, 0x0, 0x0}}, @RTA_SRC={0x8, 0x2, @empty}, @RTA_DST={0x8, 0x1, @broadcast}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x8000) r3 = accept$packet(0xffffffffffffff9c, &(0x7f0000000e80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000ec0)=0x14) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000fc0)={0x0, 0x0}, &(0x7f0000000f80)=0xfffffffffffffeae) fstat(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f00000004c0), &(0x7f0000000500)=0x0, &(0x7f0000000540)) r9 = geteuid() getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000580)={{{@in6=@initdev, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000680)=0xe8) r11 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000980)='/selinux/policy\x00', 0x0, 0x0) ioctl$TUNSETQUEUE(r11, 0x400454d9, &(0x7f00000009c0)={'bcsh0\x00', 0x400}) setsockopt$inet_tcp_TCP_CONGESTION(r11, 0x6, 0xd, &(0x7f0000000d80)='dctcp-reno\x00', 0xb) fstat(0xffffffffffffff9c, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000740)={0x0, 0x0}, &(0x7f0000000780)=0xc) lstat(&(0x7f00000007c0)='./file0\x00', &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='system.posix_acl_default\x00', &(0x7f0000000dc0)=ANY=[@ANYBLOB="02000000010004000000000002000300", @ANYRES32=r1, @ANYBLOB="02000400", @ANYRES32=r5, @ANYBLOB="02000200", @ANYRES32=r6, @ANYBLOB="02000100", @ANYRES32=r7, @ANYBLOB="ec59045a44d516e4", @ANYRES32=r8, @ANYBLOB="02000600", @ANYRES32=r9, @ANYBLOB="02000200", @ANYRES32=r10, @ANYBLOB="02000200", @ANYRES32=r12, @ANYBLOB="02000300", @ANYRES32=r13, @ANYBLOB="02000400", @ANYRES32=r14, @ANYBLOB="040004000000000008000600", @ANYRES32=r15, @ANYBLOB="10000300000000002000000000000000"], 0x7c, 0x3) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) waitid(0x1, r4, 0x0, 0x41000000, &(0x7f0000001040)) r16 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x2, 0x0) write$UHID_CREATE2(r16, &(0x7f0000000b80)=ANY=[@ANYBLOB="0b002101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000df0009000000010009000000070000000600000037f54edaaadc2efcafc6ef39350c365499353a2a2935821c4f2f2033842cc50436eae2e43b4eb35112e93bdb94acf4a63c0948c32d370fe9359b66a40cd7e2771b17465bae7d938ed360d1060cb1a07517b4e5a8a02250eab8e91b020ce3b59b98e8784f237b99fffb111d5a0539a09fbad758ab6725f7eb5b9152fbefe707b2b2e5dd64741c97aa19918b94106628b8cf47734bab2bff5fa76a3016bf188aeb0c06756526076b00ec274decafb59f01e1a5a4fbf6f13bf70a3b61b1d8f3e8a352e2af32e832f04e54ec3d0a41b5bb3752d54b2d3b38ea720cb8c9eda36497"], 0x1f7) pread64(r16, &(0x7f0000000080)=""/32, 0x20, 0x55) sendmsg$nl_route(r11, &(0x7f0000000b40)={&(0x7f0000000a00), 0xc, &(0x7f0000000b00)={&(0x7f0000000a40)=@ipv6_deladdr={0x94, 0x15, 0x511, 0x70bd25, 0x25dfdbff, {0xa, 0x3f, 0x102, 0x0, r0}, [@IFA_ADDRESS={0x14, 0x1, @remote}, @IFA_FLAGS={0x8}, @IFA_FLAGS={0x8, 0x8, 0x1}, @IFA_LOCAL={0x14, 0x2, @dev={0xfe, 0x80, [], 0xe}}, @IFA_LOCAL={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @IFA_LOCAL={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @IFA_FLAGS={0x8, 0x8, 0x200}, @IFA_CACHEINFO={0x14, 0x6, {0x10000, 0x5b9, 0x3, 0x94b}}]}, 0x94}, 0x1, 0x0, 0x0, 0x800}, 0x8000) write$selinux_attr(r3, &(0x7f0000001000)='system_u:object_r:mqueue_spool_t:s0\x00', 0x24) r17 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r17, 0x2, 0x0) [ 775.705888] binder: 3328:3330 ioctl c018620b 0 returned -14 09:38:41 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x800100000000001, 0x0) [ 775.776726] binder: 3328:3338 got transaction with invalid offset (0, min 0 max 0) or object. [ 775.799469] binder: 3328:3338 transaction failed 29201/-22, size 0-8 line 3349 09:38:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(0xffffffffffffffff, r2) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 09:38:41 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) connect$unix(r0, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) [ 775.941956] binder: 3345:3346 ioctl c018620b 0 returned -14 [ 775.996130] binder: 3345:3350 ioctl c0306201 0 returned -14 [ 776.004769] binder: 3345:3350 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:42 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000100)={0x800, 0x19, 0x3, 0x5, "a62fc4cf12d6a8e97a14b757d3470fd4ad00ee8348562b901d8dfb87852ab691"}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)=@ethtool_drvinfo={0x3, "80e31719b5ac6eea53c373c2ebfa93405b3988b38542140e10c78894c8010a5e", "a43a618b528add95e2eab0ee8d8ce8e1d014503a03a0ead121ee9bd9d07b520a", "6374c0f6b0c42835350fbda7a58bfc7e7d092a2e38e5c0890f5824258c85543f", "4173cb8b8fdc2b9877ea5ea91a19a50df3fda0a62f257af96779b5d46209b5a0", "e7132e86b3939d7cab5a0c7175304c6757d2ae4e7f70ac4fce21e0d956ae0289", "49e311b3b5b1e0d7ee00359e"}}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000180)={{{@in=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000280)=0xe8) ioctl$TUNSETOWNER(r0, 0x400454cc, r2) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) recvmsg(r0, &(0x7f00000005c0)={&(0x7f0000000300)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @initdev}}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000380)=""/51, 0x33}, {&(0x7f00000003c0)=""/198, 0xc6}, {&(0x7f00000004c0)=""/177, 0xb1}], 0x3}, 0x40000042) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/create\x00', 0x2, 0x0) lseek(r3, 0x2, 0x0) 09:38:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) 09:38:42 executing program 4: r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(r0, r2) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:42 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) lsetxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x3) ftruncate(r0, 0x8) [ 776.412297] binder: 3365:3368 ioctl c018620b 0 returned -14 09:38:42 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:42 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40, 0x84) connect$unix(r0, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e20}, 0x6e) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) [ 776.471996] binder: 3365:3373 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:42 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000200), &(0x7f0000000240)=0x0, &(0x7f0000000280)) fchownat(r0, &(0x7f0000000040)='./file0\x00', r1, r2, 0x1000) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r3, 0x2, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x1) [ 776.516645] binder: 3376:3378 ioctl c018620b 0 returned -14 [ 776.585308] binder: 3376:3383 got transaction with invalid offset (0, min 0 max 0) or object. [ 776.594066] binder: 3376:3383 transaction failed 29201/-22, size 0-8 line 3349 09:38:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:42 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) fallocate(r0, 0x0, 0x6, 0x399bc47f) lseek(r0, 0xfffffffffffffffe, 0x200000000000000) munmap(&(0x7f0000ffb000/0x1000)=nil, 0x1000) r1 = dup3(r0, r0, 0x80000) ioctl$sock_TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000040)) 09:38:42 executing program 4: r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(r0, r2) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:42 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) fsetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.redirect\x00', &(0x7f0000000040)='configfs\x00', 0x9, 0x3) [ 776.780608] binder: 3391:3392 ioctl c018620b 0 returned -14 09:38:42 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x408000, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000040)=0x1) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000100)) lseek(r1, 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f00000001c0)={'team0\x00', {0x2, 0x4e23, @rand_addr=0x1}}) [ 776.845508] binder: 3391:3397 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) dup2(r0, r0) 09:38:42 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000000)='trusted.overlay.nlink\x00', &(0x7f0000000040)={'U+', 0x4ba}, 0x28, 0x0) 09:38:42 executing program 4: r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(r0, r2) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 777.241193] binder: 3412:3414 ioctl c018620b 0 returned -14 09:38:43 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:43 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000180)={'veth1\x00', {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x12}}}) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) recvfrom(r2, &(0x7f0000000040)=""/63, 0x3f, 0x140, 0x0, 0x0) listen(r0, 0x1) lseek(r1, 0x2, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file0\x00', 0x4000, 0x41) 09:38:43 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 777.326550] binder: 3412:3418 BC_ACQUIRE_DONE u0000000000000000 no match [ 777.362866] binder: 3424:3425 ioctl c018620b 0 returned -14 [ 777.424580] binder: 3424:3430 got transaction with invalid offset (0, min 0 max 0) or object. [ 777.434310] binder: 3424:3430 transaction failed 29201/-22, size 0-8 line 3349 09:38:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:43 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) 09:38:43 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) 09:38:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(0x0, 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:43 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000100)=0x0) getresuid(&(0x7f0000000240)=0x0, &(0x7f0000000280), &(0x7f0000000300)) fstat(0xffffffffffffff9c, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(r0, r1, r2) geteuid() r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/policy\x00', 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000440)=0x0) sendmsg$nl_generic(r3, &(0x7f0000000740)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0xdfe92d19bffdcb6e}, 0xc, &(0x7f0000000700)={&(0x7f0000000480)={0x254, 0x1d, 0x200, 0x70bd26, 0x25dfdbfe, {0x2}, [@nested={0x240, 0x69, [@generic="a7b231dac7438c47552b6a04fbfd33e6396502f2c52c0b9a1ecf5bc661edd2d387ff7f30edcbd2e8b2d0df03ba62f9aaf072a2a213ba4139b343c796a5b4997626e6ca3df1c36112fc0fd82c7785fc1e5b8e0f8fb2f1cedd6ca3c628afd3524ae70baa5876c99d855aa58cae2a583b4ed03b1b6d22df260f60790c52b2ecc5e7212a51cb9c6a3a8d844c28ed6cafede4e3348d0db516acd3132b7ee10842fc8af8db4be0d9d97f28a3698be36530011ff4c74eba460640", @typed={0x28, 0x16, @binary="b37d11b5c849aea3a4a2d4afcdae3b2700c7f8001c9def01b2348020af9592aeacb1bb71"}, @typed={0x8, 0x41, @pid=r4}, @generic="c4d0963f47cdec54cf785f9e11c868bfce48c4e60242f5296c9f57235a698db4e3b3bb3d1ea499f09e03b28626de86011603e236b9669205268cdd88cfd38f482d4af7a1874b6a1c06513888957fe9a16dd7d80368674a3d6c5d7cfa31851cfd402b84959e71f7c101fb3609367a6cca0db6bbbd40230bfbb66988380f66b8eef57d1217dc42e19eb8fda897f68e9fda65", @typed={0xc4, 0x23, @binary="d96114dad117c88cc109748f6428335a866d80f83b166502c0dae21fbbc8b0367a1c01b72d91b488a206568e13e7c99155a583a1868bfa295d3950fa23b045755371354bfa5f751cdb949b943d31aa21f478309bcca0568798ae1e3aaffd9962cb8ba9e307e474178f475ef7ec947b3ef2432842bdba28584af84ed775883033171cdadefce0b7fa29ff746c8ae313fa51de84cf7774e6570dde81c26b20c72ab281d89080e11fcec05aac561376cdbeeff54cbf5f21ec817e24f916af55b2"}]}]}, 0x254}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000004) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r5, 0x2, 0x0) fstatfs(r5, &(0x7f0000000180)=""/181) [ 777.617066] binder: 3437:3440 ioctl c018620b 0 returned -14 [ 777.675536] binder: 3437:3443 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:43 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:43 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x40000000010001, 0x0) lseek(r0, 0x2, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000040)="322cfa898f4540a33be9813b70ebdf45", 0x10) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) 09:38:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(0x0, 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 778.077458] binder: 3456:3458 ioctl c018620b 0 returned -14 09:38:43 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:43 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) utime(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x809, 0x20}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101400, 0x3a) getsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040), &(0x7f0000000100)=0x4) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000300)=0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000340)={0x0, r1}) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x77) getsockname(r0, &(0x7f0000000180)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, &(0x7f0000000200)=0x80) lseek(r2, 0x0, 0x0) 09:38:43 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) [ 778.132290] binder: 3456:3459 got transaction with invalid offset (0, min 0 max 0) or object. [ 778.141893] binder: 3456:3459 transaction failed 29201/-22, size 0-8 line 3349 [ 778.205570] binder: 3466:3467 ioctl c018620b 0 returned -14 [ 778.273123] binder: 3466:3471 got transaction with invalid offset (0, min 0 max 0) or object. [ 778.289353] binder: 3466:3471 transaction failed 29201/-22, size 0-8 line 3349 09:38:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:44 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) 09:38:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(0x0, 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:44 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='aufs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x800002, 0x0) lseek(r0, 0x10000000000, 0x5) [ 778.442072] binder: 3474:3478 ioctl c018620b 0 returned -14 [ 778.499062] binder: 3474:3481 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:44 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x400, 0x0) lseek(r0, 0x2, 0x0) 09:38:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:44 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) lsetxattr$security_smack_entry(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000040)='security.SMACK64EXEC\x00', &(0x7f0000000100)='configfs\x00', 0x9, 0x1) 09:38:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(0x0, 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:44 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c) ioctl$SIOCGIFHWADDR(r0, 0x8927, &(0x7f0000000040)) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r2, 0x800, 0x70bd2a, 0x25dfdbfe, {{}, 0x0, 0xb, 0x0, {0x14, 0x14, 'broadcast-link\x00'}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x1) r3 = add_key$keyring(&(0x7f0000000340)='keyring\x00', &(0x7f0000000380)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r3, 0x1) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x4000, 0x0) recvfrom(r4, &(0x7f0000000180)=""/102, 0x66, 0x100, 0x0, 0x0) lseek(r1, 0x2, 0x0) [ 778.905332] binder: 3497:3500 ioctl c018620b 0 returned -14 09:38:44 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 778.970867] binder: 3497:3502 got transaction with invalid offset (0, min 0 max 0) or object. [ 778.989815] binder: 3497:3502 transaction failed 29201/-22, size 0-8 line 3349 09:38:44 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/enforce\x00', 0x80080, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) setxattr$security_selinux(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.selinux\x00', &(0x7f0000000100)='system_u:object_r:hostname_exec_t:s0\x00', 0x25, 0x1) 09:38:44 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) [ 779.088498] binder: 3511:3513 ioctl c018620b 0 returned -14 [ 779.154840] binder: 3511:3520 got transaction with invalid offset (0, min 0 max 24) or object. [ 779.181534] binder: 3511:3520 transaction failed 29201/-22, size 24-8 line 3349 09:38:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:44 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x7) 09:38:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(0x0, 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 779.201449] binder: 3511:3522 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:45 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='configfs\x00\xd6\x15\x8a\xfa\xb36\xafP\xc4/\x18{\xc3\xc1\x13k\x84\x00\x9a.\xb3oV>\xf5T\xd5y\xce\x0e(\x93\xf2\xa3\xd8Q\fH\xf9\x7frU\xbf\xfb.\x93\a\xea\x14\xe9\xaf\x04Qj', 0xfffffffffffffffc, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) [ 779.264210] binder: 3525:3526 ioctl c018620b 0 returned -14 [ 779.340185] binder: 3525:3534 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:45 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x2) unlinkat(r0, &(0x7f0000000040)='./file0\x00', 0x200) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) 09:38:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:45 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(0x0, 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:45 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) fstat(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r2, r3, r4) lseek(r1, 0x6, 0x400000000000001) r5 = request_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000180)='/\\[selinux\x00', 0xfffffffffffffffb) keyctl$get_security(0x11, r5, &(0x7f00000001c0)=""/220, 0xdc) flock(r1, 0x0) fcntl$getflags(r1, 0x0) 09:38:45 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000040)=0x6, 0x4) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x101000, 0x1000000000) lseek(r1, 0x2, 0x0) [ 779.742299] binder: 3543:3549 ioctl c018620b 0 returned -14 09:38:45 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:45 executing program 3: write$binfmt_aout(0xffffffffffffffff, 0x0, 0xff92) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000340)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="2321202e2f66696c65309c5bc6acb7af31c76a1ef7b41907000000000000814911e4d1704ae20c04959e567478ef5319f141e6be41abaa78b101c8f30b693fc4501286e5f1ec78d865779114666f6167f0438d95c0e96160565e79cb170d391613656b1bc272e3570dce7c052b4384e2d4c05fbe8a9dbe0b31ef5158a20b9aa75ebfe3a86b1c9888fa8250c62b8d7d5756"], 0x91) close(r1) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$FICLONERANGE(r0, 0x4020940d, 0x0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000280)='/dev/input/event#\x00', 0x0, 0xfffffffffffffffd) getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x0) getpgid(0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) ioctl$TIOCGSID(r1, 0x5429, 0x0) fsetxattr$security_evm(0xffffffffffffffff, &(0x7f00000000c0)='security.evm\x00', &(0x7f0000000180)=@v2={0x3, 0x1, 0x0, 0xb, 0x31, "488b67dedcc5a87e15490983139c5c06c96c676da0977851af15441ea7a4c8d19c4547a0619b26bb0c2115898a9e2cd192"}, 0x3b, 0x1) getpgrp(0x0) gettid() getegid() r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/udp\x00') preadv(r2, &(0x7f00000017c0), 0x199, 0xf0ff7f) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r4 = dup(r3) ioctl$TIOCGETD(r4, 0x5424, &(0x7f0000000000)) lseek(r3, 0x2, 0x0) [ 779.807534] binder: 3543:3553 got transaction with invalid offset (0, min 0 max 0) or object. [ 779.838325] binder: 3543:3553 transaction failed 29201/-22, size 0-8 line 3349 [ 779.933278] binder: 3560:3561 ioctl c018620b 0 returned -14 09:38:45 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) [ 780.014805] binder: 3560:3564 got transaction with invalid offset (0, min 0 max 24) or object. 09:38:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:45 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 780.057128] binder: 3560:3564 transaction failed 29201/-22, size 24-8 line 3349 09:38:45 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='configfs\x00)\xd7\x86\x1a\xc0)\xf0\xd0\x99Lv\xde\xcfMX?[\xa3\xa9\b\xdc\xcd]\xd7h\xc2H2\xdd\xddX\x1c0%\x7f\x86\xeb\x9bW\xc1gB\xbf[N;\x86\x1c\xda\xd4\xdf\xb6\xd1\x13\xea\x05[Z|\xe07\xff\x7f\xffU\x922\xb8\xbe\xf6F\x93r6!\xc6O^>\xe3u2^\xbb\xc2f0x0}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl(r0, 0x80000000, &(0x7f0000000380)="9b86251cdd5e977df8703b8abb5ae2744712554de0085525d14a88d94cabf3039fb36b6227346c978a533f225d846bc1b76746b4071cc449357d6059c2580f9c540c8b1f3d28317f9ef98b26bf45537002f0") unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@mcast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@dev}}, &(0x7f00000005c0)=0xe8) recvfrom$packet(r3, &(0x7f0000000440)=""/67, 0x43, 0x40000002, &(0x7f0000000600)={0x11, 0xfd, r4, 0x1, 0xfd9, 0x6, @link_local}, 0x14) lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='system.posix_acl_access\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="02000000010006000000000002000500", @ANYRES32=r1, @ANYBLOB="040004000000058000000000", @ANYRES32=r2, @ANYBLOB="10000500af6300002000040000002000"], 0x34, 0x1) [ 780.168911] binder: 3576:3582 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:46 executing program 3: socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0x2, 0x0) 09:38:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:46 executing program 3: r0 = accept(0xffffffffffffff9c, &(0x7f0000000180)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, &(0x7f0000000040)=0x80) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) bind$packet(r0, &(0x7f0000000200)={0x11, 0xf7, r1, 0x1, 0x80, 0x6, @remote}, 0x14) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f0000000280)={{0x3, 0x3, 0x5, 0x2, 0xa2}, 0x608f9695, 0x1}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r3, 0x2, 0x0) 09:38:46 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x86481, 0x0) ioctl$VT_WAITACTIVE(r0, 0x5607) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x4000, 0x0) [ 780.579847] binder: 3600:3602 ioctl c018620b 0 returned -14 09:38:46 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:46 executing program 3: mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000100)={0x4, 0x81}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r2, 0xc0f85403, &(0x7f0000000180)={{0x0, 0x2, 0xf2, 0x0, 0x6}, 0x101, 0x2, 'id1\x00', 'timer0\x00', 0x0, 0x9, 0x4, 0xec, 0x100000001}) [ 780.644090] binder: 3600:3606 got transaction with invalid offset (0, min 0 max 0) or object. [ 780.669248] binder: 3600:3606 transaction failed 29201/-22, size 0-8 line 3349 [ 780.761834] binder: 3612:3613 ioctl c018620b 0 returned -14 [ 780.820616] binder: 3612:3617 got transaction with invalid offset (0, min 0 max 24) or object. [ 780.829424] binder: 3612:3617 transaction failed 29201/-22, size 24-8 line 3349 [ 780.844447] binder: 3612:3617 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:46 executing program 5: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:46 executing program 3: setxattr$trusted_overlay_opaque(&(0x7f0000000340)='./file0\x00', &(0x7f0000000240)='trusted.overlay.opaque\x00', &(0x7f0000000280)='y\x00', 0x2, 0x2) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) truncate(&(0x7f0000000300)='./file0\x00', 0x5) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='iso9660\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r1 = getpid() ptrace$peek(0x1, r1, &(0x7f0000000100)) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$VT_RELDISP(r2, 0x5605) rt_tgsigqueueinfo(r1, r1, 0x400003d, &(0x7f0000000080)={0x0, 0x9, 0xfffffffffffffffb}) r3 = dup2(r0, r0) renameat2(r0, &(0x7f00000004c0)='./file0\x00', r2, &(0x7f0000000540)='./file0\x00', 0x1) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000000)=""/84) write$P9_RMKDIR(r3, &(0x7f0000000380)={0x14, 0x49, 0x2, {0x4, 0xffffffffffffffff, 0x4}}, 0x14) ioctl$EVIOCGID(r3, 0x80084502, &(0x7f00000003c0)=""/183) recvmmsg(r2, &(0x7f0000005480)=[{{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000580)=""/160, 0xa0}, {&(0x7f0000000640)=""/137, 0x89}, {&(0x7f0000000700)=""/95, 0x5f}, {&(0x7f0000000780)=""/90, 0x5a}, {&(0x7f0000000800)=""/103, 0x67}, {&(0x7f0000000880)=""/148, 0x94}], 0x6, &(0x7f00000009c0)=""/92, 0x5c}, 0x20}, {{&(0x7f0000000a40)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000000d80)=[{&(0x7f0000000ac0)=""/224, 0xe0}, {&(0x7f0000000bc0)=""/210, 0xd2}, {&(0x7f0000000cc0)=""/161, 0xa1}], 0x3, &(0x7f0000000dc0)=""/23, 0x17}, 0x3}, {{&(0x7f0000000e00)=@nl, 0x80, &(0x7f0000002300)=[{&(0x7f0000000e80)=""/49, 0x31}, {&(0x7f0000000ec0)=""/36, 0x24}, {&(0x7f0000000f00)=""/201, 0xc9}, {&(0x7f0000001000)=""/90, 0x5a}, {&(0x7f0000001080)=""/35, 0x23}, {&(0x7f00000010c0)=""/4096, 0x1000}, {&(0x7f00000020c0)=""/202, 0xca}, {&(0x7f00000021c0)=""/52, 0x34}, {&(0x7f0000002200)=""/204, 0xcc}], 0x9, &(0x7f00000023c0)=""/97, 0x61}, 0x6}, {{&(0x7f0000002440)=@can, 0x80, &(0x7f0000002640)=[{&(0x7f00000024c0)=""/163, 0xa3}, {&(0x7f0000002580)=""/182, 0xb6}], 0x2, &(0x7f0000002680)=""/243, 0xf3}, 0x6}, {{&(0x7f0000002780)=@nfc, 0x80, &(0x7f0000002880)=[{&(0x7f0000002800)=""/37, 0x25}, {&(0x7f0000002840)=""/49, 0x31}], 0x2, &(0x7f00000028c0)=""/20, 0x14}, 0x1ff}, {{0x0, 0x0, &(0x7f0000003c80)=[{&(0x7f0000002900)=""/3, 0x3}, {&(0x7f0000002940)=""/105, 0x69}, {&(0x7f00000029c0)=""/21, 0x15}, {&(0x7f0000002a00)=""/4096, 0x1000}, {&(0x7f0000003a00)=""/210, 0xd2}, {&(0x7f0000003b00)=""/69, 0x45}, {&(0x7f0000003b80)=""/35, 0x23}, {&(0x7f0000003bc0)=""/19, 0x13}, {&(0x7f0000003c00)=""/82, 0x52}], 0x9}, 0x100000000}, {{&(0x7f0000003d40)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000004f80)=[{&(0x7f0000003dc0)=""/112, 0x70}, {&(0x7f0000003e40)=""/19, 0x13}, {&(0x7f0000003e80)=""/4096, 0x1000}, {&(0x7f0000004e80)}, {&(0x7f0000004ec0)=""/46, 0x2e}, {&(0x7f0000004f00)=""/117, 0x75}], 0x6, &(0x7f0000005000)=""/115, 0x73}, 0x59}, {{&(0x7f0000005080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000005400)=[{&(0x7f0000005100)=""/169, 0xa9}, {&(0x7f00000051c0)=""/111, 0x6f}, {&(0x7f0000005240)=""/156, 0x9c}, {&(0x7f0000005300)=""/224, 0xe0}], 0x4, &(0x7f0000005440)=""/47, 0x2f}, 0xff}], 0x8, 0x40002001, &(0x7f0000005680)={0x0, 0x989680}) open(&(0x7f0000000500)='./file0\x00', 0x140, 0x5) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000056c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f0000005780)={&(0x7f0000004e80)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000005740)={&(0x7f0000005700)={0x1c, r4, 0x1, 0x70bd2c, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x94) pipe2(&(0x7f0000000140), 0x0) r5 = openat$zero(0xffffffffffffff9c, &(0x7f00000057c0)='/dev/zero\x00', 0x500, 0x0) write$UHID_GET_REPORT_REPLY(r5, &(0x7f0000005800)={0xa, 0x7, 0x6, 0x1}, 0xa) lseek(r0, 0x2, 0x0) 09:38:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:46 executing program 5: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) [ 780.946068] binder: 3620:3624 ioctl c018620b 0 returned -14 09:38:46 executing program 3: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) setfsuid(r0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='c\x10n^ig\xdb\xfe\x9c', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x80000, 0xfffffffffffffffd) setsockopt$inet6_MRT6_DEL_MFC(r2, 0x29, 0xcd, &(0x7f0000000180)={{0xa, 0x4e23, 0x2, @dev={0xfe, 0x80, [], 0x2b}, 0xab}, {0xa, 0x4e22, 0x2a, @empty, 0x80000000}, 0xfffffffffffffffc, [0x2, 0x200, 0xffffffffffffffe1, 0x81, 0xffff, 0x9be, 0x100000000, 0x7fff]}, 0x5c) lseek(r1, 0x2, 0x0) [ 781.002547] binder: 3620:3632 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:47 executing program 5: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:47 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000040)=0x1) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000100)) lseek(r1, 0x2, 0x0) 09:38:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 781.417438] binder: 3649:3654 ioctl c018620b 0 returned -14 [ 781.473955] binder: 3649:3656 got transaction with invalid offset (0, min 0 max 0) or object. [ 781.483630] binder: 3649:3656 transaction failed 29201/-22, size 0-8 line 3349 09:38:47 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) pivot_root(&(0x7f0000000280)='./file1\x00', &(0x7f0000000300)='./file0/file0\x00') mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='bpf\x00', 0x200010, &(0x7f0000000180)={[{@mode={'mode', 0x3d, 0x7}}, {@mode={'mode', 0x3d, 0x81}}, {@mode={'mode', 0x3d, 0x1000}}], [{@defcontext={'defcontext', 0x3d, 'system_u'}}, {@appraise='appraise'}]}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x2, 0x0) write$selinux_create(r1, &(0x7f0000000200)=@objname={'system_u:object_r:mount_exec_t:s0', 0x20, '/sbin/dhclient', 0x20, 0x5, 0x20, './file0\x00'}, 0x4e) lseek(r0, 0x2, 0x0) 09:38:47 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:47 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:47 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/net/pfkey\x00', 0x204000, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000040)='memory.events\x00', 0x0, 0x0) ioctl$BLKRESETZONE(r2, 0x40101283, &(0x7f0000000100)={0x0, 0x8001}) syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f0000000200)={'HL\x00'}, &(0x7f0000000240)=0x1e) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r3, 0x2, 0x0) [ 781.566133] SELinux: security_context_str_to_sid(system_u) failed for (dev bpf, type bpf) errno=-22 [ 781.580230] SELinux: security_context_str_to_sid(system_u) failed for (dev bpf, type bpf) errno=-22 09:38:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 781.613753] binder: 3665:3666 ioctl c018620b 0 returned -14 [ 781.669166] binder: 3665:3670 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:47 executing program 3: openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) r1 = openat$cgroup_ro(r0, &(0x7f0000000200)='\x06emory.swap.current\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000180)={0x4, 0x1, 0x8, 0x0, 0x1}) mkdir(&(0x7f0000000280)='./file0\x00', 0x20) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r2, 0x2, 0x0) 09:38:47 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x8000, 0x80) write$cgroup_int(r0, &(0x7f0000000100)=0x800, 0x12) getsockname$unix(r0, &(0x7f0000000180), &(0x7f0000000040)=0x6e) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x3) [ 781.774848] binder: 3675:3678 ioctl c018620b 0 returned -14 [ 781.847201] binder: 3675:3681 got transaction with invalid offset (0, min 0 max 0) or object. [ 781.857067] binder: 3675:3681 transaction failed 29201/-22, size 0-8 line 3349 09:38:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:47 executing program 3: mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = dup(r0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x2}) lseek(r0, 0x2, 0x0) 09:38:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:47 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) tee(r0, r0, 0x7, 0x2) 09:38:47 executing program 3: mount(&(0x7f0000000000)=@sg0='/dev/sg0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='sysfs\x00', 0x100020, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) [ 782.255606] binder: 3692:3695 ioctl c018620b 0 returned -14 [ 782.312807] binder: 3692:3699 got transaction with invalid offset (0, min 0 max 0) or object. [ 782.321559] binder: 3692:3699 transaction failed 29201/-22, size 0-8 line 3349 09:38:48 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:48 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:48 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0xc) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x8) lseek(r0, 0x2, 0x0) [ 782.419660] binder: release 3665:3670 transaction 615 out, still active [ 782.438200] binder: undelivered TRANSACTION_COMPLETE 09:38:48 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x2) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x200, 0x8000) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)=0x0) r2 = syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x40, 0x101000) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@random={'security.', '\x00'}, &(0x7f0000000200)='configfs\x00', 0x9, 0x0) ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000300)=""/4096) fcntl$setown(r0, 0x8, r1) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r3, 0x2, 0x0) [ 782.490174] binder: 3708:3711 ioctl c018620b 0 returned -14 09:38:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, 0x0, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:48 executing program 3: r0 = open(&(0x7f0000000000)='./file0\x00', 0x400, 0x80) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0xf, 0x6, 0x8001, 0x80000000, 0x12, 0x1, 0x100}, 0x2c) sendmsg$nl_netfilter(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200001}, 0xc, &(0x7f0000000180)={&(0x7f0000000300)={0x1400, 0xf, 0x6, 0x100, 0x70bd2d, 0x25dfdbfe, {0x5, 0x0, 0x8}, [@nested={0x1ac, 0x2b, [@typed={0x4, 0xb}, @generic="fb285cd50915fb5cce4ea62f44268c4356ae9746da8ee862b8de6471f4afad67504fd81f0df308207352674e0597243a9b32066fb145c62bf96dfce6d37f6173c31fbab7f1d35d2c82394f354590cce067005fe5b21a0f8d925aba239b819b0e3076d55f7b5e6c1cb0a21ef9c0f9e9c1a6c0fb1667ed48733dc925bdf44ee80b3ec2e0401676f3bf1a1b25b0249c4274470af47cd5e9d166ce0bf7660bc8c61fd9cf1893ef08dc78fdd776263c0b7d22a3a4f301fc29ef9112665bec", @generic="13e1832a059820fc3a35a414ca051ea40e56303407b776193bacd52a61fb5f3535ab", @generic="c33cdecf073c4ec520ae77233178e85b397407899199f2e57b90c3b63bb237d7baf10bca1a1a453f040dcd87f3ef14f69f9e5679c8a6e7", @generic="fcd09cb006782316318ef2d8c1867502ffe3234a926f0ed5c85692ce711a008e82c3e2f81d5b56bee4d66ac57e36c24166f7279e702962ddb601743ed023cdc1e0c324bf732bf6c68ce34b96f1df7f8ce27704a4e0dc5eadc13cc4071936bbb7766d542bd999097b1e743aeb8987174c5f07f34e21e9836a1e8dbb88db2a519178c265df33bf71b5fcdb9824a1"]}, @nested={0x4, 0x7f}, @nested={0x120c, 0x75, [@typed={0x8, 0x34, @fd=r1}, @typed={0x14, 0x36, @ipv6=@rand_addr="305b21726622e2647410e625cc1d1432"}, @generic="ac572fb8c4a12b857eca65b0ee0bf8ba3ae3fe49e82067a01d36fd7c46d61633557bf9df6be8bac24e749b6ec6f336ee18be7fbf0df1a45f39c1f17d9114cbcf5ef2e3a62faf73c857b1ef018cfe62208474793e5d3a854f1b6d144a59043672bc054ebade2944c2b008e68e2cf332c6ddc4eecf67ce358e2b561fcddff111a05b9b8aded0a717e136d15d0779c02226ae0612bde196a1c60bbd20bb1e72dfc2c4c4e6da80438e3652483d5828d484afc665db45afd387253a3a7b10606e9818f6cf6ff1d0e0ac6011771584960ed1153569ee1d0f51050719b11623b2d5f8362a7ea643b0f2d88b9a9d7cabc3aa4f4443cabb49bb6ba1e548e113dfcf3ad3ff1574634bd2f587774211c5903646bb7e5bb1f050b4fed7d09a49d08354fc6228ef429b746224cc3dca7f325cb17b816ae48c3e36bd3bf0f71013954ae6ea25afd774f7f3c797823e521e3c824147507e0636add5b1fac98d0e97b5fcce14f151347a131895d7022b3709eba2462aa0e779342964eb6d1b1d83367ee98d0f177d594dd2c498be6003004657ad50a2d30abdb6f148c3a711dd606d949e6d71e7c196d868f074e20bdf972f8be19be2969e35f0bbad66648f242831c7c93a9fd92990a2c48907ec988e3e71f63287cdc3c4f18fd8eb0f451a98e9998f61e39d0220371fec583c9d0d8de24302a79b743ad76ae9ef5c3f8c8afd2d702a42fffb9b56a42b0c72203e87e3a16058c0d126358c081afccfba69e1409878bfc8228a9be45702cd813aa0f2d8c221b93034813264f94921267fe2c604aeae7cbdd326a7b835256b31dacc0eaacde465ad7a410c9715f9575b68d87da80a70326f5c3c78fcd636ef7176dd8048577347a407c7cf2c3533c3fc38fd772062348632795d5ef6637213954da52f6a911fa544dcc4fe303bd80ce0b63d1d99c5f2c4e8c21b7232fda05c21f83770698e4f6e219ccf916b351016c62bf932274dac79e5e5d25452a484aa9ad6ab273f2d0ec0f3bd6d65b6ed7f722c573d7bc3e55d3fd524996d1e5f7b6ea9932726516a47a1092106c3b0264addceefdd63184b03fe201a7b37fe9c51c3709fcec3dc456ac8531783ab61bc8071bb46a764c11e1c70b82e6a3e2b5b770bccb067c9f3b8adfc55d7f49fd14d4520ddd33fa70c89d9456c052cb85ce2a08dd218586e60a12a5a3f67236beb82f06e279c7cb2568ce1c434e84e41210c79452951ef50c0b9d00069b618bad3aec686a3704ead1a9128f79ca169f0be6ed0a82520053b42a0959138aefac74282a2a9d1d13d9c407d27698b2f0173d5a433cbd477397b70b801750530129a7968ab750e1cc1c57e01444b3d358e21c6e64928ac9d2d256930384fc00f86b9cd86cee89607f1c8aa76abf84d03d5eabf03c0430beab8417b0a3c0b8f78f8a42bd551c43150a40486befee50f7b09c85a888f3a51b1fbbdfb48d6e49a02b01a6def57fe2ad52ef3eb0e0d3403f2f0ac3b04810a79a8de36a232144ff886f22e30bb34631b11ca00b38d480fe0f2d914d7f13a9e5c7ae0cd8a4f8c81e1e13f032346d2fccd5fa3569bd0cc6d5a3b027a10178f638e65235f53b6e4a1965b1ddb493b0848ff933330e838789923f352fc11d67c48c1446326703c4b582b1ed3cee90890f72708e609e9f01c52655e55b2fd68eed3839ddfe86a24e3d4e3cd3b9989cffb8f33acf5e186e0eb71d241a80f70af571deceb9c0a1cf248e8530405bb56f9a94560a9154e879eb76bc81d6d7c1c409a63353b365c5ac91bf0d4120105269710a0fa480852066ece25cdaaea2aa1cc3273bc69c00e93d62d2082de0d75fe6b9f56654be3220aa7c2bbca6c5703bef19af1d4d6fc6e20face01f17058a79aba77ad61b623a21b0072e97492f4108eab2addf643381c6afa2e5231e7b68a3b21ce098e3adef9188d4ead9b5c183ea0740a439c9b227f9b06991f84dde6643691884aa936c9e57d70279dd0019a4936c147d5f8675d26e99534ce701893234a57f6591c01eb6faf4a81b85e57d630b18a9563107f7647ab144a5bba88c94135eed71570005036744be918bc320f5da5021425e023fcb59a56e15527ebfc7cbd3736fb8e3a99b69c45e9e589bdf4c32a27a1cf6666e457ee1c30ef19c3e5b0ffbee96c3573d876d98132a61fd586d7aa5962e51833c4780a08e4d356df4563934d41408f7e2e3f0fd7216a551100d35b47934bf493714d5343f682ca5125258a8cd930f9c69ea7e4cbf21c04c75b17aa5afe829719f79fac570c01616c361fe6df6f5c2d9b47bfdb69e03dcd3aaf1113ca5b20ba8af7d941ee71e9b04c77852ef7723419cb8e0d8ea83a9c12748a2168b79b01f3876c6c1892c02023c22fca056b2463e7c36711b331a515c14a2c6a1585f653d3fccf75bf3ccb629a9d5bf976838763c2b3d612177881a596bc02da58c451657b945fa3ed59ec8073da0d5898ae4b14b81353e5ed13ef054979e80d523a7ff73ff16109f2e89d15035d8bdeccba1ec9d74c6fce470a6f954e6f76e219ee926d0a145b429bbd5516735a6e0fa7a5e896920d144a58f679b615feefb512ea6a2e2c2b884b3158c0756e5acc57cd048df4f509e1f9eb0aaebf9f38ce426525f00f6c2f22f970ffbbc62f06cc81aebbfaf8cba06cfd0d7a7dd9ac4c96d8eb18522bc5eeaada950889631cdab0ad7cb221c16c9dad028103aa3c55074f3677c8e9470a1539ae085ca92c0c6a1b24dbdf65fdb71629876d8a7b34b218d3bd762f481ba61fe0d10be283d6fc77d5678be48e858eb2f5e7020ee966bfb2dcfb6e80c724ffe4337119b09706837c21396be00ffa9b457add1415f6bc810d23441ae083447b163a3c7b22e2601ddc9d326548939bf92b61115373a0fb6dda8d3c69621e2f494e931be39265291d18b0abd1f004036d5a4bd08e85d5124982b81412bccbc9b98fc3afa0394ba0a2117badec48e6f869c5e124901b3e4a33631ef67e6fd4f35ada61cf151cfac88285e9cd004e91258244a6fc7aa3a6db9cb5de76db11a0132b8f187605f24ed3b9f1af29252d59e1a9f32db9b2b772df741cae0bf50ffe1555ddea00457886758e7b2cd9c250f8e30ea9bd1e7afa79aef36782c67ed962fd17afb5d5df798bdda0e937b99de58b76b6eedebb3bec1f5011ac89e832e704480f868c37d674f799b236380af3e1b5e0ef8df2c11a544caa7a0d9d89f106e1028208b2926fd4351a7fb0d828af3f446a08e327ed6d2038a3ab4947b2b75b9c6798c8a0204d1fd63a99c8d303c0f0c5e0e21f61ab936437fbe620f2086f23557f97cdfd38297b0548ec56db51c25ed084dc0c74b1c3903e941a8a1fcde76c4025eacacfd40c2d3141a7bf42eab19d38ab40caa9a9da85b14837f86802bc93bc9b3ade8742b9d0ba1a360bc5851cc4a8332040da716c7fa963d2a8a6c2148f5c850c323f5f12722ce13a41737b108304f41f37d6d60bf43725ad5cbd92feb360641231a22e1d36c1a8b4c0e9318279d22e9d83adc3505c53382a37c123d1ef11506561c973c3c4503b2bc15a059b53a971e5bc880d3a80b14ca0026cafd3dd28c0f6293cfa1ec48059159632796956039918ab8f1f1deb08e832526e4e58f85aea89e8b533d0f1f6351b80b0d39646e12a1a8eb0a32f368696ed76c442848814c4c415917a5c2b6aba7807595de97e1df1c411aa124e20388756109bf63145a24c9a1649efd4a5f05b71b7bc84167b0839514bdc2348ad299e1c35fbab4dcfcc82fad4e68c3b3faecf60e8a339f2c09629f585af16c78fe3039cee1fd841e88e62c2e4ef7baab7204b754d56930bfb88c54bee56cf7b50bc60455838f2ebe4775fcf8006ecf205bcbaab972abee190d8e3a9b92e1dd1c4115e5e9337c543238cfdbeb6f9b3b59f2f0c29d961e6512ad1bb44931a7b2b36a3c458d9cc4f159a69fe4ed0bdcd86c0f53fc8cddb2f00cbc03769b347b7f5977374c1975db153cc541a49cd816f99a9c9a9d16a0b0b34e36f11d968a3f01fef4207e1a469e3ba9b8ef1b1a6c5861826cf38cd2681b72339690452b6d7accea9d5e5c816914a64ca819ff976a41ae6833ab7382f384b3575afaa30c104b70f0c489ba5b86a74e0b2e2a002f26c29421fe8c367f038bc9b12b0aea15b8079f1733b95ef53f1135c483f2ef6f3bed991cdd7cf5a783fe236126c6a6f3695b20be94c3ad5941a3dff4c2172901bc363fdac92641f8743ea902490b72a7829e171a44ef4b21399e6519d2b12c230fbe7ee8cde47692318538aeb56ad3e982766325e0201b5d09c7676adb0dded83f22dee5717de06cc55dcd31a8e893524a7c9c1bee6a39c855fdae36030d3680ce265edb6402834abc8df2b25faf19df690d2cbece1f3e0928eddfb4534d472a2dc67b5702b6dc93baa0436640d74ae39b40007ca73703b39d654954cf95f2e8fb1f5704f02ea7cfb8ffaa16864994b8996c105ef6b6d09a67d904390603992e5f4d4a80641631c568b00bbc1ddfc2fb2959b60c8b5d53a2b32bd44b0d775c432d6dca55c2eb39c49b0da927a3a043fa1050cf9c9542ee0f56f7127d85f0781b8266958fc45bdf1921931b8078672bd6d3e0b10274baf991a3291ba5ca68a8c100465202073afdc564d8ba6e7c721987146c376d1907a3589fb5a3c184e18912d14d11e52aa784f0c63a871fe73fccc44536d7eaab75c373ebf40c04a795e0a3c119acf7e78923ac643406abb43d98c962ab329fe159ebb6b700b02b723b9a897a94671fbf90bcd4279df07cc0179678d1d079d59348347958bbf9fa0635b446b073ac1fd0a3b3d1669d61f558363137646a68de4c4c482d9ace3c6f682ad67cdf82f6bce983dd815b2b274b3a239a236d614c4eb0e23088539469c49b28ea3f439aec22f0182fcbbe355f6adb42a2b9bdfa5867b41f7ca2d9415a5131a337be4bbec9033808c5d1940a5e6d7838fc8866f3575a098ea765b07fae39ba888642996812af8eab29fd2d7cda46a0b48e60c8af5d95cb56202cd69aad3e615be14564ad8904ea1eaf3746c316da883bd4f27e020bb6a8c7f0c694963f4927103178fa7501a110fd7e47b284f645001a3d6341d823e1d722ba5d4ac95dd96ce060a887e184007457fc2d4bffaf759656152cffddca474fdafdb6ab8f08cb8aaeffc5abb0c5fb5373b509c725ed92d2a9880ec34c8f9a8a1a6c19cf14c375028ec6ff5dc335dce0cf96f4ab9d708c1e720a4f89fc41b4cc279cf66f2adf7a98815dc7e9d8b84ef58d75fb28a70aba9bd61c857f54079369f3cbcd20f79a1f00de3b9dd914ff48865bef25a28357d09ad66bd12a6c1dbfca18a33dbaa843547111674bd5b183cb704b540015cc2bbc198d73afac5f64adfce24ded18f1c7e7bdfd07abce92f51081052acb3a8fb240eeb555f1a6343a1e57d81e062e5940accaf04757590381c01287e11269a026b7a042e70569ab87765c0a8f2160ce2ac0adb8eb4da9a3ea3b1cc4f81f25f537ca4b76777514bf5e9d0827b09bd2ffb134572f78f66a11c2f4eec4cbb3f1229efffb476334fc839b617126e790fdd33a8538c34d591860347723adc6c05dc5c087b29b58299a90532726cc765df56bc8f2c7a90b84e3e10c015578fbb4945fa79f922f0a3fa853be4b973a06dea7229100e0502cccf92b73e8372dc5325a92fce2553215900831f33b94ce8979e3def2b00b71433b64111907339799fe58e1e38d881b34c4ad21f034adb0c3a7948f90b6e4f3bcc73a987264c61cadfc22786c933a60b6c59616faa93ffda7f40c84d0f", @typed={0x14, 0x85, @ipv6=@initdev={0xfe, 0x88, [], 0x0, 0x0}}, @typed={0x10, 0x4e, @str='configfs\x00'}, @generic='hX', @typed={0x14, 0x34, @ipv6=@rand_addr="c19a3ed0739b5914cf1deb9d33399262"}, @generic="29dc448bbb76f075ef9ca49602c11e70865c86bccef9b604a206bb6003cc06dba0e34bc6eef6e9a25e4283aaf76268f314c421b99de0b0199abaf2d781343e01b1ea0d78f12f9c24da4e15f58ecc5fb62ae384bdc433f97339d1b223e81f4a5f06e4f01bf5c33ddf494b573aa786ee01978b60e02a33794572e17ff711c3173534e0ed40b2bc33517646b013215b0cd27b5d5d52ed09df929285c7c0ee5d31ead5570f5c223abfc4e9f3a3c9cf1793c2b422bdc6891e9def3bc976d7165fe8fda956", @typed={0x14, 0x7a, @ipv6=@remote}, @generic="e1ef18ada5b744a63e147da3d036e6fde7bede6a2ca037dbdc3f37eb3d631dfe22a47f87f6310ae5622c2c88cd7e836e217bababc182c5e7c24125e8c2e62105cbc2c10c9cd9d609fa69549b7837afa9a35daf3ae01f51070d81c08f7422a09417480b6ee00cf5850a4d5f38ab3d0232b876ee091fd30f6c175fa93ef98589f69bbb90f3faedcb20ed9387ec1d3200d25932710a7f720c9c28d1679a1b6e1398bdfb028a6ed21a12f19fe36f7c187405defd9abc963856a17b5ca8ac945dc13b67535a08179c890d06722ba3d9a94be23b72b5e2a852248c0c7fe9b0"]}, @nested={0x30, 0x32, [@typed={0x8, 0x70, @u32=0x3}, @typed={0x8, 0x5d, @ipv4=@empty}, @generic="dd0f44f8e9907197a2460ed0d8b6baf26d5528924d8b4563de169631"]}]}, 0x1400}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) mkdir(&(0x7f00000002c0)='./file0\x00', 0x3) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r2, 0x2, 0x0) [ 782.557551] binder: 3708:3715 BC_ACQUIRE_DONE u0000000000000000 no match [ 782.594241] binder: 3720:3722 ioctl c018620b 0 returned -14 [ 782.653868] binder: 3720:3727 got transaction with invalid offset (0, min 0 max 0) or object. [ 782.667072] binder: 3720:3727 transaction failed 29201/-22, size 0-8 line 3349 09:38:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:48 executing program 3: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000180)=""/194) mkdir(&(0x7f00000002c0)='./file0\x00', 0x4) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) fchdir(r0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) fallocate(r1, 0x25, 0xd, 0x7f) rt_sigsuspend(&(0x7f0000000000)={0x2}, 0x8) 09:38:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, 0x0, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 783.082353] binder: 3735:3736 ioctl c018620b 0 returned -14 [ 783.138051] binder: 3735:3738 got transaction with invalid offset (0, min 0 max 24) or object. [ 783.150680] binder: 3735:3738 transaction failed 29201/-22, size 24-8 line 3349 [ 783.164500] binder: 3735:3738 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, 0x0, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:48 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:49 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) [ 783.293833] binder: release 3708:3715 transaction 618 out, still active [ 783.304809] binder: undelivered TRANSACTION_COMPLETE [ 783.346222] binder: 3743:3746 ioctl c018620b 0 returned -14 09:38:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 783.417459] binder: 3743:3749 BC_ACQUIRE_DONE u0000000000000000 no match [ 783.427028] binder: 3750:3753 ioctl c018620b 0 returned -14 [ 783.488379] binder: 3750:3755 got transaction with invalid offset (0, min 0 max 0) or object. [ 783.512740] binder: 3750:3755 transaction failed 29201/-22, size 0-8 line 3349 09:38:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(0x0, 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:49 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) fstat(0xffffffffffffff9c, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$bpf(0x0, &(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000040)='bpf\x00', 0x800000, &(0x7f0000000200)={[{@mode={'mode', 0x3d, 0x9}}, {@mode={'mode', 0x3d, 0x1}}, {@mode={'mode', 0x3d, 0x9}}, {@mode={'mode', 0x3d, 0xfffe0000}}], [{@appraise_type='appraise_type=imasig'}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@euid_lt={'euid<', r0}}]}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x401, 0x100) lseek(r1, 0x2, 0x0) 09:38:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(0x0, 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 783.933396] binder: 3764:3765 ioctl c018620b 0 returned -14 09:38:49 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='cgroup2\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000300)={{{@in=@multicast1, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@local}}, &(0x7f0000000240)=0xe8) r2 = geteuid() fstat(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='system.posix_acl_default\x00', &(0x7f0000000500)={{}, {0x1, 0x2}, [{0x2, 0x5, r1}, {0x2, 0x2, r2}, {0x2, 0x3, r3}, {0x2, 0x3, r4}], {0x4, 0x2}, [], {0x10, 0x7}}, 0x44, 0x2) lseek(r0, 0x2, 0x0) r5 = add_key(&(0x7f0000000000)='.dead\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000180)="9b16d60646396f6e7c4435a82fba9e7eb0dad3d0631c22b6289d01008e10a5954d0a1ec1012b3a07b847b5676addaa311750bf433172df1ecb2a9f05f462daf160155c54d3a96990dcd4b01ba7067a652e63ebf825e856f4210787ac3220", 0x5e, 0xfffffffffffffffb) keyctl$revoke(0x3, r5) [ 783.994185] binder: 3764:3766 got transaction with invalid offset (0, min 0 max 24) or object. [ 784.005231] binder: 3764:3766 transaction failed 29201/-22, size 24-8 line 3349 [ 784.017990] binder: 3764:3766 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:49 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x2, &(0x7f0000000040)='.\x00'}, 0x30) tkill(r1, 0x36) lseek(r0, 0x2, 0x0) 09:38:49 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:49 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) [ 784.149446] binder: release 3743:3749 transaction 621 out, still active [ 784.172909] binder: undelivered TRANSACTION_COMPLETE 09:38:49 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='nfs4\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) 09:38:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 784.201230] binder: 3778:3780 ioctl c018620b 0 returned -14 09:38:49 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, 0x6) lseek(r0, 0x2, 0x0) [ 784.267262] binder: 3778:3788 BC_ACQUIRE_DONE u0000000000000000 no match [ 784.282999] binder: 3786:3792 ioctl c018620b 0 returned -14 09:38:50 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) setxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64IPOUT\x00', &(0x7f0000000100)='[em0\'keyringwlan0\x00', 0x12, 0x3) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) [ 784.330541] binder: 3786:3798 got transaction with invalid offset (0, min 0 max 0) or object. [ 784.343034] binder: 3786:3798 transaction failed 29201/-22, size 0-8 line 3349 09:38:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(0x0, 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(0x0, 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:50 executing program 3: mkdir(&(0x7f0000000100)='./file0\x00', 0xfffffffffffffffd) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x400, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000180)=@raw={'raw\x00', 0x9, 0x3, 0x2e8, 0x0, 0x108, 0x0, 0x108, 0x108, 0x250, 0x250, 0x250, 0x250, 0x250, 0x3, &(0x7f0000000040), {[{{@uncond, 0x0, 0xe8, 0x108, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz0\x00', 0x7, 0x2, 0x2, 0x2}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0xe8, 0x148, 0x0, {}, [@common=@icmp={0x28, 'icmp\x00', 0x0, {0xf, 0x2, 0x8, 0x1}}, @inet=@rpfilter={0x28, 'rpfilter\x00'}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @empty, 0x203, 0x3, [0x3, 0x2d, 0x12, 0x4, 0x3c, 0x38, 0x25, 0x36, 0x3d, 0xd, 0x16, 0x14, 0x3a, 0x10, 0x4, 0x7], 0x0, 0x1, 0x8001}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x348) fcntl$getown(r0, 0x9) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) getsockopt$inet_mreq(r0, 0x0, 0x27, &(0x7f0000000500)={@broadcast, @multicast1}, &(0x7f0000000540)=0x8) fcntl$setpipe(r0, 0x407, 0x2) 09:38:50 executing program 3: pipe2(&(0x7f0000000040), 0x80000) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) connect(r0, &(0x7f0000000180)=@rc={0x1f, {0xc89a, 0x4, 0x5, 0x4000000000000000, 0x9, 0xfffffffffffffffb}, 0x8}, 0x80) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x0) [ 784.741782] binder: 3809:3811 ioctl c018620b 0 returned -14 09:38:50 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.events\x00', 0x0, 0x0) getsockopt$inet6_tcp_buf(r1, 0x6, 0xe, &(0x7f0000000040)=""/12, &(0x7f0000000100)=0xc) lseek(r0, 0x2, 0x0) [ 784.795715] binder: 3809:3812 got transaction with invalid offset (0, min 0 max 24) or object. [ 784.811861] binder: 3809:3812 transaction failed 29201/-22, size 24-8 line 3349 [ 784.822326] binder: 3809:3812 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(0x0, 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:50 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:50 executing program 3: [ 784.999156] binder: release 3778:3788 transaction 624 out, still active [ 785.009909] binder: undelivered TRANSACTION_COMPLETE 09:38:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:50 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(0x0, 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:50 executing program 3: [ 785.047961] binder: 3826:3827 ioctl c018620b 0 returned -14 [ 785.107098] binder: 3826:3836 BC_ACQUIRE_DONE u0000000000000000 no match [ 785.114586] binder: 3831:3833 ioctl c018620b 0 returned -14 [ 785.160863] binder: 3831:3838 got transaction with invalid offset (0, min 0 max 0) or object. [ 785.169919] binder: 3831:3838 transaction failed 29201/-22, size 0-8 line 3349 09:38:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:51 executing program 3: 09:38:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:51 executing program 3: 09:38:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:51 executing program 3: [ 785.596923] binder: 3841:3846 ioctl c018620b 0 returned -14 [ 785.651778] binder: 3841:3850 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:51 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:51 executing program 3: 09:38:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 785.850466] binder: release 3826:3836 transaction 627 out, still active [ 785.861353] binder: undelivered TRANSACTION_COMPLETE [ 785.878868] binder: 3854:3855 ioctl c018620b 0 returned -14 09:38:51 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(0x0, 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 785.918094] binder: 3857:3858 ioctl c018620b 0 returned -14 [ 785.934519] binder: 3854:3861 BC_ACQUIRE_DONE u0000000000000000 no match [ 785.975192] binder: 3857:3867 got transaction with invalid offset (0, min 0 max 0) or object. [ 785.993320] binder: 3857:3867 transaction failed 29201/-22, size 0-8 line 3349 09:38:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:52 executing program 3: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 786.387310] binder: release 3841:3850 transaction 629 out, still active [ 786.394075] binder: undelivered TRANSACTION_COMPLETE 09:38:52 executing program 3: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:52 executing program 3: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 786.428249] binder: 3872:3877 ioctl c018620b 0 returned -14 [ 786.488571] binder: 3872:3886 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:52 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:52 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) fstat(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r2, r3, r4) lseek(r1, 0x6, 0x400000000000001) r5 = request_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000180)='/\\[selinux\x00', 0xfffffffffffffffb) keyctl$get_security(0x11, r5, &(0x7f00000001c0)=""/220, 0xdc) flock(r1, 0x0) fcntl$getflags(r1, 0x0) 09:38:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 786.686380] binder: release 3854:3861 transaction 630 out, still active [ 786.701439] binder: undelivered TRANSACTION_COMPLETE [ 786.725850] binder: 3889:3892 ioctl c018620b 0 returned -14 09:38:52 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:52 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) fstat(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r2, r3, r4) lseek(r1, 0x6, 0x400000000000001) r5 = request_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000180)='/\\[selinux\x00', 0xfffffffffffffffb) keyctl$get_security(0x11, r5, &(0x7f00000001c0)=""/220, 0xdc) flock(r1, 0x0) fcntl$getflags(r1, 0x0) [ 786.736628] binder: 3893:3895 ioctl c018620b 0 returned -14 [ 786.787403] binder: 3889:3902 BC_ACQUIRE_DONE node 634 has no pending acquire request [ 786.796987] binder: 3893:3904 got transaction with invalid offset (0, min 0 max 24) or object. [ 786.806535] binder: 3893:3904 transaction failed 29201/-22, size 24-8 line 3349 [ 786.817242] binder: 3893:3904 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:52 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) fstat(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r2, r3, r4) lseek(r1, 0x6, 0x400000000000001) r5 = request_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000180)='/\\[selinux\x00', 0xfffffffffffffffb) keyctl$get_security(0x11, r5, &(0x7f00000001c0)=""/220, 0xdc) flock(r1, 0x0) fcntl$getflags(r1, 0x0) 09:38:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 787.236245] binder: release 3872:3886 transaction 632 out, still active [ 787.252960] binder: undelivered TRANSACTION_COMPLETE [ 787.269201] binder: 3906:3909 ioctl c018620b 0 returned -14 09:38:52 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) fstat(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r2, r3, r4) lseek(r1, 0x6, 0x400000000000001) r5 = request_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000180)='/\\[selinux\x00', 0xfffffffffffffffb) keyctl$get_security(0x11, r5, &(0x7f00000001c0)=""/220, 0xdc) flock(r1, 0x0) [ 787.321460] binder: 3906:3913 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:53 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) fstat(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r2, r3, r4) lseek(r1, 0x6, 0x400000000000001) r5 = request_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000180)='/\\[selinux\x00', 0xfffffffffffffffb) keyctl$get_security(0x11, r5, &(0x7f00000001c0)=""/220, 0xdc) 09:38:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:53 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:53 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) fstat(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r2, r3, r4) lseek(r1, 0x6, 0x400000000000001) request_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000180)='/\\[selinux\x00', 0xfffffffffffffffb) [ 787.520839] binder: release 3889:3902 transaction 633 out, still active [ 787.531069] binder: unexpected work type, 4, not freed [ 787.554223] binder: undelivered TRANSACTION_COMPLETE [ 787.562432] binder: 3922:3924 ioctl c018620b 0 returned -14 [ 787.588257] binder: 3926:3927 ioctl c018620b 0 returned -14 09:38:53 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:53 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) fstat(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r2, r3, r4) lseek(r1, 0x6, 0x400000000000001) [ 787.616662] binder: 3922:3929 BC_ACQUIRE_DONE node 639 has no pending acquire request [ 787.649921] binder: 3926:3933 got transaction with invalid offset (0, min 0 max 24) or object. 09:38:53 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000000c0)=0xc) fstat(r1, &(0x7f0000000380)) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)) lseek(r1, 0x6, 0x400000000000001) [ 787.675332] binder: 3926:3933 transaction failed 29201/-22, size 24-8 line 3349 [ 787.689598] binder: 3926:3933 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:53 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000000c0)=0xc) fstat(r1, &(0x7f0000000380)) lseek(r1, 0x6, 0x400000000000001) 09:38:53 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000000c0)=0xc) lseek(r1, 0x6, 0x400000000000001) [ 788.057685] binder: release 3906:3913 transaction 637 out, still active [ 788.070936] binder: undelivered TRANSACTION_COMPLETE [ 788.096183] binder: 3946:3948 ioctl c018620b 0 returned -14 09:38:53 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x6, 0x400000000000001) [ 788.157348] binder: 3946:3949 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, 0x0) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:54 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:54 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) lseek(0xffffffffffffffff, 0x6, 0x400000000000001) [ 788.352190] binder: release 3922:3929 transaction 638 out, still active [ 788.369201] binder: unexpected work type, 4, not freed [ 788.377702] binder: undelivered TRANSACTION_COMPLETE [ 788.386698] binder: 3959:3960 ioctl c018620b 0 returned -14 [ 788.404809] binder: 3964:3965 ioctl c018620b 0 returned -14 [ 788.434059] binder: 3959:3967 BC_ACQUIRE_DONE node 644 has no pending acquire request [ 788.457760] binder: 3964:3969 got transaction with invalid offset (0, min 0 max 24) or object. [ 788.467633] binder: 3964:3969 transaction failed 29201/-22, size 24-8 line 3349 [ 788.477575] binder: 3964:3969 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:54 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:54 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) lseek(0xffffffffffffffff, 0x6, 0x400000000000001) 09:38:54 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) lseek(0xffffffffffffffff, 0x6, 0x400000000000001) 09:38:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:54 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, 0x0) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:54 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) 09:38:54 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) [ 788.898012] binder: release 3946:3949 transaction 642 out, still active [ 788.909096] binder: undelivered TRANSACTION_COMPLETE [ 788.928667] binder: 3981:3982 ioctl c018620b 0 returned -14 09:38:54 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) [ 788.987676] binder: 3981:3986 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:54 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) 09:38:54 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:54 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) [ 789.185844] binder: release 3959:3967 transaction 643 out, still active [ 789.201262] binder: unexpected work type, 4, not freed [ 789.219455] binder: undelivered TRANSACTION_COMPLETE [ 789.233150] binder: 3994:3998 ioctl c018620b 0 returned -14 [ 789.256809] binder: 3996:4000 ioctl c018620b 0 returned -14 [ 789.303710] binder: 3996:4003 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:55 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000), 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:55 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, 0x0) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:55 executing program 3: mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) 09:38:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:55 executing program 3: mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) 09:38:55 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:55 executing program 3: mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) 09:38:55 executing program 3: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) [ 789.732700] binder: release 3981:3986 transaction 647 out, still active [ 789.746016] binder: undelivered TRANSACTION_COMPLETE [ 789.764842] binder: 4015:4018 ioctl c018620b 0 returned -14 09:38:55 executing program 3: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) [ 789.825566] binder: 4015:4023 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:55 executing program 3: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) 09:38:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:55 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 790.049122] binder: release 3996:4003 transaction 651 out, still active [ 790.056050] binder: undelivered TRANSACTION_COMPLETE [ 790.073165] binder: 4032:4034 ioctl c018620b 0 returned -14 [ 790.078777] binder: 4033:4035 ioctl c018620b 0 returned -14 [ 790.125851] binder: 4033:4036 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:55 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000), 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:55 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:55 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) 09:38:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:56 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) 09:38:56 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:56 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) 09:38:56 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', 0x0, 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) [ 790.570398] binder: release 4015:4023 transaction 652 out, still active [ 790.583898] binder: undelivered TRANSACTION_COMPLETE [ 790.599440] binder: 4049:4054 ioctl c018620b 0 returned -14 09:38:56 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', 0x0, 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) 09:38:56 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', 0x0, 0x44, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) [ 790.662744] binder: 4049:4059 BC_ACQUIRE_DONE node 658 has no pending acquire request 09:38:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:56 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) [ 790.889921] binder: release 4033:4036 transaction 653 out, still active [ 790.897588] binder: undelivered TRANSACTION_COMPLETE [ 790.914924] binder: 4068:4070 ioctl c018620b 0 returned -14 [ 790.968349] binder: 4068:4072 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:56 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000), 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:56 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) creat(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(0xffffffffffffffff, r2) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:56 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 791.086679] binder: 4075:4077 ioctl c018620b 0 returned -14 09:38:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:57 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) 09:38:57 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) creat(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(0xffffffffffffffff, r2) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:57 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) [ 791.403928] binder: release 4049:4059 transaction 657 out, still active [ 791.416120] binder: unexpected work type, 4, not freed [ 791.427066] binder: 4085:4088 ioctl c018620b 0 returned -14 [ 791.446400] binder: undelivered TRANSACTION_COMPLETE [ 791.475943] binder: 4085:4091 BC_ACQUIRE_DONE node 665 has no pending acquire request 09:38:57 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) lseek(r0, 0x6, 0x400000000000001) 09:38:57 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) creat(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(0xffffffffffffffff, r2) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:57 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0x6, 0x400000000000001) 09:38:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:57 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0x6, 0x400000000000001) [ 791.720316] binder: release 4068:4072 transaction 660 out, still active [ 791.731008] binder: undelivered TRANSACTION_COMPLETE [ 791.740795] binder: 4102:4103 ioctl c018620b 0 returned -14 [ 791.802174] binder: 4102:4108 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:57 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0x6, 0x400000000000001) 09:38:57 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:57 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 791.963558] binder: 4114:4116 ioctl c018620b 0 returned -14 09:38:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:57 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) 09:38:57 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, 0xffffffffffffffff) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:57 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:57 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x1}, 0x1c) 09:38:57 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) 09:38:57 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, 0x0, 0x0) [ 792.233482] binder: release 4085:4091 transaction 664 out, still active [ 792.240375] binder: unexpected work type, 4, not freed [ 792.260472] binder: undelivered TRANSACTION_COMPLETE [ 792.275708] binder: 4125:4128 ioctl c018620b 0 returned -14 [ 792.331013] binder: 4125:4134 BC_ACQUIRE_DONE node 672 has no pending acquire request 09:38:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:58 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, 0x0, 0x0) 09:38:58 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) 09:38:58 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, 0xffffffffffffffff) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 792.552862] binder: release 4102:4108 transaction 667 out, still active [ 792.570535] binder: undelivered TRANSACTION_COMPLETE [ 792.585007] binder: 4140:4145 ioctl c018620b 0 returned -14 [ 792.643721] binder: 4140:4149 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:58 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 792.763361] binder: release 4114:4119 transaction 668 out, still active [ 792.810473] binder: 4154:4155 ioctl c018620b 0 returned -14 09:38:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:58 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) 09:38:58 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, 0x0, 0x0) 09:38:58 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, 0xffffffffffffffff) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 793.080941] binder: release 4125:4134 transaction 671 out, still active [ 793.094338] binder: unexpected work type, 4, not freed [ 793.109779] binder: undelivered TRANSACTION_COMPLETE 09:38:58 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:38:58 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x44, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) fstat(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r2, r3, r4) lseek(r1, 0x6, 0x400000000000001) [ 793.117784] binder: 4161:4165 ioctl c018620b 0 returned -14 09:38:58 executing program 5: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) fallocate(r0, 0x0, 0x6, 0x399bc47f) lseek(r0, 0xfffffffffffffffe, 0x200000000000000) munmap(&(0x7f0000ffb000/0x1000)=nil, 0x1000) r1 = dup3(r0, r0, 0x80000) ioctl$sock_TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000040)) 09:38:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:59 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x8) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x2000, 0x1) pwritev(r0, &(0x7f0000001500)=[{&(0x7f0000000180)="0fb7ef46bc7ee87fe43c6e379d1546091e97bbbb3d0f47f4acabe8488d574fc3c552bb79f1eec7719ce361808e799431c99da6bb552ac1ad40d95039d52121c758cb4010cb80fcdbd8b4090ddf9004e9d5131a2ff9bd288dcba8b61b6d78fddb28810ce7ec5b4dea70d6136ffe3ecad9634de1b379dd27399238d0ed1617812c504aee9e1d4e29ec90b614a88b6472d095af89202f216edcc356f0e55702cc90367ef846bf1f7ac480420cc14c28bd0f2838c9caeacb2f7c031e263071e953", 0xbf}, {&(0x7f0000000000)="11154253fb6dfe40e7a4cfea6de50463e7b65c950fa11a52990934075780577f32fa08aac0c9ccab7e9eaa2d14f845", 0x2f}, {&(0x7f0000000300)="2009f1b3805c2c42e8bc6a1634addb4d3c918cb48ea966edfa6c85106aaa70095d77af8c67ac23981900f932122b8941e95fd5ea1b2f56ac3cf42159d7d38cdaeb9723554e97ea6674e66be72c365fab827afba0c718f51161d0a039669d88a9b2a6777338756d708e6ddfbbd3bfb62f8108991bca1e9867d54990742224e16998626496531bdb7dc259f2fbab63fa8de7418eae15d4741271a0a5031e780d1b2c93028fe172c5cf1a42d7e7552ff0f5646c8da607269e8d3d27ccab5bfb9bc96d7b656279df0af4916c07439d2a9ad26ac4e95c647d6626ace34c39ac0fbd60cfbf6b53412a20db8dfa8372bab1f18736c2eebf8dc360e95d17ee9de78feb7448771ef13908c0681b7cfdb9b0268a1858da08fbfbe26a7811358aebd9d7ac60c334b8c47016d47a3e4708e64b73ab5463e920dc83fa3ce240213d8df4cee56f8a0c50cb4abd1d274cf0a701eb52a326222586348d76e883f8437a2b91cb024034f1361c6346b5c91c5f8faff155e344279a265bb0a6ac0a85d476fd528f7bf33fc8fc45c6b36625bf250c55c6de9dd3575fd30079b49c6af6578abc98521e4fb7a9efce87660d4a349367fecf5e88d99c286fdb43ea7fa45f1f2badfa705eeab28cfa594ebe420b063a03f52c68e38724bb65d5388d4e09335b466b917ede13af92fe7b94356a7c3e2d0f9d849baddbaef8acfb0955d3ab40ffca192244d220a8a49eb2157da9b8ec2aa8241cdfd6aa93c33c9e3346ca0d90d88c26f27af174e487570b1a2212db6165618a1aebedeeb4bfa1b70558baa364ab2c0d4a322908e9738a3b2f1c0370ea98a1940d27c9ed1a4ad61c76c95cc75560e8edf1faf4c42f13d90791b9b9d03f635aaed96d183ed2c1a6c4c6c933af35a270fa5a615f41bbd7278d08d43ec60b7f078929dcd1645214b218751d60a31ae17ee42853b8896b7ab42298641b1050623eb7f2f8fda0cab249b6e77d776f1ad4ccce9b57083a7f149ca750b15b0d123fdaff6cb1a0e0f34ca8c477e626185597af251a0ed17bea8951b9f1130a11622657f2ce8b0bc5553d40134f0948db1ce4312e1591b7da6fb0878d6ecf24eded18e62048133a368d364aa6d9b30be6dfb9d50320b7a94325f925b57e3e3b5b7a981c29508c4c5b39cde4bb888049bebfad9f0e9ad74bbcae1f12e3e12533489ee71de7bf3bba60cad83217ff8f066188d8368924f89b1265383c102436317844521a99137b134c9f370fd5e9fb31cb06c94e348685cedc738a8516db9a4371f73e88bb6d06b6c32adbb4ab8844b67ee7480dfb580e4b5b71a3e0fdd69244ac93c1e36936cc79daaff1af419980e71354cb8dd082f439329201cfacfc9d4694cfaa84be237f9b30d5a6704c4efcbce1e2883c2d8ee7a4dfa8f0916e78de0ce53d62ec7604b7e129dbbe8acb6d8d7e0068ede2f044ecdbc26e440cc7795d547c6f83e2008d9d6a5303df8ccb78ed73840c19c5e190a7fdedc3878f99641bbf1121e3ae016c033fcdfe8bcf5d42cc476eb7c003ada72ea0fbed374879f1f2fc87ecce4a23aa48b3f9b55a1b1c38b4d0744869003f2c925b6304698b4894a847f28b30fd5269faa22fd5a1d77056ef44c150d0790c1304f0f7d4f64329f7fcd792306854681f7474829b14428a6e963da81d234cd2ee970ea036b516e4c88bb5a01688dc1a2222fc65a647bf56c7325a990d7caed4642a90a9ee88f841fb52512676af7a673d9b330bf338c595752f4d7c3640a4df1f83c05708fc3478208cc3c761e9126609604cf7f35b08078cd88226c7bb4615c9bd414ca390e0222f889ece62a6a5d4e8428da675b7faf445f1cd6e503c517e5795d7ea679f87dc7cd4fb85c4e61832923087f1396b4c07808a3414a9d009c8103e7f29574f44c0714cdeaa940eb2d239b3f4f5392d4b988239ce196b1efc5fb5612222aa3ce889eb5da2be8c2e89495366c9e9994f0f64fca08e27ab60341d0a123dc828fb5755ae914bbe5a6dfac9995f6029c4b8b1cba941ba9640d076ee406a3022a1aef823b0a2dedc8f3b0b0c0ea8f7d97969cc1573ceec3d784c120112bd34619ee257e48df8aa9eec2715c24f77772fe1fd5de23c2c1d58f0c4e300ed0b77a696794fa130b8a144bbbefb12e5d646eb33bca7bcbcd60baa0f6ee56a7555bbbd9ad359df99d18515e8aa257ce14398f03e53d279a3169cf39af07727c921741fa74463f6928b859c18d5fa75fdf3c6ad91d7ebd5d938b5dd0e0114a71a370f30e1cbdac5e68c6f717795470d80f1675ae7e11ab24eef4d469776fff7bf1476623945f5c5f5d6b53d9d4e1e8afd20b42501360760765fe2aed852101af051538d7129e87380bbb1af0a5a62a02149e03b54f7599a22f5ff027e5e1ba1f83a5b4d610d31a3bea6c8a7658af42136f463e67dbcca30d881172645907b379e6a0bfc4304b161bebbc1776e759f7bfbb5ed0a037653add3d1bafb6f653429c73f6f4b25242655de14be4ec0442d0275628e13bbd804bd376e60bf680791eaaaf4777ca04aa06f4871772233ec88088d71bb6204592a2011f36b9292977e8aa772ec86793694cdccf53d12a21458b5c3fc2d68586ddad926df08bcdcbdb51af8be4acea9c54f0c619dff16c720671d07662e038cead2669d68b2362dbdab10cac23e0beac804493bedbeb0ed3c4be7394cbbeb1a343a3ab6c3450679eecc7620d50b1bc48813833471e5a695f184a34a78428cf8be3068fdb4d05b80132372dea173378b99b8cae700a0941131305455ec2f947baca5b4dc8cbf34c562eaa98258170e226545b58e7a3fa455cedace9d6853a54b5269ad014ce26dd8a293a98e397e15065bcc013f1e901468692fce8927693304d7efd09698abfe1e37336e6ca5852fc1b3fcb460154af0fa73139f92a2cef0e56c5f143e35aef06e45ee9ac6c1d35a455c3db818bc9257baa759cd021ea1cd84d618d1f9e94d2ed7851545c13ba3c4e1a70e0b92c823c37bd8d09af03ea97d8b51810be26c470f85ad8bdd73c323c9d6e5c96b37237e9ae153398c5462b37c5ebc41a860d7e059a064641409ae6c63307e2bccc63c605ddb7464ca6ae6829cf3b05eedbcea4ff3a7a9999eda5aa82458d38316f46d2647f0c721a46446fc5a19a54b07ba3447370a1029ef69cb4e69da71719b8b91c95c83e4ece7ca377e18442ac6bc14702818f666e8ca1ff0f5c5ce34c5ea69b3fcedc83a43b5f36e75d20d5ff5eff73f210e72830b2808e475ca40367aad775e40108912586962d08b02ec8be4d435773c8f8175aab20a9e9e11f597ce1ecfffac1d660ec1e950b3ccd7d1980a118ad2b802bdeed0200d716ac7f2aa2bf6e5b7370e7305888aa74f4e5e9ce6654579f2878ccb0cc37a8e67bb4ac72cc1c97c5a8e7afc0db5184f2e2628220106db5fa2b510315fdee1ff40e92cb3f38a0e9d9eea836df81928113716c5d00b5752abcff93d1b918e5d89b4b52c6142bcbf8abc0117140fc7a104095d340e2a3a217fa7a454059bd8eb66a251e7231def86f479e4347456f8623c24b6699e14ac285ed097434b4f5a0cbdd55343a158aefa2ef916be097b093342617dee83fe9cc39f3a0e7d01ebad225666a5006bc62adcf097d33240a3d860143879f177e6ea563a3693057273bcdac279deae673141724f751c915e5b43471b5d43ea635e44d06ab26d85c0f9b74f23cec9d3329d9a492f1ae7216bedbc5a4877a46f9ee17bc18f91b65645a673f42f2c7e0f12999bc65bc3e382ffdeac561d5c58a0b7274000fe2b4afdc0eaa87bda23896b8560b91f98f2fa6fb88b2de000a00e6d02cbc483f7ebccc209823eda63b4fbf86cdf16e91acf927415eb2b7f9c3332407de34e9f2cd2cc86c59fec3a6428d2341ad8967145fd4185a83f282c4e191fb0a365c6505ed5d28598d96a0111a987e7e7c9e07265be2e73b7b01ac4f33f7246f3ff466ae57eedbe67a219e38deb85d5c107159131c582ff45228f116853c1bfa6b7cde41037cfde436993412c63a25362e88176e7049316ea5f5b8612419223d82ded55e2788e12f7472662381022121e2949ae8367a035c004afaabd98a1d632278d928950295aa57715c53ebd41e5a5198ff220cfa13f689d10d5c5bb2e6a9bf66dd13d975365f7a991b6f4bc6e4d3785451000ab49b00c81d4f82fa7fa5a048f7143f250f4b85e89ac3a516a6700182ec2aa3b2ff940c7910ce529b11398ded1248fdca25b5d81d866bae7577dfa6c3fadcbf9bb4dc8937ab83b698a51f53520b3f514fa0e73e58620276d3745d2a32d7363ef49593f7eb1017c39276e58f23e1b8b415efb4904460da479a86bd389b0bfd026e69502cd2e431eedeb209400fb299438d51a879b1e0ef6b4ba3ae4dd963ec25ef56b44343ccccf66e2cc40670e10e0477f48df66456c185c6584347b86281c4ff936978d017a69c4b6fea610bbede8e992e5a1206d26061163980d9d5c037d295c8369fd7dd82afdb7afb8cb9070ca29b4d514b32478d34fa36a969cdc68bd465a29b2c13af1ac1438a6d1ac7c55b0c36d3109aac3d1f7c7f87a2df89ed9a15dd97260a61be3f4b2f5da06e293f0523bf1863fe63a863c12a8c1253179988053c0245a3c2e2f83173ff83422ad3fabf744b90db33cf6925ef2f6d656ee404ce80f6ac6fe126620c87ba4489e68b16b4fbc0b62c2bd8c65303420da370828365ad4d211352fc5aad7ace8e9b7d74feca3f26d5ba2b968a847bf1f3a6c966d6e927a5bc2c6c44a5c10d36ade49a3e69d98317b041e9f3edd78eec9b30a4781769f75f2ff8f81095f58ceac7834c1f10d9a3db79d3aa7e508544a8cc0ad264d1ead6b912ac4b07f8f59d2223fc46b4114b5f93ac7d390bf048e9f0a11a14d0658cebccabf740fab8b14e2c642c38a324b35d46c20f9e79d2abc374ac5fbf52bd91864a2f10d596e8e9069cfac55853062f1863317d7bbe021b2f4db7f2072861122dd31efddf7104bf841135c1c9f4ad617a6251b04cde52340858d30ba68be3f5740f4c58f87352639594dfa66c832329cdcc8c94fab4db78b307cbc776012ec9b49fcd3f3cea3b51644cdfeac5c9704d9b63153ea9beaac0255a6552864a349a8f0bb01d65af5d23398b5555b208c8269a0ee4048e7ebb89456a60e0cbd07d6e6f170fab51f1b7705e646bcf225d2c3d49abff7469d258307c4a23528f39217f42f4084cc7ec5d2f474de8cbbd6bb85f4c8f32c48d2a7334a93b6ffd5022ea00a213d6f039f5f26e65ae07120b22e4dd7169c3104e02807f0991642c9eca682446b6cfa22745161e0bbde5b80e8dd146bfd05c35f34607ff228766c0958035abf75f03195afe6ddd961ada710903cafc5f7f2e51356ca60ee62d7b038845c91304058e656f579f95ce65739ad101882ac884a9f89607ffc1eb48645984069900c0e3d6ee432a0ffad65365e5067b34ede2188e20e7a0ab55ed769fe7844dcebc4fd106e81191f01ebfb8ac90268109a8e61fe6e3dcded53c5296f0b449b6c7491d467ed52ae07b434399e4476bd285692f25433b741844cac25c17ec41a5c2d97a6acf4270b48fd30efad590d78e0360a628be23e34260c9214af4b2228444d004f8abaf0932fb707b47100a2bca0c7d186255b0e427dd814b00eeab9a128cdc3ca162bb30e3f80d69c114a04bafa40bffb08a7a2077da5ab6c7b8b81cd078b80fc28ca74dec3b95214683bd84b6db953fa3dc3c154b4747de3734ef516e80b6c90b766f4bfe1de42b5a59b3a6acf92669d6152cef4203631a7ac52", 0x1000}, {&(0x7f0000001300)="31e64f7a57f9f8ef0f65ed61dbcbc9a35b174026152ac45452f388e556d1d679d52b101066d91fc503f67133859ec31af491e919153b663d5f87792c4431c1a867db83278ef672f327ac1223d6d376ce0951599db6989f6693e4b0f616a589aac39f8ec548015af79b9079246eda5c1e35e3c9fa979011b74a52d745d6beb0c28826c663613d33075aa547690a6baeabadeeef90d3a1dc4bc40daec37dbda99286b94280db7b2ab983bf5b6c00108b64fc6882c15cc9d892464479d13a3e96d2ef70ff80d42567d9711a8af837623d53fb537329709d1b120d4d09143d3e06eb78da91694163217b9b", 0xe9}, {&(0x7f0000000240)="93012364bf2108c2bb461cc7d27858f76f87e1ed14fdd39783c71f5600f20f022d3a0ded552eec13d98b5977e138dc5a6a34cf2362d10771bbc510a22eb4a030f5e70d853ecc1ef524bca47fb465ce216c0afb554a", 0x55}, {&(0x7f0000001400)="700bb5609946deb3d9554a4355f02522b1ef756f11db3358bc173d07da178fc782e9389f13f81b0f467e59d788e52871d3c20c105572fa789db2b747e333f4377cb0af13a345dda0473ece4b50ea2534a02e2a87cc831453ada6d7233c8255dce281a9917ffdacf3393be60024780d75371d007665a980d9311a6cb9fca31577e86811d6c236f2d3dfb31fccdd51fbe2be094c746b86cad51b60a78a544bde2e1a04cdd31ac2be09b7fadecdbcfeffec7883e0fa8f4bdd470e3429f0288a383375ca859d9d6e89a3fb298221ad0f067a", 0xd0}], 0x6, 0x0) lseek(r0, 0x2, 0x3) 09:38:59 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x800, 0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000480)={{{@in6=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@empty}}, &(0x7f0000000580)=0xe8) getsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f00000005c0)={@mcast2, 0x0}, &(0x7f0000000600)=0x14) getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000640)={@initdev, 0x0}, &(0x7f0000000680)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000006c0)={{{@in=@multicast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f00000007c0)=0xe8) getsockname$packet(r1, &(0x7f0000000800)={0x11, 0x0, 0x0}, &(0x7f0000000840)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000880)={'team0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000008c0)={{{@in6=@loopback, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@empty}}, &(0x7f00000009c0)=0xe8) getpeername$packet(r1, &(0x7f0000000a00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000a40)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000a80)={{{@in6=@ipv4={[], [], @dev}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}}}, &(0x7f0000000b80)=0xe8) getsockname$packet(r1, &(0x7f0000000d80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000dc0)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000001280)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x41000024}, 0xc, &(0x7f0000001240)={&(0x7f0000000e00)={0x430, r2, 0x200, 0x70bd27, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0x254, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r4}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x74, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x44, 0x4, [{0x0, 0x7fffffff, 0x7fffffff}, {0x8000, 0x9, 0x9b}, {0x8, 0x7f, 0x1, 0x6}, {0x18f, 0x1, 0x7}, {0x5, 0x229, 0x2, 0x6}, {0x7, 0x3, 0x9, 0xfd3}, {0x6, 0xd617, 0x1, 0x80000001}, {0xfffffffffffffff7, 0x7d, 0x101, 0xeb8}]}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r7}, {0x40, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8, 0x1, r9}, {0x170, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r10}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r11}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r12}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x8001}}}]}}]}, 0x430}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) sendmsg$nl_generic(r1, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8009001}, 0xc, &(0x7f0000000380)={&(0x7f0000000100)={0x244, 0x1d, 0x10, 0x70bd2d, 0x25dfdbfc, {0x3ed2}, [@generic="f9593aa0037f26fca7e029a08b9d823242129f107e35b3e1dedcc128d809f2177ac6d0002bb8cd9000cfdfaecd14d519ddd3b3059ded705d73b5737e512c29294e0282e0515c7913a16caf86b3fb7d1310ae5d84c75eb7c15cd5f890e913111d804bc5ee6b905645034a3b30a84a05e75d7f80bfdf7032fa9adcd0f5de13b41687d91a169b96529c04ff8ba418d56cc50231126165a0a697502d94e311408f2f60e0eac90020b78e44c8287f3e981190674ac5cb565931aab4d39af6c83ea24b38f56999ec992dcf5300905246e0760888bdb46e23", @typed={0x8, 0x7, @fd=r0}, @typed={0x8, 0x31, @fd=r0}, @nested={0xc, 0x5, [@typed={0x8, 0x27, @u32=0x3}]}, @generic="63837060496a9d0a38d1c96515f579cfccccb3b74b05be11897158418e67810dcf58866ea267a294b1a64f6b7d3030fe76174df00500b2d9eb5acc5164140068b0708e1f1d38cb21ee84133f9863b99c7fee7fd847c267cfda909192c30920ff99424c6a2bab236c1e84469d50838f91f31a520b6fb9aee71560d05a8ef2dc886e09381c342e4b6a451de60b3455510aaa71cf9378cd8947488d8edb47ed083d952a2edfcff7", @typed={0x98, 0x85, @binary="33655e16a3192c05dd67fcd4e62194036c1ee90cb9f14853894c34ed622c9e70d54968dc3eb03dd6f7aeeb3a6325671ddd596408edf9074d27b1a39f14742979cdbd0768d32ee7ac39bc8e9f276508a9aba416f1ca1973630ec4872ba89dc0dad10bd56dab1135b12da4ca1d8ac53dc1b2fb12f61ba0e7d63fb16c51dbcee68ee54327cb8c9d840e9496410005e73dd327"}]}, 0x244}, 0x1, 0x0, 0x0, 0x8000}, 0x24000000) 09:38:59 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(r0, r2) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 793.392233] binder: release 4140:4149 transaction 674 out, still active [ 793.399431] binder: undelivered TRANSACTION_COMPLETE [ 793.433378] binder: 4182:4183 ioctl c018620b 0 returned -14 [ 793.505961] binder: 4182:4189 BC_ACQUIRE_DONE u0000000000000000 no match 09:38:59 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/checkreqprot\x00', 0x20000000308100, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', r0}, 0x10) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f00000000c0)) lseek(r1, 0x0, 0x400000000000001) [ 793.619615] binder: release 4154:4156 transaction 675 out, still active 09:38:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:59 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:38:59 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1f, &(0x7f00000001c0)=0x400100000001, 0x4) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000000)=@buf={0xfb, &(0x7f0000000300)="a6e586907671353119f179127175d00c1afb92d7628b888c929acbeb946a2e6a3e2dbefbf4374a6c1c20a4fe4bd60cfb7c247ebe7229bde78273055b54361ffbabf0bddab6167a03c8f8b547f1278f56750d93106671adb9e8a289487110f7e2240688cf786f2084a47d761da361f03b841cf4cae3f7fe5a49be3a1b0705fa6bee305767be516485b9f5b8ae8a08bf3693327fdba29ee9a0115c074a8fe01ac964a7a5bf5fa088575598e0f1f40b59c613ad1ddc2cdf576a4d63707c5b8abd6d6b42728a6e15b7d95b8ced8c5e6e365e327cca2c98735c497823bcfc6c0b0269ff3128ff1985093653cc9b10c3351f63d2bb6b9b65bf9d9c23fb30"}) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)="614e434e69e3751888343aaf81cb321421e940b3fa3b5afdcdb032516fdc9c719af8f3643c9571d293a33321d7ec9265ef2ff88a34dc49b7e22d00bdbf9f6c4a87ff0f1a96ab42edc841da31a467394a273dfa1022482cd57d4f155cca6cfadd17ad12f330c0a89aeb26d6cae9e569d95de4fd2f7eae3a020b8000617859d522136aa0fd05250680cf9de7dfecb15cbc77ef618e92dc918db3ac796e691ffb70cba8fb2e2ce3e996ffc744db50eba67ce091f0238a92b6379cc7ba3c55c8edba5b566d0f3fbab339", 0xc8) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f00000000c0)={'filter\x00', 0x86, "159a2838d5a9b84bac50bb7ed31295d01c84ced4ab8248d33640d455cb9bc579d7134dc29ed0167a2022b6572e1f86486417f6161ce3c583002e674627ed6f399e32b9c34997ebffe427e6626cabe87f20b3852a7e7db748b39c85705c7c0db33d975b648c92a8ffc7c34ad9593513fd040ad4abb817275c59189fde1e5bc66f6a838bc24bae"}, &(0x7f0000000180)=0xaa) 09:38:59 executing program 3: mkdir(&(0x7f00000002c0)='./file1\x00', 0x1f) mount(0x0, &(0x7f0000005980)='./file0\x00', &(0x7f0000006b00)='configfs\x00', 0xfffffffffffffffe, 0x0) syz_mount_image$msdos(&(0x7f0000004540)='msdos\x00', &(0x7f0000004580)='./file1\x00', 0x8, 0x6, &(0x7f0000005880)=[{&(0x7f00000045c0)="0070a3301d4eb3649a73f16dc633f36217480a0a1753b91d1b8d66cc6c5d0f404c865e96efbfad3b6ab502894386b748f937d07aaa7057764cbfecc536f3b8d7cc317e5ea8676c629fd459696bc3c424ebb73767f1cefa8b73b24335e47137f3be4f6211ef813d1f567dfa3e70d90d35df58e173e1ea741f5699b9d267fc88cd12978e72c52f7edb0fc764343b487a0ce54aea5a524b66a203a87838f7", 0x9d, 0xd7e}, {&(0x7f0000004680)="0f77a7d0f8a8f3cf0fe7aadf572e15c26ce38491861f7aa0183220db324dad3fdf0431ab5d3c2f782253f3e7c2a6584720f485c97933c91ccc45021cef028be4e79a6025cce2a9b41390a9854a1392fa29225c096e801108ae557d2b569655b4a4e513a154c0003ae07d6884ab5838a44211cc4e41c7ed2a33ddb74fbda7ca7dbf8eae61dbe4f5a29fb6b7afb7658dda199e048196a2aecb46f1001a00bd9e7763c471bcbdb2309945b163901e23a2d3d002e4922b65b97cc6e8b4fbaba2827ff484e826966c9155b4df30d693af53bbf01242ac0ef446b7f615f82de559832da3526942ad00df737403f290fb012816f56cf6a88b7a24bff96950da0a350b000da9993f91dd05e7154b0ec5909f84fa558869ea7a2aa5134834f3e82b42556c90760af58093a4ed20dec215bf7e7e07db9dfcffeb18ecb9e40766e5052c5db71ce0541d14d695d3aea5424b9e36c0ce9dfe0692d7a68c5e6f31e47f7cfe41375a66eaa2a9db2632759d73eeab0251907288d016eb859405b3b8fdd217b62804e23a1353dfef2e70219c650159e2831d082e3ec504d2ecbeff9c1940d9c508dbc5e3df7ae7e51152760fb57d85d0d89a959677320dbb7cce9ab65594ad6cd6066d43f452595e591c940ef2bf12ff5ca09b81eab592f37cd1a23b3ec7c5525d8e25a515cbef94ab8eb02ee673d756b1fa79623e2e78a0b8b640a5815138626e8bb6c9c55f144f3f49aab1a1b7ccd82f9773bfecce240214f9a565ad1fb512dca351d383a85a5437daf2a01666c916b775c22a30dc5c7d1b7200b76d34dbeefc5a17a302303a3492f99f2ef1c037519200bbc4598d154aafd128a8a4c407c540d04645ceff3bca759c4519103cae92c1ad1bdff871c1247b3e649678a63c59423195a4342d531afeb758a79fc0786ffe49f867048c86a80cfbb523b85503e4c66bb869530aa8ad87ff4fa82164536bc031fd22ec4dfaf8eebfa8f43a0c14da857d80a838ccf30df65d4b033a01ede51018183991351946898cf94b5eb067dc7d1b2e4ae3c69988961c8759ebf62c532c772d2a27ac6e9e60f280b048e73076ce14beeb1efce1a93afe68a3369f74db353e8e9a5cf0c5cecb05315fac4c5a4e58231b5ce6823bb558c9d8d63b41cf09cecdb6937f919ca10b2ef0ebcefcc04c435ac72c6cdddd3cf09076f24768360405f2c60d4b8dab5ef38b62ef09fcf64352a0a95404ea6a1a31c51c376e34638bbf9559af30482ae0debed138013b7e04ff522425d5780466119b1d27ac3725ba611dcf91a31f4540d4e2bebe8ca5ecd6271a294c8518621c7cbaa1f86f578bc3b36469bffb2bb0340bf73133289e6394a21b98e7c49629202b635c1be2e60e666bf70550be23518713a91549d551b816eaf2532c8c712548b6ab285f4cb893eafa85496c0fe899864796b8a19ac4bb352ef25a0da40f917ff0d601362ecdb8091063aa361d2cb85e77d5b4be38e40c4be2a38182ecb54f1eea6014241ebe4cb6eff3a506127976b787fa05179d00932d98f373cb5f6f264830bb5cd75fa6527146bdbc065be57e95f23036f84480cba48fbbbc8b6d60ddeaa79d3c03a7d5d526dac660952329ec7f14d72aca572447402f1168dc588b9d61bad05fe79ecb513679c17c540232f51fd912538a5c8726221478c0d1c2dd53d7397310b07fc3f67fd6e2df83da9b6212eda56345bc761ccb94f9aa38bf37f526d051104170d7302442befa905886baa55f90f9d5c21f3f5097019c3a7d123e4f3e6b51b5094ec1b65fe25a57b9131931446ccfe1b4509c5955b3ef9d76b7962085973ed906ed2f7c662b15475b9f087f3f98ca3c4242a83d86900be2021139aebbc2d8eebf25ca1d64fbdc13b806fcd9aae3ab73d4869bc9d11d3d89ccab020dd30f53f00dca53c0a4c61e9b77ce0d863bb16ca5be8f1c208605a8db023c8eb9945bd46c97b85b01e21d56197c322ea8f0d9fce85001242e49f62246185edf4449ecae660b272d150ee5a4e86df52ca890abbc2de35f17959140eee931df6ee6b04f059af3938b2b14db860c5f6d3b46639c6319ad760748207f37e46d44b694d80adcd17a2001dc60eda9da81e917d4e4a189127deedb2f7666e3d0095cedcc417db7a50de7d9a06e66923f59c2531231fd2add5af624e8d1892fe0701b2f95ece6643e383f1450bebf72eac827eba117b7ca67776982d297ff13d9dd85bf33e39cb4ad2251a914358ce1ca0653984d58d10cad40773bb410b7276884dd4fb384d243f82b6870954f1b8a4d71653149a38bb0edb4c8ff82b3ffd3c2ab094efd5d3de79a7376992d83303bc607ba9b068e48190c51a4033ea4649f42cecb50180804fd1ba79cb81422effc34c08f16663f4e034c679f54c50981b10457943d5d63ed821bd335d15e524e4649cfb0756016e647491bbe371be7d166f36c3c58e3e3a0a00bef829ce20f80155a0e5ac4ca6c03d534f5c16131edc9c901651e4bd2a4448928ddcf2555f1f3bae602ff7cc7de9408132d3309ee182e37541dad9a8c8642aeaaa15176fbcbb10c097bd32e1d3b502c21b4550aa84a68f73222be4dbcf228f83a3ea88ec49092906b60982a1fc3dd7176cd62a24015d1c65edd44a3d7b9aa8616fb012e9b966a0fe07c9e0f931f54b3f848c8c1c6493eb801040786b7e0e265b7dbe44466adc8462e61b3898d9528792add1bb420be8f133ed7416956c96636d9321bc1683980785749cba4fafcb477d2a1426689315f79c9e0c29de975923e1117ba5ff98b271d29d2641b780ed09240abf0565764fa2949865e6909bceb53df0177c01a383deae2269ae448bce089f00d14b0e6d831c72eb9ed9f0db61b69e15b23d66f1792b137f692c7db7e61716c87f564b696dfddebc670e62c16e32ffba6b95f1ec99f3a96c258f3fe29ea5c5b20a89a967b02967a4e316806281721a642b6326b95f342791b3a92325e7c3a76291ad7042a74629ac84e656c9c7b837e5ea70210a6a71120213056d5d5e387e10c20ea0024c64b7ffcab34fb7a8492eb375d188085bb298028f0a99e6eab49dd205db7dc66c0a223b421e76c2949d69c7b862fe9ac9f591a92708ec228d51477516ecfd11f60e9fc35987e29cd40ada23a11d8b5a5bcadea2e120c40752680f3da173c12f85feac833206278b5f66a05b7451dda88a0c031032164f752d6f8a48405b5647fd880b9ae76b3ed4cbafb308dc528d2d6d46687becf53de5cba67d080b0e8e0f1c89709cc34ef2ac9007d45a25853b604dc29ad9c3cd1fc135e2c4abaded446f03092a6d21a3cd79ec9f54cdebd8aa916905da4d412fcd40afd4c1768a3e820355ff5a897660d3776e7a418454f70c8f8e45b649945154300a58eb0b268951b3edefc2ecdbcbcdd18848e2832821bb5b230d0c6532ac86f4ba6a54741420562e97ded4b3f76ad9cc667e68885ae21476ef62c02bcde41aa4a9bc0a3ff1dc745bb73fe365e3548476caeeb0f787f09663c2f40659a442c9e7d8038f66bfcd821f35ebdb1f2b5caec23dbdd5cd71f7eeadb3f8e4c7bbdaef8a12f2048216c65db699cde97726d782d5d88af2abf456deee5f730c9855371afa2c48c9d72f34f5a324f9d47495bb9c9719bcc7f8be0a974070ef2696de7adfefa5b412935f8b0b8b02e25b00b05468de8663e2ec27af90d84db12b841b762f9b827b903618fa363dbddbf16917420b3ef73dea73a3f12ffb2e797ec3a5e428b98e8542c0daa0506a8d6d021d580722c2730a0356a11875fba7975be87c1bae5c774dfafd1cc1896b748aa1ef8bb31f0876d4ce8fe73ae9b562cf70985d1a90b1801de10a35cb34cbcd090f551214ade25cd191e4a012e6dedcc932067b50a1d2bf38ff83063802d2c87af3c11ce3fa623106c6f53847d5edd1ddfe5a29c5338986cb9fdb98efbe4ab7d63426e622ad84277cc9bce5155117bc3b67007012fa003710000988f178d4ecef46562047c3eef5066c7af4ba9f516df39cc59569c2feff28ea696c8f3a2d4f1d6268ad06063f46561f86e52d23858715f29d270fc9863e00ac23477df79e60494c12ff4a5afb3b45847c88961793741657ee6e5527d6d57445e57231f03c84af0632029890b8b162df68561600ae3d2836c5da67c858a547b5b143e5877904d2048d8c39959afbcc1be6c5b762f2714ec7f31f48f3beed385b58be693e3fa4bd48f70920820f3bd19235f1325ac3017352a3b66654b83b47dcc87e01d6d4ce9fa61dc239222a1ba1cc27a4b18325efd4e0267d93e8b4cc958aeb259e666dccb681e5c4f381aa07ef53eacdbd669dbd87f1f21af0d7473021acbb9969610857afa15a64f499c4fef817980a2f554bc8e348fa98ea2fabf2846d2c4876c9d53d3912c822342bf0bcc4e66c514b3cee1623e52e338c8019314ad8264d32e3cd53709d2964b9e5921130aca08a265c47017cd1a14a1a448734051cb3b18e494c9d589afdaa0aec41839d6d03f01982712bab35d4ace288467cc3f62ee3519113808828f71a43465ebc8833dd60d4cdc52a30661003bbc518069bf224d10bf510ce62b7ef352a77fafcc7ac0f49de546cb91370eeeb21ea00847e926ce651ace8201390aaaad928c7b24eae8dd0e3fd8e6c1a78123970959978169ed8f93e1d07b091c47bd98cac5f899b1562161f43d92d3d4eeef055b511b7e8f999b5f28923a6cced1406c8d33418d2164cde80383dc199a61cab16d758fdfe7b1dc01cf22dc6bcb455ee935c60b2b979a5641e54aba33b934c8d55cdb2cc4ca08f5c0f85e4b44a5acb50d100a785fb07cd3bae5aaff8ba711d3c6eca1cb2113a3591f2fb393657c301e91df9498da070016e40dfa7403a2e20576d09db6a6e06d9832a36d19e8e03e2daa321ceac8c5adb5c16e7183983254ff6e3c9745f68bb7b4b68733e0e7643555a6ea7005d9b088abae8af7937265116346cf15d7f42bd2e314a1ad90bbf4583877bea9b7363e6e872f70fda0066e97b027321de1f77ffe263685cf26060a8045bcf0b916583fd64905c209e467884d3c4cd4b9987e4f3c3db544ef8967624581f7254f0e34a2efadc10b59aa70960937a5b710e7bf59a944eb55506cd77a77855dd40f2faca162fdf4332e1f2a6e321f9c75828f63d94af33da7c1152351158401f0fc5a220276e4cc2ad437cb64c65bc281840d922b6a1269cb6a24f9a04e611d623b904d9a94454e74ec42c7f426bfc18c9ebcdfaccb87838161ce062f24064836db6a050da5814c0085cf573bc477f6abc530984a2a80e4fd43a88c6ac8a09dc75daa50c09359197af84aae0178d6faee5db057a4eba0904353cc1c213fb2110ae74fadc46ad37c3bb36844193f2660fc2576f6992ca3a041a9062296e03be48c1de66434560c7313d8732c680abb010e7122d67a8ce60856cff010e57ca0e4cc8485133e44da22fb1081c07650f89f982e97f85b7054c78f8e5ae37a41b6ca323334d2a737b784c43b1214589d0e8fb66b90989930f5dfc4ae373b722bcbea616e1c40bafbabe77a3a94ea11411be0520b7be9bb9ed50c5f6540059ca432e9f6c3112ef6f95216eda883be5a6bffce92f11a77ff7695157050580d0d5310f48797ca5379020d6dcd3c94873af8fa6223639f340d02657aab4cca7503f0d188002425e1141ee5658efcce509d3e8e8c3f937ebef31ab389cd0d5dc7df2009b68e8737b857bbd0ae8ab7566fff26b582afc08e2f1b5d9d77e9549c498246ea587ce6ee3ca34eed1212c4413877954e777cd214711ce80c93a7f3c0d7", 0x1000, 0x5}, {&(0x7f0000005680)="d25e263b70ffea41552249c270f9a378b1e522587bd08ccb7519aec8b6495064d566e2a0c5c42f94c87a2b69e8e8142ab4d0ce6d3d54ea421c959d5afe48cdc4d06ee335b8e8a916c089", 0x4a, 0x7}, {&(0x7f0000005700)="7cf7b0f0d703a2f72f9339412f61401dd8695fe16509d5d70ed44aeaf9dd826ad73be4a7675a7ffe35dfc8d4dec19dbcd9fc6bc944907bc6402cef857716fba49e6c3fb42ee35fe69dbef9ea5e7d85a2abf2ce904ee2182e3b5fb3530c0db6504b2788b0d0b2f66f9fff5b", 0x6b, 0x9}, {&(0x7f0000005780)="69277510d552ee9ee195554a66e384df3e520f59bd8594056eec5d1ac59bd59ca99efcb9abd70df93c951ead7f39672432eb55bb51ac011733", 0x39, 0x10000}, {&(0x7f00000057c0)="8bf1a2c24f39b89f03226beebeffb67ec3cc066394d45bcc5849513d1cb89e942f39d0e4b5400fc5dcbf46fd020a83e16ecb522aa9b510f606ce795f0bdd428016c717aa26509f686f6aa33f5d55eb8c88d8bafc3c2a924424290d2aaf561aac0058c418472732d26fc6599b8e2d30ee6fc0ed5018c59f7d1e2eb02aa18fbfa8e3796ed89c436e", 0x87, 0x1}], 0x42000, &(0x7f0000005a00)=ANY=[@ANYBLOB="636865636b3d7374726963742c6e6f646f74732c61707072616973652c61756469742c736d61636b66736861743d636f6e6669676673002c009e4bf6d967414180fe2ef58ee8b5d36e48a9161d3cad499d3e7559537050da9ecdeee2e247df8fe84fda78ce1ee2a5fe93692d1f9edfe6914d0c8ea3e1f87d8f67924ffd4ed39e3a1754ebc62eafc8df813db9438f93574c89c0e7240befea8fa373a953e516efb8ffd094e9b881e259"]) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = open$dir(&(0x7f0000005940)='./file0\x00', 0x511000, 0x7) recvmmsg(r0, &(0x7f0000004380)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)=""/70, 0x46}, {&(0x7f0000000080)=""/127, 0x7f}, {&(0x7f0000000180)=""/144, 0x90}], 0x3, &(0x7f0000000380)=""/181, 0xb5}, 0x3}, {{&(0x7f0000000240)=@nl, 0x80, &(0x7f0000000840)=[{&(0x7f0000000440)=""/146, 0x92}, {&(0x7f0000000500)=""/211, 0xd3}, {&(0x7f0000000600)=""/242, 0xf2}, {&(0x7f0000000700)=""/49, 0x31}, {&(0x7f0000000740)=""/121, 0x79}, {&(0x7f00000007c0)=""/62, 0x3e}, {&(0x7f0000000800)=""/38, 0x26}], 0x7, &(0x7f00000008c0)=""/38, 0x26}, 0xffc0000000000000}, {{&(0x7f0000000900)=@ipx, 0x80, &(0x7f0000000f00)=[{&(0x7f0000000980)=""/187, 0xbb}, {&(0x7f0000000a40)=""/107, 0x6b}, {&(0x7f0000000ac0)=""/241, 0xf1}, {&(0x7f0000000bc0)=""/182, 0xb6}, {&(0x7f0000000c80)=""/192, 0xc0}, {&(0x7f0000000d40)=""/74, 0x4a}, {&(0x7f0000000dc0)=""/10, 0xa}, {&(0x7f0000000e00)=""/253, 0xfd}], 0x8, &(0x7f0000000f80)=""/190, 0xbe}, 0x5}, {{&(0x7f0000001040)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f0000002140)=[{&(0x7f00000010c0)=""/4096, 0x1000}, {&(0x7f00000020c0)=""/46, 0x2e}, {&(0x7f0000002100)}], 0x3}, 0x3}, {{0x0, 0x0, &(0x7f0000004300)=[{&(0x7f0000002180)=""/127, 0x7f}, {&(0x7f0000002200)=""/58, 0x3a}, {&(0x7f0000002240)=""/4096, 0x1000}, {&(0x7f0000003240)=""/48, 0x30}, {&(0x7f0000003280)=""/4096, 0x1000}, {&(0x7f0000004280)=""/105, 0x69}], 0x6}, 0x5}], 0x5, 0x100, &(0x7f00000044c0)={0x77359400}) r2 = socket$packet(0x11, 0xfffffffdfffffff9, 0x300) fcntl$getownex(r0, 0x10, &(0x7f0000002100)={0x0, 0x0}) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f0000004500)=r3) getdents(r1, &(0x7f0000005ac0)=""/4096, 0x1000) lseek(r0, 0x0, 0x400000000000001) 09:38:59 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000240)={0x28}, 0x28) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) dup2(r0, r2) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:38:59 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000100)='configf0xffffffffffffffff}, 0x80000) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000140)='SEG6\x00') sendmsg$SEG6_CMD_SET_TUNSRC(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x11010}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r1, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0x8}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @remote}}]}, 0x30}, 0x1, 0x0, 0x0, 0x84}, 0x4000004) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) memfd_create(&(0x7f00000003c0)='wlan0--$X\x00', 0xfffffffffffefffe) connect$inet6(r2, &(0x7f0000000080), 0x1c) getsockopt$bt_hci(r0, 0x0, 0x2, &(0x7f0000000280)=""/132, &(0x7f0000000340)=0x84) sigaltstack(&(0x7f0000fff000/0x1000)=nil, &(0x7f0000000240)) [ 794.732762] binder: release 4198:4213 transaction 682 out, still active 09:39:00 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000040)) lseek(r0, 0x0, 0x400000000000001) [ 794.792958] binder: 4253:4257 ioctl c018620b 0 returned -14 [ 794.819148] binder: 4251:4262 ioctl c018620b 0 returned -14 09:39:00 executing program 3: mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x21, &(0x7f0000000080)={@broadcast, @multicast2, @empty}, 0xc) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000100)=0x0) fcntl$lock(r0, 0x7, &(0x7f0000000180)={0x3, 0x0, 0x35, 0xfffffffffffffff8, r2}) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/attr/current\x00', 0x2, 0x0) lseek(r1, 0xfffffffffffffffe, 0x3) 09:39:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:39:00 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) link(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./file0\x00') setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) getxattr(&(0x7f0000000280)='./file0/file0\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="757365722e2f73656c696e75782f636f6d6d697421e013cf64696e675f626f6f6c7300"], &(0x7f0000000380)=""/62, 0x3e) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) inotify_add_watch(r1, &(0x7f0000000240)='./file0\x00', 0x400) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000300)=0x1, 0xffffffc7) r3 = dup2(r0, r0) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)) getgroups(0x3, &(0x7f0000000040)=[0xee01, 0xee00, 0xffffffffffffffff]) ioctl$TUNSETGROUP(r3, 0x400454ce, r4) 09:39:00 executing program 3: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x8400, 0x0) sendto$unix(r0, &(0x7f0000000080)="acf2b3a12907d48e15f0ab42c2d35238de81fa9e223bb93f37e8f929536b4f3b6d6cf94243c58eae42bbd1aa5b9eaeba0907b71b7036aa43586e9d", 0x3b, 0x4000, 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) utime(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffe) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) 09:39:00 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:39:00 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) [ 795.079812] binder: release 4231:4239 transaction 688 out, still active [ 795.097814] binder: unexpected work type, 4, not freed [ 795.119060] binder: 4283:4284 ioctl c018620b 0 returned -14 [ 795.134582] binder: undelivered TRANSACTION_COMPLETE [ 795.166640] binder: 4283:4293 BC_ACQUIRE_DONE node 698 has no pending acquire request 09:39:01 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) execveat(r0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)=[&(0x7f0000000040)='^%trusted{^}cgroup*\x00'], &(0x7f0000000280)=[&(0x7f00000003c0)='md5sum\x00', &(0x7f0000000100)='cgroupppp1posix_acl_access\x00', &(0x7f0000000380)='co\x9b\x12\xafL\xf8\xa8\xd8\xd2k\x83\xa9\n\xe5\xa7.figfs\x00', &(0x7f00000001c0)='*wlan0$@\x00', &(0x7f0000000200)='configfs\x00', &(0x7f0000000240)='configfs\x00'], 0x1000) lseek(r0, 0x0, 0x400000000000001) 09:39:01 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0xaa1d, 0x140000) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) write$uinput_user_dev(r1, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_genetlink_get_family_id$ipvs(0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180)='/dev/uinput\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r4 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(0xffffffffffffffff, 0x8935, &(0x7f00000002c0)={'teql0\x00', 0x9}) ioctl$TIOCGETD(r4, 0x5424, 0x0) getitimer(0x2, &(0x7f00000001c0)) mount(0x0, 0x0, 0x0, 0x841405, 0x0) mount(&(0x7f0000000e40)=ANY=[@ANYBLOB="6445090c3fdfa397b8ffd622ea7a8f75bd294fe69237c0efb2385c072b354587c21b44b0605c14dfed0a6872c258c47b5b9b38ade2350abd3ff674a0d253d85741e496eec4855f3590e3b94aa134657fe2840bfaf573009f06b2841dda210c151172514e02b911e533c84db6780bb20dbe0500000000000000e1b625f9ee4b7fac89c17096ea02681e4e77d1883c296b52d94b9b7c20c2e40eca58cf47ffe7dde28e20245234160d"], 0x0, 0x0, 0x80000, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000040)=0x80000000, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:39:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:39:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") 09:39:01 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 795.596396] binder: release 4253:4268 transaction 691 out, still active 09:39:01 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000440)='./file0\x00', 0x0) unshare(0x2000400) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f00000004c0)='cgroup.procs\x00', 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) pselect6(0x40, &(0x7f00000000c0)={0x1, 0x0, 0xcd9}, 0x0, &(0x7f0000000140)={0x8, 0x1f, 0x4f4e, 0xffffffff, 0x1270, 0x101, 0x139, 0xe37}, &(0x7f0000000180)={0x0, 0x1c9c380}, &(0x7f0000000200)={&(0x7f00000001c0)={0xf1e}, 0x8}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) chdir(&(0x7f0000000200)='./file1\x00') syz_emit_ethernet(0xb6, &(0x7f0000000000)=ANY=[@ANYBLOB="a25c84258bf2a0bd9a32f85800040001aa797d6f88b596cf975190c2793e36acbef5f26a36c5f9eb04e06c6d544d2895595a4030decc762e61250039c78d46d07c28cf544dfa285fdba579e94869676be74af8de2cf14592b75d9f4cefa36a2f9edbb955d8b394b4ccb07bc29b119e26bd99281f9ae6e074be67d0b7dbcb7b9d91f834ad694524112e5e7ce978d65558f509f641bbed9eda5948e61dcb0d113a5703e263214ad753a42bd6cb7f630000000000000000"], &(0x7f00000000c0)={0x0, 0x1, [0x74b, 0x89b, 0xa2e, 0xa99]}) lseek(r1, 0x0, 0x400000000000001) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) symlink(&(0x7f0000000180)='./file0/file0\x00', &(0x7f00000001c0)='./file0/file0\x00') getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000001440)={{{@in6=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@empty}}, &(0x7f0000001540)=0xe8) stat(&(0x7f0000001580)='./file0/file0\x00', &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000001640)={{{@in6=@rand_addr="60a951db638dfafa2fb03eb224ac33a8", @in6=@mcast1, 0x4e20, 0x20, 0x4e23, 0xa3f, 0xa, 0x80, 0x20, 0x37, r3, r5}, {0x6, 0xfff, 0x100, 0x8a, 0x0, 0xffffffff, 0x1, 0xfe0000000000000}, {0x100, 0x10000, 0x596, 0x5}, 0x5, 0x6e6bba, 0x2, 0x0, 0x3, 0x3}, {{@in6=@empty, 0x4d2}, 0xa, @in6=@mcast2, 0x3505, 0x3, 0x2, 0x9, 0xa5, 0x0, 0x9}}, 0xe8) lsetxattr$system_posix_acl(&(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000280)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x3, r5}, {0x2, 0x0, r4}, {0x2, 0x3, r4}, {0x2, 0x5, r5}, {0x2, 0x0, r4}, {0x2, 0x2, r5}, {0x2, 0x3, r4}, {0x2, 0x4, r5}], {0x4, 0x5}, [{0x8, 0x0, r6}, {0x8, 0x4, r6}, {0x8, 0x4, r6}, {0x8, 0x7, r6}, {0x8, 0x4, r6}, {0x8, 0x3, r6}, {0x8, 0x4, r6}, {0x8, 0x2, r6}, {0x8, 0x0, r6}, {0x8, 0x6, r6}], {0x10, 0x4}, {0x20, 0x5}}, 0xb4, 0x3) ioctl$EVIOCGMTSLOTS(r2, 0x8040450a, &(0x7f0000000380)=""/166) [ 795.639843] binder: 4302:4305 ioctl c018620b 0 returned -14 [ 795.666427] binder: 4307:4310 ioctl c018620b 0 returned -14 09:39:01 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) 09:39:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:39:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, 0x0) [ 795.913123] binder: release 4283:4293 transaction 697 out, still active [ 795.931480] binder: unexpected work type, 4, not freed [ 795.933766] binder: 4323:4324 ioctl c018620b 0 returned -14 [ 795.952781] binder: undelivered TRANSACTION_COMPLETE 09:39:01 executing program 3: ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000000)=0x0) sched_getscheduler(r0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000180)='configf\x98\x10\x9f0x\xd0\x88\"o\xefq\x8f\xb0\xd7R\x87\xdb', 0x4, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f0000000240)={0x7, 0x6096}) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x10) write$FUSE_INIT(r2, &(0x7f00000000c0)={0x50, 0x0, 0x7, {0x7, 0x1d, 0x20, 0x60810, 0x1, 0x7ff, 0x8, 0x400}}, 0x50) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000080)) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 795.986712] binder: 4323:4327 BC_ACQUIRE_DONE node 707 has no pending acquire request 09:39:01 executing program 3: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/status\x00', 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='\xd9\xc9\xdb7g{\\\x88\x83', 0x0, 0x0) fadvise64(r0, 0x0, 0x0, 0x2) fchmodat(r0, &(0x7f0000000240)='./file0\x00', 0x0) write$P9_RWALK(r0, &(0x7f0000000280)={0x3d, 0x6f, 0x1, {0x4, [{0x1, 0x1, 0x4}, {0x18, 0x1, 0x6}, {0x2, 0x0, 0x2}, {0x2, 0x1, 0x8}]}}, 0x3d) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x2, 0x400000000000001) r2 = accept$unix(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x6e) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) getpeername(r2, &(0x7f00000000c0)=@isdn, &(0x7f0000000180)=0x80) 09:39:01 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x9, 0x200000) r1 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/validatetrans\x00', 0x1, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000100)={0x0, r1, 0x5, 0xff, 0xfff, 0x1a7}) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$dupfd(r1, 0x406, r2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f00000001c0)=0xc) sched_setaffinity(r3, 0xfffffd9a, &(0x7f0000000380)=0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x20001, 0x0) getrandom(&(0x7f00000003c0)=""/48, 0x30, 0x2) ioctl$PPPIOCSFLAGS1(r4, 0x40047459, &(0x7f0000000200)=0x408) removexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[@ANYBLOB="7d30ffffff6f6a66698fb0b522b8b1f50e1706bb79f7dd092c98c6463c49c593486153025f6bdda0d07cbaa56882029ed33e6767cf0263a97d63"]) lseek(r2, 0x0, 0x400000000000001) 09:39:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, 0x0) [ 796.443817] binder: release 4302:4313 transaction 700 out, still active [ 796.467903] binder: release 4307:4317 transaction 703 out, still active 09:39:02 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x0, 0x0) getsockopt(r0, 0x8000, 0x40, &(0x7f0000000200)=""/17, &(0x7f0000000240)=0x11) ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000140)=""/83) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x20000, 0x0) ioctl$VT_WAITACTIVE(r2, 0x5607) fchmodat(r1, &(0x7f00000001c0)='./file0\x00', 0x10) setsockopt$inet6_tcp_int(r0, 0x6, 0x1f, &(0x7f00000000c0)=0x600000000, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) fsync(r2) setxattr$trusted_overlay_upper(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='trusted.overlay.upper\x00', &(0x7f0000000300)={0x0, 0xfb, 0xdc, 0x5, 0x5, "0af7b86ecc1dc776b3a36c26ac47880a", "da59172625db39cfbe6215cdcb41d6af93ee8648ad3171aa16b044f4c003136edad84fc845b5ed11aedcdf82a41e215f5f5849076b627cb9ce4a1cf0bdbf79cf618f27e5adde22f4961282309f21962d68ed3f0455b0a9f2f5596a128d35d4711fac544c9b667efb3e3b478fc83e8c464a20fa073950221d3744a8fe98f8a1a8df0ac1e5dcc71a90f15c3aea2c08f04f748137dcd163eeafe18311125049b3c918e605dffbccfa42582930a4c5a223d10776c3ceeeede63bf7a363e22e61b6ed660a1f65dd4693"}, 0xdc, 0x1) 09:39:02 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:39:02 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ppoll(&(0x7f0000000000)=[{r0}], 0x1, &(0x7f0000000080)={r1, r2+30000000}, &(0x7f00000000c0)={0xe2}, 0x8) 09:39:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:39:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, 0x0) 09:39:02 executing program 5: r0 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x24000) recvfrom(r0, &(0x7f0000000180)=""/139, 0x8b, 0x2000, &(0x7f0000000240)=@pptp={0x18, 0x2, {0x0, @rand_addr=0x1}}, 0x80) r1 = gettid() write$P9_RGETLOCK(r0, &(0x7f0000000300)={0x3e, 0x37, 0x2, {0x1, 0x3f, 0x5, r1, 0x20, '*.security]posix_acl_accessbdev+'}}, 0x3e) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000000)=0x2, 0xfffffffffffffd47) flistxattr(r2, &(0x7f00000000c0)=""/82, 0xfffffffffffffdd9) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000040)) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000002c0)={@broadcast, @multicast2, 0x1, 0x2, [@multicast2, @dev={0xac, 0x14, 0x14, 0x23}]}, 0x18) [ 796.578056] binder: 4359:4361 ioctl c018620b 0 returned -14 [ 796.599932] binder: 4358:4363 ioctl c018620b 0 returned -14 09:39:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 796.740988] binder: release 4323:4327 transaction 706 out, still active [ 796.760610] binder: unexpected work type, 4, not freed [ 796.786323] binder: undelivered TRANSACTION_COMPLETE [ 796.804591] binder: 4379:4380 ioctl c018620b 0 returned -14 09:39:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)) 09:39:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)) 09:39:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:39:02 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 797.384369] binder: release 4359:4369 transaction 709 out, still active [ 797.406894] binder: release 4358:4373 transaction 712 out, still active 09:39:03 executing program 3: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1, 0x4002c) lseek(r0, 0x0, 0x400000000000001) r1 = socket(0x15, 0x8000f, 0x9) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000000)={{0xa, 0x4e24, 0xfd, @mcast2, 0x80000000}, {0xa, 0x4e22, 0x63e1, @ipv4={[], [], @remote}, 0x4}, 0x0, [0x6, 0x6, 0x6, 0xeca1, 0x80000001, 0x4, 0x37b5, 0x3]}, 0x5c) [ 797.434611] binder: 4395:4397 ioctl c018620b 0 returned -14 [ 797.446356] binder: 4396:4398 ioctl c018620b 0 returned -14 09:39:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)) 09:39:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000040)=[@window={0x3, 0x80000000, 0xfff}, @sack_perm, @sack_perm, @mss={0x2, 0x4}, @mss={0x2, 0x40}, @window={0x3, 0xffffffff}, @mss={0x2, 0x5}], 0x7) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f00000000c0)={@mcast1}, &(0x7f0000000100)=0x14) 09:39:03 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:39:03 executing program 3: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = fcntl$getown(r0, 0x9) write$FUSE_LK(r0, &(0x7f0000000040)={0x28, 0x0, 0x3, {{0x9, 0x5, 0x1, r1}}}, 0x28) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r2, 0x0, 0x400000000000001) [ 797.510952] binder: 4395:4402 ioctl c0306201 0 returned -14 09:39:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 797.564278] binder: 4408:4409 ioctl c018620b 0 returned -14 09:39:03 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000004) lsetxattr$security_ima(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.ima\x00', &(0x7f0000000080)=@ng={0x4, 0xd, "0c9a73086ce62c8cd24d94d0962ae0708f6a"}, 0x14, 0x1) 09:39:03 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:39:03 executing program 5: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) 09:39:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x40000, 0x0) ioctl$RNDGETENTCNT(r1, 0x80045200, &(0x7f00000000c0)) connect$inet6(r0, &(0x7f0000000080), 0x1c) [ 797.626805] binder: 4408:4419 ioctl c0306201 0 returned -14 [ 797.636931] binder: 4413:4417 ioctl c018620b 0 returned -14 [ 797.659354] binder: 4425:4426 ioctl c018620b 0 returned -14 [ 797.724239] binder: 4425:4437 ioctl c0306201 0 returned -14 09:39:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:39:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept$inet6(r0, 0x0, &(0x7f0000000040)) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:39:03 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x10800000) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) 09:39:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") 09:39:03 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x8000, 0x0) mknodat(r0, &(0x7f0000000040)='./file0\x00', 0x1088, 0x5) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) [ 798.244594] binder: release 4396:4400 transaction 718 out, still active 09:39:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x200000, 0x0) 09:39:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) getpeername$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, &(0x7f00000000c0)=0x1c) [ 798.298130] binder: 4446:4449 ioctl c018620b 0 returned -14 09:39:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:39:04 executing program 3: mkdir(&(0x7f00000000c0)='./file0\x00', 0x200000000000012c) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord\x00', 0x80000, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x0) lseek(r0, 0x8000, 0x2) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x10000, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r2, 0x6612) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={r2, 0x50, &(0x7f0000000180)={0x0, 0x0}}, 0xffffffffffffff24) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)=r3, 0x4) write$P9_RLOCK(r2, &(0x7f0000000040)={0x8, 0x35, 0x2, 0x7}, 0x8) 09:39:04 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) 09:39:04 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000040)=0x200400100000004, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/attr/current\x00', 0x2, 0x0) fgetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.upper\x00', &(0x7f00000000c0)=""/236, 0xec) [ 798.450657] binder: 4466:4467 ioctl c018620b 0 returned -14 [ 798.474996] binder: release 4425:4437 transaction 730 out, still active 09:39:04 executing program 3: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000080)=[@mss={0x2, 0x1}, @timestamp, @timestamp], 0x3) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) write(r1, &(0x7f0000000000)="f9e17b8e48a16165f6564a9629b7c55955faf87d29b9de0b72c6ef10eab3d1054716bc43a95b644d84e386283e3d34d7527f1146ab6967740341ff43f8", 0x3d) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x1) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) ioctl$BLKDISCARD(r0, 0x1277, &(0x7f0000000100)=0x80) lseek(r2, 0x0, 0x400000000000001) [ 798.528932] binder: 4472:4474 ioctl c018620b 0 returned -14 09:39:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:39:04 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") 09:39:04 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000)='xfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) 09:39:04 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0xfffffffffffffffe) lseek(r0, 0x0, 0x400000000000001) [ 799.081691] binder: release 4446:4457 transaction 733 out, still active [ 799.113090] binder: 4487:4491 ioctl c018620b 0 returned -14 09:39:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 799.171811] binder: 4487:4495 ioctl c0306201 0 returned -14 09:39:04 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x4a0200, 0x0) ioctl$KDDELIO(r1, 0x4b35, 0x80) ioctl$EVIOCREVOKE(r1, 0x40044591, &(0x7f0000000040)=0x7) 09:39:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 799.226040] binder: 4501:4503 ioctl c018620b 0 returned -14 09:39:04 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) [ 799.289545] binder: 4506:4509 ioctl c018620b 0 returned -14 [ 799.295232] binder: 4501:4508 ioctl c0306201 0 returned -14 [ 799.327811] binder: release 4472:4479 transaction 739 out, still active 09:39:04 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$binfmt_script(r0, &(0x7f0000000140)={'#! ', './file0', [{}, {0x20, '-'}, {0x20, ':systemself'}, {0x20, 'configfs\x00'}, {0x20, 'proc'}, {0x20, 'configfs\x00'}, {0x20, 'configfs\x00'}, {0x20, 'configfs\x00'}], 0xa, "7fe19c31b3f64e4b50274af08cd3a4164453c59880d9b210f578c3bfc0c353fafa1711c15a811b094f48f4442fc8416c7c14f156c80723ba30b621fa0b1173cb4b61e17585c3f58da1389c948052883637a3985f6afde842c57866bddbb9640079100bcbd8d7f759721c1a643bb61dff0b5a4b62ae25a5e6e3b5bf7df4d6d7edd1a843906db90ee1542770d9df1ff96d0c615e1c50f4e0e3639d062e1a1c13a98e3242c410aff613e7e309b0638a201222cb8c5ee2fa3ab55de25503119d"}, 0x105) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) r2 = dup3(r1, r1, 0x5e5e0953bfd4b7a) setsockopt$inet6_MCAST_LEAVE_GROUP(r2, 0x29, 0x2d, &(0x7f0000000040)={0x3, {{0xa, 0x4e21, 0x400, @dev={0xfe, 0x80, [], 0x1e}, 0x3}}}, 0x88) 09:39:04 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") 09:39:04 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) accept$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) [ 799.385613] binder: 4517:4519 ioctl c018620b 0 returned -14 09:39:05 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x480001, 0x46) ioctl$TUNGETFILTER(r1, 0x801054db, &(0x7f00000000c0)=""/96) connect$inet6(r0, &(0x7f0000000080), 0x1c) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000300)={0x0, r1, 0x9, 0x7, 0x1, 0x8}) ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000180)) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000140)={0x255, 0x1, 0xf798, 0x10000, 0x9, 0x3, 0x80, 0x50, 0x6, 0x100}) write$binfmt_elf64(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="7f454c4601020805060000000000000002000300080000005f030000000000004000000000000000ce020000000000005e0100009ea938000100ff01a7013f00040000008b000000000000000000000004000000000000000400000000000000ad000000000000000500000000000000010000000000000006000060030000000700000000000000080000000000000040000000000000000200000000000000040000000000000004000000000000008500616af97ed58c294835ae2fcba0f80d6517f1fd4903681718bee9f7dd77fde3aeddd23c8cccb8d885c2e12c36ccda972b510d48c523289564fb70ee5937f10d035e50fe97a3e977d0aa1ad519375ff162c37276b2b77567745ef0fc8a5336bfece0a87260727a985b2b1b8f5a3cfd7c179e320028c365c19e9e1095496996c392fdb5b63709d34676b5dcae66149ac63549d18d793195582e471593dd4920c0bf7bb633bf344bd26960de887418c4756decf6a2d43f154cfb3302a24741e9b8bea6deb4e94f87ec88fe13c200d1a4bfa95c79638d03571d4dbc3240e3cd82bbeb470f3ca3a1690ee24a569ecf2cb5466803fa236ef45d4903a5389994bdb4e08c2a7a501b8c2e5eca7cf282293be76740b544ae3e48290ec9084c6725698830567a29d97384a6d3bf8b80e33d6eb64ecb7a4bd694f1c8843f4fc4f90368345d32d0d8228c50a78c77e9fed64824ba2d4a87309e6b14c2f65c10302e68a274"], 0x17b) 09:39:05 executing program 3: r0 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000180)="5a113ee8240f94370f6dc2f8cdc0c400497c5b24f400fdef15c6752d19eb0e7f7e49d1c3d65a8aafe8dbeaacd0c58d069928fa8f4a941fe2262890c966cdf6e287522cae6c22d4f0888aea2b95a5bd457c66c68cd9d9f474f43ca46001bbeae62bfe4e98f49db55f5b641e3dbcf55a68d6494bdf35e91a36b01dd5bb2dd3cf2c73c0d6a67004f7e9132aa3e41b2e51bc47ec0295258560dca793215462e805fdc5ffd252d95d2487cd5bddb54ce40403b6292e73d872bada38836deba66c90eab5633ad220a5fe5483fd95730a7f899e2ddbaa5829e53c", 0x56, 0xfffffffffffffffb) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000080)={r0, 0x4, 0x5}, &(0x7f0000000440)=ANY=[@ANYBLOB="656e633d72617720686173683d637279707464286372633332290000000016000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003778e17fcdc83c4daec6e273c87c3d3c498b5cdb67"], &(0x7f0000000280)="74c25b9a1304c6eeacd7050b495bc0d806f3908652a967486bebc945f12c886f60", &(0x7f0000000380)=""/152) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f00000000c0)=0x0) ptrace$setopts(0x4200, r2, 0x7, 0x4) 09:39:05 executing program 5: openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x80800, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x2000) socket$inet6(0xa, 0x7, 0x5) setsockopt$inet6_buf(r0, 0x29, 0xcd, &(0x7f00000000c0)="5973e1d6ae79e48640b76c73b86214a7dd23f5d300d538415dd89da7bc5afa76db6cff22b46464bd198bbed63cdab5bc96b7bd1cd99a6474685f05297637c34bb681382e92268e4690a4480eb437fe6a7cf625f84c154c51fdc3c7ca6dfaebcf63f4388b49148d36287392d5bdf52b1c4b9f458be14d36ed8cdbf4c38084c3bd697d4db4dbea00b237c64ae9970c842d1e895a97dca985b187e5220df37f984b8fd1f43c823cb06798fee1f4d8d91244475bee58123b8363cbf000", 0xbb) ioctl$GIO_FONT(r1, 0x4b60, &(0x7f00000000c0)) 09:39:05 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000300)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), 0x0, r0}, 0x68) r1 = dup3(r0, r0, 0x80000) ioctl$UI_SET_FFBIT(r1, 0x4004556b, 0x39) lseek(r0, 0x0, 0x400000000000001) r2 = dup3(r0, r0, 0x80000) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10008000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="78000000340389fe5eb79d05337b1739b3000000", @ANYRES16=r3, @ANYBLOB="280c2dbd7000fedbdf250c0000000c00090008000200fbffffff3400060008000100488900000400020008000100000000000800010000000000040002000400020008000100000000000400020024000700080001007209000008000200b6d3000008000200400000000800020040000000"], 0x78}, 0x1, 0x0, 0x0, 0x20048000}, 0x40010) 09:39:05 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000140)={0x2, 'tunl0\x00', 0x1}, 0x18) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x20, 0x0, @rand_addr, 0x2}, 0x1c) setxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.origin\x00', &(0x7f0000000100)='y\x00', 0x2, 0x2) 09:39:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:39:05 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) socket$inet6_tcp(0xa, 0x1, 0x0) [ 800.030219] binder: release 4501:4508 transaction 745 out, still active [ 800.057367] binder: 4559:4560 ioctl c018620b 0 returned -14 09:39:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 800.097209] binder: release 4506:4516 transaction 748 out, still active [ 800.115582] binder: 4561:4563 ioctl c018620b 0 returned -14 [ 800.116499] binder: 4559:4564 ioctl c0306201 0 returned -14 09:39:05 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) 09:39:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") 09:39:05 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x4) lseek(r0, 0x0, 0x400000000000001) r1 = accept(r0, 0x0, &(0x7f0000000180)) setsockopt$inet_tcp_buf(r1, 0x6, 0x0, &(0x7f00000001c0)="39346ca4e268bb59431dcdcca83abe3a92f05dd3b222d8a6", 0x18) 09:39:05 executing program 5: r0 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000040)={0xa, 0x0, 0x0, @initdev}, &(0x7f00000000c0)=0x1c) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000100)=""/244, &(0x7f0000000200)=0xf4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) [ 800.186068] binder: release 4517:4525 transaction 751 out, still active 09:39:05 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x40, 0x0) ioctl$KDDISABIO(r1, 0x4b37) ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f0000000040)={0x7, 0x100000000000000}) 09:39:05 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) accept(r0, &(0x7f00000000c0)=@can={0x1d, 0x0}, &(0x7f0000000040)=0x80) sendmmsg(r0, &(0x7f0000004100)=[{{&(0x7f0000000140)=@hci={0x1f, r1}, 0x80, &(0x7f00000003c0)=[{&(0x7f00000001c0)="0968d72dcd1948f87551dc31c88dc924fc1c2027786e169749217f83cf795e5f3aff95f5e45b0e037d568fd5183175e20dc00eb6e649989ee03f62419a04243be3f89b7bddc01890edf13c29d14b3ba9a615971d5c62ebc4e0be1228ba685d7fe604d2dbd19581f1d22e463bd76e55aed18a84405a3d86703c72e6e72b93450748f478ffba67", 0x86}, {&(0x7f0000000280)="00ce77c2b1b83d87aa25fc7d69e7a88bccd7a667414be87bf3b3dda5deeed7fe2e900356b25ecfbaa5fbb156c4539d0e1a7cfeac37feb73af865c4f89dce74853d24f6d374fc3318fdb4a5059857d4896cfb2128a9f352b0c6bd128c1bf5fb4f915053f897769748f1be6d031ac23ff93e241f2faf4f1ced25961f9257db66841ffcef9739cab6642c5eab2da3528a564eee83ee228840ff681b42dbddd2d4b0d4df56bfa92f1af6f1bdb1cf7fbf826cdc5bb84b50f5c1998ef93c480dd7df2f858771", 0xc3}, {&(0x7f0000000380)}], 0x3}, 0xfffffffffffeffff}, {{&(0x7f0000000400)=@ax25={{0x3, @null, 0x4}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x80, &(0x7f0000001580)=[{&(0x7f0000000480)="1fcc6e7dad2309bc5c3212174ed8381c453d38a802bcd07e37177225d14f10db63ec48c6a822db6b424a03cc589e627fb91a4e418aadcb7f40538f2fd7e10bf0e16251a3ee2f6a663bffa903360634cf92a393b41c2283f20cf37b463adc83367c3384bbcd616a994d054948e44cb6ea394ed8a2cfcbd4429fe3300d6d93db100fdbda27577715588f600d8f9cf8842afe7a47309ae6cbbbe6449f61bcb13c6aaebeb78f98167eae4bcfe10088913d36ec1f6a809d761316337b9779db", 0xbd}, {&(0x7f0000000540)="399eb0f55663f54af27c643366baf2a653958a4cc2bed797ace4a775e272d73327513f6f", 0x24}, {&(0x7f0000000580)="2604580df68f07ebad11ec82ba6ae1819560ef33262cc2c6917d0739436cd61f62440fcd79617b2eb9cb2349c40d823b3b323e3fd22604bf82b5e41e780b4356d4a373fa6bc04d2dd0f3f3da3a03d2f327a6ebf1196475fac46b7efa0c53b36833ddbf3a9401b3b3a171d33480e92a06d8bbe9d033877661725503e0059a044e1737133b6fbf3a97ebcdbbf7848a45231b518b8cf36ee1ca1fd1e2daa5797632168d875f24c14b39b9fee7da08b75acec8b65f1ab28a4d4e497e9c8861ad989202ba9d7e98c680a9da392343f4b38fe9f2aa7ee8deb52e96d58ec1a9d67cbe9ebc0a862c5d36ee33da1a35ed4246a95b8cc18ac455f1d4bd0c68928fc970e1ed87e7c9d1cd0c01052e0e8dd55e6b9bfb97f0bbbd3a543a358f009b42d0a8edcfa41ea0ef9c426f9da46452b70d23c395c8915e05bf36124bae784e8f2620c5ce8b31f3d8cdcc624dcc599413a4007c3929d8312ad489541520dd5d818af30a69bf5eb0f78c6787dc6ab48d6b4e5c3c9818c7568bbfdf5f70d26de050e2a4f3e6620acd011f0cc092a6b08eace3c16b82852faa380cbecf16fad715819fa765b065665557e491d16184392023645345f5726a1db63606cc3c1a1c508ac83721c009c7606350b9bf1ce1ed1150a584318b9ff635e4b9744ab6250ebddf10551d2937f7f3c7cc2b6b19d024666378a251013da03a939af012fe42b6f55c44b95b02ebedcf19604d76febb87b0c329af3c9dd3cb862a8e7e486bb4ecc51c6e75e9494666d1bb45cb927121ae6a1ce046bc040320b519ca430294d64215470e71180e8845f5926c7929b99e44039a52e4f85d7a70d969ba40a396741d9804bf085ea33e81e528badc7501260d6017ec6b759fc9af91d7244e2e195a72edd0d8257c9edc2794d0ec3b0e183cf5b6a45e65df2e18a149a02723cb42488ace06b727184025f92a16f959eba00aeeb14f85729b8d5650576fbc5a8b95cc02342c7718bb78d232a4b2b8e9b96daded51d173f33efa7cf39894eac71a3171e4cd17eba9d348c3b231a5a4f30b3584e10542695579397bc383e636aef58beab2fe0cdceed4678ec4ff5e54e629ccfc2990fe139f8724b84a0782a4ae9cbf7d580f1270c2423f57714a1ff00e2823a5d730b9d0fd5fdbf4c54eb070746168ffe25741989fe5780e894d1250b877dcae0b30578eb8cca5cf12094b834037352231d3cc0a33d180444342a675bb46d2a402f3f76f5a03f593f93f207cf4110402c25031c0d93b1abd699e2d1993ecd27dad2afbf49cbb45303b2c5406ff86bc918a85dcc524336b600c79176c8a71989cdd9e7306346041185724ff9f4d6f0c7e67703c438fdb5aeb0648e3d64337f54a596e8389b3b1d43f29bd6391175a8bda8d3e337567daa0054af5b7a0ab5ac1e10091b0d9562c59786eeb3d64740a060d9963a5e9cf05df9fd01a6877070f79c50bd5636021e447d1ac7b3565212244e84db45936356091eb19ad583b63cb7dad8ea8b497a14de2358d5603933ac54e3263b7410fed2797d3e78d1bdcdb8d328c6645d0e3eaa02218491de70362b6ba92a4677510eabab8939e2c6a98fa3ef3bdd2f4fc7c47d1a54bcb6dd024be27fabe6a1f616c58a44a5b65b484eb0f6632b26dde30777cde3e3a738368711b27c31493f5386c0daa438a25cd98ce2fb824009525d7c1bd81aedb397533581020e6b635e15e7b64d79fc3fe7fdedb144f961ade7f5ca8b82fa4097dde6c32055c9268382a47a805528efbd4faaa9f9f30978191329c985596f3414fea1cdb6beea24bb00648d7f2965252a284e597501414f4bfe9e817845c5b30f640d6c2039ddc7cf9374d7b1c9ab779755e331f1e8fcf31391e284c742fdc8584ad981f56953d627aa5935e6aea11946633faf79f6f492f37a520968827a25a57cec3cad16778e48a7222beb8512fe717a871ce2d2eb3e423a27b14980e73039a20d01934babb4bcce564bfbf86291796ea5ede4ce1cdd2ef24f05ecc34980faa1625f94d7765150aae76cf5df5edc88885d421e9f8d6cf45ea83f139b37956947051d90665db55d461300b933dc5f11de0ebef9ee2c5e8a92c50b87f5a6b98021efcd3ed1852586a0f4036e3d3ed0ea7abf7001fd7da3f92331ee3644a82c9282901aa255bc122076ef7c0ccc1f6ffba6657a74c038a7fea240d7d3833aea976a12333065d927b65fb2c77f3df486278da171afaf8e735eb7dc0012cf0dae137d9f04b7aaa695c6f6d938f261534277a3b4d447917773df32b7fe98ac3627f80a4976e02a57ce392dd8ff09c68c67375bf46cad94b2c83baedd244a2ff23db634d0d93f0711700987cd8b0752afa8cb0f25c34e4b2674af3817c050da1bbb66d9a7d99a49a1330893034dd866308809cc5f201867f04cb5bdb9260707f0e36e56f8936d8a48b7a36bafb6dabf2461882fe094c18f922ae49d1de77dd3889905fed04a91798a130080a99a95dcab5d14d87090b3920cbbf369a87bd14220d6091101d1328e2ec6d34cba02b8da8d5a797c1f73163495c5747de2fb5417a9c3075eebe67c832b9c060489f7255d7f7ad29557d38839c7770fbc1a3e5a697e8c540e50d1c778c601f5f3226c653baecaedbe1798f7b112cfb8f0b06e825195683119716b9321b6228433c027180dc150404653be883169a3bcd7af4134df898bdb34c824967b6c826bb0768eede5a79993a966d2c22c0a2511ec1c84de051af7e3a4911b2c92114e2f087dfe6ef1e3622ea67921d08edca4bd5aac6bd0528bd5f4f608fc468fe648e3e7d994bb29f6726df573eb6658b89ae1db2ce947c1ff5e03952173d06d445ef93ae909efd06501f7abecc518be46b9055f86966def6d95fe8728056839f35d66ead6ae4b301ea96e56532060cffb13158b7bcdade07fe6918e99afd973e9f30b977eac2f2066cba1060de5d498e1b63edb1011fccc16ffacb25296a51d5f5e1803bf887b893a6907138e62df351cbf3537e168a11d58414d8dc8b9eeb3d33336986ccd3aa1b1811ea683e62bdbd9b4d4c50b93aa52f868ca6279942451592ff37faf2e8f3955b1198ca667c424febb3a37c0895dfb93bb0732ae2e7d68c1d12beb250ef62147829ba878e8bca415e080d6f716aaa529db6c681d694c285d15c28649b6325cb9b321f952b691094821e7c11c13c4ad57aca74ecea2e277d8c212bf56343be77aca6d39587fbf06e1e38710fb39d3fb9bdbdbaf85770ec9e14f5c089d6efc9e7767625da7307d6876a90b1000eda64c138cf056e9c0aab987ae8eb532568cc241f80682136b3f7b9ece90197efc7fb7c97cca81509f5f6eabe236d865b5ee98192bd82d530628a1d942c7b07f90ca9c6f338a18e4c0f0fdfbfffbef3aaa332e67d1cd6d00defe848947b12983b0d4d474c8d00a9d00695777dfc95ecc20f129cdcafe224601cdfbc868dc1dadf997fdb5b9bf7a5e6dd08a36e4be6c9425c4fcb681692ecba5df90287ac1ec59b7508b9988ac1d041c0a72c69a2440fe0f146c056a21c026959aa5dc19ed71d78e85bbd894e7fa1de931fd8bb3d26e500a096c36eb561e1180ceecaceaae3f44343956df5e6efe448501d05500fc051f6a3bb75dba7254c15605eb6eaea9f8746db178746c5d7b49fdb063a15a90d4b4bc079cbe71726432502963447979bbae8a187c10558d27f5f3c873ca97f979235edcd4b9c118a756794da617a131cd7ec3a54c3e17b2f032cb301c0f303d9e6ecac0e945cd99ed494590ec11117b67acd88ab3050950571cda42d87794df2fc5a2e14ba015ceede061994b0da6aad960b8fd08297a8d40b8eb1f1d49d07c9b962982c266cccd4ddd3da2fd396c1cafc545431d3e040f31e8aa59a2d36f133ea98459121cb82f3ff33fe7e4279b5f3fe4a8520cd4cfdc9b544af6f3c5df898c9056b7eb6cf2119e51e20e20b8c5eb92f7adf59d174e1df43c9ef980cdd8c5d33e3a5570e97af6e7d7012927b0d5d7e31bba0f5592ca228fce0d8e53013124e3aea6ca7b3ba665b021eaf70885992bacf879696f4965c0311724c7f2256728dfefea6183367d8ee5a7b4faba5751b8f4b2f75a68b08560ae2e65333ef573b9df3c6b621cb3a0655a30a023a6c50a503e7c0506d466362483ade40f188aafc6bdce29aadcab0b8b63c24c55e1a717ae5e2c455abab87aa72f7d4fc0353d348f109f4f510633f1a7d056d19ce8600190ec2c60b5f205e0e5a21ece2b9eed354b574a0863baeefb610000d72ee2fa8488a6ff8e68cddafcb2bc306c875fc3f0fa1b60e5d22fd7c2e212ad2236bf5ca1fd378628547d952c6c7ffc326c451577228fc8bc9aac1e806cd9aa1c2f220b8fb52f8a9eb5ef0995980af3e173ffb1d526d5f2302604cfb49a492558a35a7ceea30c723462a300239073a963d872bc67f77ba6f1e5a05a9f83d1c1d61174dcd3966d04194140e1957bd36ab9954fbb4356c85efebeb82322ea21f42440a1ed9f6c2e3cfde3d689111bbf57f103d50165ef04fa8391c555d8aa66d3d7574382045b7537e6a5bb22383381678ab010899080d1bcf91a147bd1220d98cae5e7e67f01fde4349b8f2de6e1da9b86fd9c289dafffa6ed49fbbfafce2ef7afba4ca068ace82fd4bb68b44f528dea53afa677c9b44e49e0da08e3a9da932dc9b785067eda5ad45dedfbaa5503ab0dbc3f809fc93d936118fabb4a626a39ad9f2fa5a12216f7c50bd9d8a01db24583f3bf02811ebe6ea3e3a0d29728c59b3aebd5ab9b11051b8e443cfad4ac5ffe841c4c792a067b43632a1fdf9511b1e265a7849148a80aff199c9f0cee6893b070bb66df4da2a6c497699a2acbe88d52d493d14625933672726e54518245b2a83f727751e312831ad507692f8ceec14d9a4ef9996e2d02e78e63f2eb3b1619c19babc97caabad43b5fa969dc38a11ddb4652451772328543c90751daa9ec7f4062dc09db5b904e3e6956514f3f9341127abf3dc2a688dc2c04bdb1b031e4337c1306c844fc77266b11caa166744fb314da304546ce2627d083a49b92839ac947d2ee0ef4c9859f69aa256411ed42255a8c9aa4af9230b569f4170b00ac20147907d93e1ceaec79510028c6c8c4112dc31cb2e6b98709b5adfd0cb18bcf59d4f5f7c24b999c852c75f1507414bdc6cefd10cadba92b174e017bb7a7a4fbf181be24d1fcaa086b37c3bba448ad9d4b423dccafdd626f02c231535d4893b053e371445883932b5c7928a2987324061c8ed800e2ccf430861ef54f37aa79431d626aa172c1b5f165a8b9e974044d8abef7eb97ad20a6503117e85490ea5b71b4848884dba2006ac8fae43287bf84fd841e6364a37de76ac7ce8b2c4d3cda604b4299138e944f28958dd6afa6731788ec4b07536a4a4a4947ec5e41b785d39eb7d11aaf8a50cee74ef7d4c9adc91763a5986212c8d5e563db7373ae45b48208df1cb0e17a36dd4d32306c474e12bab07a5f1c28c215ee7587d4a925bb917b0826af0826cc595e733b580f8ed715953599fcf2cfbf47421876e000c3ef4c1e69c161ccb9505b6b7268aaaf1a6672e217663b2f5d44779ddc1f62fcdf857cf8cb5f80c6318ba25e811d717625042fefbc85ef2e6d1a042ea43077f77cef8347c0661b12f44d5bf6fabbd9722f6f173f8b050fc81236040a6dfc54b2567870f2b62e7f68970e8c7e58f705bf41eecbb633ff17591c6621d793a14b7d5286d931daa03c4de5ebf550f9fde29382956cb9c92198ece80d17f27c3b7d1c4aa281ae2da2add6b32ce6e4f51d833c07bb93ce74b", 0x1000}], 0x3, &(0x7f00000015c0)=[{0x50, 0x10e, 0x2eee3961, "2f5fb3e1c942185a209dcd9ff94e41549f197702f4cdd56295e352a08fe54aee3e66212e10702559be2f673d72215cacb3b79386c131774ab1bdbb42a699"}, {0x20, 0x113, 0x6, "7a7d09a26280139609f2bee576"}, {0x68, 0x0, 0x4, "71f122bef42f89b61528a55706325965e4109e922ad791835396846cb7e72d69fef39917be6e0a8b3a0a3d0a67957f0f4411e8f633bedcff6871e38cd4539d71403211cb3249a0ee01c7595c01066af160e3df86c3c187"}], 0xd8}, 0x323}, {{&(0x7f00000016c0)=@in={0x2, 0x4e24, @broadcast}, 0x80, &(0x7f00000018c0)=[{&(0x7f0000001740)="e05c5aadf5e69883d20b2d035e708e331db2d0ebfc73b9c4a6fb9c3195814f556805ee01c6d158e4583d3c337161d05d7dce2071573093517f31ee51c8bfc60c5489ba075e702465aaeabf40ef9442d362a06d9f53f67d30526046e7562e3f00debad108730e9fb49dc5d3b405a41fa34be09aab0cd9bd5db03893b0a667c7fd5897d31dd4ec850f498c6b417ec4b1b8edfeaaa0a088d401d688e4b4d2fd", 0x9e}, {&(0x7f0000001800)="cd8d03799613808051e79d6ea5efea62ec7116667b8f14979d276b874b0465a45987bc58926944ba637eacc1793d16a58a41f6e02804c2c9c393b68efb8d7d7bbacb92b796c4c1079119cbc2bd882afa5e397e15dcece9dc7bad2f208f2916d6d2c7a3ef1f945dd75b5ce9d8d9c1446dd991d7b45797c7c7a7cb9caf1c08b1290e25c99b4d703ae8073c42115bcd75bcef141963adc8e255400422c3e2bc", 0x9e}], 0x2}, 0xca1a}, {{&(0x7f0000001900)=@l2={0x1f, 0x4, {0xffff, 0x0, 0x900, 0x8000, 0xa0, 0x1}, 0x0, 0x8001}, 0x80, &(0x7f0000002cc0)=[{&(0x7f0000001980)="df1e051c82f7d50b342cfa55c3c77093d5c0101d035b034c39f013cf839c9f627f58e64cecf540a14c03cb56b91668e11be22eb2d7f1b8fc35af90c20df72cd45727d40dcec21a32239b58cf9eb63809c0a74bf21abb46af6850a5a58c263f82df79269ed7ffd3e6ea38aac16d790b2679dfd32cbcb4758af44abda741701ac3bb845f434a1da707c47b60ce43b38c4710433fd1bb3d07de036862956726e34056c37d1ea2c0aa8a55a3c6103c803bf05b4e9a4e58da677fb9dbd608039b6e5cd4dfae50f7f9e97189699c4fbc3476684c8d24904b27294e", 0xd8}, {&(0x7f0000001a80)}, {&(0x7f0000001ac0)="587b57f7906f13be49e4060ef16e9f3e6e00da2ccea4687deb312c474d5576f0fa64670999079b853b834547239ea583d63c55ae3f7774b28a278a661b4c1d838d7de75e7b177c738069f623af53be18de73c41fc586a0e37370f3ad4ab2ade75668bfd5b33726e6906c99fa8244c8b117cf2038c1801aa88077e35c2f0876057d3662587b68c7064155f9f4bce62350d8f76fde24c63e5fd4d4bd731c5e946b424cc5476cd6a552c8", 0xa9}, {&(0x7f0000001b80)="315b15e7600425a7f675a9c5acbc9e61a2cc568fb8f2eb6acbfb294ea64b9867e70f57e063fae6e10573fecac46d5419367d9e380eb96c151a2c05ee9e28874bf4a1cbc124985632182d66d4e5d34d0417cb6f4c5d8c3e1f55c7806abc8725bc9c004ffb6a9ce9318967236a5611acaed98e1ebb47202ae952973fb5ed251933839067d1bd6f21571db26b484d1ed8864c456187409ab8be38c428bd57b03f6cb583d7fafa29b2a87c53c9dea8832d60647e338cd559717e8acfb80d69bf21188eb95cbbe65a13c6aa671ac5d39b52052ea54ba68af6ee25554477efb3b5a4deb1f2d0e69953f672767ec3ca527a460cc34083c3b3574f562b11bb7f0121d788c9d675fc4c5e2ef3fa44c85d4ffda59b083f5342bcb72cfab4c438c3f7cf58f73141828e987899375ce5b770fe0f9c3e0c7336966243730c7fdc72d2b1afa6fedba4f6aa5e88983f42d6e17b79927245f33611e584df1cb675624a0edba94eaed35b7ffc936ed07ef111048848bfef88520326333bc160664f2b27cef5abb473bf160e5aaca26ec438aa72a635a700ef3b872cd52e914ed0a714ab54b9d68874d50879d8f08c28dc4f83eb520cb8f056e3d62d2f76522042188f1112c3af921ecf03bda28cb0863f22f24da33f95066f6d04a957204e63adce45ed564919e375a3d42921e2dfa52e9ccaf602173e1cc02acf765e6380b1718af2f24334499ef66082586137787615ddcbf52eeff5ce223a76bdcc650c33e22a212a58c9e9f827e0d0f16a12dcf0ee7ace6cb83bda2b87ffa847ffc4fbd0159f24ecf9c6f703582530c40e8dd22197d3be3c46a66f22c35d6f0f38f623cf0516e729aa7184d8a4a1081e71eaaa86122c1f27f6ca790bf17a29ea37ee7fd89b7a1a60abd3e127d698a9e38a2d22a265d94ef6ec3c4ac4ebf05d4e1c1318b889f13d9911cfbdf2f5910748506d85c466fd0de9912807db9f404555d7652fac7ea4d0eea7d932758c5733d298cc5f83aaaa3cfa67236f5e6cacedbf04c2b799d8d662a83ac958c98affd4d566c641a58060398e3b74229f2fbb055c69bb9b9eddf2c5874eb257abd14401c9718716292ec553d19bc761aa0374930e2ebba8f601e595d95eee110d5cdb9732a42678d2de4a45e7fef41cee26cd2b777b6101014532f2be1f6ee0b8dc7ad08fe053bb6d469362ef3f740c04c798a8f47766dd294ca88e3d3d677ef8eb99d36b5c962517ca49de4578a81720e0e4f44bda2917a43bd664e31fc522703d32fcb883b088b63580318b5eba6f1f344ace4046cda02e21424c20a89ce248a090e607ada4ac58fa5fd3b913a44102e52ca2edcd308a3b3ac9471cc43b76b5affac041e84635ad9d90a9583767c9bbc78f7e660e592dc6d3d6d20af013d8e21d82bb476ba6317bd1834908dde2ca4804112ca904f815124d950b8e4711fc97743834dd4cf5e478ee61dd179407a2ad8fa8713040c3a85941bed665944a597f790731359bde41e718f4323918f4f4817b6184ef52f38a26a123379b3017d79192faf64c5a5b062f9e0f28f4d65e8aa0e3abf02ef260052df73986a6238813036449f10a2bf0ddf206189dbd2d3236a13362579fd068ca0741eb74370e62a03f00b1d55f5db719051f0a431d1efaf1a970e579fc7c7e819e55596d2b5156bec844650edcce18ef3801df7e92c617bea5a60f9f1ffed074b16ee2897e2b977ce6a3ee4a14d777b79c6859f03de63d476730d8e5f730681ed028b8f0542c188ea0537173089430fb929f21ccbf463ad8c4d37bd0d75b835eba6d0f1d5ad89ad4bfd90b597d178abd7b0f5b7e9db64fed9bd7ba8d0c427ba2631cbf4f84f1c67c2f05c27a0afda04752047eb83e8904a9c52c67c635f852781abe7b9c6d0271bd7f804f37ebb594980b86dab1720f52b6064d97575f08f5fae421639776a72d095ce4e47561b5098a33f24b0b216d84331677f7571fc5d4e6ded79bf1fcab3e40937ccb94fcc6493ba85286d3732b2a50c70c2c2851c05fb95f3811c9638bfeb3ce234074594f38ecc831b849ac9f5e5a8561ec598543ab423be1901cbcfa4510aa3e797afcb524e73efb4d27022642b75dca983a253eef1cf273cc3d100309ae859a2d9069a8b91e54515a434f0f9b38c3ea21b1b9d6345f1dd5eb42755b29837854b9837d7c07dc591a40c930fe199dbaec7cf926ada1c6f744567743d92d049c9698fb765278293ff3c51887ecba8144be832988632a661a28d789a85262e7c648e7ae31dc29ce4a9d0884794fccbac290adf93be4caa6e6a19269f9840be92b3f8175a355ed6de845ff7b2b7d4adb98045615b6255d62ccf1c9b09f6bc604ad1da92df3fe07bcffd20ad409f0a0bfbbf401bae7ef506fdccc8921038a03bce3c2027882acc78e576f60059fc1169f967a146f67ba5465e402b75e6c35b261becf52f78576209e48537f4e4aef31e6430c96184a64802c292a6f843664c781b80ea0f897dc58f53bfdb6e95b0af5b31e6a132a0de8295774aebf8594a5cd647d28f8fe7fd2c56d61fc537e088d1ace2987f4d9814ef1b94a3ba4bef4c77b0041a93791d09e653d2e5135945e80209535757c902cde714951f7e31944a07a5ad5b5328bbdb95fbd063cf496d0e22a26ba4219bf0ab53ae43b59ba625c14248c94cee92a10c5a146b641202f204871a7c1e5cd8eb71ef7508aa895846cf2fa79e05b7f6012576caf674aaa073aa3158c3014e3df254576217a7a6f77d77bae1f400b2bed707c885cf5b77efb31564109097a19618178a6abafbb06d7adccca72837aef7624714588572f0dd9ccf168c8d9b62771bc595cff75e4457bf9882fc5630ea192df939f287eb0fde3af60b58f8ee437f1b9f796b72d4dc619755abdc3d75fdf6c7946d4f2892cf76b24f20053c56a827e412b15014ef11910794e9dc40da202f08fa63630b49762a6e5367fd8cbd9e35ccfc0bb57b1fa8e4598672fa52f6206e538e5fdc59bab3a3329dfd83e44f667ec62f2187c92f17e6af2f966a37b74c5973b119193ff7c22eb6076b1de7910c710d8b18b998b0cb963084d4d0e3e59e143e0304836434fc01d7027743e37638507c33cbd87d73ed3525a9c8adcd517c315bb4f13c0bf82fee9c6a43571afed0467d13b236efd872077803c406d498befbdb66ee68ff1ae363255f7a86376d990a69b82d4117920e0ac4592f515e682e31a6fc3155cd27fb94e6c9a48eab964c9898230037cf407d2016db21d9851905dba9d8085ed268e5365db8bf9543debce4727ceabb8f4418b64a1d754bf22186107f462c95d54cd4063ffaa34e0d0a3bb4c550fd25f5b241c980bacb837e76bd27b3927b5f75568e4ea508d1b4e10428c14cd623d71735a31cfd9f64455663df4e6bf275f7979e66f87f70cc78f2b6f4d47e52dcadbcea33b17b2db76f387b0a198af3defb9ebc1a117e429e38283baea0e225179992e276904bdeb8149f369ef42c122f9c3c3ccd4a43584c3451eeed6cdcaf6334e1a7ae55afdea30c93f9918152d7382d9b01db740c0f1e402531619a7dcaebf70388732a225507088bff539a2fd08313b5c24281a505a1f262aca62095fe6e590d741f790ca1bb988f5e55139050a8cf83372030358afbc27136bf2df32442c35a92d660032a6fd7dce2d61f3b86c5703e7011a57550aa02d754a891d6151623f4299493aec2e6f97ef72359ae0f53750105807cbf9c03c471c1e5c8b72d0dfe2441b825a450d50f2adf0af065aa254c69e6bc656c1d94a09bfe8bb3612d428ae6b92f6e9d594d1d4312d60dced1c5d7e733149204e31b441cc6b0d71586a94a1b47907397f13cf12e589a022f31f161445685a92e49529c6405a565135d99f8bb54236c79d9b283eb9e48512df5b8933cb3d6546d1afc9a9da06aaf0c6b90d0ee66980c08e0e00225c3559fad724e403bff8a4a3c9998ea7ec44fdfddfba8f0979307682b7db36f43eeddf1d5873a6a413d62bbd34ff8c6976fa4d23742979898053ea8340991c06b30228a94e18d41ee4df5fbcf7da0a74565ed3fd758d7ed124c8ae5fea4b2086b05964f9e176ad34befbe8b6d4341929fcb8fbb7cbe3712c57e25a757e17598dd87ad8fa0bf7bd057197805de53e618ede7c38d7d5065a48072acf672d16996d2120f0b099db327d7cabf6f5930a75a277ed7ab5ebc07cb8a38fc954cd07699bad9fe647980e61e909986457c69a61e055719e6e8531918a6e7637338928eb8f04354115799552187225c92ed3642b53ae072c6b40a93658d60654182247a3515a7c9f592db672f8cf878165e9719183dd46437c4c51be122a29fd618e4be38111db87be20d87e53d64dd4ac077b2055e215bba9138cc2c01ff83129a865c9cb038e0f7a97f7022aa73794ab75259b701ccdaa04570d880ca51782840c6763c96a9001d005a7c8daf54de2feb90a724a501262c4e0c6078476b68cb3d18ebd0f0f4df201c257dca49f5be6b3243b3e6cf9ca590b3e382c6632d797b303e3bc30bb406ff1432c09424a22812571cd430fb7ab3e5101fb1a7417c6e5e32303a26514ad885aaa23108c11aa5bc215094e86ba092a581778f0a5058bf3a964178d0fd00577f810d9f730f534ccf90dd332aa78bf6b53e9a143beab680e9fc2a5395d800fe31a879d28aa892026a24ad68970bc67edf8c4c2572772d6c10078b984760d7d69379b6265037b85bce1f7b71223dc672dbc98bf6433950d1571482fbada3968289a049dbf8dfd843f02d8720fa3d2ad7fd633a405e99328f723ba7647f8a576c782283c1048054aba4c1e9a0f500e688de08b94b1410b6ccf9adaf0feb0382f2fbb37866b1b5ba173c1b35df834095d71672a3ce15cf88adf264c4141f26f2174a7231356114692938e8e0d58138f8f3de57ec2fd2d0af8816c709154f4681ca51fc8af30d96f007cba173d2d9e1e1065533e1c50686e6c1fdada6f97260093033650d57d623d86e8d8e8c6a66b8b09dc4cfe6b22ff5bc59cf90fa74053cb6870052f1b1fc069a25da2aa3847b14afac5cfda0356cb395374f4a9b372360fa3ae860625ac61c0d62d889bda99d9e7abebee682dedd47ab3b9450ae24717581e7da652ebd7d6595f3be9d6738369e166d468443bf59693529d61497bc469207207ac8da69dd471148de1954bfa243fe8f213d3e74f3b7202ac4898011c212c9526adb90ae8878fdf18d716fa45e1c5f3d84348f9478a148cca1c267c29fbc319d7085e2d6688948d35554be8b25ebf1a26ccb5ac1ffc28c8179ff6f2d7c2a39060428d469cf27aedf73b76e3dca406cbe085e5d034a68ffbb34d48d54d3dec101128ab1ac0efc4541f441618dc90f1599e426e7d3bb039d439ecbca4f761acfbfa207808ae6c21ddea0ec753b6f7ff09ba7100498f37864f8581a64c9d5b5fd3556ff2eb90677694168afdf83a2c4039fcc6fef7cbb1ecb38092a028e96ade5fa4fcc85f5ee20946adc7193c8dbfd7c471664895a9833e67fffe8e10d00478c5805b056de57fb6b9f4e738d3eb81d10d6acb6ee5ce0fab3215069a19c207a2a81f8e7638eacbc12ee3a300aa25f9895952bf6c1d3e7d95a4516107d0d57f4aed8edde00886450f538ea38f3620fba942ef0bad6316f9b18cb0f0cb93e057d4879c4f09c5f52446e214353a0542e52a3171ecd73e87a85e4a88d12b759314d43687180c51eb8f4803bd66ab4009579a5d783c648c77b979a37b6b86570b4bb26601c256c48e8242cd63c8f914b786f1e9e178e27636b965a2495ba01b471e14a4", 0x1000}, {&(0x7f0000002b80)="3122ff3702099dbfd3ebbc6cc526938c4353ffd3966ff0fa951f3ac0446f4c9b7c", 0x21}, {&(0x7f0000002bc0)="d48c685846947573bbaca367ea5eb9a8a540bd6e5990582847c9a081675613259c09a936d5c21bff3d945b5f5b391ed22bad9e9baa0afb", 0x37}, {&(0x7f0000002c00)="70f01a468ee6d8bab0e034f3aab38e9687bc640d657e7a74ee8547c27d1706ffa4aa44f497ddd08d28d58a39b7e51e55d318d69e1997acb4d81f53a0406db0ee7db24a38880e3e6d453cc5b81f40c69b6f3658016727f22bac3656266e7b51de2af7bfc6178877229ecc71575908ad7acf1254dbff1b1320e4e3d43ccc707266d669ca150b46aff8c75438b6ca66d832b66f76c1", 0x94}], 0x7}, 0x7fffffff}, {{&(0x7f0000002d40)=@l2={0x1f, 0x3, {0xa419, 0x1, 0x100000001, 0x4, 0x5, 0x8}, 0x1f, 0x1}, 0x80, &(0x7f0000002f80)=[{&(0x7f0000002dc0)="86ddc9d72d92dc71c0480d4fa841706edb24ab1557809692b4081124519062e2b8caea119fdc62aa1daff6d43121ee54ad8746f0c3afb3e9b6ab96d5d74a3420469367bccc3241676b5bd9ca9ed10a588a5ee71a4716ab2c428d2b12079941", 0x5f}, {&(0x7f0000002e40)="3a54c833ffdcce1b39a68fb27d667a5b40fd5554d38c93edab0bd4724dd87b5d62805ae3ba2444085efecd5ac8605512a82124c2960b962b575b4fb0c8cd104b48353d5cbbd9d8", 0x47}, {&(0x7f0000002ec0)="f0a147978a5ad79899eb52a9b6af1a03d0e50f607e133a80c4c697f6a0c45a34908a5202273c7b649b07995e8fa75ffdb5018c883e03ad4727c7fb2f2d0935d2919485710d36603de420b5b851fb937b63ac3544b9515e2506acbbcf5e61dd1422d7779521dda2585970604039ba5dc4d6992a52e7bd9be1cfbc22dfed5423594365348b64dafb0c10d6df6c48dc83e1909de615e839ca9aef964522d9b040b510", 0xa1}], 0x3, &(0x7f0000002fc0)=[{0x50, 0x11b, 0x7c, "128db6fbf24946d4efbcece9b0e7bb6b2fe00b29eeaf9167edcf088604f1fbc18eef11c1dab7791b287f812a2e98b506f8f2e2486c78a80e41bc75d5253c51a9"}, {0xd8, 0x119, 0x100000001, "72bb903ccd1a2c4802aeb4a859d5c09d6aa23076b231970781d602ba433e95fedd315e7208d304053cdc8a1254d051ed715d957dccc2fac50bc6fe866c30536bb235c3745eaf3e1ecef97a8c2b9a42ff411f8b3b3cff33d59c34cfcf48d31f9c1b231c73314d5cb496b29993df88b0aa4b9153630fa3cacd99f38a341fedeb57c0a63c0392761801a02cd1e4a72d5a5f9ab72fd2bf0bc12fbfbae895b95d1bd4e69786fdb1438920a7e38666c6a4f7158136b93c53a174c716dd1449afb18068dba608a0c66a8170"}, {0x1010, 0x1ff, 0x2827, "b0e39d9907ca7a29cf12352dc1046f003a193975af2844da50a827d0aff0db23b3d974becf2cbdcb31cf8097242e7ab21bef2310ad0f5870ccf7fa643b54435ad63c3af9ab9f86ca86bd2bf42de1d72d9116105b40b1b856c3f7490d9adb576d1d30a7ff1a7eb94062cd90f063224e3634fe63b7fa6a00d0198817473d9b6b2e7332cc5919b724278fa9ea84b637a0b458349eb055a4e03ac943fc78f1e72a1e318bd7e6c7f5ee6ba8025975f9f04036ab75295b6dee63cb8ea6460ad5fe63792d9f6796faf414f374c3132b52364c41efa2d52545bd8daa6c13e88284f7a93e3d3918f2248f12acb3e1ae8273a1eae3da0367257688d75de94a6fc41853199e80597573d02010254d37e0ca3b5e69c103c5ccd664a2ba116ef1ece66d7614078ede861b856fed48e11e78eb721d30edb069d466071500ac871eb9307fe099a993261911bf3e764640d57eff563615d24ae8fd14b024bbaf4a07e75a8ce3e8cf1f735e7dd3e8c0fa1239cd6f4aec84d8567c18b875cf045c7e6cc6ac647cfbb5ecfc711e4737381bfc628bc5fce6f441ee109d6f8a8f6a56be962bc087717bde495612cf0ec8adb43ece80d902033cfa6f1efd347b44c1b0666d0e1f737f5d718917285e1ee14c120aac743f85622afdbb2ce1862136311327495f47fb217e20618bbdf942b9eeda0721aa9b1c17d731eee884aa45879eb676817ba10ca8c1d7cf31c30e617a1a4e75eaea9b96fcfb47f9e0f32ca2a3df1ce77df69bb3d018c6dcd7ac635d6253fe9b8f99cf6cd43db8ffa360bdd4c1c38ebca93455ffbccce16e18447b6fa8db6a2ef812b406b82b67ba2cfb2c120eac41df2d8dfbd87953c5b5e78105df2b4e8ac18034a95efce323e959e90ea518c211a23a097c5f251038b2ca3be8e4339b362cfe04ebdadf2f16a4100c1e2ea0a70413f7c7c6193f41ca7d2809480e115af013ea8b58a25e9e0cf45ab15281c71f71ac88db1bb45a705a2b161e17b33585237df65e7141c2b59170ecce22c91fb2669b22f4b2dbf0909d2f8786fa3e465ec1bd11ce167f9bd5d754ff3c139e23f3b81e04999b83463508bcc5ce4c9f33f346b8d0f674924dde6d4df88c31fcc545a9f4bbf5c09af97529e66176ee21b69653e0faa848d1ff120768b2fdf121eb0cc01184111dc715127af21896844ce66e76706b2ba8f7eaa0a7e4d63eba034705c4b59dbd2b071f57acc030a0cc4d2334fa78c0f7c95a423a568b82bee6a7993cbd7cad66a21f720471016f746e7d9260a42f1a257c998f12c1a2873142fde4e02255e52f83cb7488c23dbe21cc5da5e7e7d992f71efd2f128bb37b3dba6dcac0a5f8fb44183b8a2ebe8053d7853a41c131aa79f725073933c7d644cf94e6b892039044a2c3ee3c77a28ee10b165a013baec927e8f098cf317eaecdf6118aa99c1c58e8d15588fb7a1f2d66ce4adc4bd732869edd9c9fc041a526b9fa4a9061e459b4c7ef6af4efbf67847557ab1349d7505668fb7a22c4f63155c7e7972553cabd9d4042a46a501f739326ab3faa0fc613e1bc1f2e359e47006277c2db0cea9ce5f8ec0d3850b8c26fd8a8e4a0351e957baf9f3953280366508cb45d426f2c3f1b776e5bab9a7309172d37e51b48fb97d84c157dd3765c2b0315622c493041211d4d63702538667181dae602a0ebd94f0e1b6899353cf7db43ef39ea34db0ae6c715668ecf9750f5c77234801ce5bb5482252ca4a3151ead171769617d9dfd52646cb4f5574b1872e592112cb4c781efbe01942f7da21e531cb29b003ab702064ea690ed022fd99aafa6b7150522e499af07e44174b427076e79dfb95012fbbc83ba62b992f6101a6dbc44d1ae7f1685614f1338312da9813054529820cac5af73724a1ad66bb26226b8dcc226de831488cf6c57c23f3f277473cf3949639dc8e4177b58a3746ba604c631c3610fff3155b5ef609f852f250f6765d9e1657ac78937a45fd34c9d2c4db102a27ff90680201520b72caaac7b71c92b28060754bca95c5e3244e989d71d1babe679309eb79188780c670fd80d555718a105e8f09e04acd893a15593a39b748f0538570f045e870d30e912d2a7804a301b28b52178d12f8ccfc4151990af878cd7df10fea1827f92308fe65dd9146cc3542a98a7a444a33118fbf22be191dad4685edf9eeadfe09daeeb3142644d2ae37183cfe38a92ab4bfc7cfee2e588c25164f392d32d67fdb288c1cc29d8f0b18cd8b766111915a6f2d6276ea44c10115f69f3220674789a5a3ab3a69d3010f4afee4ccf7aa06d70a1c1dfbdb95e54db421a16953acf4e83f517f763b511cdbec17b54c3f358e61da55a558f4596aa85bf11ec2a3dca1df2321f829843ce8215999ac8d2c4c31e6057c4217dca200e98756ad316cd689d657c8c68e3308a3a94de87f363cd84b07e95b05d1fd147e6fd3cb8d6237d6c4da4e62cbba5bbe4304fd1d27564962a7ccde3b8ca5c1bead5b72f4c63244cfac5e6ac5f4621411da511b4d50720321befe5efb769f557dfb4fb6e644003e8b6bfac3d6754f2cd6fd0cac5084368c566ff466f6d463c260ad782abff573f2465b0bf50ee119bacf9fdf123cf02f1e537991bf209d3d93e0f6a02de40a03956d01baad6707945c1c1ffab129920f528541a09885c6a8d414cd7c809b51031692aa751b1157506c428d83394922c1151be8ab13c870d087d22cd128f6ffb6a4855a8f955d687ff1175eafd1ee0dbb2dab03d680c098b34fa6a875fd7c0794ce74c938ab7190460a43e93ded1becd71deb17f19bd1f01d38a35506c583f97f295223a9fde35368c45e1af4bd71d1d51eb06a3f204ba7859d2099633f250cc7be5b6409c840f6377d78db400e03654b7e0f5562419f149cff95e3951f82d06a6d8c4a367f256c74103ad36cc9c744c31a2ec63983fdebce89569e360d0fd5f536d23ed0c76587f19e4a754089dd3b578b7f5943c8e14042b2b5c818ac803e0019367b62b4b82f031b3527b2e5708d848dd9a734cc2d162a426539bd3137078bfdf0835b7b8748eacf18e77bb3a8d84f4bbfbd5f34d2e1458ec4ceb2a988824003fb9bc3c39fe5337e06dd459eb47d60d845dfc9bd07d442b4b21874a661102e226534b97a2c0af28650a5e374d248ff3ed54bd344c96d6bebff919d5f8e75408412d357430b582b7e457f312e8ac028b4b7b3fdff933c47c23ef666f5cc4485b1c09f8d5118652bc28551e30cebb23903f04179761a58d2d97e625296bb44d211f7e5bd2b181d47a5933f317d9eb90d32a884239184f769889e9ab72857397c99def904ac4fb8478ccc5b9b5324562f67ee9f1d0c541b49b03b95e835500f801727ddc419cd4354549d16e3560d023121c824da6e3b5774810674dea92970cc0ff9d47b1b317c33013f71d61dc57d93e25de4fa425feb0b5b6c91122bb91cca9596bba25e25fc9c052ea3e0ef99b790938d9d4ae460cd891464a70b3998c802cdd9f07d20c49c206ed4acc9ae486062b36415cd3f30d4df0753dd368ec5e55f91e94a56f49c29d9be7982dae6825f9a6c7cbde71fc3ebdffdab26a8381e3164be0f47595b68133d5f10dec854f3876230b597105df9cba4d27b0b4f6f047070addd28eceb16506316c2bc4f7e838252cd39f9718f1b2545eafaaa04b5770de26f66528216e4fdcbc7a39358390a3c583d040e195043d54568163f8ac06ffc047adbe8575e029b88c28b8b93fbaa9b8d8f7c9a1f533e5a42ea4832366626676fbd7c0ea3ffdaaf67af64634ea5fdfc8aead633586906f005999f757ee5e3cab466212ebc5fca417945c0ad1aef6700a849feea7493ae78bf51dd3740711da9c0c70ee042030373d8ce4c278c8bc72d45dc751eccaa36feee959881ee00a5d46e5336cf8144781ba3f7fecf80df5715210f5f488f39e5d1a89e8d2c3c6368c25385f830817704f769d6dae0b55ca58f19aa8dc904612fbad7ef679585296521a9d7656f013c58fc41f5885e7021a803bf45f9b06db658823c62b8601bddf3c41665a0813c8ce746939b6a3bc88f85afb2aa23645225533cbffabe1a99147d8fee28cc915f31b57f97dab9f93c6672a90004bc456e71b6d5750724de124f308cad856529b52770860fe62989bfd52f339a18419f9038f73438064a1b8b95ef7a9659e3eadf98214e8cd1f52ac8a33c032293053e3b107b13f1b4dbb8e26afee727c017b30441e6f2dd4c78b08d5d735edb98fbd95e8d5a87f4ef331ad0b5fc833d3fb0e029fe2679f01e077eafa38e49b6bc482111d13f8377008900eb49ec21aac7cb01a6b53681e6c7426e0bd61b0955d1133324f2448e1bde8dd61a5e14b84ce3ab0ae9d8fd5019ac9c3133cd99d7d51ded32ae42113803a5c2beed3616f795989050b4f9d03230a5f583469e2d8e20832387a10068c7343eb20273e6c0ea5dc1e17cbfba38808bd0d9766f8cabefc093bfdcef58fd5a4202d6096830e6f356dd2da93074c229fc37b3744ca5d19349e77ed6b8d05cc660fa802e4f36e31192f07ad3a67526b30bdba9924495d237a7aa580d3b136d76a693018feb389f408e0e8b5c9c4dabf3d68d307fa49d068c66946a371632ac29ed258ebf26a3b4e31c47979fd9293cc237594281c0ceb2877e1373095920fe2c138f838664837e32bfd7eb0480dc22b8c937bda3f0525a846ba9a24f95452de5e3c40e82df297febd064c1653638662d4c57f60a61e18b6a84c20267a520c7dbe5b23e7a31e9a1f82b1bdd7e77166db52ff275538e344b3806e4d12f8a9adb88d0bdd221e6bf50711418b3a50ea5f7c29e0f2f776f1975da94eb9af5edef75006ff3665eafc4be55b72602c11948454f5fca61462b00349649409d9b5f98f70e8ca497df423079f7f8ea78bb539016e051db3658bdc4d6a5bbb664ccf8f9a1e6bdb9e632b6c215b060643bb73ee0830541509c3df66dd19f454a43e9de4313110b0b5b52cee519b401dbce1f6e86b8ac1016af3e8455e75f0b5dd737c8c06d64d87174de27a03948e161fe42a17a6f7afe18ba5c29909690d5b51626150bf0246da4e0a01eff397254836ca6818c47fb325c748be052884b74cc3e1ff290b05b0c8f72d6c05e64c8aa45a23c65dbaab7f9ed30de2dc02368b4734cef5fb6a9d4c5b903609d6a65f5ffc1e687d4b11cc250132bedf801b8b652375bd897433403a12be549d583d1b2ce4fe684ceeb4f9ebd0c24aa2c499c8363a458b1132a8048e522794e8c31f7da2ee99142953fcb37b48237ee6d7fceaa7b2c7219bbcc674b2f03edaa4f7ebf3467ad331487218a3db7873045cf52a1d65410311b103c4ad5082759f47edd61287c72f3845e906d1f58be7fa808a078539b70a276ffbb5d29a69044fe6567677a5f76218dbcff8369407203c963f9e7d0e3496f39561ef1161e0f98a584c8e124af5111a263c0ffc6a1ae24953d157ba016beca82e93db63520b10bab3f953594831c6c17392f52e7b44f01339572e5e2dc1d4efb5d53f7ce478d6395619bf2d330af87ddcb726f631c836d03b2e7eec19fa2018bcd02a6f0865ea5fb0767fd891b13ac92010d60706b9736472b50ee5684d0a79bb586c72540eb866683de41c7af4112dfc780efa04b5a860782d77a0ecf00092bdd60c89be586a41eadbdf0e2c33ec170cfb39ef55a4e8b4cc3b559442ff2932103fc31fa312de5d01a7db8690c66e15a63557baa9f797d84f4b363aa690a0e531d55aef9c3f08dc1e87298714e143c061706abaef4dcf8f2b34c0d2330b4332a776ed6311326a4ba8"}], 0x1138}, 0x10001}], 0x5, 0x40000) 09:39:05 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) umount2(&(0x7f0000000000)='./file0/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x7, 0x6) accept4(r1, &(0x7f0000000040)=@vsock={0x28, 0x0, 0x0, @hyper}, &(0x7f00000000c0)=0x80, 0x80000) lseek(r0, 0x0, 0x400000000000001) [ 800.231025] binder: 4573:4576 ioctl c018620b 0 returned -14 09:39:05 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x18042, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x0, 0x1, 0x8, 0x3ff, 0x20, r1, 0x1}, 0x2c) connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:39:06 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000000c0)={0x0, 0x0, 0x1, 0x0, [], [{0x7, 0xfffffffeffffffff, 0x9, 0x200, 0x100000000, 0x9}, {0x3, 0xc000000000000000, 0x67, 0x4, 0x0, 0x55b0}], [[]]}) 09:39:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) 09:39:06 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file1\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) [ 800.867213] binder: release 4559:4564 transaction 754 out, still active [ 800.891150] binder: 4606:4608 ioctl c018620b 0 returned -14 09:39:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 800.919127] binder: release 4561:4566 transaction 757 out, still active [ 800.933529] binder: 4610:4611 ioctl c018620b 0 returned -14 09:39:06 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) 09:39:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") 09:39:06 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x20000, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f00000000c0)=0x100000000, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f0000000140)=0x9, 0xffffffeb) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000100)=0xd, 0x4) 09:39:06 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0xffffffffffffffff) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknod(&(0x7f0000000100)='./file1\x00', 0x2, 0x6c4) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000000)) lseek(r0, 0x0, 0x400000000000001) 09:39:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 09:39:06 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) prctl$PR_GET_FP_MODE(0x2e) lseek(r0, 0x0, 0x400000000000001) 09:39:06 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r1 = dup2(r0, r0) sendmsg$key(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x2, 0x6, 0x8000, 0x7, 0x3, 0x0, 0x70bd25, 0x25dfdbfc, [@sadb_x_nat_t_port={0x1, 0x15, 0x4e23}]}, 0x18}}, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) [ 801.030633] binder: release 4573:4582 transaction 760 out, still active [ 801.045219] binder: 4619:4621 ioctl c018620b 0 returned -14 09:39:06 executing program 5: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x10000, 0x0) ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0xa27) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) getresuid(&(0x7f0000000040)=0x0, &(0x7f00000000c0), &(0x7f0000000100)) setfsuid(r2) connect$inet6(r1, &(0x7f0000000080), 0x1c) r3 = request_key(&(0x7f0000000140)='.dead\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f00000001c0)='@vmnet1selinux\x00', 0xfffffffffffffffc) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000240)={0x7, 0x8, 0x4, 0x25, 0x2, [{0x2, 0x4, 0x3ff, 0x0, 0x0, 0x1106}, {0x3, 0x400, 0x1, 0x0, 0x0, 0x400}]}) keyctl$invalidate(0x15, r3) ioctl$UI_SET_FFBIT(r1, 0x4004556b, 0x4) [ 801.074790] binder: 4628:4629 ioctl c018620b 0 returned -14 09:39:06 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80000, 0x87) unlinkat(r0, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) 09:39:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) 09:39:07 executing program 5: r0 = open(&(0x7f0000000040)='./file0\x00', 0x480000, 0x20) setsockopt$inet6_tcp_buf(r0, 0x6, 0xd, &(0x7f00000000c0)="f5d95d755b37fc02ef7eec7b584ff2f5c5a2b47239d9c3c73f8792a2462d48005b05d5f837191048be207fa4e5f5ffa9c230b42278e1aed13f4ce11622daf13a959b7330ecad4ce5d8bcf7489deb04fc454559c302ca75aec0855d04898c3aa7", 0x60) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000140)={0x7, {{0x2, 0x4e23, @broadcast}}, 0x0, 0x3, [{{0x2, 0x4e24, @multicast2}}, {{0x2, 0x4e20, @broadcast}}, {{0x2, 0x4e22, @empty}}]}, 0x210) connect$inet6(r0, &(0x7f00000003c0)={0xa, 0x0, 0x2000006}, 0xfffffffffffffeb1) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000380)) 09:39:07 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") [ 801.700653] binder: release 4606:4612 transaction 763 out, still active [ 801.725506] binder: 4651:4652 ioctl c018620b 0 returned -14 09:39:07 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) 09:39:07 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="42b1e161", @ANYRES16=r1, @ANYBLOB="000026bd7000fedbdf25010000000000000002410000001000137564703a73797a3200000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x41) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r2, 0x0, 0x400000000000001) 09:39:07 executing program 5: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x40000, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f00000000c0)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) 09:39:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 801.855070] binder: release 4619:4632 transaction 769 out, still active [ 801.885481] binder: release 4628:4635 transaction 772 out, still active 09:39:07 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") 09:39:07 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x40) fchmodat(r1, &(0x7f00000000c0)='./file0\x00', 0x88) prctl$PR_SET_NAME(0xf, &(0x7f0000000100)='-:*user#eth1bdev{\x00') setxattr$trusted_overlay_nlink(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='trusted.overlay.nlink\x00', &(0x7f00000001c0)={'L+', 0x2}, 0x28, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) [ 801.935797] binder: 4663:4666 ioctl c018620b 0 returned -14 [ 801.942069] binder: 4661:4665 ioctl c018620b 0 returned -14 09:39:07 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x8000000000) r0 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) ioctl$UI_SET_SNDBIT(r0, 0x4004556a, 0x4) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000240)='SEG6\x00') lseek(r1, 0x0, 0x400000000000001) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20001000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x74, r3, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x330d}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x5}, @SEG6_ATTR_ALGID={0x8}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x8, 0x0, 0xc81, 0x2]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x8}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x3}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x107e]}, @SEG6_ATTR_DST={0x14, 0x1, @rand_addr="310e240d680aab7be2fb974a8369793f"}]}, 0x74}, 0x1, 0x0, 0x0, 0x4040000}, 0x8000) 09:39:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 801.997534] binder: 4661:4672 ioctl c0306201 0 returned -14 09:39:07 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x3, 0xfffffffffffffebd) connect$inet6(r0, &(0x7f0000000080), 0x1c) [ 802.038854] binder: 4680:4682 ioctl c018620b 0 returned -14 [ 802.099015] binder: 4680:4691 ioctl c0306201 0 returned -14 09:39:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) 09:39:08 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x108) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000380)=ANY=[@ANYBLOB="e0000001fffffeff0100000002000000ac1414bb000000005ffea495c88787b9928a7844f7521eaf8bc16b6b09b29a61f4a89e0c3b0acab5e69570902843b65c8798f107e14249ed600d214a6da751e0186539db49a3c71b8df6dedad45132430a0dc3bfaf5d883e6a027c5e79f9335cd46ade1b36ecd5c1de4a5c4fee5a3cd7c4a41e51afff4616f40feb3e72518f857b8dd0904b1451e52747403adb8c7638"], 0x18) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x4) setxattr$security_selinux(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.selinux\x00', &(0x7f0000000080)='system_u:object_r:ssh_keysign_exec_t:s0\x00', 0x28, 0x3) r1 = dup2(r0, r0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000440)={0xfffffffffffffffb, {{0xa, 0x4e23, 0x3, @remote, 0x1f}}, {{0xa, 0x4e23, 0x7, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x6}}}, 0x108) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x802, 0x0) getxattr(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)=@known='system.advise\x00', &(0x7f0000000240)=""/63, 0x3f) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000180)={r1, r2, 0xd, 0x3}, 0x10) lseek(r0, 0xfffffffffffffefe, 0x400000000000003) 09:39:08 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") [ 802.530989] binder: release 4651:4655 transaction 775 out, still active [ 802.559636] binder: 4703:4706 ioctl c018620b 0 returned -14 09:39:08 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) 09:39:08 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x80000, 0x7cf) r1 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000000)='cgroup.type\x00', 0x2, 0x0) dup2(r0, r1) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r2, 0x0, 0x400000000000001) 09:39:08 executing program 3: getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000017c0)={{{@in6=@initdev, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f00000018c0)=0xe8) mount$bpf(0x0, &(0x7f0000001740)='./file0/file0\x00', &(0x7f0000001780)='bpf\x00', 0x100000, &(0x7f0000001900)={[{@mode={'mode', 0x3d, 0x3f}}], [{@mask={'mask', 0x3d, 'MAY_APPEND'}}, {@rootcontext={'rootcontext', 0x3d, 'sysadm_u'}}, {@euid_gt={'euid>', r0}}, {@dont_hash='dont_hash'}, {@fscontext={'fscontext', 0x3d, 'root'}}, {@obj_role={'obj_role'}}, {@subj_user={'subj_user', 0x3d, '\'.'}}, {@dont_hash='dont_hash'}, {@smackfsfloor={'smackfsfloor', 0x3d, 'security.SMACK64TRANSMUTE\x00'}}]}) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) lsetxattr$security_smack_transmute(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)='security.SMACK64TRANSMUTE\x00', &(0x7f00000000c0)='TRUE', 0x4, 0xffffffffffffffff) readv(0xffffffffffffffff, &(0x7f0000001680)=[{&(0x7f0000000100)=""/251, 0xfb}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000000200)=""/60, 0x3c}, {&(0x7f0000000240)=""/15, 0xf}, {&(0x7f0000001380)=""/162, 0xa2}, {&(0x7f0000001440)=""/239, 0xef}, {&(0x7f0000000280)=""/21, 0x15}, {&(0x7f0000001540)=""/199, 0xc7}, {&(0x7f0000001640)=""/9, 0x9}], 0x9) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200002, 0x10) lseek(r1, 0x0, 0x400000000000001) 09:39:08 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) dup2(r1, r3) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") [ 802.739357] binder: release 4663:4676 transaction 781 out, still active [ 802.769852] binder: 4715:4717 ioctl c018620b 0 returned -14 09:39:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:39:08 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) prctl$PR_GET_NO_NEW_PRIVS(0x27) lseek(r0, 0x0, 0x400000000000001) [ 802.844441] binder: release 4680:4691 transaction 784 out, still active 09:39:08 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0x0, 0x400000000000001) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000040)=""/108) [ 802.895546] binder: 4725:4728 ioctl c018620b 0 returned -14 09:39:08 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x3, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0x100000}, 0x1c) [ 802.971644] binder: 4725:4735 ioctl c0306201 0 returned -14 09:39:08 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0xfffffffffffffffe, 0x20) lseek(r0, 0x0, 0x400000000000001) 09:39:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:39:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) 09:39:08 executing program 3: mkdir(&(0x7f0000001b00)='./file0\x00', 0x12) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) lseek(r0, 0x0, 0x400000000000001) setxattr$trusted_overlay_redirect(&(0x7f0000000700)='./file0\x00', &(0x7f0000000740)='trusted.overlay.redirect\x00', &(0x7f00000006c0)='./file0\x00', 0x371, 0x200000003) r1 = socket(0x1b, 0x7, 0x7) sendmmsg(r1, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000540)="ca3d360356404497b6c9bee9014ebb9ccb0b8ddd13fb4c935ec55fd3c5f3deb7789d3e5461bda1b112840850410a3e8741b30a352939b6fdd210035b21d418e5ab836692b6c6e74dc9d30b0e58", 0x4d}, {&(0x7f0000000780)="de6e40f6e42840b28d240051fa44baff81f1d1cf724f1893f0eebbd7d8e6da6e173d99f7fe72256d906a9a8e3b1f380d61ce0c1c2350c91491c490c388b095e770588242f3721bfa9b20fb5b4c941dd0dbf7a0f50eb248b26e542ad0a8faf5ba3442d55427f04d849b0e01953dd09fd77b3dc8fcc5361825efac9fef8baa1fb49e3708b4f5b1fa", 0x87}, {&(0x7f0000000840)="5a34acbf73f55ca0dce90597ef76503ed907ca0ad3e2c50a90d9dc543969232ec6e59c2d4f56ad3b8646344a86f840b70e5c9b96ecd7d898181ad3ee4907cbb2bf9a7dbf541a2ed6248932f1917fed468a1efb9b4c42bc493acb62803ca28605a33a7e1f1018ee8d619cce700e8c867eafae47c73523", 0x76}, {&(0x7f00000008c0)="0e921e5ad94ee8184ee71e797d3399777b378435409968bed6841d9d35e15427849f4883f7b2d8b9ebaa68cf2d5c52e26636f0360a0aef4b3cf192626cd554c85d0478753d931fc3bfeb1a55b5697c046d55019047b2da727e8581bfb9e0286e5ccfd5a20a7025c40f9b8214c7f5749119c15b13feb20ce79933197d8bbd874a6e428c302230afd328ad2e62e897c2b4055ad5b8db48ab2b6b1c99d46849c86f01b73976bfc4b52fa0958d05e76924bafc9e01acd06f3c87a07fe6ba2295f5ba1dd6e0417a775a59a0d6a25600db9bfbdf5176c283f85f1112ffddfbb06f732434732681180e999a1103a079314e8c072b4da1b08082535553a881527fd2195ce21f954bdc0ba319a7c76b140061b8a9114fd6b611a30cd21a9da2bb4588c0778a7783189306f83b83c962d416d21fa8894141f9967bbb29faf6e9ef10e066870ba0eced091a0d4b6c1009780ef03ce77e24ecc63f109f2e1b67daa23424a973e99695b41e6cb32b6dc3408041aab1f7e1ace76993f92bfd9cf675f12c058e6c908ce7c8a3694c9a23b86c27df59caa36ebf0ca1c2e6c0725bd84216d3401a04a77875d053fb440677ff3969b05feabe7eb300ebe413ef86d79a8a4739293f78e1edeb8547df70d1c4711fbe355f5ef17f54ee0631261749e44bf657f437e450f1904cbe5cfa5293bed172d257514b5d2acc639cd256e8a0651bd6823e3cdf65e47f860ad3ae4838f281f8d700ba585f902ca58d8c931a00b43eb342ed9879d27cff98de81c462a74fdaf1bce91cac49aa7c080205d99016371f16a590600dea0a097de3809b1ff5a71a0602de9d4103567caf797487cabc9334462cfab3aa4a799d7fc6152829ee153ae158d5cd9c25aa6ecbd64d862a89b08a60756195d235962930df1c6bb317a804c6a34d7fe7f5a280c2f1d393b4888bb51bd9fc342227a8e7354935e1aa805e762df87f50458859a809bd822e6ec38cf8bef349d8ce478e54550b5c0ad8fe2259af523daebb583a3d00ea3754c70905ddeeaa7bbcaacc340c841136e0f93ff613addeeeb6eceaaac74927070725beb057a5da1c1fc14c156342236188858835f220beeb63f6db04e52c57790f36e8b8d83b1a6df5757636706e2005e6edbad75695b41e89945923f3c21cd6e1d574a62cd5a22b5d41e1bdd0fe20119e74a11ad79848f31d683938abb9fd65d3f1739d296d85d5f7fa2422ebc78b8417a07283fe49468eb25cbb995053906922fa448bb7f527e09545279c2e865fdc45c2ae53125e7748813d5b77d823c65bd794ad0d91f3d683b406f3968e6dcb0ce0de2199952e29c9381ba04c94ad745ad410c6e73918611d29c32f1eef5d2729355adb86cc79009efbcfaff376bde804880774f5974bdb57cc1a4be42106a35383efeac17104ce034560198c40ae46f8f7535517392a811f08bb936220979d234b0e9dbde9c1563907de40ff154e2736500f5c23c03a59e82bdcd8c8f06b7436eae0fa59d796707acbe7f5ca25769f471d30d106cdad89ec03d985e96fb11e172975944518ff2cf477ba6bad206dd177f93fdabcf159d684d2834cb9bfb68cacad0be3f495016d402e578a50c879541f9e1754b0374136de0784d9bb322ed554ccc9491e7c74de438ddeefa3a5318c396c5cf9cd69b8efd7566c4864f5bba3617acc3cc81394d274c5b75d6f4507e253d69d7255dfc128dc7483943dcb5ac39d84c22500c991ed2fb94f6e9deac5aaad54bf0a65e742da95703066d82355da54b79faf79bb3a985a3fc2bccca713d937080c7ba0dc4a0102256d0800c189e328a277b2cc4532aad16590153c6bdd19cb910e9a967cdd0a2e074e6c945520ab320f4f31b6d3137708a3831615c8dba3c9fdf3e6d84881122d24981b014f36ad80415d26e5b3ab9c40d8ed844c3297b8253de725ecebf21b4cb5c3d0cef044ce59fd8275cddcaf453a7aad8832e516309ce396c4bc2faf6e62b6a48dfbbee87f3a0c59eeab45eb5fbf7260a8cc7d4f05b72a406f76f31fa03c846e9cbfa2c6422bad0e76d166b2ab0d3f8fa4f41ef3217653ed6a65359969c96ee9da4937d18cf9f34821719e264fda392f1de4915cc4e597c84eddf6f0728274e0eb9d2449a1ef7002131dc45e8b5cd3cba73efce9b0b1e965ac416d92be4c6132594b3a7320ba1629a610ce05143a1dc6b99dae36e4b738685febe4a64fd39594af049992074f256d94670f7c7b05feb741e3523e25333a8345c901af6a4422ef68381b6c2f27b8e8b557dd1685588d3e245baf962ea4d39674600f35cba5fc6c4fa4e3cfba0433daa50fad422c232bf5c3e61d187b1e6959a53507369770165276799e5a4d1a7dddef9b53a0293a49ab6fb2725e2f9d6ade5fbc59cfd86299f74a187e9b672f2cbf868775201317f7f01cbd2d733e3c6a87ca672a3d367e918c4863aaab9fce8236e10067a2da9720f93aa2c38bf02b1148f958b2d505575f12eb501367b190aee1e6cb52d534ff61638491ceb1820e4b6acf7dd5b436e2c81b309cfa9f4b2b7e252dc0d53f078404bea29f531cc6f757887e86d2f6e288beb20485f771d3687a5e69287dd1d60922043299c943405b0f2fd37baaea12eb36648f65382c93dcd2eafc00049a0aaa06dfbb104cf4a33833338892a2df18abc5963ee6e593bfd01c8663b992b907303511a8ba82fd9a4c12ce7022ecb8713471988a1906c84a8a6e9a1078487f3e3bf42d683f5541234b0e63b6381d65cd4ed265adbee81fde70fa91c31368f510b04f1d437caf37c0a41751ab727a916dc9dbc7be0d01fbcd3bbedf55a7167077b12b1abf2e7adb47826446f311afd505913badf4f98b42c6fd8400f33f44119477b807df68a0191edbd11d57daeaf211b96efd23275710dc301cc23b362f80c176716c0f4e8f1b169e18e98b635a3f08766dde08d970df15ba4078f91cac21d11cb8dc9795e2bb566b31c83b5f19ef544aea0ea156e26b33b05e234c97da3646e5b7dea38c4ee9de7c417f2b6a93c2e66bdd602bf6836daeb961da445698b71936717f33ec1cca4bf8397b714760e28d9dc5e515424d894dbfbaa735809f67be6febb37bdc582bfb850db3631127b3c3612a5c6683ab8468db33c3bb934ea2be5b8cf7c05d5517c3b1076ef2d249339a0c1c9ec1274c6a3bf47fbd6059b5a6b498be9eaddc267c1a379564145cdeaee08e04a2935d88c8f5c56054e246b1d90f4e3cab606657bae031dbe4bc4c0e1c732e6f02205d0407494a9b58a5cdfafe0908a98bba509b954c46b8e729667365fe5303bad0bafa2fea99d5fae9f20635d62970a880cb65610b270239d0abf2b179302fa32daafc934c044d17938d344defb6ae6e9f6f08647a7f1b2ea0224c11180e01e87b9e2c9a145da16f4001a99b46ea2a7fff7e124a640642e060164d7b3fd8e875052b5def33c556a2a3ef1937ebb0a1f77ede868de55cef8d23e06ab153f4d47b18b309eb08ce6f0ab468ab315dca41e66db3784fbc9c0fbc565d72674e84f1cbdda6f014e8df386a28858c5064d01dc5594424e6b74ec2efdf4c1126db253049b8b4a4710689d1a5dc5ddc1de9d5bb6ce1e89fab140328168cffac7f28e2b4e9694885352bdac39ef725421fcdc34bb37fcf95c5ac609c47cb1f5e67c7e5cf6799bb4c68d10b250d8f40d6eb172a6dc3e84b9542b24fdfc90c99c80bc612d764a10b0e2b5e8f27f57815bd872932380e0ccdc41a6f1d22a5f27e8045065db3d296f780e49496415664cfa20e888a7b11370bb942392d462dd29a40b212b4c832596f5e2804a57e3bfd0d381f97f8b47f0be7e7b45b648e9201bcde6e82d6be434e604ab93e437f3b25fe16b0970bd37807679de767494d9b74482a929d3b2a6cdcf02027091e775412ee148c9ebf0325b7f9703b0c215ba9b2896719ed2ab53207a7cd71a672f5f86f7eb4cf95c6d9ab2510e0a0f6143c35b70411a07f143221f08d6d088748c7e3aadba16bdab5d97446be6049e73349b5714058dd2be9620ddbcc3ad0b92b1dfca080c512ff86837d44bf37679f666f3a696deeb7791bcd002171148b0713a3c210be73d75a02bd37cbf9c6ee5c3a74e442873231b59935586c10d50d650a76c772ec7c8a4db0e86d22318dcd2a4c7e6bbcd835a1618b444ccc313ba4dc0e28301fd9d017dc825c49febed1694f06de4fe7efbeb24fc69ce12a077b33b9a87c22203609cd2430445eb256c5c4395a71205d71102ebf98f34e163401b14409b98e9c1ee3717dc8ba2aebef3a852d4bffd86a606954658635095015e9a30063c4fe99cbc053c98f2134118e34b3ce95ff18d8da3007c46a42f15f2efbe86f651ef09d63366f6ac0fb9fd569dd2aa596041d411d43efefcc80b71b37d348291f9d723afd91bdad49aebc51ffb3f21e7c1bfd49b1a6a03830cf3b31e9303ef0710b4c98458ad88c3488aee9c01c288f302a30c1bd3d9bba0eec2780502ff2c81fd96b0984a6fff4014cb52801d6816e015141e6d054436f1d1881296f9a5ed850590dab93c34dccce4e2d986273eef3bbd734c9e7e49629b3e6fe540cea30f977fc5764a476e8e488d4a9afee22ea51dc4d6ea0a07b102bd702db55333a5a5b7ab0d6f0007f98b83baa2a5acf763bdf8b368c28ddd1f52545fb14994a173f2aab87fce5a37f004d1a0541f037ca45088ff5c6ba773a422987d270945c4873f74ed12517ee8bc81297e24a59fc166332bc009338c8f5d4aa952dd890f590e6491cea170b56a9e1aff2f138b08b72df6a84c950fba2167fe8637cb6631f71596414748b7cfd813c6712dcf44c118a27522da7c251a9e509edbe56783c56c9a4715614d40c63281750938333e6e09a162512d54aac6261d2e8570e288163d28fad8cfef1c1ace354caf39b5c4161d73ac4488bc37a9a4a3c6899ce709eaced7b01977ee8f23cbf3e99e7ebb1f81bfa476a6d5c3edf96d62b8119e041ba84fc88f4c7a3bf5a1d2bc9c01445250ce30065a7d9e56dae25a2e124fd87765b9573524907bb5665f8f4ad77828ef9d26bb3674609fa6feca455cfc6eafc30496c6b83ed84b116fcc4455e736ee685c75a2081cd696e2f97271d4a6006e6f87e5bae5a6deb4a9db21c39729c65bf18c7ca7bbe3248f4557775ab0f67e5fc414e9a2f73422e83621cbcf6e00e0a978d4597d33fef642d4c65ac0545a6aa033b2347faf98c711d4425871850cae85d2be219816e3b757355f14f5317e3d14a9e6ab929c436c38410483e200f1b971360273455f10bc88947a3674d1c84992ecc45729fc7abd09423090573d771f048b830bbd57cab2bc73fa530d8794d850f6b02270dc36643d965c38695cb2ccece094390066a8946088a90af619ae7d8966f95a641d8b601e7910071726faf732a20d8cf83670e213c853e498f1e605e81e305bc9baddf42615f14628c39579b93ab1f6c56bc603af252b777d5703676493cb802b47cfb7e3f5e3017c0d5850a3040c8f5968de6a377737a83115fb897795962df0aa56ab945d9f8f775f8296d27ed7918df370238f43dda56ff1f67e17a2cea8d0bca8ec189443bf07418dc88f45d3839ab2cb68d04560d1b5bc2e6f7c1ed217300ca8a268d7fac9b30030ad509fb2add999449001380b25ebd0873974e767f988eba057f54054524a4b42e618d7adecf99f2f45292e5cdef0f6095c869850ff95f46d3bf00d3a3cd47290dd0b9f54c9d3e33d63c8e86c825587e223bf64f6c151fb3f68738ca3774032b8d8235d7d06ce0062141c4622b4baedb097ee3c9cc", 0x1000}, {&(0x7f00000018c0)="fe8d092fc1fe8828064c107aff0003061b3b8140f5ea8e0d5338dd4d301bf44b8403fa4d6fe24196847b9b551fb8675b56e1ebed84d3f8e4d20d818cd63b47e095a1fadd6c6f3089e247904bc4164650af6529317d4ec63ce2259e7059e59ccdbcb44ef10220b4728e4e6641860b0fd933fcf0216c583bd51ec38072b8e7941818002ab772", 0x85}], 0x5, &(0x7f00000030c0)=ANY=[@ANYBLOB="280000000000000000000000040000007e7b05f457aa98e9061757965950dbc3cc6200000000000068000000000000002900000009000000d87e1e32ccb9b24b694a5f329cb1c2d8c825631297b86ce53fda49f3f34b9e90679bbb4715f223f7e42bfa586f23af766174f75a4cd6c5e9347415359b1d84c2062b7c80cfdb32849088c4bc4f7a4970348c000000000000280000000000000000000000560b000085a142f6b1c6ccaf5f9a78d6ae16b712a10dc46a00000000f0000000000000000b010000ff00000037867d918d8e8bfdd07d286f1beb30fc60911e5c3d72ec5ff742a758fd2d595b5aa35602d1273927fb8e91e8642a960860c4259310c43d9409881ed876d1bddcafa2fc08af060568d890eae8d88a1e443a870a58725b21382c2ec1e04f0349674f747abc9074a53a84a6468fa1ff7267c3429bec585874fc6a50d30610f3917076915314b70a3d863cc9a6ad8d371020191c663fa87608aa276346d3538fd5ea6e057eb36868a4d4c8a826d10ae115be9f5af2c148c7c18d54faef0104549900480aaa740bdaff3482f1a80c63ab1ab6127d0babd0851500d639bfe952370000c80000000000000006000000b13d0000e736d7450ee4e716b5b19a707ca6c386a6670b04b0df409aa7d77b696a1f09d7f7d272ae35fdeb7d05c957c5ff00fb0aaba4f2bc9ddc67b26020a09e370dd24c263bc7fa1fa5dfa1e30b00e837af2495ddf8de2a970c66df601550ba272217db57b5c301d8d0fa260003fd76e8aa6e1566842ea9d6ac95deec4460e0f4301001cf61dbda84af2f0a1cb76de1156a0e888d20ecc488ae14f1001589d5c3c3a733f9a4804c760c434e0762a90d5d3aae57f513cfbe1b2ff35098000000000000001d010000020000001d7fdd1fdbeb62c0d0cbe1929ab1f0d16d703c4dbb1838ece4f5185ceaf35124cd77d73a17a8734f04b332f7b96d8e909c3e788a38606a2098f18603fa061308c53b76220718fd5148acdb8275d67580a35dcba3bd6761d2bede168abb7a115438f5f3ad41529e931e0c92f0f6713c2967fdd5a589499089c0c7fa1e3b2cd16953f293f47f2a6805b9c9adbebce1ee06c302128d8bb56ceca42a8d82771317402458e0b3b87b6b8cf5219aa8004aa4cc8a979d3e575d5cc35f8d2897482beeaa75f1e964f3c8e6861f30fe7853614e1097a6cb3ebad10fa1aae4028caaaf19ffc0463c788f10f997f77261710c99a01f06545bb8578d214c345f2b255a"], 0x308}, 0x4}, {{&(0x7f0000001d40)=@tipc=@id={0x1e, 0x3, 0x0, {0x4e23, 0x1}}, 0x80, &(0x7f0000002fc0)=[{&(0x7f0000001dc0)="1645dcdef3fe99d6a1385f4e8bb38e8efa4665d3dd3052b52a0a67caf21c5e31bfd737d869fffcba3634280631dc43f094dda4fcf6edb8b6f5244dd4a701c4521ddf4be180a9ca625dfc18084bfd0e6811e5ee25972f7f3113f9", 0x5a}, {&(0x7f0000001e40)="c3be51020f8fa7ddd10d9d2e9831f943adf483596092a84f71cb53fa5ef48cbec5c9b14a26690cf3f4e9a9cc6085a439858115c153721afc91eb4217d38af5d045b5803560c3b1f3eb815cee680c92bb2ea41bf6d0c12323528df04115316841ec248c31116250d3c332b08b0485bcc943d0f3e2c344469f82b8ada609ef48d43883eaa55f824f7212fe28691e8ffa48a602f8ac803c1215d575a35e31837852410221370747362c39b799bb5f78f61e87506cc4354eb4d5c570480c9f24dc54550b538efb42707e82230e5207711a2a13bcfd68cdaa83ffa5c6f7dadc13caea3ddd2c28440139d9efcbe24e028b2c35bc527f7a40f62738366dcb3b2df63f084efa8450bc54048c1b5d2808bf8e812790239e46332091763face822dec83c15fa1bd698c46e1b366f5e8fdca972e58cd44f9f740dce9c0598753520d8a3d3ac9b2e8e72fc02c90f1060a95d47c7da58000f98e11b5d46bb47b2ca186def2911994d8007599092ef04e528a231e79fd97e3ae0a569fe4646ec1f1ca3dd295233a17ee89c561348fad279711a359a8b864cc3bb4a0f801b40f816f82e7c265536bfc90a10a9d284bef057eb79d4b126d61de5c08899d9061443c47214cdb4b0ec123591bf62c96dc067b566b948c98bd929fa959d1e84023778a15f3a2370af82ef02c53ac3fa49215cf512933c78a4329af83dafd8cad4e56efb4a1aaa793b01371768c4571eea25d10c0f049a7c82f397ddf4cab58f3235ded088336f89819d86c1e3767d0c899073fae31c4ae4f91859eaafb33cc06508ef2654b4297d1ae751276c7ec0ef4e45cffad23239e1efd0ba044073602299f98f4174a20082139e175211a771c23a18c9e4e0624a6632d7061ca6e09902e004ba58e08697bda565a22f84070e76f13a2f96ec7d298162d8b4b63f3c0e7110dae5149145a52a6ad03bcdf81b0ec07407c25504613a0ee283dbdbbfdad2cdf5d74ce19900aa3cf213fbaa17d2ebe9adc947f34f7799897ef3bc05185503a969f079155b70a9909dc45d13a0f4206df61536a00a7dc91eb95684e7ae4576d50f1e97ff534316b5cae635bc3044f70ef70d9c08b7aa92a198c351a3db9e130bf4af951918af2877d0d8ffeb6bf00d250db458ed228fa48ab49459832ab120000b2e566ad4bf3014ce37f58513f3b5769a55d3d274563f56b2d739d0a1ad75e72784b39b35002878e93dcb3e54fcc864aeb557b749333181a9a4c2b69844c703387ac4b106be2a867c2cf2dcb56b4eb4384f634a3589f97c4a7ab441a491d5ab7b8ab065b6c420fc2efe0743293b3ed781203a8f72d90c80836be0d3af1378547cbcb98c6d715064207bd05be2196b64bcfabd7584cae74a15704ddc4f81d1312f9ae964972da0ecbd1f71a5a16f684ca43b6aea30910a3416ea88185eb0753baeef2b2fcf87a41e54781f8ff85817fb940076827927f43d8ce8cbf644c91dfd233ad10f1c845f438daaf9e3623e6781cc5c64fcd36078b450f9d294888a74105d8655b7274600530ca4961ebdedab6922672369fd1138d44669303235ebbd895b08501eec1ed07b58e9eea295f8cc600df990c2a0d07cab6c811bc0090a8bfa9a8d86dfebb9bdb21e3065a52c15515093ab74a8cd51a3249fd517a290f22cb4bc2775b7fe5f0613649ca121c0658024f14b848297efa610cde80247b7895dd8d11062ae31725c201e9bbdf17a21d5b36d45a199eeb8d8823c2798773b7c1b4b6877539dfc1b888dafb7a0d1e35ef7c36c5f30d5e1c0ae02c572d6b0e1b0e07826894ffb30d5bc750552b780346c70e942704430900a9687a12f53df69ca250dd3e1e20f832464e7508892e2c82fb3cbc66a2d2186b60edd364ab0113966e8d1714571c06d7cf11679ae0d7388a9f76b2593275f35f165b9aa908b456433c3bb88b96777ac13c703ba7c2561762cfab497f71007c97fbf683eaa8cc941a804c00fa312a972c9474d836b6c86b0172f99aef27ba86f8f44714778b390564c155c7fea154967fd65725c945b2a954669c60990f9ea0d3eb6b8ea9e6d43ce364ca8a8a4e7ba83bf68904e982756447fee0c8e28c8ace263f306c4e051553642240e2e31f6a858193f55af2f044ee28a30549acbc18826f598d20764f94563b90a734d1cc4e79a02bcdd00ccb5ffec208861996118c1d53c5540e0e5256794adc1eca6fcfcb2a2e06fb602728b36f8d42ee208905666da6b6e79579d64e2639961e365b0cec54e27a3cbfda8ef5280a1b28c0cdb30a15277b1070001c66b23fee4a65a51c2f6e6da10b931c920849e7c2f58bbfe3ce09fa15154eb85726a2b942a1def69072d8b28c24d12378def08a929d01c749fe60aea7d984756fff41024278c1f03aaa2ef6fe35015dd97707d02b537c4a353135aa0d1acdc8cc6911653cfc4ce59aee608ddb90ea2d840023b9a965aa13967878b006bd41169583161cf79889a1408b366a016123629867d6b8793b8b9a2dac3f9fb3dde2bc7d194400f3eed7b1083bfe82c08fc6fa985baaae3ddfbbfd29e5bd640128ac603146c894af85971fb104a34315d74db9ed7a0886a612e324795eb6b7b63abde9be9c6b2132097595b2d528263f81d31f86f48415b5ccd429685b085fd29683ed359d102611ad8155cd760770eecb759b882fbd794e827179f8252017c61b2e985a8894ec38902399e0ec0040389a2dc7e683a9ade5ff0881d8b8de39a05f997c349c655f07a9b158d350c62fb00f74654c9889d088f4d204663df9454288de1a123fba441be3ef12b1a002722a38b2801ee3dbd100866bcdf607766c846f7b82ea282ab3f5ba6fdb4e3d951d24dee3f7def08489068277b15bd7742aa115d8be9b9ddca81e412a2cfeb42c15e6d9a7286f267dba9d5477e75fb90fe9ee5f29bdcec54f0f78c86a0a68d221b3fd06022ee5a58eb7856878239a7f2ae283721542cf30ee3ac788f6028efed05aad013dbe2e9cc50e367bb631be453471a3600812a3dd2024ccea9e9067d1fb242da2a35f3d245f18ac3b4392e1eac9dcd4ecd9c7f1f16a899818e23145225337133642474bba15e7da692939004e92b727de1404161ccd4fbc2c5a157e2dab4866603a28715ca68077c8777462f8784140201f80dc0ec8682afea9fe23d4ab9a50e5a570125c177d49a7a3d2d0cbaa278768f119b6c19d1e82ef7d0c30ceca02815582f461eaa2bd510771a9d9aedc4cf6b94453f72002d701d882b25b8ace626fa273b225a37df80b9a8b5f6e345e2930b4926391708baab6ea4a12c5c046eb7ad87cadbde28ef87512dc0082e18228613e1c97b1fbb286501f19b8aed0d92c43a6d4bdaaa5f95766432313aece8e94389fbdaac772adb8ed0e3cbe6dbcd804f17a5a907e4e7b6e0478e7c88625460c4cca12e49605c8feae334af497952defa41296b741fa7800ac7b3d5b900bda0961d11ff0e3b6eb57e1400edc0e2874c2490aed9af8aa32830c8045b260768d7deefa4d6fb58182b83e092e34fa6a69671cb5cba7b0897816eaac68a21353ec61a57f8dfff8b748501d6d3184bee10be2b1b530e7ad606f831d9b6145b51f087a622ad1c780d739aa57026044faafde8c4c6b2e90ec70f09bcbd3dce8e054d010eb4dbc95e1efe799ebeaad4d0f70a68861e344b1476d519c2112a8302a4c2ccb4ae65b66c5d89674a2d4ee2a3e17feb6f75535eb983684c908d7c0658012fb8a421c55605b774e07a8807021d7cad4756ddfb82cc1352d4b1d64e59c777d96b6642b281965cd5de4267e83409aa7d933024ef8f88a14bd4e671666e573c277a151b95565f820354f99927dbc4a7056870a9f8f4e9db8b511c39771bd2142aa2822512d916828deff6dab20bd946b9aab2092598a9414aa2ee3719c002fc4474e43e67dbd991b13002fdcedbdc4668b0fa7f7c6c9ba1e9f22b9369641d3519833b0d5b957047aa02baf67a0df7350676eda9c4353142757b172de86c34d62e11ebc6bfbfa9fb4e92b8a75c200bd8bef20f680bdcef1f96d21318fbd8e08b9a83de1530cfb72e47bd47bae2ee8fee45ebe20dddacd416895e78c148ec7c91a54e5604ba92d0bab0d96918b8a1bf05e856b2cc5de8b03c97f599223efde5635e4053a0043599d4cdfd4355777bb6cbe59019ed0c8e5fbe4b5d307027f06321cc03a711ee6aae43c9b1d5d70cf05b65cfebb582667000be1879b82ccb62c7ad9048f16c84a46b14b61a2200055ef69f957aba27ce1abefe386d3785573a6d2da67d7753386ef805d0348623e6633a54da3fb50eaadcfb8112bbf8b5d287db9ae6ffcd0c7e8aa8095668062b812a47a4813e13eae60a1f136fdbcabe52a1145f0ce5669280c08d496df95ba9103713da6ca0dc48803ac8417cbc3c7f317e554a9fd94a07480b6764a498a9e73047c6f049c69e3224aaa5be267996fdcf3d407f76eb0e902a55b948b12fcf9ec697967a796a1508edc95ae0c36d96a7e747a60c06f60a8e95bb06afb635b343f70ff5f0cbe45f87eb19ab6fed900f6ed8792078979a3f7fa379ece926958a7e52cbd2e30c3c78fa70a8ed178f5a3e51de65f28b1d730d7bd96b28759e9202c02ee8de75f5e725edee50b7bee967f1715acdd5cf0bfbbc6da8657694dc7bd41fb960e4eac0d7a266e2c01044d9b7a5ec923e9f61cfef5a4b65095ffed50c551f90972fe00357a9c5016866345a73a27e46543f7146036326c4fd8cac0266b67cca2be7ce09bfef8b2a2901d8ec5c30756a1234574e51df44245acc79727eba0a5a0ec4befa9a58c674e3ac5156d02b134c4d7ce07385d3f9c794f150c1e06f110bc67246f66495d2c55b982fc4c85cb80afa6ec58b6531d4c896c5a8737c14f3c8f22065ff165f156b85db9d82ca4eaf1cd79a8f73aafa8f57a347f32d354bf15c686866647aa81d2b789076489e57d26bcf5c77326340338d41629ef0f973f6f39d6bdae2cf406a638aa8bf6a37b540bd144b3db548882922882585bc2cbc68ed1098ba6024e9c9fb0823c1f10decfb0f1d82b1ee67e891d09104daf5ae8eb2ddeea36e4d8572c1bb65c877788e3821815845c029f4c32d696d7d1c4e7d73a8dd3df3d4ec002a324082fbc51a39eb0db737588e4b801327fa222ed20c727f17d8a4670e960460892020dbdf356a348d9235a9abbdc7a7d7511ced02ba5dfbad3d93f2fd1e876fb904e7a8612b8c9fc2b220257f2c5df6159353a505291f716def1dd5db6568adb10e90d74265b0fb46711e3dc03f491da721d2e980352bb27ef7e2c8e45512dc1f3afd626d6cc4321a2f9de8de51720ad273e5c142a5183c1d6a014ad5e2476c2efde722260c87a15a3e9aaa71d1ec5dd6266a3a5ff51e7bad50b205162215d07342cef71316cc9b95e20d8930559fa38c43e8f249577b8b3fc7e2008eee67625939bea9933433006d18cf79c0e25a014c2de3db670a7a4e670960cd3aa84ee1b17e212b668440eece75b20cffd0a96dd397b616d841ef59a56d9c221965eee7f6e80a660889b25f1156780537fdf14fc593801fb0eb8b8ac525c216ac02678ca840b75047765ddb42017d05390181ad33b69094aac7e10969ed99ee2e3e1be9213e952b92615a95dc802475242d44add10bdb0a49c11fbb555436dc385a980f928bcd243f50613ffecc73c23c69280ba4b32c4d234edcd53ee0a1e3df43e645cf2e0b14850a02d04718d9c6d63b131b34c4c29095a2207b694d5e00a9873002c85b0107bc2a43cd9784ea4278c11ca527178ac1254861bef7fd4b73edaafebccf05d35e", 0x1000}, {&(0x7f0000002e40)="4ef70f235a32f22f9af09a9b5d998da82af40b83a95c9022c564d6d6a3469fc0bb0c7c549d838230780439a4a7e89341a9dbdf0e6d6c24b97269dcba7807e52deb69c2ef4e10804e7fb887ece45bb618653c00f9e753bd70b30a2b5bf7973f24ac0c1e6a823fa0c595f615bdd49fc5ea05b87ff551f13a2cb3eeb6b256aee4b2efc0a146283aaf5243e3436d673705e1716e80e7320c288ececef1e6ba40b4f5ac4d8bfde19aff016f61af78d0df", 0xae}, {&(0x7f00000005c0)="7c91be71e0c3d8e20f8b5b8d79af", 0xe}, {&(0x7f0000002f00)="5e05200f3c39fcd822d4113ea47c6fc065edb52b3ee8c52ac49c04f5459d67ec878a1e3ff2a5d8249b44813de7dcc2c47a4dce978a9d3cdf2579f72ee97b7bed95e52ac560b4d12fb4c615045224ccb9f859f83c7a5e5d97d7bcc269212e02688eb5f57a49edf8ebcf103699641a6d0bbe816bbf9952a3bbd231b7bdb42ed68be9693ec20cc845", 0x87}], 0x5}, 0x400}], 0x2, 0x40080) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) r3 = open(&(0x7f0000000180)='./file0\x00', 0x210000, 0x2) perf_event_open(&(0x7f00000000c0)={0x5, 0x70, 0x9, 0x4, 0x7ff, 0x80, 0x0, 0xffff, 0x2, 0x0, 0x3, 0x7fff, 0x400, 0xffffffff, 0x4, 0xb8d, 0x401, 0xb4, 0x2, 0xffffffffffff7fff, 0x1, 0x0, 0xfffffffffffffff9, 0x3, 0x4, 0x3f, 0xcc4, 0x0, 0x9, 0x10000, 0x3, 0x8, 0x1, 0x1ff, 0x6, 0x7f, 0x1, 0x0, 0x0, 0x8, 0x2, @perf_bp={&(0x7f0000000080), 0x4}, 0xa, 0xbed, 0x5, 0x5, 0x2, 0xfffffffffffffffc, 0x1}, r2, 0x9, r3, 0x8) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') getsockopt$IP6T_SO_GET_INFO(r3, 0x29, 0x40, &(0x7f0000000600)={'mangle\x00'}, &(0x7f0000000680)=0x54) sendmsg$TIPC_NL_LINK_SET(r3, &(0x7f0000000280)={&(0x7f00000001c0), 0xc, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="e4010000", @ANYRES16=r4, @ANYBLOB="20022dbd7000fedbdf250900000048000500080001006574680014000200080001000900000008000400000000000c00020008000400060000001c000200080001001c00000008000100080000000800030009000000cc0004000c00010073797a30000000004c0007000800040006000000080001001300000008000400050000000800020002000000080003000100dba4000000000000000008000100035000000800010008000000080004000700000044000700080003000900000008000200000800000800040000000100080002000800000008000100000000000800040002000000080004000104000008000100060000000c00010073797a31000000001400010062726f6164636173742d00006e6b00000c00010073797a3100000000540004000c00010073797a310000000014000700080004007f00000008000300030000000c00010073797a30000000000c00070008000300030000000c00010073797a31000000000c00010073797a3100000000680005ff0100000008000100020000000800030020000000080003000100000008000300a4ffffff08000300ffff00000800020006000000080003000800000008000300090000000800010000000000080004000000002008000100657468000800010065746800"], 0x1e4}, 0x1, 0x0, 0x0, 0x800}, 0x10) mkdir(&(0x7f0000001a00)='./file0\x00', 0xa0) [ 803.364002] binder: release 4703:4709 transaction 787 out, still active [ 803.408606] binder: 4750:4753 ioctl c018620b 0 returned -14 09:39:09 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:39:09 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x800, 0x8) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x84) ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x1e) prctl$PR_SET_TSC(0x1a, 0x3) 09:39:09 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) vmsplice(r0, &(0x7f0000004200)=[{&(0x7f0000004580)="0e195a05b62447fd3e032710c069a17e709b3877634213d5530d1e2b5ca804a65e7b869e97dd1aeff5a1e117099b7196f9157e412210086fde16a03d8263d78473f44dceea3827b3f38d8b95e6cd93449f0fe38282ee5c2139184138693666e21c4088c6b39b84204d69f98e2445a74a00e722d9421aab3364489a7070d200d6061a5088ba1a5b66aa7ec760466c1be21a2306f7cc62fc3dbe0ee54a16dfed3a09e9238c589579d2cb93ff5bd9752ea96120fbc783be77a2b2569cb94409078ff99dac3e6ab3", 0xc6}, {&(0x7f00000000c0)="36049520fc993511f7afceb18ced8dc33cfb66329632d8ed31aa84f3e7d0d9a6d8bda1ef99c6c241237bf15f6c8b83002671b8268e63832c7caa1791533c87adc74af625de4b34e535cf39c3f54cd6b96bb3783485a723a5911981b00a781c2f7cc3533d526496f53d9cf07891ab0629b76521", 0x73}, {&(0x7f00000041c0)="d7deac12c0b084d46ef4a3610ef1", 0xe}], 0x3, 0x1) lseek(r0, 0x0, 0x400000000000001) lsetxattr$trusted_overlay_nlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000080)={'U-', 0x45}, 0x28, 0x2) prctl$PR_GET_TIMERSLACK(0x1e) r1 = socket$key(0xf, 0x3, 0x2) r2 = open(&(0x7f0000004680)='./file0\x00', 0x42000, 0x0) ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, &(0x7f00000046c0)={0x3, 0xe, 0x8001, 0x8, "f5ac52f6921e495da344a259caf4b26ca2b430585d274407358fe1e13dda9f38"}) socket$inet_tcp(0x2, 0x1, 0x0) accept4(0xffffffffffffffff, &(0x7f0000001680)=@hci={0x1f, 0x0}, &(0x7f0000001700)=0x80, 0x80800) r4 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000003fc0)='/selinux/checkreqprot\x00', 0x8000, 0x0) sendmmsg(r1, &(0x7f0000004440)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)="29b799898f9789d8f919da0d11dc051dd46fc588a7194cabd4e0dba750d017d3062c0a4ea1f3c1cdd9dca0b1827fbd46a8d6ca784ad93c92e04aaa9782bf6ded9f853041310e054b89319f155fc24bf6ceeb074a79f9d34987e4b16e099ea8d5856b540aa8d8d716e73a703eb9acb7c00f9abbc14e7eb904ffc27b4764e6dcc29f201eada36c4da91d4d10a2a6cd4b9aec4d33ab461861af8801a6a87ea7d34b07f09c76e2d0d247ea6d1c15c057bf5f5d9702f1891fdbe6cf5221836f52", 0xbe}, {&(0x7f0000000380)="b43c9ff72c3fc59885ca181e9f353dc3407c9a5fbbb90122b79e92f74c119fb55b104b8b60d5cee270cfc8aaaafe163eeb3bc4223a47f6301f37e45ef2a3ed2bb17c30d9588976c9087afec159e36f7cdde670157801c89b05e220c363aa09ed58e1313bf3dccbe74cc28360c70197ec95e390ccad6d7b97879b5d9271868048ba64562eb7c5e1bc6dcd21ab9a0091467f39e9bd9c9bfb6c23d99f60048fd58e6c295ea7d6bc33d7af7cfa99f7491dc76fcf47d28f5ff746e5b2c4a007bd4f66dbd976935e1f64e8014f25f77de69c08db99adbd9d04441c7fbe1d3b46ec52ef47068b386765960eb32601e3ebf53abe9f2af465c7abe32a5a59d7e6c726a5257298f5adac849e60a65459e761121d41b3db172e2f69c8fd581b0b082a12d283cfff35f6ee347e6ecf5c229132155dbfbb7e7c2f1e1f0402330661eb0412507bc888d315e9c9a672dc6bee384cca704e08e32f22d05983a3a547f4b907ed3a709b4f0c44ecd558b15cce7a6b4c14b3f56b2a49ad1098d23c535e95c5b49ccca4ae4e8f21cd6343c583fabef04a03d3e30b88fd5e39c13508177454d363592948e009c881477494144731eb7b6522644553f5d178f4819113b357cccbb1ca4f49d1be713b935d39d3e79735435e4d65263153234fd0f0ffae9298d2e5646a8622391dcabcc3e98d76bb941ee0863dbb3ef6927f840bb1ec7ac02230a08bc17aa513a9d3cd3ddd931e9a9913839e873540e134e67467b08361dbeeb940c423b23d60607f847bd986150efbc1d854c5ff20b77a464e589dbc7f1478dac9657e1d4d5b31614c01650a721e49c7b9aa6470e77dba11f3f0cf98f99460da41d1bbde258aa7db5b6295f2086dbe6594ee45b17aec36afc7fdedf80f50eec6c67debc90f05b7b6aa82de7b420c1c0940c3cbdab8e07371ca68c39462fd6859b193382e84603b6256e7b08b3d821535adb6d3d6062e501e40820f0f9af768f44f266f0fbc278530c455c069ded536b793cc48b7e52d618a1ea80ff4c06f4429a6cadf96208a8782da14b1ad6d7cb4436ce5f5b0055b22da6758be56b1505af523705ccc2767553956413e889bf6bbbc28e9a988e9755a7b622d342478d05f3a1b40edee111958c84493cb9984b001e53626612c8dd70e1d1d89c0f605d42b3608c5a7b4462642b2adb3efab70a6165cc6bfa03cbd78509728f8e58f65ccf52f8edf4f89e27f7367bd778f2f3f4eee483c54eefd9201a2d50ac42a924b2479c68fa6c1c8807a222d9dfc7b5bc86b7280f8dcdaaa858d82e7d4ca87e0ae496d070e531347a340b3895a940f3670cdeba1a67b048636688f5e32b06b53318477cf3d9bf04371563b940a16dac16c6871d34063da657be77033405c28fdbc3c6bfb6c2f98ed6634bd835882ecd478bb2d3474aa9dc2a1a888e6bb9c4abac4e1d088a7c60e3e900e24a322dcedd29de23bd65b45d4a21f1d38cd2ed7d2513cf3c3866df238f359a7e7950fc066080c0f05a29869a51320643ca79835927a2c1d82e74aa0ac8365aba1cbe0061636b19af20bbd4681e5abd8a6c6be5f9f696c92d6b6e78739464f664c1ed4068b032afedf79ce15158f6b1766e7cf6efbf00b2e072e0c60062c5df2812751e44b40a046e6521b55a5e27ffac070853ab8fa7040463ce676f92806b6eecfe839d4f9fff71027b172c3fbc45d51a6792a2d08cbd0a82d73615a2911de43eac0c8a274c1efea0bbd824c6b2fa7060392f80fe9115a2e37512c2de96b329d1bb61fd86b09d846acbf380a51cddaa587ec1c164fd1e115dec8acd82222dd0bdecd6b27873cd9177d3e7a9c156de12d652531ec87ca05d78afcca5490c9a54dfd23ee40b02772aa5652b6aa1e20bb32053e1eb527775139ac6d77ffc69ea7e717bc4ae200f6e160efcc4051b2df878609239e5dc7870c8f167b1a12a94d0012fc07fce83b60274efe9f911023bbaae2af4b082a04d38938fab9bb0426a9c3dfaa7a9a087fa00d143d556d8d94036b0f9eb011da5114cc7def18c209ec08c2ad6e2374e629a0869c0cfb86b3b6a1574d17c7cec939c6f5279e0601fca67b38c50f1e085a6c56ba18e581615eec2bb3b44eafeb5aed993bb679b17f4bcde651d4a3ff0d53d75584da27132cd7b277ed1971e53d0086b477df5400d37fae918163ff1bfb53861dbd82bb59cc330f8ab13c3d8e39bf580cb3a855192fbd0e6ca975377bfff358f03bd917eed630cf783ad88e594bebfded936e1786eba31152dd3f8b882af22de2a486ae560a39a16f268da2b40604a6e1c66907b5db7fe2c1032ba8e51071faaac3e2eb5b50bd32c686ce41d3d94e242e24adbcf1d88469cba340f26fb2113713d92cd0645fcf248be66a78e00d15359d22f45edd01f0f23fa536f0a5c6488ceb07d83b3599a7b4c5af886bcdc3de53bc773d849435cc031ded75221d53d2f437a56ff5b41c9167bee11f947d19f8669b5de82445888ebcdeacda0532fa2bfb347f8dd1cf5761cbc8a7c25adeb808c4189bc0c19e0d54dd6966bc02abb937007ec49e91c7c4ce440be328dd2948041f57c5eaf51cb3f644eecd9cfc0530ad8047f7be66d7669bedb672ac082f8be804b31e722b441cc09b0215568eae32b6f4d534402d50913c71ecf7642ba79e79c40ef7834e5a2e2c5c7f7a055b0edb8e4080f944a88252f0ecc3ee6850d9d1983b00814edfb6b0e187d71483f22f148a7697d97a00729cf6a525fda97f1024d988884d85994863256ecc72fe27c2c20e0b16fe11c19e2fb4cf7ac5af5a8e028ecf997b1e54554842f4b5d8ab8f67b5fe3f7a0a76dd15a45888ae009cc12b4857a67e70a028b1b8423a2a9d8c9a2f86999973af9a3e92d21c9128ee4b8a170d4c40c7b16ea693d8436a8d7515e6cfc5e1a94bb4a8bc4752c3f634b77d84d074f2fdf5a562a492c36a4a7cd1f246e683b55bd96fab6c577ba022f7a21c4ce8601e46bbfd7170e62333823f8b16ab1683633e888e4686571bce37881b863bccaeb86b6bb5884000cf3fcef24ff78027fa25968291b2dc1b8e3eb60dbbb79395cd349bf4294e5dd83f605d953926e44fcc2a8876da993cb6e68059c1afa3dd3d1b11780a05f001ec16ad4983648831aa0352bc2d0efbdca4820595945a14b22ec669f0d28005c79c1d1175d3a56e946b00fd38927c6679a4127a097a83197f69b6da2d6328c767b69a0e232beff20c733c7f6b7fab41048881ddce2095166ca844bb36bb680d784082c55c375fdff1515f9a3748a0eca4403a8d091915e0e3a9ad189d2188393cf11455e0e4aad99bd7a3692aa3649b16c0232b292b9b657060dfe950b8c294f1f4e5377fced2a84e46145b52c649cf40c848eefb2901e5f4631e477bd9494fe493acf8379d441e31f403ae372f09465004cf134bb11a2d20c82b197c5c6d86cf9012d22c84aab8bdc4424d7b92b39026c3732d16cf4141566f38d1dda7e905dd587681826e173e510ff410e7ac4a33419228879940e88f30cf23c861b4b05d560ad0de840f99b6238ebd07eae9162888198d0ad5643bf64766033bfebae05b1c2a8599511efd754994f42d7106de293903ad3f3320d46e03314dc408b905448968adefaa401ebdd82fb64fd134cd2aaca8f4524022e6b96df3df2f34b366f442ec832f42e1c5a54899a8ed93a897664fe14a9c04e1816b04e32f49e79b438d4dcf035e55c6b83694f6fa785dff530026c410775f6d1a5dbf5c9354230335ef62180cb27b703fe7b4b944c892308106963656a22dee1bc8eea6e701a4dd91aed9146f19901ca46113a47d86f3ec08d9de4a3034c9cfa0f6a01ee389097903247649f7f56ca2e6ed58d9d376596bed6f5df827ad099ef4530affc75f7c9c358a3410d2f67ae93768b72af5ba4af2668c79e44987ec40c72d4bf0c259fb13387400c77aeba00f8a204514918cb2d9531d1102aadf5b01c1dab364a56c3776f7df1550b1f6c298a90518078309f116b4e1e90c6e43840555d1eb9f99a621513a94c7caba6a26e5907b246ef118c2b01ae09855668ca9c6fa440ffe73d551bc6ffe1ce9ef6dc8f3d38dde40629ac892dc4815cfadd17eebdd25ded8b13133c60dcc40a98a6dafbe4c0bae1ef7ca9cc3f0d92f9da515cc9150229162d2e2e91b6abef8ab8b3786d7c8b6a0910f12a40978a86ffd3f98452b8114c2f28ecd3fb581f9cdc382af039c77ef3db47a354f524943ecbe37f31f6e87da5176214f50a3bbd10309f15f4b4ebc26470eaeff8f86e3858e03241da894165830e3447217b779361d8bb7760c96f985f28e3d3eecafa35e3874f491bae251e0907ee56e339cde307688842c4d733f13e9a8758c1881a938723ed74b37aa28d9d53ccfe4bda1740becb9eaf3521ebb785fa9a68390387ac2ae55d48fce61dcd8e227aaf0d3a30c360a1eefb8aba73c43d8032be4db2fe5a902c929238e9c61d7be2c056a53ced766b0c3be57129da8b5559528836601f0b97434fcca8f9578baff8e4e2b7e03b832c6b2cce8f6913799bc3950658a8081b99f424890190742cd99cfdbf7ade796c678735b955ffe62160abc6aeccd93b5a7bede3be21d1ef9364cd0099d398541ab5cf971b3645e563c94963fb480d2a9520859ac1e4e6717abcc2f0f52dc2135bc99fe1db4394cf529fdad69385e209157814dc08145ad8c9aa3d51746b8efd31aa7306a6133a0cfa9ba63f53fda210b3b299e358dca42c64a12b107f1294d0cde49443551346f12df04caf71ad7242eedf03541d633194b07682102a296c8ac7b8a2840749f588121ec73b45cc926c11e39b4fd4ab96c82f0a87e6f635bd20ffbf9b4c0ecbc38a27ade4135f78108afc0721f06435c676f9454ee3c4ad5a195b8832e9e22b020119c28f1a710db98e351872d3f76aef1d646972f0ea121f97f9da38fb01083ec95210efc6aa48a8930ac952544da813c2341efbcee9eb3da5ff551484ceaa16a29a755439aa661295f7149020e3d45b581e79f667828d0ea90a1fd949132f5161db73cdc41b35b54c9a4bad99663e0bb60b71b8c7aa9eddf195f1b04fdc41dbc9cc94e1d0a67980133c0d8de2389cfba7b2020dcb245e295f30f451afd81db87680e58c1b096770cd29be16d61dde64bc843c2493c0fd2505b4b79a7ab4e6d2c9e3d95a660ee523a26e5f07fb9fa56f03911a0d2e2e8f9a75737a6bde14bbef97f6c981d0b87e4050b813ad0fff797e41178b6ae26f399f5139c7a5c12596118e0ce3efb71cd824f64440d58be6c848cf8f3c4d3e17ab4e8ceee6f77e5ea1eeb35af4ac314ead007a28167ccb23fade5c4534d1367bd7261efe170547d577829f179d6173f549fa494d42a4d12db8019242936a36e18a9195c252415ea05cf7d4e3d21efcc02a951a330e44524aa3a38e3b78618d3ee9bf21b4118166ef56142d16b748679483ca287d83d56e61ae316f3e89958ba43eddaad90b94a9287e726f710b65f9033178ce7fb68f1384be8f232353d67138cb7acc96c99ff219a29dc75c5f02c819b2f63a8dc993a28f1fbf9c74213acec18de2654cd155ae1ed9b2699f3759612bd0905e380d6dc4bac8d8443921e9f0e34d5f1e354c56f223466aac41643adc9fd18c8e303d2bc334572ad1f49f0409d08952fcbee6c4dcd5dc505aee5667830aaa0750608a36dc19e57a0dbdd2eb9266fbddf039b3527b86f774f5fa395830be9c6222262007697dabfe7be4667136114f5355c1802c96fc3fb91b64d1addb44ab18d6be452638c99f7a6c4e56d2f91edfc28ef46bf9455a897d0", 0x1000}, {&(0x7f0000001380)="f0bc5e78cb9fb0675df1f0318584c02862242c229c98d920894088840dbe482c34fe1c6d4c4cf692c888d83c680d97772f87601da82ee58ffa242e6206aa6f117f1b6fe1815184452f6202558a9491526bd66e7b49c2c3e197fe45ad98c3165f1d14851912e62dac38e3b1a81747b9cf28dbf552fd14289bd35d2733f6929b54ce368641a78cc5c1274d087f2eed875f7fbc9b4e73145caa7e0aa07211ebb4ef502fef42bc15bb6e2648234efe174eb749612952", 0xb4}, {&(0x7f0000001440)="c585b98097d70d73fa39410b74c8613d6c351f505389c71651bc76a4dedabe9dbe12cff9f29fb6fc41d8e0e46459796970c135f34ff3847b20fc576832807cda5b374eaa852c560ea9811a61f59eaa571372d3028d5c23a6051cae2ec068ac0f05e4b4691923fe5bd767b7c4d0b770c3263365c0a2a936f4ec9a4da836ca71710b7dce57558aa62e87433131b2c1d8132ab3a55f6646be3187e56db662fcc3699ab425c34527f60817ccb313", 0xac}, {&(0x7f00000000c0)}], 0x5, &(0x7f0000001500)=[{0xb8, 0x19f, 0x4, "a0773fc0cbd79f28fe19605bf3813af87d1ad31f461a662bd003675bee330a1426c4e3c277e5f5f4deb3e01becfff750ad96d36f069a3953fe61dc680e15978a2a164f13e34ae8f18de5c9066a2e3678838911314604db6a2b13096d16fc571d26ad8f6985fa189f0bc41bba8e6cc1de905af25842a711e8a63ddfe176133048e6b63d1ffaf9fdd8ebf350a7f8dd38881f481dd6a54b600984c7cff0d741f83ae07ecc"}, {0x18, 0x1, 0x3, "7550e2caad"}, {0x90, 0x10f, 0xc0, "acf92dcf738c96f6615159f751d2a0e4fe36a1aec4d49717c5fe1970135e18312d5aa20898a7805b3d2fbf3772214343e58201ad2ac68ba45649c9e71e6b3bf8d6afaadc418a5a5037ef1ae9ad916d36cf4dadbc3569ff17fc34e5369f2da1c1789cb01f88773e02814cc4d53c4f1ed73d70848e5a5527e617017986"}], 0x160}, 0xfffffffffffffffe}, {{&(0x7f0000001740)=@hci={0x1f, r3, 0x2}, 0x80, &(0x7f0000001980)=[{&(0x7f00000017c0)="befa4a90aebe891dde4dfa98e9b4e79fff8a81b70902801e890e6492cb5493c6d8f76dcf233228ecb70cfe616df9114c90345479faf08ae54ea4019d6e7c58d304be09db65a0a235a7169d1c35d41a035175a0b5e44f0f8088bf5596b11207d5ac3e4f1de10673964035c18a4555d6d4184d2a09177e", 0x76}, {&(0x7f0000001840)="fb23429cf254271a9478", 0xa}, {&(0x7f0000001880)="05f91b0a7b83e99952663d8fd071034d2f10b20f7af5be7a4724bf862200c98d206d0375f01bf3e0250fd547df166d99bf1ec8b338576c87da13bde35ed2743975c34a3c1d9d68c70bf55c22bcd53a3a33ee290e7aea2b3ef7829d13fd9d619a56c2d5f9f77774bd1fbabecd7d78c349c49d3c7623c5d75b248fbb2211b4409361bf79e7762d52cb686779265539c3b9d2afe1c20f717ddea9c553e0a66db600522eb45c7d6b2c05a89228b4607be5bbbc53020620e2ab55ea9e315a3bbfa830690e6e5fd648a249e683e70d", 0xcc}], 0x3, &(0x7f00000019c0)=[{0x60, 0x0, 0x0, "7425c76c2f2e21a52da0da7b18983ec3fbae138b20c531124f5a4c7e54bc84432ec2c868f423e74f07d2c427d2c88dfcfbd9eeea8550bb1f06e577e7ecc7d5d6980c904d9445c2e618dc964fcd"}], 0x60}}, {{&(0x7f0000001a40)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'sha224-arm64\x00'}, 0x80, &(0x7f0000003e80)=[{&(0x7f0000001ac0)="6b516d4cd777e1762cde4d0f4883f360cafd5685f8ed72d6148c2c16420d6bca985acc27ff7e179f65a2573be75eb5b5b3d133f42616edd90cd34c0b76984d30492e668ea7cc4c2b044dc57005f9063c8d20f9bc91c3bc5ce48951f0b3e937b7e9f87a16a0a4b698fd93a948482c0508a82773f664f10fdd2f3da278bb837349749a098a555bae9e16e29ce180f3b6fc07dbde3df7ac54f219", 0x99}, {&(0x7f0000001b80)="8f7d6555973c8439bfa47e319ddbde61da9b17ddce69d8feed73b048233831a2c3b6ae3f0de3ecd189d3a6805b44f75afe06664bdfc1b6958fbff71de2ef1472355577c6c54045e6d0ff97f7c5ebf05e54aefb1504229bf0dae98130027895d267a19cebe67e014f6c90ece216e5d56d8c9dc8bb24b0a74420efc50c80435c008b527f16a266efabad1282eb503b58320f5d18e64d81f41f8e3c0de81169f0874b9a6d30aa724b7b19e59c0fd9d5616d79790d3d4b3d0e8c9e7d142b4271e7858fcdad3e94faa7d4d04fa71b2f58c3c6b3fd26555451c0850cfdc6736d37cddc37713b7ff3d3666b7801", 0xea}, {&(0x7f0000001c80)="91d7f93b917c6ac1e958284413282c16d92b607fbc69dac1df3602ccb2cf65a7592789aa0964db82ea08eda039cbd36a6094b110bc5e274f4b4881c3405357b5da3983d078122caa3ae89564b28806fc40ffb4ae000c862d8b16a034c11932dd8a1f7d80a4b54d0e678a2c6ab70dc3179da8ad2737e47b391a6f0f", 0x7b}, {&(0x7f0000001d00)="b15f241ec272411cb4842542fcfd7f1c0ca748f724c7d91c1c78a8f4d506e858ba2f679364d2507a52df2f63eb859cfc083b0c5a5f17874504ae23588d2b1e8aa12ed44f0963e2ea3b1ef1093028acdea0ded3ccbf00", 0x56}, {&(0x7f0000001d80)="8fb989e6047ff441098f812f09822d773ceb80a0c24325bca85c6f05d31fc8beb02179bf03239d2c16c473b53bec26ee5127c88d8166db10e0c79c4e9288c1c698287700f5903f2d79dc4a315a86f9f7fabb9cc8c6890fb3eff94adb73e1c04ed3fd01a99156d1c86614a9ddde16c5074ec242ac72d31e8394", 0x79}, {&(0x7f0000001e00)="0644c287c7b4c43ef112519ee999227fa764fd14620bc80e4d89b432c60575affae5fa4d8a93a04ad1e8e9aa9ff5ff83493f15b2e511185c82c6ea7aea90c6e27921812a9770f7cbd0a40077509fa2f62a2e24fcde2e3e8494fd063ba943d9c9b94a173f92241633eb1c94c1f32c6aaf0d139d492649133376ad4e8c1ac3a6b6aaffcdd1b91f4176c0158ff485b341595dc92e382a36fda9d6c98c7484668f0c828999d0de2c962db2442e76f7018e7f63ec051640a44007fc110bae95074bbf50a81cd1609da3e2721e75b4e6423515c8a0c60d03a7b5167d0abb819f6062d9ff07c48ef1a2906d186da53e0cb3bffed9993615a094820da658ca3e0034f1e04f1995b8dbb52dbbae77e099146b528f8683af837020dd09511a3e687814f9a13c113ebff3980e95c11cee5c8cee8e1fb95fc17d37928040839cbc540b33a6103fa76664fe2d93dc9dd61da0552313975a8b4d2c6480065b7e58aafcb7505350f637b55287f5cf7345ae2fe3c6c8c15a6d6f9825a61c5180ebf8e0ab5f9cd992e7f28fd664965929d4cd5eadb1388619f8c6b351f6fb1c3ff6dc21373c7dd8093279e6a6e11e0c03922f83bbdc18ca625dfcdb780041171bc9ae4d6a825261a607a9f0b43998316b2586b23983e510afa13ae33bc36acdcb8f51bf5487b2013588dc1955c68c8eb996714bc51020906b5c2d7f0179714252b03d294d9a7bb8931da157e636195486304385e00374e92ccc7608e7e0a342af218a88c161b1bae518474947ace820d2999147b844c34654273608397b8f61d41fd0cfdd55d7c9010179ae957a383b129755652268b511842604afb52740da06b0bb59b1f8a8181adc1d1215e029bef76dcff79395dacffbb5f34c175d50031cfcfae1f5e83b78bc4067bc22b947662268d5a280a15e1f23d1fca475e87df3dcf0bf47483e771aff3a7af04bc2edc7ede3f65472d6df7303375675c5d41fa2a000986a2cffb5e184ac743b6d9d167502385d704096ec016eb9a4f317fe4dcca8187413ccfd299cbaae6e0b9d5b04e08ee11e464407c90b5fffb614438bc436648322e6d02ba02c12f4f5fd5d2d0f9ef497dfb3214e29fb1c7f23b8978b772150973cf21ae74f3339d4e94769848386b5ce963e6e0396c68285de544def61fe9edc5513e619a79c455cecc4fadb0bfc7941c40fdc9115d5a29b388f4e29fd45e16b619466575995609ebcbd8a6a54fb897e90546d1d4b389e9e8ba18335bd321011ac3770a88f7b0c0cf4b23fb06be6c539ea576de3775b311c01e4f3b53987eabf2429aeb4486e5fcb3761a2a37c5a90b20d5f9d6b510f758b88a755cbc94845468df30cc22a30693beca9fdbaa492e84f307b30f5c0104ff3459ae28aee9660fb1909cfdc707fe961497b57ae5777a0757721c4058343958062c001997743d66a025583c1e0d23ed8e65cf56297c7c99306dec2e8f6028a0ecf6dfd9f452b68a2e4493573afcf02c670d7f230bde247d74a767500f7fed474b7240bd3524f15068deac62105cc4f5e9f331bda7d1b9410281a2406aa13f872dced3d6b1d5eadb66a12aa574aa9f344f21fc6687d837625f04198da408562d6a6a39e2ead041c130651b51ed83050e5e8d24d6b5690cca158657c33efe4a342142d2ecf1140059509c8ac45ad795cabca965f2cf04c1f3f24479263c5cd95637aed88e37e820a4c0cbf5745836ceb929d9d877f8ac0b6153e2189e69225e65d8704064dbec18fe23025646c6e7c50b7b067532af111ff369e99aa2efc9450e605be64d5a134675fbdbf5f3c1f837d0f71ad83ef616526ccbf752c6235e309954eab31140438c862fe33dd78ca7bafff4a3d0b13144863c51225e022741e89a7b988d540fc65fbbbeb16749f9db1ad437f557f0fb3e030344dd2f28f2d64cb0572e3bedf11e19eb7f6f846c433bc07ed70391b4d0a12f58c6a8b61d352662817fd8aaa3d89ce1bb3170b28e70e7a5a4b1e102821b463d3b35275554be55ab62e3a35c1af6af46d21b43e7e23d034418f070f0939cc8a81caa5e55ac21b4f14953b18c05c72d2b780d48a9fecf9256b51210457ddde07009aa179dda37e210a763321d345b19ad2624cafca18629e31db10c7b5723483fa7a399e09dbc79f99519ca41c8db1dbd024604c4df29d5b5f8847a862e02f32e775bf5a2bb14c950e05b7c6794c38a6acb4c0cb3757939f1ff63e4b66d6a7ec87f8dd2f289e88196ff4992dc8f9aa75437ccee20251a15e7fd22310362db79ddb72ddaf1cf7e23232100481eef7538a4a3389d093d3616b3db162684556a7da75a595b8e13dc7bdcbd75b6dd9617872b5dad6a0ff10a2552c99eeefbb6720d1a5652a8c0b20e6e2ee126f29e37a71c96a609d19975a1835b85661560f3ecbfe04953cd8452836c9a71d7d457a27977a41ecdc4f3ca46b0e9406b401813ddfe8f7a7c16c65df725bfc12f4c03205e2fb1b07ec5798b5d4ce07f249818c29d57d3c2ac8c8e2b9fd05e146093e97c6b339190343e6e3b654244b63e8fbd00dd9d01bf56cf2b012c032bfd975d08be062397ff33517a0ae1e3727aca23e45030ceebcead649b1c97c7afca6fb4599249736cfb71e429b971bd9d11f5cec57b90baaabe1157910fee5f244859187e6d8611ffd98323dec3b7a5f42a4be87714f5c79560aa8b633c8b66b018b5d947d4a8e6f3c74d87331acb876bc15156681edaadc38c700b6c3742f2cfce622c42fb8cd1b8c917c9e2ba8d294266e67ef38975aa2fdb73290a8c4bfe33b2b3a2035202069b5fb8e839d78e53eb71757999285398d06ac783d228f0a942591915f3f0b0bfb9c0eb2ea54735acda61a221de1e768b5ae6e7c41a37e108afc41280b31f71e439ff06947ecb3ee3e95e855127864513403bee89da8fe0669b9867ca85742df9051f0800bdfa9382b83e1decdad6ae763d4206d12ba1ed028ae5bcd7684f79dde510899a0611368ae550d6eb0b8cda891b00955281d6337b42b6dc3787a0995dbce0b2e636bad5a447a8b2df368150b4994bcf35def38d18864f96b37d4a9f6082e17d5df0dc667d6623fd7c36a243616681aa30112b9c6276b5643de602b63ee5806aa020865d2afff20f759f2e755a88e6a4098950ddb05a42af056e68c21a5d58787c6630a30fc959d937f77ddfb960e4bb370c06436b016128430fb0bf8ee68dd4d774ec5e4372d14804cc660dcb160c69abe0b3b5648df1643069753b0d2154b87139cbbb3c9e15e98374afcf522d8dcc9ae6f237c955b132dd03a10de9221e00e2541130c9a706e88fde6372bd638125ce5eb5205343e78a111d29065036ac07705c88eecd71bf8dd5a9f5a75d90919d17c5a5f1949f55e4c05776b07c295f3ef38de728882171368948653dab1d13afede752bdf1a1ef05bb9d4cb4e8a3cc9d3930c0d70f8350738b03ae098b2f3046086a98a41647c5d8470e8025b06ce865c3f982d939747c7439a976bd50ecf6e80ba01ed57163490a7dd3154065341c0a72dd4106d1da962b261a6430678af7e3eba8f1a763188f23210c9064c370ae7bee51c79dbf3c62c79061ea5e730b6689310eb7df2e11d4fd9b004947b6942dd64c666ddcf7cb747067c9ef2f5ae8a48dc30d85b9eeef41b7ecd586a65ab1e675f6727556233adb3adc056739ee43f991d31b54ba7322c01cdc808f232c7e5eafdb159451fab4f619583f83b451371e6011a83d819e91943030e51bd9d15ca7360be30489eaf324b71c469c8a00a817d909837e5db420994bcc0d765e42ba15145de88ae5763fbfdbd0924bb2e23aaa9dc8db2dc361e54027dbca8d8bfe9bb8ca5c29a11389672eb0e3d3e90930c0f23af7aa2cfe2be040b40bda32d47a41afed2eb685b32d2a1628410f23d9d9a0f341d9765a599d217149a860a9c4c348f845d4b81f7f0d9705fb69d35001cb552ade8d09ee2a14649090ad93281934037606b9c75bd2cf10114a8cb975a3c0ad38375fad442e374a7a79ded08c097cb36110e3f3b0858348c889af6aa540074f7d2d720cb5d05794632e3a9cc4e6106c18c116bf79a83d547ad4e9428e4a4938e80a909ecaf8efec293672dd6a90e5b5ff9fa9dd536a2fa47b27a4e0a47e076f19422d0e2acdef9c3601babd5475bc1ea8fa3d1ac44804bb09291a2f8033c1c3efe3631308de396db9c0e909989bf99e322aea41c9fb45116325c1d161eb2c9038d090021b45a2ef5bef085a845522800ff5c8ded2b52fad16d9fc6117edf18df19dd4717487550c2fd1c58db41c7d964e3c829a4d59eceda4fc5d467a34f3f39ef0b07d6c25c6d36f5cf9e9f9107ea3bafec81fe3279e80d8da3a245089063afb71b6c89cdd36182a9f1da209dad7dca7bb14a0b415f8cd7590844300e38474974cb9e59b13ae027be9964fcf78c0b5bb5b7f49aa651cba5bf38014eb37e186f559dfde9e97ba025205d5228a44ee770f2460fe7bb2c4546c910061fcc5798a33b29d2f974259715c680d3b870f3fedd51fb492545e08cac7020721f732c9a5b08c0581d5477ac4d7d5b99952aca22073cb08f764f3932f7712006cbde9d3180e53c327d3588ce941a40aedbb4337c3c634c3948bf638c7967835a4d484fd3a691989473c96d5c8e8e2e772cf6a9816925f865f56fab714d800740140964728340717b06daf4f3d1570c6ead278c0bccdfb1a6180f59ce5845320d2e339d160eeb298f51e0f07ef44e4a47d08cacab6181a383c8bb9f75c306b9e317bd38bdb2e71317efa51377a171e013e07d43c8cca6c04c954a8aab3fdd5cce6518acdeb8448656d63bed9bd4b0996a82e2f4b679daf113ba16da7db5ceecf5ad64ae226ae6ed1a51ca30d3ede4b619c6b7978ea9b27b64db51a8b11fb0bc2b27b9e4ead0b572c7a72bbe27be9019ecc08179ee276d74b7f2a02abe599b12847e39be59a2b0459c3f054efcc65f9ff6afd93afc2a7a8212691f2fd0800f684bf5bc2a25115e342ee627b926ed951259a2a80a3a63496344d8f3151eef1f30267a6912e880a05628f3d805870e5c10a0c9d4a3479432e58d1aba2b0b252e75238c5ff09098d6dfd35a733d4e8d49cadb52815c9d166b7917bba4dbc2eb93155bc5afa58bc53fc9bbcb3e0c6273df5f9525df979ca07b11b7ec8e73edc6664647b630bd7db8d7ad970ff2b7c1a00f7bfc606c03e88da5c584885024fb287853de721346a36d94467be08e775c27a6a80d935ae2799e1c30f85cb157072df628e727fffee0037550d5151531cf70b815b822b3c4409f88a90c6ef9f764e7f69168a03f99e944c46a5da06e414fdfb7ee3a28cd202e4ce9c02c586b4a95c5d665bec20771dd38534d7b868eb6449700e321bbe9bb08760da85a73c7b366970d0732ccce43654323a281994f9f629c4ab9c550458b1a243030cc782d0bfdf82e62db7f6605232cd16463c2a389c02565dc50d7bfdc2df3e40f2893be00b6b511a31823a255032faeffece028006950190b41516f300eb1bda5bf2a77af5ae27a1f749f89511add11f61792e1814545d2d5f36e433c895c6a7dc6a668c11006d31caa2ffd8312d3b735166578ce184972bf236a1fbea82511180f3780043b63e18ac0cacc189561b133209d6f28f8780e0909646bc7cb87c4c2e61fa0c071accd877ad1cf927d8426de80485b94cb148061144b94f512c336d825747bebf61dccad9b9fd7ef8b14390412f6883f38797cef2b765a951b8fb4b728cd2e40d6f5532b0adb9fd38cbde8d4508531ef71f6b1fac7b346bd6ad2b7db9421c30ef9fd", 0x1000}, {&(0x7f0000002e00)="ff0e9e2ecb69cc6fd2c729d15c972412b5b9632f9eafe3cd83f2730acf8eb0d20d01e4ed8c2813f6504ce5ed4cc86a45c02eddb84c92f3d8dff546ef89813f85aa6457b0ae07e6989830febdb6f21be94942d0e64cc29f11d2beeca673bbf661525fd3d45f3c3ed839e3b64e59d1ae6f2c8c9b997d4ccef0ba403abaac5ece85d20fab83e7eecce44d44e2771ac376af9f6269b810726920ae115def5fbe55c03a21e880a2355bd1d9d762618028c9e7e7d5b81f2249ab66d06c57bc44675ed427923863a70ab1b9b4ebd7129dc6d940f682508da7453260c44d8f6d2ea263172b753a9990e089cd3efefeb08f0a0c4ebea0df731467f543497c96d668881a9b074c2f012f3d157c026312edb1ece8f7051f3dea178c9524da1c5cefa7c156e71927979c83eb2b6a5c39370b0ab2af6cbbc8095bfb348286be03b37dfb53fa3714049420dcef138d287f58e23a424790ca367f7be0ded45ec6a32df6eb19ce9a504e65fdb7b12562b45c7e110c500ccd202e8cc7b96f64d196399a6c60fde9d211818fcb487d39af19bbaa8ad4b7a020f4031e5c408cadf75bfc9ec5f23a381539f07c46ca068afb012f56a3c234b1c40476ab45eb20fb01399ae869349dd2f9e56ae78bd7576010de9f85a02e048bc9f3e63a5e75bf19e93ab8263bf32786a30c0e17b13fda65cfd0ed46077b38abc882f240c15d52c7a96efe70ab7e1784de1d511d6499f2e83d9edd48ab57ca9d6530fd5ff237086289f7ee5a30b95e8788cff4aa52231b9f8cac1a55d66c97edcc41af4227503b14f8989c102c5e36bd8a0c8e54c744cf8508b8ad75aa2ef51bae7dd16e66d8b783355036785591097a469f68644be4ad4ea626f075898e102b8354b37e04ac9b7fa85428664da0bd2219ce051c19efcc66b51d7c26e735cb43aa00ef39dc5d3c5618a45fab330c143c4b854cb4cd632625462859ba55b70d23815709d7c9096a175cb9edd6ca5eb8950424d84b0b8129f934e5f0e9423ae30cfe85810465d8a6481b51195931fffd895dd99e69224d41a4662d1c3041fe6ad7250675c72724a8fa14e12edda6c6d0f9e5ea6b73e3f7b824a081d15ff0d347ff6cb3d57140ad4558b8aaf59a8d13b69ec5f7696006fce9c11675cf01f7f6939e7e0a20825298567c64d93b878378d0ae18427c48d207da0952f7974d9f366b857b2aec02682f3912cf854e84de32489023fbacd39ea4ed338699632329427a017f65dd537cd87ad129c383df1d4be4f845aaeb5002efd705dbe28c3371ff4f29dee1d860174e725324b8d1f9213b300258ae950f16cb71c97e98fc42e57553a4078104c795ac3885ebe95550a66f86a874d0bd078e7a2fccccb937ffe21a6a85b633b19f047be6fa906e805d493f24b51e80154c4ce3125561d6fba42de9a01d7e61f8faaaaffb39ff63cce2227b367f101682bc922eaea4fc4438d19fda7795fd5c95b15e03f2ba5e3b693a948da641e4d69b6148980e5537573096c9919e7f92ab32c7d6c616d2fbce9b0af41f7d36ab8d21d1c22cfe264d51204302bb2498310b823ea525cf8477516742cbb7bb4aa2cd48509c5a1777b1adcef9dba9d0aec1205a9f0ba706772b74f393dd88ca02d074102f779877067e4318594cb439b13af4ed12a13d04d09e78f3b892a8bcda356d35a0a4e7d37a0bd22e7b271757de7f291dfce8cd4fa61ab41052d4eff099446fe650ac42fadeacdb5edfdfb69b09fc284fc1b42af9d721f41f859f9f3d8354bb4fca8fd1e19c180c9467921583ceb60dbaf1aa89392afac1822eb04126eba3ca15c55ed1d54161591d2299309fb8d71aed4cc5fc450b5de91a033058707cb9d5a7a13387fc27a04e24ac75779aa5c766da003aeee029a750b16196c61afc5931155514186a7c0018ffdd085ef7a23d215449f66a2712077b2ec609d3b40a839d7f65355e49700648b1571613b627fe783e88fee1b3d022a7475b0c914795a62a81619cf4681cedfa75ea8a7026480df0f762c7cd14dbe0baca9cd21c6351f3b63dc01a7c4656c735c693effe2d3804216f9ed0defaa2ff59560dae70a87ad92cfdbca0d601d6407dd83a954ef070fe21c36228271323a22fbb7b2bc3afe1b4e87851b18b2fd5baad279084efc81b652d1c671801240654e905b6a2c217db7d4c1dd0bd1b52b7c2f70468a403e62d6da892aa729657c12ab7a9c3911fd8138895227cc6f4c911c495e9fc1d9add27af6a75ab1c1a828d9520ac6eeb9a2db825dcb227e34c434200a2f4df4b36e4995d512cc00510516adfccfb21593fde07b9bfdde677a40f2356404dcea18168b266194edd692819a7ac708345e5bd549bfe99da86210c36ea28523e10ecab11da41d8f25728b2c764eb89046a0a08a7d2d52ec2b98ec5f3612d01fdcd57f7b5955d76f5e3e5ea00bea82f78924aaa48cf054d710bf9e856ac4fce5332b67e1e699a34cc0863a64d2c4b3311b5c25f50c1e40e503afaa02d9266bb8908306475e9d5a2fb1a8fb55cce4dae66ba3841c9fd889bcdc14feb7c30d983642dcdf9a197059b48059d0dc26d6cd34ad857949c2b9d53f83fec6c75039d8997897a2d29d53bd756d6a6c0cceb06e31b899b5a1e32e3ff34057dfeb69a992a873e836f68e4c6dfce5cb01d773e0383d1a4217121876472178a92da51b3c3fcef9451f8f7b522a60ca3e3bdb06d0d70437d2611fd22870dba8265664fb9f6d01cf8bd7f621b01d89a14750236de3bdab4d4d607a76a0b572e066f932fc87dea660dc901abe4f32a78b824b6d8fadd5bc707a00c013933dcdc2a422f5b060759868fa501d2474844d66fecacb87853962960c3fe14c4931b9668fcccc23a26c11e9c26e9a85db1dc7118070f7b0e4c31575c2493b669a013621696d60c2304144155b8667ace1ef7399e9f4a8e7c8a3090129d76737bc30257e8db9fe302ea440edf2648059b4c60b62166008f18335805c24c290edebdb4290862d69587982e749f786375845fff664c07a1050b839fe12a019b4ae630e4b08c7703d53a3507eb76a7079e8e2ff61d8921e99b7c6b6dc081b42a0c804a4422d297accf7402f66c60180439ac8cfdb9d69ce7f3e5daa23f0893eb3887f8b3ff7e61b84437812fb9ff0abba004bc37173317c0fd0e94780cbf4da80964a4d111ef5d33d92e3b2a2a698908be685282ba46535bd707768a9e6c4cfa9cd0e123caf77c2397e1ca91a7160bd5d8559d8572be1bc430aec32b2c28a4cdbb7d8c749500defa71a80f4afeae53da2914e095f647009694b4527ca68c000136801b90033286f5f6de4add624791bcdf0eaf8f0aba8e29cb2f36fcfad13e7609e9aa9d9ab1c19492f6d3bd613627c212e481b8ceb9bebea4e335ffe8ade14161fe1f2dc0b63883d1de8ee7cdae24a3324f8178e94e993a70410e7fdf420b44333ce228350af697ed380602f63aaedeff4858a11bc9936498d5581d7f08bb36371cacc10237d552818d1062e1c377fccffe67c710b09cd9f747ba53d4da702c420477d4c2aa0e6874c00b840d5eb7445e2c0bb074f4ac0da0e79f7ea7507a862a46760c0420aca315ced892835bebae159da87b383ff9b201d2bb7e667d1db240e4adcb8ce1514a8cae982a38f5294fb2afa8042dbab6b6f54e04d6519ebb55135cf1bcc038775b9d9c0dd90b4b8dd2487ec4f100efdf3f6e4a75743e2645a580732946f807865164f1f0549821bae6d4bbc61bb5a2c03ca2df282a1986cade2cb3f7e3ce648fcae2a8f77654a0135c0f80f559cc6000c7005c0f1ffa6a25971ef651d861c5ed7d3c5b861c5e058b10e07f9c98499c0a86af21910bc54363bdbdbcfd81aa7d9f29eb3103ccbdf86b31ba961b120e0ad8da5d042cf18ce35ec1e200e2185388b471132c4fa5c97ce20fba71fb945ee494a9e5df2ecb05c288c4c5a9712e830ca17b81a3de0cdfbf55b433b74430e3a008a089f070179a164724360e51a8fa99f83ee98301747e7038beb7fc1bc5fea3a24e592127a5e9859e33b35681b9f48aee90e431792e3fdba779be66deab0213944f631427ac46574529a229a18fe97c13762138dc1c8a49fb1efb1df99c0413cbb7ff281c1c7c3def766461305c1b949d32e5b12926d96d60f3f20c48ee2bcffb247f34259d0254a149dc2a10f98b5255f7a54b3971678b2604a6ce855c93efeeb8ad725881ed9d7c95f98a1d37490a309d7c82def342ed0676a13e75cb3a683b440c2130eb7a9f39cd2fdac4dcc9468daab9ececf9a0b08691106479cc66edc225b321ab2ee8d4c0154c9c99319e547b81e2ebe22506b3a1880d1d4a8cf716713951d9c15d149af68cd0df794767b8f2892d995252db121216229ed562599672ef85a3d6d64fef9c7bc32ed1dd6f0c0c160f65a53504a1cafc5fbf07f5aea1978e7784af217fba62d2c03572e2ccafb6aa1d3ba6aa0832065bc74ba5d9cee32e1448dcb74299a8fc3b02a9e8867d565e586698525512a68ca1260d655d16d24a9380ea887bc594c3744fe3c80827a22b98c08c0e31e99027eac8a11c10e86a92c4411abf7798ac31a778cf147e641a4153a99dc7f1a3a8835051c0a6d3d90946d27da5adf8790ccb322999214430ca321ded0498848c8dfb494d2533903cca0e8e06c80be664c548a487623cda91536bff803a3e0a3473e4a194e835e3cda9da2ba374f7a8696a705e440a9ef509973f5d6a54a67f5680cbb123ecf2875140924f8e5a8bdf353ad3f51705b628ea0d08861cd5499f5231ff57edbfc32fc103b6f1f63e30aaf78c668fa5d0ed8a02501d193255908ee0d56f968a04655683d450409a8e5341c14f563c6919f4a073c72118974a5135b3d267b4381e6ee72a20a5b7798e3e3cdab1da40f8a7c65ae704622fc4fa19c8566d0e82da2e8fcb1cbbf18eace73954892fb9c9136a30058dfbe1b3fc1e364ac193cb2dc4726c199130d2417bc6ba432e921ee8b1811cc267763c2c84a7cc8666daffbe3e72884d142ceeb25212a29bd92ed7d8735e1ebfe392c1b3d9403972728bcaee730dbfd0ca800c1872d8bb2ba7b009de2bb1207eedfe4757ae816839956fe1129dbad6d95d45db4c7e9b40211e8f4dfb8be8c8bccedfeb4b3c7b542b8fbccbe45991d11c16ad33bba8c803317313464bf487f062833d8599dcd864375e981473acf05ce4a0738a6ef3f3b3a429d7613f76034bcc0e755d7dd9ece02e54d46678db3f7b4e36e6b7a7bc6e20a0254f4e2ae209fcddf43736b51c1fc342dda5ad39ffff9d75fb7f93dab3731b9883b93fcfb74d105b7ad3660fc9539241868f8a8015b943fee9bb102990b460d0f2becfced6adf8ea70f08838d9ce1bcdeabb3344f517df3394b10abc160c22911b294f4fa2077baff03fc4af3f61438b2b00189f79906f072a765603cd99b8d11fa43243be878b23eb0bd3b6b539ca5ed42b015a9ed284f98834d0c4fc5b79e14561a20bacbfff07a49063c850161fcdaf1ad89b20be780486dc6df2144761b8f1d8605347966c637081adb3f5e6d237a558b4db33296abe0c5e68280ed481cda1cff7597d4be5667ce0d1f5c39a720925f589842b688a9c0da1c5ecd864cb166827ca7d7e9168665c3f6cd37c050d72d224a73be9a639bde0ab282df44dcabbcf43345309ed89a0c51899c6304302fc6ef24fcad31da39330ca13009d1c955491ddccf4990a59b7c60ad4a873e1ea13a3597207ec4494230a15a702c7180af67ec4fc2cecbc71c738f7e0ceb72fd479ff2aab297d32d3986be2cd719778b6ccbae4ca2c09a996", 0x1000}, {&(0x7f0000003e00)="29532204e37a65ebd1f7b5", 0xb}, {&(0x7f0000003e40)="53bd4c4f7c707df8f1f213b3dcbb94ec70c460546bc8e2e0bb4420e17d", 0x1d}], 0x9, &(0x7f0000003f40)=[{0x60, 0xff, 0xecf, "fa3e7d5c97488f47324dbad444bbc7d461066736e37c9a1f8cb1127ae8ae36e08d53a857bc54b517a9760d173c83e29514532543ab572c4f9004bb919972f0146cf325597cf8ed01672c905b"}], 0x60}, 0x2}, {{&(0x7f0000004000)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x4, 0x1, 0x1, {0xa, 0x4e21, 0xff80, @mcast1, 0x4}}}, 0x80, &(0x7f0000004180)=[{&(0x7f0000004080)="9d7db1901694820f63f1845511e822895a41cbc4218a5ae89b2bfefc2b89316d46cbd19342d2c858323ef963778e8e4e6bd1f197c52aba3d5c4565e0e54da87fb81335ba0882d4d53834b9a7a4ae15110edcf6261d983d68b3253708cbbbee299d7a8177618e5afe090a94c3e8f9e3fd53f84281171e7fddf914266bdc6945a7d2ee4c5de0eb1fda7876ff865bed2a52", 0x90}, {&(0x7f0000004140)="50585610e6a5ea09d5b2124d318b8d19b27323585279de8e8e54145ac9d30f207d66afd16aab720e11d3e5f8ac35e9ea0149", 0x32}], 0x2, &(0x7f00000041c0)}, 0x20}, {{0x0, 0x0, &(0x7f0000004200), 0x0, &(0x7f0000004240)=[{0x50, 0x19f, 0x1f, "342d29cc4e0ae5454a272ced0d225c545d2e58bcf753cf7a2152b894b311f475d3399b7bb5cf0a512e96230654330a2c6dfb4ba60334836ebf12ec4529"}, {0x98, 0x84, 0x6, "e09201d645ce364a8209cd801a22be197fd18fb35b7f4b1a2839ffea3e056e898cbba99cf296772eab3ca6ec39d11f26b5debd3e288ebb2cb05124c43d8226207d4838a735085928b53411f5bb914edf216ad9f9ceeb39c1c3403015736648b3fc416e61c36585c54a6db4b1fd0b7e0f8f06afc0d64f01d8b89ee59047febef6ebe1857a5503"}, {0x18, 0x11f, 0x1, "50514290f5c5301d"}, {0xc8, 0x29, 0x72, "969b9ae0d0a20de8a08b101a80f66e835669d07b38c9e79f62aadbe15287526d78a63635d54fe2be867f1271c15153b138ef41d0e24ee21467e81d188423e7198f45ca1eedaecda58c6da3a6ee480408a169798874179715990de2b2c36ebbdf3e470d6d4ce5be71a2067c47d6ed6acc2b4c626cbe0dfe45a84370d06c1443cea2ec3b1cd13d1e02f968b2004e8e0ec22c60f27a004799102ae72bac7daef6aac9f2f1118b0b6f8d3b982119aba0830afc1f"}], 0x1c8}, 0x40}], 0x5, 0x44801) mkdir(&(0x7f0000004700)='./file0\x00', 0xb4) [ 803.578154] binder: release 4715:4719 transaction 790 out, still active [ 803.615922] binder: 4764:4766 ioctl c018620b 0 returned -14 09:39:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) 09:39:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:39:09 executing program 4: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x8400, 0x0) sendto$unix(r0, &(0x7f0000000080)="acf2b3a12907d48e15f0ab42c2d35238de81fa9e223bb93f37e8f929536b4f3b6d6cf94243c58eae42bbd1aa5b9eaeba0907b71b7036aa43586e9d", 0x3b, 0x4000, 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) utime(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffe) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) [ 803.695411] binder: release 4725:4735 transaction 793 out, still active [ 803.722763] binder: 4779:4781 ioctl c018620b 0 returned -14 09:39:09 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000040)="a6417cad540578dc0393ee8e85e8af6c", 0x10) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r2 = dup(r1) lseek(r2, 0x0, 0x4) 09:39:09 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000000140)=0xb95) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) mkdirat$cgroup(r2, &(0x7f00000000c0)='syz1\x00', 0x1ff) 09:39:09 executing program 4: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x8400, 0x0) sendto$unix(r0, &(0x7f0000000080)="acf2b3a12907d48e15f0ab42c2d35238de81fa9e223bb93f37e8f929536b4f3b6d6cf94243c58eae42bbd1aa5b9eaeba0907b71b7036aa43586e9d", 0x3b, 0x4000, 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) utime(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffe) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) 09:39:09 executing program 4: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x8400, 0x0) sendto$unix(r0, &(0x7f0000000080)="acf2b3a12907d48e15f0ab42c2d35238de81fa9e223bb93f37e8f929536b4f3b6d6cf94243c58eae42bbd1aa5b9eaeba0907b71b7036aa43586e9d", 0x3b, 0x4000, 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) utime(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffe) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) 09:39:09 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='\x1a3\x99ovw\x00\xc8\x9e\xdc\xff\xdd\xd5n\x92\x15\x0eU\x1f|E\xb7N\xa8\xde\bG', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) [ 804.214033] binder: release 4750:4760 transaction 796 out, still active 09:39:09 executing program 3: mkdir(&(0x7f0000000100)='./file0\x00', 0x6) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = fcntl$getown(r0, 0x9) sched_rr_get_interval(r1, &(0x7f0000000180)) r2 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000000)) ioctl$sock_inet_SIOCRTMSG(r2, 0x890d, &(0x7f0000000080)={0x0, {0x2, 0x4e24, @empty}, {0x2, 0x4e24, @rand_addr=0x81}, {0x2, 0x4e24, @multicast1}, 0x100, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000040)='ip6gretap0\x00', 0x1, 0x8d, 0x7fff}) lseek(r0, 0x0, 0x400000000000001) 09:39:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) 09:39:09 executing program 5: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) 09:39:09 executing program 4: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x8400, 0x0) sendto$unix(r0, &(0x7f0000000080)="acf2b3a12907d48e15f0ab42c2d35238de81fa9e223bb93f37e8f929536b4f3b6d6cf94243c58eae42bbd1aa5b9eaeba0907b71b7036aa43586e9d", 0x3b, 0x4000, 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) utime(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffe) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 804.403208] binder: release 4764:4774 transaction 799 out, still active [ 804.431728] binder: 4807:4808 ioctl c018620b 0 returned -14 09:39:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) 09:39:10 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000040)) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:10 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x2, 0x4) lseek(r0, 0x0, 0x400000000000001) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000040)=0xc5a000000000000, 0x4) fstat(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getgid() setxattr$system_posix_acl(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000440)={{}, {0x1, 0x4}, [{0x2, 0x4, r2}], {0x4, 0x2}, [{0x8, 0x5, r3}, {0x8, 0x7, r4}], {}, {0x20, 0x2}}, 0x3c, 0x1) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e20, 0x2, @local, 0x9}}, 0x0, 0x1f, 0x0, "0f1d26c9fcda4a2dc9cbcfd257227adf13e57585ac9b47dee8fe051015d9d627985298fd08c9f628bb6883971c7612dc9520de146a8d76c6a017910e066ec1aa0045ddbf600496aa49097da052261c46"}, 0xd8) 09:39:10 executing program 4: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x8400, 0x0) sendto$unix(r0, &(0x7f0000000080)="acf2b3a12907d48e15f0ab42c2d35238de81fa9e223bb93f37e8f929536b4f3b6d6cf94243c58eae42bbd1aa5b9eaeba0907b71b7036aa43586e9d", 0x3b, 0x4000, 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) utime(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffe) 09:39:10 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x200, 0x0) ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f0000000100)={0x7, 0xffff}) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_int(r0, 0x29, 0x3a, &(0x7f0000000040)=0x4000, 0x4) 09:39:10 executing program 4: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x8400, 0x0) sendto$unix(r0, &(0x7f0000000080)="acf2b3a12907d48e15f0ab42c2d35238de81fa9e223bb93f37e8f929536b4f3b6d6cf94243c58eae42bbd1aa5b9eaeba0907b71b7036aa43586e9d", 0x3b, 0x4000, 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) utime(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffe) [ 804.530257] binder: release 4779:4784 transaction 802 out, still active [ 804.550998] binder: 4817:4820 ioctl c018620b 0 returned -14 09:39:10 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.current\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) ioctl$BLKIOMIN(r0, 0x1278, &(0x7f0000000040)) lseek(r1, 0x0, 0x400000000000001) 09:39:10 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:39:10 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x3707, 0x4) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x6}, 0x2ce) [ 804.575322] binder: 4824:4826 ioctl c018620b 0 returned -14 09:39:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) 09:39:10 executing program 4: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x8400, 0x0) sendto$unix(r0, &(0x7f0000000080)="acf2b3a12907d48e15f0ab42c2d35238de81fa9e223bb93f37e8f929536b4f3b6d6cf94243c58eae42bbd1aa5b9eaeba0907b71b7036aa43586e9d", 0x3b, 0x4000, 0x0, 0x0) utime(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffe) 09:39:10 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000000c0)={{{@in=@multicast1, @in6=@mcast1}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000000040)=0xe8) connect$inet6(r0, &(0x7f0000000080), 0x1c) [ 805.223596] binder: release 4807:4815 transaction 805 out, still active [ 805.253203] binder: 4849:4850 ioctl c018620b 0 returned -14 09:39:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)}) [ 805.358575] binder: 4817:4831 ioctl c018620b 0 returned -14 [ 805.385479] binder: release 4824:4838 transaction 811 out, still active [ 805.400285] binder: 4857:4858 ioctl c018620b 0 returned -14 09:39:10 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}]}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:10 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x90000, 0x0) openat$cgroup_ro(r0, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) 09:39:10 executing program 4: openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x8400, 0x0) utime(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffe) 09:39:10 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r1 = dup3(r0, r0, 0x80000) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000140)=@mangle={'mangle\x00', 0x1f, 0x6, 0x698, 0x500, 0x1d8, 0xc0, 0x0, 0x418, 0x600, 0x600, 0x600, 0x600, 0x600, 0x6, &(0x7f00000000c0), {[{{@uncond, 0x0, 0x98, 0xc0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x1}}, @common=@addrtype={0x30, 'addrtype\x00', 0x0, {0x404, 0x1}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x2, 0x1}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x29}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0xffffffff, 'bond_slave_0\x00', 'caif0\x00', {0xff}, {}, 0x2e, 0x2, 0x20}, 0x0, 0x218, 0x240, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x1}}, @common=@inet=@hashlimit3={0x158, 'hashlimit\x00', 0x3, {'bridge_slave_0\x00', {0x9, 0xd7d2, 0x8, 0x4, 0x2, 0x8, 0x401}, 0x7f}}]}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x38}}}, {{@ip={@broadcast, @loopback, 0x0, 0xffffffff, 'bridge_slave_1\x00', 'veth1\x00', {}, {}, 0x7f, 0x1, 0x24}, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@icmp={0x28, 'icmp\x00', 0x0, {0x0, 0x15c, 0x5}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@uncond, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@set={0x40, 'set\x00', 0x0, {{0x8, [0xd8, 0x4, 0x2, 0xa49, 0x8001, 0xb6d], 0x3, 0xffff}}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x6f8) connect$inet6(r0, &(0x7f0000000080), 0x1c) [ 805.410840] binder: 4817:4859 BC_ACQUIRE_DONE node 818 has no pending acquire request [ 805.419176] binder: release 4817:4831 transaction 808 out, still active [ 805.426592] binder: release 4817:4855 transaction 817 out, still active [ 805.442151] binder: unexpected work type, 4, not freed [ 805.454251] binder: undelivered TRANSACTION_COMPLETE 09:39:10 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000000)={{{@in6=@empty, @in6=@loopback}}, {{@in6=@local}, 0x0, @in=@initdev}}, &(0x7f0000000100)=0xe8) 09:39:11 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x800, 0x0) ioctl$KDSKBLED(r1, 0x4b65, 0xffffffff) 09:39:11 executing program 4: utime(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffe) 09:39:11 executing program 4: utime(0x0, 0xfffffffffffffffe) [ 805.461367] binder: 4863:4867 ioctl c018620b 0 returned -14 [ 805.513684] binder: 4863:4879 BC_ACQUIRE_DONE node 824 has no pending acquire request 09:39:11 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) accept4$inet6(r0, &(0x7f0000000040), &(0x7f00000000c0)=0x1c, 0x80000) 09:39:11 executing program 4: utime(0x0, 0xfffffffffffffffe) utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x401, 0x9919}) 09:39:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 806.059008] binder: release 4849:4853 transaction 814 out, still active [ 806.099512] binder: 4892:4894 ioctl c018620b 0 returned -14 09:39:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) [ 806.206867] binder: release 4857:4866 transaction 820 out, still active [ 806.227479] binder: 4899:4900 ioctl c018620b 0 returned -14 09:39:11 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000480)="725966958e258bae1bc404bbbac4f4834a6c48bf386ae020402a054f18a6365d7101829ce0bd309f5e81e57240e67df024db13ddbbe28deb4762cfdb280397154d05fc1cabf728c93d5b777f2579601a8233f92efb5ce53067d9540843213d54c268a5a2620ec360f9fb17396cf91dc7305b846ae2c80af1fdae0d05a0c4132df59cce34f85e5c42c218a9f327b2619f17149ab8073be225b9ef55837933e6143b9255ef79db5f46356fbda0a781a1847cc58606d4141ec2547e5be4520a5c1423c861cfa7718d54dd74c02841263a0ad3b3badbea5e107ca3dfb5743151b594d7aebdbdf1b07d6643ed6ddbfdc1e324801d", 0xf2}], 0x1, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x80, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000180)={0xfffffffffffffea0, 0x21, 0x1}, 0x4) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="423f4bfe", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$int_out(0xffffffffffffffff, 0x5462, &(0x7f0000000080)) 09:39:11 executing program 3: lsetxattr$security_ima(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.ima\x00', &(0x7f00000000c0)=@ng={0x4, 0x11, "863e68dc6f2335683cf58e86aa7e"}, 0x10, 0x2) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000300)='ocfs2\x00', 0x4, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) 09:39:11 executing program 4: utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x2, 0xffffffff}) utime(0x0, 0xfffffffffffffffe) 09:39:11 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000040)=0xffffffff7fffffff, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:39:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 806.261373] binder: 4863:4901 ioctl c018620b 0 returned -14 [ 806.267730] binder: 4863:4901 BC_ACQUIRE_DONE node 830 has no pending acquire request [ 806.275981] binder: release 4863:4901 transaction 829 out, still active [ 806.282809] binder: unexpected work type, 4, not freed [ 806.288167] binder: undelivered TRANSACTION_COMPLETE 09:39:11 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x4000, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='rose0\x00', 0x10) 09:39:11 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) write$P9_RREADDIR(r0, &(0x7f0000000180)={0xe4, 0x29, 0x1, {0x1, [{{0x6, 0x4, 0x5}, 0xdf5, 0x2, 0x7, './file0'}, {{0x2, 0x3, 0x3}, 0x7, 0x4, 0x7, './file0'}, {{0x8, 0x2, 0x1}, 0xb8, 0x10000, 0x7, './file1'}, {{0x20, 0x1, 0x6}, 0x20, 0x0, 0x7, './file0'}, {{0x14, 0x1, 0x6}, 0x4, 0xcdc, 0x7, './file0'}, {{0x40, 0x4, 0x5}, 0x7, 0xab78, 0x7, './file0'}, {{0x2, 0x2, 0x7}, 0x0, 0x3, 0x7, './file0'}]}}, 0xe4) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) [ 806.306911] binder: release 4863:4879 transaction 823 out, still active [ 806.320240] binder: unexpected work type, 4, not freed [ 806.325950] binder: 4910:4914 ioctl c018620b 0 returned -14 [ 806.333121] binder: 4907:4915 ioctl c018620b 0 returned -14 [ 806.339773] binder: undelivered TRANSACTION_COMPLETE 09:39:11 executing program 4: utime(0x0, 0xfffffffffffffffe) mkdir(&(0x7f0000000000)='./file0\x00', 0x18) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = accept$inet(0xffffffffffffff9c, &(0x7f0000000080)={0x2, 0x0, @initdev}, &(0x7f00000000c0)=0x10) fcntl$dupfd(r0, 0xebf58bffcf8b7bf5, r1) 09:39:11 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x10, 0x0, &(0x7f0000000680)=[@clear_death={0x400c630f, 0x4, 0x1}], 0x0, 0x0, 0x0}) 09:39:11 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) fcntl$notify(r0, 0x402, 0x11) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x3) r1 = pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, r1) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000023c0)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f0000002400)={r0, 0x0, 0x400, 0x0, 0x6}) [ 806.375130] binder: 4910:4920 unknown command -28623038 [ 806.381484] binder: 4910:4920 ioctl c0306201 200003c0 returned -22 09:39:11 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) lseek(r0, 0x0, 0x400000000000001) [ 806.415691] binder: 4930:4931 ioctl c018620b 0 returned -14 [ 806.469087] binder: 4930:4937 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 09:39:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) 09:39:12 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = accept4(0xffffffffffffff9c, &(0x7f00000042c0)=@in={0x2, 0x0, @local}, &(0x7f0000004340)=0x80, 0x80000) sendmmsg(r0, &(0x7f0000004c40)=[{{&(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x1, 0x2, 0x4, 0x3, {0xa, 0x4e23, 0x5, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x80000000}}}, 0x80, &(0x7f0000002500)=[{&(0x7f0000000080)="2ac44d780a80ada464d126eff0b6d0ae9b78f2407a71a9ad2ba40c6274d8149eac479747376c927aac9f0cf92017698f3146b1a9962a8403960e48a06fcd96949435b15a869f2b567aaace8e2178e6b55a854913ce6270fbe3b11495dec99161a40e9de32c074e6d4bcba809af7a6a434fb9870ae15c393fd8ab6b74304fb9d8ca392a69b2161ef890d570756f78d856c27be0c5e1d1a9352a9b30aacca4054539b79f732df1877154a0adeddbe046b89d77859f21ad664857a5a339d7c5b83b52d487f6d395eeac99226dc067a6602ccb1ec9c621c5bdd0b24a213aa9cf5075a59a2bee69dc9dad8d5fb545f0859dc0a9c69900007054fca953cdd7446a877735c89c37fab63a82cddcce6f52b0081bb1ce8c0a858e204fc397dd403dcc83341086ca243e0b75e970c0732729f125d59e300da0708ac6e9d76233785a48f17451973363718840725ac48d9b8e02341198f6afd59d49f14c49a93cfcfc3dd46a87b10dc2e5d1cf832b9369008bd2b67ae2f98b1eb501cae3640ce2e3a392dffd9366bb8723da5072885f78e23d9aa197c2cfedfa524237ac0edbeac624756022c9943a897310fe29de344946462f5da8bae93a64f32bd1457c21cb456a6c15e70345ef8f23a1cb33b4f65156cb8a47564e49060f9662d948a0902539a28657571adfc87bfd0926e512224c54c18a3feba5c04f65ec685dbd09dbe5b4a20c06fd63c707be2878fb296bc9432d739d609754f14fc595aeb89b8599efe420105768b2ded65b76a09f97e31e7e52f6e4c2fd3034d550ac9816b48aaf01c1b085e6b5f65d79f6f701162bb5f76a5766f0f4ba1034d85299cde93dc2656721d690bd5fd5e56eba564aee551d6f992db2cdeb70e379f287348e7ffb2737f5ded8a07163c17a40c28a477b7782710503fa0c221143450f52b1a7dee780d000e8afd42e36cd742974997e99b156dd690c3e0b2bbba813a708ebe40ce1daf3ca2810d89002b758cc676b41981d10252a7abfd4b065a18a4fd1ec5ce0a4de1f6a82a68462129078b2b826b55a6a1e100695b27adc1ad2faa5a94ca63e518143cc18f8c6cf78a344337c5673dab15db7c8c194e9c5a375e967286c8fc053ce0f021bf32cd9b36bdbe8225b845b51bdf35a578b813d23877ca4f721337152e104582721465968985c223e2c4a46a4133ff5f1464d46907b8f5d79664bfdc07f82ceaec2ee682a83ad6bd309d450b71991d4b9d1deac6f2e62eff449769ab1edfaafd7f93601fbf6ae9e3093aa78efbc9b5f1fcffe751094cf1bb04d513053d9b6ea604ceb8073a977a880dbf11a38ac0e6c8eeae4e5c72c7d4ac6bd8acae25b93d9664a1376b26cb6d68cdabb68377544f355fbc75273fb427682683625fd2af308ce0d9fd243cb5d1272ab3dce69045702a81d471c25e17e7304fb5d61694509d62a0a129ca6ae0d8418ba4ad01c86ca8a1348566f8a62dda926a828b957d329fc332daad0c8e965788ac938c275492065cea63a8227fc72eb7f8434cdfbe2e32dfcdde3d857034ff7a101471984742d5819b26132fe28e7c20fa789074f80f9f497fe4c4baa57834e86f26174698ac3b0414c2385bd1bd2730182c26fd6500976f5ca29475e4d04be6595e80d7dcf6b4da6bbbc34322fccfe4bc9aa5f039ebd5c0fa5b6b36b6d0ec512b2647de64a440e515141a691a882c9424ec42fdd9d132f421fa843bbad9b37a011abe0e851f5c08c333583592c5f3e0b1b59b78f6f6b22cbf66c2a14ee3b0500c9e3ada86f30f603da30b11688daafc31a8a244e39043fb17c4c7dea990af20d82940fb746ae16153636cd45ba561670fdc62caa0f50f39aebd95826e32e4415684146ca7cfea4bb07dd0f7253383665e6aadca195b4a30c53084c13a0ae2b1234df9eec0be878df76b9fdab52a8f943483f999ac8414651e082dad5435b641882823a650649ba8981c3f0c193beabbb15b2b443788cdea46d25d6f19904f4ce86de132dcaaa600177074dcfdbf1fcdf99063aef8227936fed1425cc8e520b2b95104f734294afa25dec462ffbcb882b5eb024fc6819f3d13fb96b293e1456d3169e7b486e72cd0121cb18711e9d8f8116ab5ccde301ccbac235317a07ca8fd1b59348732ace8af1c96b7cbee309ec5352fa36865e599042ef5aa35a8d315b8ab434c2d05ca59229966214aa67e3d1af984d766b4a20156028ace93afb90e2f02c65fda1ef02a6ef613e4c546959b0ad4b8d3f70bd85ccb15bda20dacf65abe2a2b413e0f8975cc1536f2e2e9113b326709549e4f5e21383f21360acb8d6c1b38e185b206552548ea74f0c3cb3ed820d413cd90e8f037ce833528cd9260c4975f3d827fe64de5b84def04cd2648583790354d9f610f8a63de4505e501fd293fd27b38baf1ddb4145d01f134db45161b3b49d5fcf6c372baeefa8969eb24a517a8dd31aaebf195b3ff4c57787fcb115d8958675cc52e568972a682a6575dd03246924292c3930a78777f66761460616597c1596e73187dd2fa87dd7eacda91c9fb7cfe081cb6dabe18395ec4cdd5773a94fe31260e48ce8b2d2da1ec1459f84e25b7835c7610bac4895ac0615993a9cfe49e4f56d0c11ce9c5b8c523b8f6f5a7a90f835aea0b489a6e10cf0a9b57f29c66cc7034de43749d90dd159c838832136bb7f4d90930bf74ab9bf581a02cf47bf79bac36b7059ec40670076f06bf802ea4e8806560c33bf84c543c4e0125c722f20cf79bcb208eaae8d2b04ec818f97b759a240e5de88d71df7e2fbb0f91816db3cc14e53f0632c22c7aaf557a9186ae435ef03661926c0ac71e06a2a5d5e05672c4217923b9ebdc964cbb7108bf0809cb6a9b33f77b2e6df9e7837055771bc9c2ba414ab53cc9f949c9cc2f6b35131ab69cb88d97be1293b1ceeacd3b555d47b50dbcb499abe3eea9befbf2a60332a8a47ca2c80d2b18d097dea4b3d5ed5209b8eb84619c92dc66e7dc7260ee0290b51919257203b96039808d84a35447cc2ac75c77f940831f7780185677dda100addfb2e985ff37761df3c217cc1ac0a33b98331eb97b0a86b20f6a2fa54abe5bf7424775cb26e16484e7eb454e0491ca54e778df8c4dcd8e41a5ee61e9445be3f14e434b071540ec93e1ebc59950034b5074da28636c7f20bc930578eb487bbcba5f498e1b4a545f1d472d4e6a8452b26ab200ffd9269950ef4fffdba9137a6d3f83f54407c7196239cb9b19e1b950f6a83f1909fc3371df0cb2ffdc956d7eb6ee450b7543186951270b3b0ea77471404e649c99bf410a78f19e4b28c5e1d07cf624f6a8a8b62f5fd33b01276bbdb760bbf10bc977f653a48b872a850c11a61fa8abfb7e47f4970b53e65e5286d14f7828767287a89a719c6ab15e0c217df611c797b55484a01b3137b0dedd144d44eb959c10d8f7cecdc2a33b95ae3c16030ec8e31b9f94ca35cf001cdfdb8938e48e309581ae468c33cb3a4dad0efe44fa4963646ac3c9978657fc6274e90d3136f85abdce78295a89de8d71078849219216a71879a321a41bf3cc58989729083cf7a455fb703510d928559d4e9c451a04716743327650ac52819d437c3decceda9d6f4c8b811f2845c45b1c7be9e1faa2cc7c32631757e4c0f3be7ad2baec26feec7aba59e0a4494b3b8da1aa8089490b1f839d54c30b41bd15400f94eddeabc226ffca466fdc62920bf62ff672302ab5c12c269c4fc0e314c1ae730aaada733d6fe262ed362384ce90452db28dbdcbe46a2ec53ef01f56ad154e299c2b3786db4dd6c55479fe309409eaf6acc173177fed80123ee8e612e79e5a71e0597419680cb7b4778d2c27a6acb6ec9f40b99bc9a9a759caf3a1fffc6d4bb7c2406346011500bfdc64044cb70de804c8fcc6ae41d4d80da7547760d0a7d24f88c39309c4cdbeea27332e2c2addf336783de1e7543439fbcbb69726856e0030d29c90e6d46968d022ceb41e2aa4378bb5558238b2dbeba29792a65014d9a646d21539f5360341465ad673c7058d96c3f3be0357e3b93bb438652b08986872aae01514dbfb65d1948d3de9a492ac653feb3df1490901bae50e5e36e5d4dbc79149d83b81215e003520888332c22174ae5f9018593a2bb4edd8305e9ce5e59b802c59f23f1c22cecb6eee4129df9ea38952621d17f3c162cd6dfd201d907744ec2e188f3a883bee9beba6df49c773257506ec7b1a3910a8b322bf71c3330a83053f26120903f22019d1638e239c672ea9b3f3ce5967d8acc61461142f8deebeb6d1ed4a0b89e770e8e69f23352373d377fdc4e996189db0ca79cc0d53fb3afad3020176c66594c9bbaa1242dae1cfabad3fc0d18b2047cdc3a3ec664a761716bc64b296c9311d89aa1ab0ed302e924abdcf1b46cc0bed1bcae97c7a9fcad1d62f5b1cc6404f880f37247d860420edf5c137353f295d62a9140aedda3c363fffe17dc80cdbd6685e36761d867caa2fe8437b2bc2de5d9d80635c887d4426709c57693bc70735a4d60ede8c7999c863874610b5a2fd5e9fc0138e7a200e4f1fae4877311ddf3ee38bb93d3a5fb21986973b6e5e33350ba4527adbac89f40b75e6302fd16fb88a1b7395f94634405388283582fce1f66332c75f09e0ca3b48ea90cac4fb7a99973e9df1300291a82968d55b885504b9f919f9afd1ccb20ad37df5c3d161de51a2d0422857a5f3a3f0b2179a13cb9d30700cee94af5c123f483d777dfd9316e2a030f7aa37b8391d485e2bdfa93b50d89e092b30fe9221bdd7f0e1d38152251b99cac742fe07a8a57dbe085e6d3d042a748983daedcb941b72212ec86dc82c0382b632dbe2cf0c04e07dbba546f000cfa7b21af5c92c6d9b465066ba68a52108d1aed3eb49d05f82d1cd3480056c93aab071591e74099512023b0e775b2581ae5330345d51682eb2bab45f9986788a16e0e9d88a176420348de117e11399df54930be983036eef4c15801445c0383a99d43f094bc647d31a25ff08549f752bfe2921fe363d5b0a99c9fc63e32cd2037e6afa0bfbfe6020221f7e54f374079f8cf5e7a5d556a106897df8f2fca04c8c17624b8364d7d96926ae73b746b025d4a1329016bff83d7fae9666d73b71cbec7ebb5d071c0b4bd7c70bf7150dcce336eab00ef201d021c74521bb68df986af83da94a85310efb6ba3d078811a5fd40379bf4e352dfd309685db2dde5e993f535c5b5089d6c84909822bf72a2057ddb931dd316c25b6b65c8c3d811e35d5af713ce5fd69cd57c4701a54a7ec9facdbbce332cfa88d8c0a1db60ff80c35bc8a5edf010c443f4b3ba454f2aa95cd518344508f4f205ea79dd0da547624831ce6783cf2237f460b70a315cca1d77d71973f703eba4de7d84fe19b7dbd35290a32728a9df9458ca05d5959b97834eb244ab13261f6b339365e2249b8b6b9c351a74c9b3158628181e0a511ff642912de00051632d5e18cbb1c19ccaed6b94a33922c37d3f9ef2090c268b8892721ac26fc6583ad594e471e9cf4013fe152ad62c1ad3ff4b9bec3ce922caac3277f3a4176bc9b0dfb72dce702af5c55f802a4e5fd147376add2e47a0f6fdeb3529bcbf1a022039d52fab19f016641e057d6d35bb8b6574af8726ab7d864348d2f649f97fabb0af7ad3067d50069edd86cf659cca0f6216cb69a964920158fe72ec06a0dd89de18533d826fe474094c2be5fdcbd6242fc129a34f97b0539272acb208d383def49dbc60eb9166af384d2f131ecea1531ffe197c8c1f16d51e3d68c24805e8bd0c5bac25696f4cf10040e0901bb53ae61a", 0x1000}, {&(0x7f0000001080)="0caad5682a02ac0a7cd5d310befa71adb65e0613cba9213a9f95b08a9d9554c21b7c49e363fbbb72b58cf6f904569d2302c7bab6c32a4fd1a5e8e2a6ac08da9454ca73ecf137f94e4c6a5024ea327aa9f1574d51baaa3b6142f86cd8e1ee691604aa650395dd01d3eb2caba9e47039d5ddb11e9be06459a8e1d87ee1eed50946ef60d66c87248f55593c692a366663cfa528c8f1d95efe60efcfa903854457cee4f6330a44a66597", 0xa8}, {&(0x7f0000001140)="02ab57f91d487c6dfa5f0adb58d59a96124e9321f1aa07007d96c8bfceea7aa66a4203d8ecfebafd79176b83900f62ca96ad5473593668d8675582ccf90eeb896f864bf8a1554cc0f1361dbe2c1d11aad6ad1c1ff0191d2a92402be93d6634ea80ee0e15c8928588e30e7264f43b4a3d56dfe031660e6e69386f96c69812b809a78e8939323f9f7b639b3fcf0d0358b31ea2e4eaf5ee079d50515aae9e84e993f5cdcb730e28baac97877da2958367df1ad7ffb8a2c110619e70b0edcd8e23f8be3b0f4d81e1b66c01ce82499577254e6f27240f2cdfe9d8aa2473d674", 0xdd}, {&(0x7f0000001240)="d61cc36aedb7d9301680853ab92b85573d2a82014f0c8e4b939d0bd6f204073b72b465fb859c542029cfa32690e6d535243915352865e9736be694349818ef9cb64b23c2cc0a9a1e659b9c452c03a6050bdef18bfe987b4140c1e961cd898f0e7a4527277ad6866e7744db523295d8fbec8651b5a205e84e18f0a809c4cdfb9a88ef015aa260fe9133df6c10e6083c581a4218b1646042d91a55bb246cc8", 0x9e}, {&(0x7f0000003e80)="f49c411df7741da1859faae467b30c28a6a706c551557599a003011813ec16c0794f0954643bf99e9032eaca53becfae1890", 0x32}, {&(0x7f0000001340)="fe23d79933871f6b56789d1449ad6f01c8232d4891eb8c623fad96538fd168fe2a9ad0fd89f5fe226e1e53c5c54811f49a9f9cd573447b5c4cf74bdef658beb82bc6214e79d386247ba9416fa42bf3a65adf053dd96d18ea71df1c611d7b00300157b606d07712bc917f1a9573eb12da848453cf3f3c157096d18b8c5569b22de107a58a2af19e696dd03c7141c13027616c1b9fc049519c329294bf9df60b700991b31daa73c89572dba743806ffe1e73e2ad23cc01df5f", 0xb8}, {&(0x7f0000001400)="1c10f304aa617b28fb9e3afb61aea79b1d1a05b01f5dbcf085d94b34cf9255d68667f57786d0dc73245198b8d0f12392749f495c121147abb75f301f29bdc2c4dd993f22728ecd3ac97a6f51fe3d3ebebc2d59060540e13149fe28c269a8ad587d46afbbdd6a0093c30e2afd456be63c1f8cc21007798e350fcc97f857d68cc037b0ba361991eaf1f68412c865f042c4175204807964c34d9ff10f56ee039681402747ec0307f850b62aa6fc3be22f1b2cae9f5db79d0325385066ef370b00a63ea49fcafcb22ea8c6a6b3a6660f6ded4ef642218c5df8872ac4e41d24c0abfbbe7391cebe72f40a26", 0xe9}, {&(0x7f0000001500)="58d7a546f9bb23926091326056443a599dca9714bd79a8d4e891dec842576419cffb1a590ddeddfe9ec8c616c441cb3ea167ba868ca8199d2b609d7dd9e7a6d5c3dd0d9afdade2cbfef448214e76842e91ccdda9e42a414e44602a3753c123fd1ac446b2c6373ba02103c1ada6d961788e575781d76e92b949de5b37ed6d6bf18192daa1f4bf64a730fb0c85336df392b151948de3255213657d132f3910e4aae46d96051040051f71122f7b24e14e6587349e5a558ad2bd7f9c3b5d8126107aac66a0aacaed9648b4273440e2a1b7093be97982abfd179e88526d00af2e4e885d555ec66c87b693649b4f041c0b220ff35e5a4ce4a7b5fa4d527e4701fd4b0899ce011a9fe96737289e7731e3948e9dbf38f4076474bc5394b8473931ce56f7ea1ce42c88a88b82596ce4ae087f6dd5b0a086a7ae77910adfa66d5041b5e035ab72a32cc74ed841ff987b3d3d233843075571cd37f4b952d58fa865cbc13f19a16c74212a54295fc2260e4d0454a0826128ae62c3b93be5019c2bbd4ce0d4c22735f2759bdc1fb21605cee11139a13a83d6686008ea37ea780d6e30d7cc25c483d4e4082c2c816425ac28ca8e69300e68a732739e506377ae3f4cf9f593324ca3c6f25b88ae91d7fe60ce855baae97a2359be1ef07aa974b3b4baf84f0d9ffd742225980f6d0d1f1716877ccd4726a65ee916957726bdcf254f8d45882ed387003522719ee9272e5f10a01d381054390c2f4f4242e7d66a3f20ee2e5c8a90ca80ee5320b603d174f198de808a97bd8d02ebc323d0287387358715ab54bb25d3e41d8ed59df1981d67d82d981526d304f5576d629f581c97b3f3a3a2b2f071911bad9b6b895a871ae308f0ffa9061adce43880319bd22911f1a0ef50a5686e6f7e7c81bb41a0b8daaec8b3efff171f762ae1bb7e1eb57a4a13b483a8c8b80e65189171660eeab635dfc02ebca75bfab691617ec9336d7bc5c450e47b8bb2664ad3ae59f8abdaf0847a70ecf3d2560cc1a3fb47c9ca1b67dab65a98bbf3c79b6b0dfdfab3de5422da6fbf3aee6643a0504e09af09be6181739c2a45c18db2f10a13f5ef27d57d462fe155cab127d6945bbc9e8f78fc70a6a7ca9b6e2144498b019fadda1a30d92f8a917461d1cf1493ccb3f971ff1ecda159c65e998daed8201be360b22faa86bcd823848c32b676cb19323e69727c52ece670e61f2f95602f6dd2f7710d4b069044352b258637418d31c90fb400df46ae1bd22a4221cd00fd05f9c86409d92655827ed64ff7cf123e1e1005233032d2ab98801c19f5a5df4dcbe9cd0d83cdf7f679e38ff1c0cb01fb16ba8a5ea95ac73d8bc58726f97ee6759c220583a81d5ccc3decd39ee8d02b35c87281111cb2e6c0f221a62e38d4a71933f69571e3a6e9cd7edf853ba9f495011f42765e039d153f9ae7ddf012ba8c0724253311db3640c5a720c4f4d32abdc15ab246688e7738f4f46e2e4ec0455a223821affa18268d48a5089820c9cb2ec3ae5b5eccca94d94de33f4c6db0df6f1108eed991806d2becb96f4eda66d4d47e7f05faf529566856e127b0ca14618afecb4e54b0085ba4804cf71004583fea993b9d223ab4f42271d06524598211c70b0d201d306a04b1ba9fb3b0aaccb98b8efff1bdec35314dae8a0a9381a4b2f5e6223b9edbc022cbf01270aeb42e1b79e442225730addce98eaa6d8631a4b13d9316c356f5e803e1e12094b586cf0098c359d4a3361e7a476dbededb2343513f9bb344f43c52bd6ac16ebad4962d50f31e4314b2148f982034e032622d046103fa1ab0b3dc6cee534b1e5b169a976eb5439885a3fc4548b1058af704408085910894090b3e136868bc6f655b222016511bc6336879c4338e67feffa05413906799d1ab5611aa1fb7b3bda37a3ad3f47fbf5f119de24fe1ee9f88e4b50f6819c6df9274f421cba69d973836f262f2ebf6e5ba6addcdac78024b4be7653149a1caeb39e9773c6a8e24ad0344c7f52996a494bf06911c4e37a50b81fe4c3e59a5daa6725fa3ec96bced25d10f97c6371a7e0e1861a51157130eb161f990dd4a8e4ae6b63a94647cb46d2ec3d5930d69e53e6e5c267856d42eb2fdb44bd6d753d0fd9ebc2239ad1045cfcaeb942dd2f3558f5dabb967246e256803418ad4ca3b0c9dbe07112236e1868f9a176f2423f9055d19b4a40f5c37342cdf10a5810f187ee351669d094b1aa115eff25d95ed11acba597a161a28f1fa295bde159393f6c83084125ba44b1fad000c46833a4949a99286db47095aafc05f529b9a938cf55ffba3e4932379188fa795bf4cd9883a26da2191d8dd8399049b92066785b2a84d0e2e076964f5f33ac1a853e4072ffd7765784697b542d043db07ec4fb178d498a7ad829898128a7a245f7acfd9b3132d2459ab6c55cd43ff12ce4c82daac28c219495c6d12ae6dfc945aa871fde81c34278683d87448599e263d94e82e151e31f14c8e7a57e35a86e952b164f6a291df5efc8f7a0e6fde5df35ad47f15d185e93cb2994a94284639167b74f03e02e5b4f1e0e05e42d012cb1439079da1c8d4379974dd0a99f76019164c73c62b5110b1423c2609d328c6620ed3cdcd81d83f50486e9e6e526ce55cbb9716b2abc0e4eae67499c57034e440e1e13fa9b13fab4ca3ad368e237549020b7dadb1352bfaaaa29429888f68c1ca95328dc48d590ecb2e6f2a9d17f1ec01c10bf76189a6c8f969d4626fe2282981a1bfa7f4381bc0651036249ca9606288f799ab678a856c535707be207ae8f3781aac432fdf41ccd90db7cea08e2074e0964a053fe5cc971ea7d3b43a3abe277048df420da3468ae71f616ffa15ded67e4b29815bdd57acc3c5b0522097a61b00916a51fea34f476b85d05c3266a52bcb82c56a6b464dec03f754133f5cec3b55eb777404cd8990309ba71a74c3be857ffad80e9bab0aae13a6f59b56616e261316ca984a9d7f210d50ff5e5fb6e36e952cfa67fba0742eceadf4270593c1914e5ffd22ea7ce7cd81a8ee86bcfb51ba73daf95063ccab440966575146eb5baa75e21b222ec14eaadefc083133d3aa09d7b9879022b29e06c825a88544c509ec155c9f218bf5806ef97e7b3007bb02d6298ee843e23d81c452ebeb7e2df65820c1da93343ef480e567f73c9ae29993779b0ed9f91cb81967a7fb9f90ab2327240f739db28bf18d1aa54dae3d18302ef9e8189cc34a3ca1bef06066f9253ce622b286387933d3b2ef53704749ea3221203f5f0c3a2ab1b67d6cc5313db100aaa43e9acf4844176e0f054d54c225edc9e8cfb093e872eceabdb8b61f808fbd1d5cabbc8ec03db0c93b9f5f3470f239bbf40f65c72f8eec2e5e800adf796cce954161f000797ccd255d6b81473ebc2edafba7c9d3ee61ec629cbe62894dc88d0d1dcface297f22ba0e2de7d4462eb3d4b74c0c256e14e7fd100ec1a2212055b990c18aa875511fbf1ee4e37c317d8b1ab65a8ad7251cd4cda6a556d1840a03b9f42b80acd91f521e9ce67ff227aa1a33f5b2c3e8744696aef2a88fb20c42a4a5b5d0dce9b9e8676c6e59617253ca79d0f28e51a6aff3b31ba87837aaf1e204159b09aa7c090fc65fc06ce278402a2859f6e1a4c319f04b93f06475b2f67c3d2269a3aeca33c196c7e908a2393d2cbd2748b3b89a00e2d11af8db7d9018ffce4143931aff2a18cb977d1dd1a2619956e949ba8d53ee99e955c8d0050b255079854bc857ab7c5d2dd3499e4506612e011fa60c3275a6cc0c9ba2855bf94869aa86a2fe61e3dd8bbea7d9338667cfe1086128d17a7ba7d42fcd9b488d3189ac459635e8b8a5aa07fcda1df50eb7982c9e9c92f38131282f5862ac09c425fc9ab9a42f9c5a5cf5cceb4195c1343f3d53bf2f5121cb15b315da066f234bf516866fd4db43e4760b606b714cd27912d5398d5543217955ebe50257c8f0a3f9d6a02b1892585843cf5f4bca0b306feaab6d92218833e82eba3ce7d2a4ff1baa5b2f9fba66048ad806f94849ea7fd84f61101574ac2a814e6c0f433d4268b2ab33ff6f2f684fed83b2bffba2b55da65171abf2addfc52cd723cde2d77673243134b567c904721e04f72bd5084b0fd48999d8729b9931c91b4e177895ba05e168e17128ab638fb926f9f842ed9c076aa82ba73649139df7a07b0c4a5a7364957e70cbc2ee3be4aa668f72e0c387913bd440bd37f4d73c452bae88dad2c21e92f64e6505e2a2b20398d8e501ae49541e3811bf88596eac3999331493151d8be9d90bc62490fc5beff484d5cfe83447079223ca5b1710e779429af35d8b700e849a333af31e16ddd9eea6fba4213cac6ce57761bae1631d2f7d60941ce27f5211f3f4af17964d08e0c14e0c5b74c924f143547563857d29ecff2e9da83af26a31d49205b5cb4589044b36d36bb186a3db1665adc061adc9f69d7775db942aecf8a84375b19da78a4135d6ea1db34458eb645b6d1f5eaab935380542bfc57cc0c2cb05d6faec3f480bfcdce4df619e5c3f2e859ea8716f1c29ba19cb033bc9099773a7e9e879dc2e9d11c93693c7784506f717d7a50ca8b94888f068c8a9938c9c5124ca3273cd3ed7b188dc6c14710724f4245f84bbfee527ba64d580a433a55d66a1bc462b57d0900714f1bc6c4893f3b9ca14375d7276c797c8b4a36b20c188913e6950910fc99d135a97cd7b708ec62cc6d1c78611a80ef21e0f5e403b00c269702105da8dcd7a254a5bd5b2b3b3815f47b3ce78b8082ea3d71812caa8152a07c9b44a4ed951aff85f8a1ee50d6b7d171e1f6b08fccedee030492b24a22a9db1b690c662ba061db5fcc33fd6d48ad7a405d59739c19fb8fb62beccc2b250033693fb17756325813c314d8caa45451023db1b4ba706c096680c201211ca50f7631de4be00b14cafdc7a057dc8996f6b192faa97c84f0905b0dfac1e0a3a9c863bbc8f90a97ec6ce4fb4c57113b968162629a755dbb5865a25d90162162a627006754cfae83bb81c11a2a7c32cabae4d791dd80559c94f710b036f5c3fd0ee0274758cf263421cdd571aa9782afc6c95d94e666e37cd54f53bac257a8f8a03751481ccc47a481540d7e71fbd97945948d418f88a7486b756bd39ed60f34e9d8c8d156c54cad4a7fca389a7005711afa74dc224db6b2642a44aebbd059ef38205b042012d81d6c6ad85dbd46a67d11f1005136182297fe9837e4a19b5af28e68ecc532d6bd442b250f707be3385e7a3a357ac078084af4024bfd9d9788f047729a23990e691300b0bcd3b67d1a8c595676d10ee466bdaa7ea274245a998a58207ae8ee1383f42803edcaafd6f52632600e198cbde4b62b3fec382649aede47c331c0d24839513b183370aa86300726990f5a51dce6a04557225ecb5e38c264321f562f651e18856613a41a726c484d7e51a5c1a999b2c8aa5ddbfe3530bb798cdca9370ea2b7695168e180849eb96bef7a9641678b35f6fcfa5ad77c3f13cf1bfea905f23d24516ce6baef659b987424746914cc9c7319c3fc5582d123118aa30d5b722c5db24b365fed2b928861db9bedc8209974f29e5b8cb853a14a568a3788036294c0fe6ea0eddda2fcc6952aa35c68011a623ec6156381f2a88eb9b11bb6d0bf64659e64f488449f8be85fa818e37b19499d3500eeb4c06569c83d353572e0dd7410061e85dd6ea721c7e238d361d84261b09defb8b919b67b011b2665ca4dcb0314170e3e020010f1ee022f4901e2748db8a55aa198f572cca2d6179dcbeea532e7fb6b431ec3b5a7e7cfb815c419ff", 0x1000}], 0x8, &(0x7f0000002580)=[{0x50, 0x117, 0x4, "199fcc41851eaca5aa320f70c73cdbee771f95c9fb1c0caef8f8a2e645e06b57cf66f0eb46b7b81724d60946f9f8a6acdc295b8ed21c621c1c"}, {0x50, 0x102, 0x7, "3b00bd41ee34a6ed0580e9dbe738f4c155a833029ff02144d48b28992ce30a94683df547abd9fdb32d1b8fea1779188b09dc2b73da748bb4b1"}, {0xa8, 0x88, 0x7f7, "4dfef1f719a9b426f8d91d7517cac8a9a24415f97a2080031c038ef1670aa0d94c71070ce6da2e3686a8f8000c0e9f56697e0a35fdefda7c555ce08ac5d44e08195a3c9f9899e13575c96d9bf0dea0b856167547738d58fc2d8e6fd9d30cef91790db7431e4f3240ef32feb22c83ad1211b2b623e45c2148771ecbc5d783826cc50be40000000000000000000000000000"}], 0x148}, 0xfff}, {{&(0x7f0000002700)=@l2={0x1f, 0x40, {0xfff, 0xfffffffffffffff8, 0x5, 0x1, 0x8, 0x2}, 0x10001, 0x7}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000002780)="76d3edc8679eca32dc1dc1f975b8907002640d12846a8071a5e38ef61814c32572209e34f24106b079f240eaab", 0x2d}, {&(0x7f00000027c0)="0ac82d2d975a9463f04f49a5d4e35d8a7fc9c1e170bbe7d0cf1408a34dc1816a057b2763002796ced79d5b56bc6dcc3d9c02e405652c929f1351627012b739e83db8ff7baf8c330b7bd1973efaa78d9aae113f6df026801bdd8ba98b970c2d9fef2b72b2fca29edb2b80f88a4e584586e48e13a1a70ad7dbb83cca8e319f6e", 0x7f}, {&(0x7f0000002840)="130d16567c5f64e6316a13510b4014dd2091cbcbb0619fe67747ad416b96c9eb9a91abc70bf5bde1e41e028c50104f77fd41a7ac45ef2522ffc1aaaadf6cdb9247fb74bc9dcb8a6ade83bfef30fc892b561df4ac3e6d31a4330a6161e3e0fab7590c750d48fd424de4fed5642faf05cb5f291e326379148c296f626fe32a155d6755ec0966ddb9c0ec399157c5ebda989a4990b476441653f9c24140b096c57f8702d0a561d4d550fee48a85b543c0aeae2a02f148dba262c5f5839f7761a6daf82bb13f2a46cd2ee04d888ccfc4f21ae473552317e7bdad8105316f5abae876befefe3d", 0xe4}, {&(0x7f0000002940)="f7345db28fe64b1406f53b5b9fe6b3d5a6a1", 0x12}, {&(0x7f0000002980)="5cd3784c98b37af47cdee79e16f8c4b848674d5bf2b26480d58661783c7c8fabe5ba40bab8e390f501ad507a62cda48ecc306b17f4b4ebe767a48e9f1759e86f2741efef3054571cfbb87c7e1e2c501983b378ca24c1092cffbb1bbdaaceb6bda25d7f2a3e67b49fcf23c9", 0x6b}, {&(0x7f0000002a00)="292c27bb647c241e175ada3cde31056f6c7126ee07ebd073799b8ce2a2be99085f28188e76a68e052e03ece9ec856a17518e3406334facd37997eb05611003218c836e276ab348efa09ad83ef19749739c1bf5b8a8cdc033948362eebe3158dd0946c4e981440eea6db7f0a3390d198b36490bda8d20477ccdea870837065256e88ef9da84a9572fb9e50df3871b9a821f33faebc63c69f662f26ebd5030fc5de65aa9f9d65c51fee00c", 0xaa}, {&(0x7f0000002ac0)="4a0f29affda1861f4dd6a23f978c5158f8b636241d4594cc8027a80a1110de39f906fad9d12dbb5cddcaf15689c393", 0x2f}], 0x7, &(0x7f0000002b80)=[{0xe8, 0x119, 0x3, "5e2ff7b3f4460c50ccbe67d2978cd83a17858b64a14d28bd1fc1feb63aa0bb0a3364006f0a419a9aec94c3f1a6fe0ecfe6234f971ec24f08fbbd827566052c771fbf8bb204a17f44b23f94f321bea203c2cccf7754cb092a07828abd32896da07fb8041da9941b6583706368dec3bfbefce9971b8bd6961fd7cbcbfa8407f7df66f8fc767ae8a0bb4dec70da47e999fbf4d495aa642547abe3fb35e673286ad830442f9d5b30c894969825bf5a0cac28d41bbae34485ff2507d577bb9975666ce8abcd112016257ffd5dbb4fd3ce88033e0a5261be109797"}, {0x1010, 0x11, 0x9, "567e49fed9fee8a67ed82e0a8a7e26e62e8323d66e57b88ac01c42c2511826913d3d9839c500b7d10e016e5869b70bccda0ddf520b3fd1091425b42d8a3f3cbbed0ceddcddc9b869057c3f71f3844bff341251e96c0e3e28b9c52e099bb3f9b74dc7de37361c377823ff7265975984941a77083023cdcf5e36f20dbe457fab2fc187ea34fe99c0e7a9e00ae871f0213f4fdcce6f963f4591aa2bc8e502e2d618d725764c90460291febad3e6557b717af2db9e3514f0ffe3667be780d6efc8fee0bd822fce3c9939180268351ffbe46f1c4990ae5f52551705c08f72a2fb4dc3ad59ac7a8df99c40fd8d1f885aa9fbf04b998c4279f42ec5c1473d93e2b9f5bb2eae8b6fd79ccde1c05950b4e7808e164d5fb550512fe6779f585cd762ba370cf4220a3f70f076eb84abe37f2b487b19fffb8ec83523e6117a08d7cbaa679718606a3d296134eeceaa9a4502042c7ed3483e64e69314eed5af9948bf999c8e5d10134b4bef67e8105674210cd38c09837be0eb66609cce646e2fcf75f670b8b38ccd6c4f3d749a8ec509899996809731bb2629375cbcb982e65f1aaba37b248540bee60f0a312cd9559bd2c6f3d2c8f9686e44399b9942c0137320d813cd9a3006a4e040b558a23f77599ca522d9b194cd57124d39f8441bc4d635f1a2c07a9c7439f225cac4d5c57b6d9e533260f8365bc8e48211add0670bf8112780390ff3edc21474e234411b369c8e262cddadc950d912b1b68380c917a6cd781ec0b1d245ebbae619e5c67f9c5eb369848b8e52c6d766903f95f74b633f4559e6983126e7101ba4eeb42044ccc9dca553ada5a16bc1284ec1f9e96e913e3a4ac330f2d552913d3ee47cba6caddda4d23dbf82bde034e9b9a2a7f1a82d99377325fa1d47c1131ab166176ddd65dd88382c013c93c16b1f788e0e7daeb47a3713d8d33b853da80307011526befe25d00d2fef7b589791a7531e4859e59f84a46d79ed8916c047a57a55d21165bf86d8b8329861b4a80ed5040e85b6d9318417e125ce09721cb78c11e7f9e0edfbcfbea6e2c400c97843a989650f567ff14353a1350879cf5cd11475c9133ecf21dfde66a2f1b402cf8bf72865e217a7961d1c6415f4dc8d87d309e0ee4fbc98cb7fdced73032fcd1bd69a1a386efdcb3f2cd15564d14e3bab7252f489dbd6f4d883c89f02e1887cc0735394981c7ae28b0a5dbe5e4969d44ff73000ea8fdbaac8e1f322ca5147403408e18e6ecbf35ac50ab5078c74cb77dfeb7359a919937654101863bca0131d424fdc4fd44d29e8e63da832a0c31a9dfdff9581ad7ddd2849fa7c3b4057a784c4a28f961befead55846e46aa9bd4d8c6be3dd97ba0759b05ac09078fa837104f7acad061624377f948ffbcf28eb4cee82155e1278a8137ce2bb1eae62bcffc49945eee9cda07bc64c167a6222064940885f53b3ba91e9ab1bc40a4673fd02e13ea00aaf0e0bd4524242b7f2333d22baa6afccac8007218f0133c33e3ec788aae5992142d9326b816f00707fadeea0a4070efb65de0d347839de8003b65d08a9038ff564a25a43e2edeaaa49d911d5753ed4e836c8da37b07e1a30899c0c13baad62a8e7836a58f251955912e37c248c2cefeefb74344b90b9787339921bc7914f467bb2efa164f7b6996afefbedc7fa2d5ef3ca03f492f5b2c2e3fce04665855f264d567b96eb6e668444406c322cfa1501e07313d55b97b3fc1922292c7b2dc0559c7f3facaf864a9134b57317cb3218115d141e84019d5d1cc727d0657e0d5aa28dec21f657c8f619cff6829e423c6d9c4cf0fef45f7aec1d24a9529e5ee1d22fb271fb1477882fc0328434fd14c328e41a5f811f7093d81bfbea8a95f1cac97cb3da3137e053131915e80d4739a56172aa083cba1f66502da75343adb819e7b0976175348d25bc8c80b50c2f2d647a1805be77e12964c1cb514d3a8d13a40136fc4d18e082cecd9a7f467e799a9a8db6439637400324712d83cd1512494062c609276971008abd8aced80be0577204a23b058ec5963d7a7f396ce0846a876e81f28ce77dd71d000f814145491ab57c902637e55641b3505aa70e91b3726002f78f4e3f063021a26804a697f5a35a1934af4699d322039662f4f05686350d81f5603261476ce7da054f68ebeb037c0cef233a6afe1fa0c273540f4d292206defd3367dfe8cab7c0d187ce679f2acac4afc76c7855c5d149bf392c08a6010b6fd6ea3184b99f0522d4ea23d5d68374df278f2c8245b4c30e31c877a50c0cd2ea505b78a9b8816c7dca90ca598dee40783a6352f25edfa9eac6d3f3b30e116b0585c713c94c346ca779be858a5d48ba53cde27d553a6f840291d9bd0d07237f34aff91cc8a2c17225e2ad30bcb5b6514e5e2ce7349dea39693d8e853513895b02f906dd5fd1a7832725c8127eb6f9a85b57b7bb671f2e553830991d4e5804c8172577aaa23e489249aa6c8a8ab63f9e50f1f203838a96e99a15a296c25e87f3a195e79ee7fdcad99d0161f0de1d81636b75c06427f33d1fa9bd0230ae517062a259469ed1556d862506b3c0427a233807bf70463d3b807db3daf3b1fae2cdeb1f612f061928db0f637d75ac44d3d81a1dcdea08b58556fd22eafcbb8954e4de166d14b022d90daadcde284a15e7487a6f3640596c08326d8aa174e368b86fc06f2aac5f6669e70f6a1c4a08f0c8d23a501fe549333adf0c87a263481a7c27123707a814b5368d829d1779e60547ac84f2dfb835d6e70912a0cc35f1de74ce9e01e6bfa11cc2c3a6c6e9f39ab46378047307b87ebe8836694f7872039f925afbde58a5d09be9eefbf0b7771796e8f3917e5abbafeaa662bac0cc78819dd4f6a26559185c758315537468edad7619d18b95dc9a75647d3a4458d66e427448a5f0e45e01a7e2fe113d2e2aff477ac907edf3c8912cf51309bee0cd154574b4da2630960daf4c6d5c22e6b8808ba69e3de61fcea7c8d93c2b7272586ecc3379e15a0f7d004c50226d30027153e7a68cd0f0cd39a87eaf417acf1e30ed767438ed2777a29e1f4237bff33f126fdc839283346f379724b42b3b31cea34952aef2d342103a506902d33f02e171c6391f9ef0073ac6332a5969f99cb4668f1ff2111a96d54d5761ed585486dd31978f7fcdb447d86439b2fffc6bad6d99dda6a9c6ce7d893b1b82caf2f5dde20dfdfd60e84daec9c1d5fb0a0b6df08cc974851eb968274078778452ac19889c6efd34375425450191414dfa5fbd7e9102ee23c10075d3859bb9f9460c01626920e8ecf86df101479b1a68c710534a6ec7484da07e911e126a72346a3da552684c57a0fbb3532b17229a913ae357f737884e42e92d91de7b066d8ec5a415c873d4484ceab5dc4dcfcfe127408d4117ed05a2013917ef724a14d879d41dc7a0d6d1f12ff09870f4e6e8e8dc5ac3b473cd32c369bf507ea2959f3db04c8f3a9fae44508e26870cf010fb4306ee58d062eddd2d4f8e037c07754e7655046614d67addb0a5063b8c89cd16a7c46a20c5de285214ff47ee8d247184c39f1ce70bd5cab7a1cd6e7b001e9d6e844ebcaaff7c804656187988fa84b571d58b31988e0b0806b079cdca3e5a06f9ad4e6c5bbfb955d25fdca805f2262cc0325e0fbd068367849ca2863904e8db3d1977827d7550dadc24887f5369cf59ed6cb652b50b4301e6dedf3593101079ce1a5ddacdf8661fe1cdf474f256b9842f7f10144f37cb602535c55cbbb827bb157cd10c00e86d9fe116bc948fa5c1abd177c42652ca6f42ec4c1cca4005e23bdb40cd8cdedba76deb1765e4cbbea08bf4983549b7e59a2b4dbe6908fd379d713c6717ec7801adf71d10830707e21b6e104794285c89d3d340c5d3dc5ef44a401dcd26977f363207685324ddf463042c6b35eafb2a1305f0972e9792ca22fd5b08a978cb5818da79140a50c042bd1059edd78722fcace0ee477f75b66a8f354be89b2ef42b3542719726a38be86113a85e5a9ba6c0e29ceaec61dea95c4cca8b6573325a7b6b731d442b466955b68d23f6bfe46a775a575dd8d98471cd0132912fe876c1c0a6980d766bfd989dbb5188f1526c0af35595d41c1504499a37574ac67c7970d2cdc8cd4e48f7c5d18e3dc2740fc3dd0d62528e87ce0f2a8591ed5dc6393ed4799c39378a3aed9a5c5f184dae10ab0b323144f3c58c121938f6d5c32685d219a1ae1d237a90a7979adbb2a4dfcb2dbb014174813f69fb38e454b1eb50388821697376d87542feebcbd13e5e1996a2435e1f0d03f89843bd4de949ec144790adb09de038b301eee8106db79c98b9f50706f7c71ec9a230d7cd33cd0b9df4c6e0f25e9abd1b970d7933710483c13da0950801b01f223c2cde18722e294f22c4bb6c9e0beeffeba9cc3780be4f4f058f1a6551362bbe129ac1697353fba8457c8e69f4db9db4f0530d6c52b7a466bb1a0f4fcbae9fbdf039c8d7f7c14a363fbec8c9adaa6734f8bd0a3bc164187d248c367655354d6af1cf30c9b96a7bdcec9240535e3d2fb3104d629355ebdac97c8bf4e0bd9e1f15696f81aa6cd9e6670cea7803995025c1ba00056ff17b0542379a22506c0e42593fec6250c196c820b0d72ea46fe05697fcfe8adea6008262145edaecd9b56325920c3ef0ad0c1a9fe723801e068df91a5e7d0f7bed753e854a9148924bc92ef61d0aeb1faddff404b0a66e09b3eee42f4daa37b9e9a2de53311c2269c532da82ef736c6d7db22251e8d51fcc3a081873471a21421c9e9a5f3a1eeecf718fa21d967d74ef34dbc7f8c7d0e7323fca4a350fd3dc7f7acd41d33067783a4ae2231d29a7be9ca19d9f3f95af4644923d45c5617c2129ea9f20a4d1e67fab669896c912a21a57054cc98bb07f07a2ea727a78b05a24e657dd613ac0560a9baabb150838811b64c6e61bc2403d4b9a78ca158b13020c3cfbf5ca39d316decd986d6d3bc5039b3dc73c4281bba76cef19395d8b5004bdf18d840bd8e38ee591f7fe6824a726841ccb03c6bca0e8d7772510409d122c699e08faba2a4af256b163fa52852d78b60550b09cc4586332f6b06e44be9db5a4c7d151bebf326ca8b07e342e4e2a858f8b6bd4f216db528695e09da81c81da3e3dabdcccb9f32b343ed93e01b1b604670a8c09b3e1f0e7cf8cb0a943a30b7e8ee2a7d17481eecfd7defa5e94ec66e6a0104c866a36991059d7d408fdba2ba3da2fa1255edde02ab847f4b15f82f24094945814ef43698d531eb654978273dfd99a15549cce1acae458d815318c1272c3973a5386a7b64ec0fe764870065c45ed6d1b6a4dd6dc4f8d1748188805c4dbd904fe462b0af89ce08c7800a166f9d03e5ca1dfb9670df21ec22567a44e5a80ce775c0960f76b23e243ce26b1787209bada07a5cc424895c895154426a90d93d7d577ef61c614c2f5ef0289bb0c8632e8a78156f3d35f7ab49e05f3c783ab0005655e9a726f9760101790d4cc2a4db563358bee360774b63f5f4b43c23a29bfcbec49c67bb3dc744a3acbd259602fc67f5580ca8efd73387a1a56df9f61adf69d3cc29bd625275cd98acddf8ee1979ea089b22bd99b52bb7a1f0aaf8aec2d971058e2c37646b2fff7f3500d25a79c1482b132f2742a61585dc4ad59712e00e8ce0e76dd4d649f01fd2423234b4060eff13e657c26b60e2f890ae199659aad1ae18e0abaaae28522931f558edeea81e605c4a41eebfdf1774746240fc9b408132744a96b6a6ae6159508359fdf54a87e672654bd43214e75be8dffe42feaf98d6e80c122"}, {0xe0, 0x11, 0x2, "39ac19cfd3ca422935ddf3908e5d6fc481102170afe4c3d7ae7acc69ced8637e188868f293ea697355fe7cf20816f9f97351d1d12f3852aad7ef4c2d65708be1d567935ed4e604f0c6a53226ad351e5887d8e5cbd0061c8fe660a52f2a889a9d3d1652bd6f8d815b0991cf0c57bffc2eb86626290c5da541b5eed9515abdb3cc0bc76cd5bc34ae7c6a72e63ed03152bedbab041f0ebae5d3641131e50d6ef0fc7cad8ecb76e0eb5e3b3377e0f782b710b12700ff3ec4cfb2c0c768075e12de54913d884a83b369988a0d3e6a87d1b411"}, {0x58, 0x0, 0xd7, "95fe9abc913d93e1ae3d9946398434ca6d6d1d672bf1c66c16a279db64fa700f7435d56feb8b2fe6fa89eb0ef8445b0dab785ae8309415861ece19f64c22d2bd7f098efe"}, {0x40, 0x10f, 0x5, "e5a1998e8f357cb1d99857df4f9c4b61de79e0c0c12ec8716b7d0babd9d40594f36cb8e143aa9635ee68"}, {0x40, 0x1ff, 0x4, "36f02bdeb9c18d4c26f9efee601544351d501e483e1bb81c0a00f0f26aa2e79d2c8c277b6eca5bb5fa"}, {0x30, 0x109, 0x8ac7a55, "82b06259debc210aa38bb3eea22b599fd949e3479c8c4b3cec0d51aa734b"}], 0x12e0}, 0x7fffffff}, {{&(0x7f0000004380)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x1, 0x4, {0xa, 0x4e22, 0x5, @dev={0xfe, 0x80, [], 0xa}, 0x7}}}, 0x80, &(0x7f0000004500)=[{&(0x7f0000004400)="7993287cf90810fa36a1c42e14d15958007d340cdf6db053386dc0a55eb26bf8eb8c6cfb3c1115879bfa416e7ad0e10838123317ed7ea8f81a2a7f99fa723b002a70710ffea86abacae31d989c68a6b131aea2857d55ef6f5caafd962500784c40f99408a56b9b029993a9277f55558929663f237377088c05695628fb128cd36dfb5fbb683044ecccb6d4d68a4b67fd31bb580e6dbfa154a464c1aa05c9fecd79d3e757aa545adecd9b45c5daa992eefd0b15dbc4942231c8d5630e54d207b204bb829223b2d0f593f577335488971f", 0xd0}], 0x1, &(0x7f0000004540)=[{0x30, 0x119, 0x0, "cf8ce0f66e4cd06059dc30582c3323cc4721f194286ddc20ffbc"}, {0x108, 0x103, 0x5, "7824564e597d8230189f60a99546c07fb72c6eb67e3cda68a4bf2b5a0697c56fa2f70f71d9ddbfc86d432f90eae152f274777bf3816d233214542a9e0ee56826062c29640f50667823b87e6fb8c48a7e3bff103ae449034959189a497601fd90804aeee75ccfcf2f1dd9c608917d84f819ce999c98d754e3dc3d3f5c6ebe94f2ff2a88ee7800a3ae2ea04754dacc4d60ba2259ab5791593101d424f4d38983b54dc558ff5f2a433b42914dd18138c9292fce7c0360bf88176a39c6b3d07525471c8ec63d1e73de53d379eec14274320ca394cc756a4f5c40cfe18585fffce2ea7dea8721ffbaeb52160081e048699716925f0db7d6"}, {0x18, 0x1, 0x3e, "1edc"}, {0x108, 0x3a, 0x2, "11c6efaa90a2c872151207658b736fab4b3abba9b0a4d313188f056ec9f93528d3e6e75070ebc097a2e503d7d91d3d7e392990f2c7f7b80d6c72e85c50331b8cfc508900b3e9f3301ca2a96a6b1d3b11314d893e1da6b8f8184ade7fa40e882d6ba3ce017bc48d2a5b97b0073defc337787389691065150aaab21f734e254ab70f3e76f6a72517170697711ace2ec79bb98fdaf6bdd2ca210115125b3c4e99708d9b84bb3158d343aeeece86ee39d8b64d4ace78c2bd3773e79f62581bc092b91b08599f8b873f013d45aa7848a9fc75004e15e22e6c5ffdfcb9571b1214a56cd0ecfc2d9e428c5847c3545e4f14c0064bdf16e36b"}], 0x258}, 0x100000001}, {{&(0x7f00000047c0)=@un=@abs={0x1, 0x0, 0x4e23}, 0x80, &(0x7f0000004880)=[{&(0x7f0000004840)}], 0x1, &(0x7f00000048c0)=[{0xf8, 0x11f, 0x3, "5aab8281b54c35f6e06c983a41d642a372c746de3791f7fbc134300651604a814b8187f065942d6c2ebbd34fe83396fa197f78d840428a9a25d9820a7de5a6780e08f649156e7655254724643ae23403683da472d4fe0438567875801f54215ac57cdd88e0098b18d55287a24fe9c6f5a69dfdd34f7b2756fee93e87ac36537e195832bce204054a195cb555e8e2e78e98143b7c46baa07dbefea3c7ffe047cbcec6929156d40cbff346355900ee28da9d4b9eb60f2e793ee959a6e9f1504fcd9b769c50c50b558d13891ce7399a3f5a70b27a649b8cb7710790a0e062928783a83f"}, {0xc8, 0x10f, 0x8, "db0f2fdf37be5a1fab47533f5ea23c4a8597fadfaa56734148693c882cc230c544296d08d64cefe2328399bb221fac3a895aa6ebef68d496257796d050063f164d9f634382bbd8701c49e044f9fa85a4aa21404a555491ffb14df1b6c81f6121beadc95d2dfe7bc4ee40598c0dc81b53d929650976e408103095b2fe597db24d8d7496964d7b74742685a22f4c3a50f55a86f0046b1ed0c069067998dd84ddbd37ffeab5fb4fe3cabe6a3d835486b59013d9c8a7a15150"}, {0x48, 0x10a, 0x2, "df2ba89b01862c33426b8010102d9ed14471b5cd15c5eb58b8876e84abe029c359486771c72067e94fd8b658c735c315a10a4da7"}, {0xc0, 0x11, 0x1, "dc55fc6bfd49ad628dce79b68ca62a8cc36a8843624f311c7d69d3675543c840acb81e78f2f7f8db64ae8f545c0fa85819bf5e6487b6c54f99a04e3147439f0601358fa58844b04d021c7ecdd07fd644e29a32b86699042ac3144c4a6de6400c12737909bd562b6f3a5c2b5ab4f4b5eaab7a0da34062169224dfe75c288230cfb13be399b761f70172a53d4036e61249dac934d57dd92bc3b9aa3048756ed6c64653cf6d32c6338f0644aa4274845e3f"}, {0x10, 0x105, 0xcb5}, {0x90, 0x11f, 0x10000, "0dba20d31a4e12670cb127195c7ebae4bb69d705d33cce18c031f46cc4d4973f34a4d829f982f5162b6b77123ac39ea5c1993f55ced8501e500747c739849bbdc95adf7bab1c8efc531dba228014af108d95526660b627f9727dab5a67c37a514693170d482ebbc9b7024d687737ab3b96a9e8b38971d8c822427cc1"}], 0x368}, 0xaa}], 0x4, 0x4000) utime(0x0, 0xfffffffffffffffe) 09:39:12 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40040, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000040)={0xf, 0x1f, 0x2, 0x8001}, 0xf) 09:39:12 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f00000000c0)='ufs\x00.\xf9\xfa\xe5\x8f\x02\x02;s\xc1\x90\x9e\x01\xf1>\xe2\xe0\xfd\x92\xde\x95\xec:I`[O1I\xa4\x9c\xf4r:\x00\x00\xc5\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\xf4\x89t3\x05g\x13\x9c\xfcF\xf0\x1a\x18', 0x20008, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) [ 807.033711] binder: release 4899:4903 transaction 832 out, still active [ 807.055098] binder: 4945:4948 ioctl c018620b 0 returned -14 [ 807.063473] binder: 4949:4950 ioctl c018620b 0 returned -14 09:39:12 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = pkey_alloc(0x0, 0x1) pkey_mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000009, r0) 09:39:12 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) mkdir(&(0x7f0000000040)='./file0\x00', 0x4) 09:39:12 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) fcntl$setflags(r0, 0x2, 0x1) 09:39:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) getpeername$unix(r1, &(0x7f0000000040)=@abs, &(0x7f00000000c0)=0x6e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 807.134713] binder: release 4907:4924 transaction 838 out, still active 09:39:12 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = open$dir(&(0x7f0000000000)='./file0\x00', 0x2, 0x1) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}}}, &(0x7f0000000080)=0xe8) r2 = getegid() fchownat(r0, &(0x7f0000000040)='./file0\x00', r1, r2, 0x1800) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r3, 0x0, 0x400000000000001) r4 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r4, 0x40505412, &(0x7f0000000380)={0x6, 0x7fffffff, 0x8, 0x0, 0x3}) 09:39:12 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x2a200, 0x0) ioctl$PPPIOCCONNECT(r0, 0x4004743a, &(0x7f0000000000)=0x1) utime(0x0, 0xfffffffffffffffe) 09:39:12 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x48ac00, 0x0) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f00000000c0)) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000100)={0x2, 'ifb0\x00', 0x2}, 0x18) 09:39:12 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x100, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'veth0_to_hsr\x00', 0x400}) [ 807.199561] binder: 4963:4967 ioctl c018620b 0 returned -14 09:39:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, &(0x7f00000007c0)}) 09:39:13 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000014, &(0x7f0000000040)=0x400100000001, 0xfffffffffffffe1c) connect$inet6(r0, &(0x7f0000000080), 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0xf51c, @empty, 0x6bb}, 0x1c) 09:39:13 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x8000, 0x80) r1 = syz_genetlink_get_family_id$tipc(0xfffffffffffffffe) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x200, 0x70bd29, 0x25dfdbff, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x1, 0x800, 0x8}}}, ["", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x40000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:13 executing program 4: pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x4000) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000100)={{{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6}}, &(0x7f0000000200)=0xe8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000700)={r0, 0x0, 0xea, 0x8e, &(0x7f0000000540)="e754753a68ccfd52b5ddd89119624e2d584a14d666edf19b66d5eb08fc77653072d001a44095393779d546ecd698d203d03859ae95eba5860b914e83f0f0537b54d69b33ad4a19b3bca97d6d3dea1ffbe874346069c67a44c5f4bb46d9ec56e44c60aaebe915f9f9ae1b91f6927067378e718cee797e6323b744807e90919751f12a0f44bfc4400207f6249bd4c212d7ccd6f87234da4df7f6676088f3ab32946f6fa1606f1668bb9b9ab2963af6772f86cc1ad2fbe16c0ee81b6861e072cc026047b180bddd15c8ffc2f254e8bf6d006510a73b99f8a2962d06bde90ebcf3076b4a5e7f8dae1b6dc3c7", &(0x7f0000000640)=""/142, 0xdcc}, 0x28) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r0, &(0x7f0000000880)="c4c38ad45e981512c609468940ff976403cfba335e09dcd64b0ec4bdb6f0d39b5b6a7efb39c9229ea30a49e0dd681d0b974e2848c2a8529d692f53597333bf4b0285bc7550fbad7051b50c5ef064e814dc6d95"}, 0x25d) fstat(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0}, &(0x7f0000000300)=0xc) lstat(&(0x7f0000000340)='./file1\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x80000, &(0x7f0000000900)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000160000,user_id=', @ANYRESDEC=r1, @ANYBLOB=',group_id=', @ANYRESDEC=r2, @ANYBLOB=',max_read=0x0000000000000008,max_read=0x0000000000000001,seclabel,pcr=00000000000000000002,euid>', @ANYRESDEC=r3, @ANYBLOB=',smackfshat=,fowner=', @ANYRESDEC=r4, @ANYBLOB="2c00e1f8e60b61316ab8e52cd92ff5f26e49f9677192c9fa4fe9f58423d0ef66a11ca600157bd84d3119dc2fe4f8bb5e3c9e46ffb2da042638"]) utime(0x0, 0xfffffffffffffffe) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x40) fcntl$dupfd(r5, 0x406, r0) 09:39:13 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) [ 807.862408] binder: 4945:4987 ioctl c018620b 0 returned -14 [ 807.869285] binder: release 4945:4987 transaction 853 out, still active [ 807.897456] binder: release 4949:4957 transaction 847 out, still active 09:39:13 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0x8000a, 0x5) setsockopt$sock_int(r1, 0x1, 0x1e, &(0x7f0000000000)=0x4, 0x4) lseek(r0, 0x0, 0x400000000000001) 09:39:13 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) write$UHID_DESTROY(r0, &(0x7f0000000040), 0x4) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x115) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000000c0)={0x0, 0x3, 0x6, 0x1}) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000100)) [ 807.912681] binder: 4993:4997 ioctl c018620b 0 returned -14 [ 807.931620] binder: release 4945:4955 transaction 844 out, still active [ 807.950683] binder: 4995:5001 ioctl c018620b 0 returned -14 09:39:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="09631040", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\n\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 09:39:13 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x801, 0x0) r1 = accept(r0, &(0x7f0000000180)=@x25, &(0x7f0000000080)=0xffffffffffffff74) fsetxattr$trusted_overlay_nlink(r1, &(0x7f0000000100)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'L+', 0x7f}, 0x28, 0x1) ioctl$KDSETMODE(r0, 0x4b3a, 0x800) [ 808.005977] binder: 4963:4983 ioctl c018620b 0 returned -14 [ 808.010432] binder: 4963:5017 BC_ACQUIRE_DONE node 860 has no pending acquire request [ 808.011034] binder: release 4963:4983 transaction 850 out, still active [ 808.030155] binder: release 4963:5014 transaction 859 out, still active [ 808.046987] binder: unexpected work type, 4, not freed 09:39:13 executing program 4: 09:39:13 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000000)=0xffff, 0x4) lseek(r0, 0x0, 0x400000000000001) 09:39:13 executing program 4: utime(0x0, 0xfffffffffffffffe) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) fsetxattr$security_ima(r0, &(0x7f0000000180)='security.ima\x00', &(0x7f00000001c0)=@md5={0x1, "592b37f1a6c509e2de665df2ec7f3096"}, 0x11, 0x3) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r1, &(0x7f0000000040)="5c568445891edd19e0eb03b3f027f7b82d945d40b2c0ed29d27bdba296903516042478b98648f3f190d6a7cb4df971ff9c51dce279407993397078c8785328b0b5f89813828b8ab0c8dc7b13ec1c3a3a47da35356b88ad92efaabb607d4229d871c11bc759c659c6bb34ba49", &(0x7f00000000c0)=""/75}, 0x18) [ 808.061638] binder: undelivered TRANSACTION_COMPLETE [ 808.073393] binder: 5020:5024 ioctl c018620b 0 returned -14 [ 808.121803] binder: 5020:5030 BC_ACQUIRE_DONE u0000000000000000 node 866 cookie mismatch 000000000a000000 != 0000000000000000 09:39:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 808.715387] binder: release 4993:5008 transaction 856 out, still active [ 808.740429] binder: 5036:5037 ioctl c018620b 0 returned -14 [ 808.741305] binder: 4995:5016 ioctl c018620b 0 returned -14 09:39:14 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000040)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0xfffffffffffffffd, @rand_addr, 0x1}, 0xfffffffffffffe77) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) 09:39:14 executing program 4: setxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64IPIN\x00', &(0x7f0000000080)='\x00', 0x1, 0x2) utime(0x0, 0xfffffffffffffffe) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000100)={0x200, 0x8, 0x4, 0x100000001}, 0x10) 09:39:14 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x4, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) 09:39:14 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, r0, 0xffff, 0x5, 0x7, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f00000002c0)={'ah\x00'}, &(0x7f0000000380)=0x1e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ptrace$poke(0x5, r2, &(0x7f00000000c0), 0xb0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="09631040", @ANYRES64=0x0, @ANYBLOB="0000000000000000f4154c54108253d0d065e7d5892612dd3a20050ef3980428a164d37b551173bac94a5b180605031dfc766c8b517a184f74d6c8ff83bd8957d4752f676095d24f53a5d2833a16"], 0x0, 0x0, 0x0}) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) 09:39:14 executing program 4: r0 = open(&(0x7f0000000000)='./file0\x00', 0x20800, 0x10) getpeername$inet(r0, &(0x7f0000000040)={0x2, 0x0, @empty}, &(0x7f0000000080)=0xffffffffffffff06) ioctl$RTC_PIE_ON(r0, 0x7005) getsockopt$packet_buf(r0, 0x107, 0xd, &(0x7f00000000c0)=""/88, &(0x7f0000000140)=0x58) 09:39:14 executing program 3: removexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)=@known='system.advise\x00') r0 = syz_open_procfs(0x0, &(0x7f0000000000)='setgroups\x00') pivot_root(&(0x7f0000000280)='.\x00', &(0x7f0000000380)='./file0\x00') ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f0000000100)="00deb4fe888b29851f71372691090e06a4cfe98e4f171972dc196c1f3435a301944805c13eff21") mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) accept(r0, &(0x7f00000001c0)=@nfc_llcp, &(0x7f0000000240)=0x80) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000180)=0xa449, 0xffffffffffffff4a) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x576c00000000000, 0x1, 0x8000, 0x11, 0x37}, 0x14) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x2) lseek(r2, 0x0, 0x400000000000001) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000400)) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0)='nbd\x00') [ 808.816611] binder: 5047:5049 ioctl c018620b 0 returned -14 [ 808.823979] binder: 5047:5049 ioctl c028660f 20000000 returned -22 09:39:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102002000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:14 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000080)=""/4096) mknod(&(0x7f0000000000)='./file0\x00', 0xa00, 0x40) getsockopt$inet_udp_int(r0, 0x11, 0x6f, &(0x7f0000001080), &(0x7f00000010c0)=0x4) 09:39:14 executing program 5: arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000040)=0x400100000004, 0x4) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x40, 0x0) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f00000000c0)=0x7ff) [ 808.880247] binder: 5020:5030 ioctl c018620b 0 returned -14 [ 808.887355] binder: release 5020:5030 transaction 865 out, still active [ 808.894948] binder: release 5020:5061 transaction 874 out, still active [ 808.916453] binder: unexpected work type, 4, not freed 09:39:14 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) lseek(r0, 0x0, 0x400000000000001) 09:39:14 executing program 4: utime(0x0, 0xfffffffffffffffe) lsetxattr$security_ima(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.ima\x00', &(0x7f0000000080)=@ng={0x4, 0x13, "176b4b00836aeac93c15ab1c9921e01ceeaa2f"}, 0x15, 0x2) [ 808.933175] binder: undelivered TRANSACTION_COMPLETE [ 808.942298] binder: 5068:5072 ioctl c018620b 0 returned -14 09:39:15 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x84000, 0x0) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f00000000c0)) socketpair(0x4, 0x2, 0x76e, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f0000000040)={0x1, 'vcan0\x00', 0x1}, 0x18) 09:39:15 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) ftruncate(r0, 0x1000) 09:39:15 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000200)='tls\x00', 0x4) r1 = socket$inet(0x2, 0x80000, 0x2) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='pids.current\x00', 0x0, 0x0) write$FUSE_STATFS(r2, &(0x7f0000000100)={0x60, 0xfffffffffffffff5, 0x1, {{0x401, 0x40, 0x800, 0x0, 0x81, 0x2, 0x5, 0x7fff}}}, 0xf) timerfd_gettime(r2, &(0x7f0000000180)) getpeername(r1, &(0x7f0000000000)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000080)=0x80) 09:39:15 executing program 1: ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) r0 = socket$unix(0x1, 0x5, 0x0) fgetxattr(r0, &(0x7f0000000000)=@random={'btrfs.', '}user\x00'}, &(0x7f0000000040)=""/164, 0xa4) [ 809.538561] binder: release 5036:5044 transaction 871 out, still active 09:39:15 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) r1 = dup3(r0, r0, 0x80000) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x12000}, 0xc, &(0x7f0000000080)={&(0x7f0000000480)={0x118, r2, 0x402, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0xac, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffff867}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_MEDIA={0x58, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfb36}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x63242fee}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}]}]}, 0x118}, 0x1, 0x0, 0x0, 0x90}, 0xc081) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) r1 = mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000008, 0x5010, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={r1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000000c0)=[@reply_sg={0x40486312, {{0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x38, 0x10, &(0x7f0000000040)=[@flat={0x73622a85, 0xb, r1, 0x2}, @fda={0x66646185, 0x9, 0x3, 0x3e}], &(0x7f0000000080)=[0x0, 0x78]}, 0x9}}, @free_buffer={0x40086303, r1}], 0xa5, 0x0, &(0x7f0000000480)="d3358f335ddffe42f68acb049f16cae378d490341ed8043178d75c52dae93e0efe6e45cb5503b4058db8ebd4f3736f481a31573d70d0e06141843bd55754e186e6d56d751465ff6143a742dfa528d5012581e01930ae3a919aabe4ab214effe59240381984f60b8b625a752316db0b36344f6971ca7a0c6ce6e92dd0c0ebac1bee4ea774eefb264324314db18b1d404f972af46342b15e41a65e7f1800158dd56cafd5e270"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:15 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)=0x0) fcntl$lock(r0, 0x27, &(0x7f00000000c0)={0x2, 0x7, 0x0, 0x81, r1}) [ 809.623383] binder: 5047:5107 ioctl c018620b 0 returned -14 [ 809.629736] binder: 5047:5060 ioctl c028660f 20000000 returned -22 [ 809.631976] binder: 5047:5108 BC_ACQUIRE_DONE node 884 has no pending acquire request [ 809.632640] binder: release 5047:5060 transaction 877 out, still active [ 809.653422] binder: release 5047:5107 transaction 883 out, still active [ 809.660795] binder: unexpected work type, 4, not freed [ 809.666087] binder: undelivered TRANSACTION_COMPLETE [ 809.682097] binder: 5112:5114 ioctl c018620b 0 returned -14 [ 809.688295] binder: 5111:5115 ioctl c018620b 0 returned -14 09:39:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x400000, 0x0) write$P9_RWSTAT(r1, &(0x7f0000000080)={0x7, 0x7f, 0x1}, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\a\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000100)={'syz_tun\x00', {0x2, 0x4e24, @empty}}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000180)={0x0, 0x70, 0x101, 0x1, 0x7, 0x9, 0x0, 0x3f, 0x10, 0x8, 0x0, 0xb0, 0xbadf, 0xee, 0x2326c5f2, 0xd72, 0x3, 0x8a38, 0x6, 0x6, 0x2, 0x101, 0x1, 0x42ae, 0x1, 0x6, 0x81, 0xffffffffffffff8b, 0x8, 0x6, 0x1, 0x78be, 0x10001, 0x0, 0x7, 0x9, 0x6, 0xd7dd, 0x0, 0x6, 0x1, @perf_bp={&(0x7f00000000c0), 0x2}, 0x1, 0x9, 0x200, 0x2, 0x7fffffff, 0xa46, 0xf12a}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) 09:39:15 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = signalfd(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffffe}, 0x8) fallocate(r0, 0x18, 0x800, 0x3) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) 09:39:15 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x8) ioctl$RTC_PIE_OFF(r0, 0x7006) r1 = pkey_alloc(0x0, 0x3) pkey_mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, r1) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_udp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) setsockopt$inet6_MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000080)={0x3, 0x1, 0xfb0, 0x1, 0x1}, 0xc) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000001180)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@loopback}}, &(0x7f0000001280)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000012c0)={{{@in=@local, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000013c0)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000001400)={{{@in=@rand_addr=0xfffffffffffffff8, @in=@rand_addr=0x5, 0x4e22, 0x6, 0x4e22, 0x3, 0x2, 0x80, 0x20, 0x29, r4, r5}, {0x400, 0x1f, 0x8, 0x81, 0x1ff, 0x61ab01a7, 0x1, 0xf4}, {0x5, 0x4d, 0x1, 0x8}, 0x0, 0x6e6bb4, 0x2, 0x1, 0x1}, {{@in6=@loopback, 0x4d2, 0x6c}, 0x2, @in=@remote, 0x3500, 0x2, 0x2, 0x5f9, 0x3, 0x4, 0x8000}}, 0xe8) 09:39:15 executing program 5: r0 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000000)='cgroup.type\x00', 0x2, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x30, 0x101002) fcntl$dupfd(r0, 0x0, r1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x1b, &(0x7f0000000040)=0x4000fffffffe, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) [ 809.737246] binder: 5068:5080 ioctl c018620b 0 returned -14 09:39:15 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000000)='fuse\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) 09:39:15 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x4000, 0x0) perf_event_open(&(0x7f0000000040)={0x4, 0x70, 0x40, 0x10000, 0xffff, 0x6, 0x0, 0xf0f, 0x20000, 0x8, 0x4, 0xd65c, 0x1, 0x100, 0x8, 0x4, 0x81, 0x9, 0x4, 0x1, 0x5, 0x8, 0x80000001, 0x8, 0x0, 0x1f, 0x97ea, 0x3, 0x1f, 0xffffffffffff3bae, 0x2, 0x6, 0xff, 0x4, 0x40, 0x401, 0x100000001, 0x4, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000000), 0x6}, 0x14404, 0xffff, 0x8001, 0x9, 0xfffffffffffffffa, 0x1, 0x3}, 0xffffffffffffffff, 0xd, r0, 0x2) 09:39:15 executing program 4: r0 = open(&(0x7f0000000140)='./file0\x00', 0x2000, 0xc0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000880}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, r1, 0x305, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffffffffffc}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000880}, 0x40) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x208000, 0x0) sendto$unix(r2, &(0x7f0000000040)="500daa88e16d607720d463aa0f6aa9e8fba849d33d43028e23c8b9d3a25b8f19e3d45ed11b173907b2711443ddc7eddd19da8362a50a6fe1c4c52ca21dc2502713971921f81445436e1ff3742f7032f235ce874dce8adbb6da286a7e9a8d5cd06e8a9f39497503bb56e8a5cf0d9c111f527b881e3ee5da943938d2ffe2e4f4e0", 0x80, 0x24044844, &(0x7f00000000c0)=@abs={0x131c693331f0a586, 0x0, 0x4e22}, 0x6e) recvmmsg(r0, &(0x7f0000002c40)=[{{&(0x7f0000000300)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000380)=""/215, 0xd7}, {&(0x7f0000000480)=""/236, 0xec}, {&(0x7f0000000580)=""/69, 0x45}, {&(0x7f0000000600)=""/33, 0x21}], 0x4}, 0xc9}, {{&(0x7f0000000680)=@can={0x1d, 0x0}, 0x80, &(0x7f00000009c0)=[{&(0x7f0000000700)=""/116, 0x74}, {&(0x7f0000000780)=""/149, 0x95}, {&(0x7f0000000840)=""/152, 0x98}, {&(0x7f0000000900)=""/186, 0xba}], 0x4, &(0x7f0000000a00)=""/176, 0xb0}, 0xee}, {{&(0x7f0000000ac0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f0000002c00)=[{&(0x7f0000000b40)=""/171, 0xab}, {&(0x7f0000000c00)=""/4096, 0x1000}, {&(0x7f0000001c00)=""/4096, 0x1000}], 0x3}, 0x8}], 0x3, 0x62, &(0x7f0000002d00)) sendmsg$nl_route_sched(r0, &(0x7f0000002e00)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x6000000}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d40)=@deltfilter={0x4c, 0x2d, 0x721, 0x70bd2c, 0x25dfdbff, {0x0, r3, {0xffff, 0xf}, {0x0, 0xa}, {0xb, 0x7}}, [@TCA_RATE={0x8, 0x5, {0xe02, 0x6}}, @filter_kind_options=@f_route={{0xc, 0x1, 'route\x00'}, {0xc, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0x95}]}}, @TCA_CHAIN={0x8, 0xb, 0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) 09:39:15 executing program 4: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f00000000c0)) utime(0x0, 0xfffffffffffffffe) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0xc000, 0x0) vmsplice(r1, &(0x7f0000001400)=[{&(0x7f0000000100)="40dd8d03025a22ed3625ee56e2dfe51b84d1f6f43259995c2ed604cb074cbbfa9d740c1b440b13", 0x27}, {&(0x7f0000000140)="6980d29a257e82d4b0140b04d757aba47e32f6b053cb84b3d7f873fb0d1537e68a67b8b3705f15d8dbfa77baf5dee73d566e32805e1e6c270b12a9c6fb2cc7bd937db7d985a23ede2f144cea8e68632294a1e98fdc7662ba4bd38ea3", 0x5c}, {&(0x7f00000001c0)="eed8ad26894c57c8ff2e50af12c29f05e87822c1b07ffe29b46e", 0x1a}, {&(0x7f0000000200)="5f920849a1b34d7afc37408daf02a22a72f9730e9a29a00575b2b19dd0a364097375f0672f50c8c2fa162230f990e3c4bebac90907e7e2f6fff1c7c4d57cfb796637a0abea350c5310bc695d3111460ce52a6652d065fe9a7b9f05540b31cdd2751b75925ac7caac9f6302f341a38618cbcf72f847f91bcb41100aca2d9d25f55dcc675bdc1f522f4fe5c4fe6b1a7a9c6e9dcc1dee4e3192bcebb23f435dadd0d7e4e9a4cf2da56b175becc0f8bd1edb846e203edc9e4690faee4b9665211483db225ad2d842b10c49708078026d3e1d3f0ec10a4c2b141393a17faf8ea3", 0xde}, {&(0x7f0000000300)="d4157a010bed02a27b0b7c665a038a00ecaadc9b1c3cc0daf990a5b4981f7b62e7d47a05b43d71fdb4950ced01ed3ad895d7b7769e8315916fe8ba4d3dc09c03f655cb812749bf7e8a2e778f620d93a9d8305fa8de08e652274590fb1672c09bfb9a6285486d65a92a2306435cd67af0c7e8b1c699dc794b3b3dba93a5af30de72e5bd9042e24a52aa723ecbaec3720b1e1ae4cf77fae00d9b833f273b506f7c1659fe97e0c0c3cced0c679e92837fa96b07898c350dc1dd2027176edd40c0a7e1", 0xc1}, {&(0x7f0000000400)="06c418f34d5a66e8f3e6927e2d401f3f69f25f9258397ac3fa1741c9bb930f94bf7e2cab7ec0418a977aaedf0af85f9de08f6d06e7e58c944778518d616b2b8b1ec6399115752fc49aa7a9176d7994acf8bb41ce262fe275d95510a037d3344454cfac20f0d26ca02c52155949252ae937359c8f69dca01e96c8e866a0526a352d7708b8cf4d18ce99274f056719ea6c6bb62536e0447a4a1e059615c3c7080ccf68553d1b2674e1aa28355fa0e3138546f9ed63d2de91eb863a360cf91189641314d8b18cc9edbd36cf2129518080e6304757fc034843e22fb836e8fc8649359739f5f72fcb7ccf0b000f2a452061e57ad6bfb593b1e2e39a0be9b64a17f1be99881d7d477e5928b5e925eb0e34d49fe3a03fb7f8a26597b5c55badf3bf9ae6091591c3954b7a1d4a13e2113bb3da08b08ac03cb648eddfb08cd87b4666d57ff00fdf52cae550a60ee3e7ef597e5979bdb182254455b98d716a7f8d011248c15163d39cbae727a093b4da7fc076b0d38be4ca9b6c86378db5af2e37b41bfd6d9b437e0c10e2de0e5cb407f728ab9e9649410aa9377fdcbba05ae9231ae21af55a6d58a0415daad44da80583c0a06325488f434ecec0db0c00258a1c341be9c7c2b8f6a1f8dfcb93d9c113cbe3b18728e729a5489a47162a7dd2d3177f1c02a730f0c6e22a7bd8a5efc3610f185b2e283e7e8c1d3cc0c69342cb9b0ac4a8a5a952df80ead99af53eba14fcb19efbdd8b9b12d458bb0112fed7e5c798d1ccc416822df3ea2a376d145a27d17ac7d88f12e0ea232c46d473b56dba8ff96b394bbbc97457ad491de780622f364382d0f20a8cb1ed0079e2542ee7cf8bc9f293635f3ed5a4d07faa3dac7303e9adcd2051b2b3b1f62bd634aa22b7d57e9512cf0a7052b790485bad11cf08638f383013b9defc084966f19c762587ae4168625336bc5c83d2201f674376634972569cae8e13b19b3c7fcf24d2832a5e493d57f5e5b7f5f5b033203b61075f167fd4415e0520fc5f48607d99fd625bc127b31d4ee6b5a0f0e27596b215b052ccd73b3069886d5e5526a626a4c5f6ab86d925d72068fd9193bba744b1a271bc782b3cedd72deca3404253c86b857c79f020f6c22860f1a073c46121a8be48cef90e181952b3f45eda29f7326e199dcd910fcd00110e274cd6e153f8c3a47eb57ce4d51acc1ec5928929eb5f2b01818b4ce6815b748f8b93a92f347ed30a09180cbb99fdc63346007e8d9d72e541f372cfb1dd6d68065ac745748b775051f5369ae6b949edd8bbfb12f34791498dc15ce0dfd69e0592a9eedb5b144c424285096e9d9ae6bccdf36edea81775d8f5b4e1e3d77368e570e0778438f766f7c4663804de09b408c8709cbf901cba58c816b78d4d33f03fcba0647b6b58435ca75a1763b9505ebce42ff6aa9a19f5736eb60a3bf0f21d4b5ee2dbb7f56804d079139fb10a99c63a45b08dd4e28a681fbda39647945f58d79ef0a59ae13b3294ff5e3d8cbc04a74a50481b46bc5ea838d33c1aa1118e351bf9e3e524bc54720a1408612ea127282f3a4ca5d8f31e14be56e64a5186a87dc07671a4137302855569bb9688fd847c38002a9e6802ea3690d1e2eee0a58c66c2ddb574f468b8d4dff99c1a434a78b5fc7ae744eb72bb60ea06bfafc69451f394a9a12f52c03d6579c9f0f1922462a690101f5bdcdcd5f6a07129549438902e4a1b0bc912ae27c1b38469b8ca90a594b99724916db00e2b11197b3bb69af0d8be781b272d08ebcacc27d07a46c57d47aa1dc8a9aee15df5ba822e0959cb1ba4957941b2c9cbb98138ead2ff7c928ca0ab5e107e1836c58cd654a372e8ef618eabf13ba53e0803c5c9271cb9161cd5be5df89b4fedfa5fd530f75a206540da528efff039fdbb5210bee82509f1dc42f7bd8958380ccbe2f93801bf8e3a547848902dcbdf617f37cfb62f125e758e7480abac19b1e7663c6d0bd2e2acb67fc0addc2aa19d62c92493f5d89fdbfdf9bfde19b73b8f9eeb9b26ed7dc72e2a104a8ac423c6bd263e6a7e0469bc3b949bae1d115a3b2b583e1f6866fa553cd7137fd6351ca4c88a115aa801a989360f2e365761901c8a57af210d02a6f63869a7fd0d9a145f6906f9275f7d0750152170e3deb17a732d1b749934578d84b1591d6483da540ca404c22e9f373f8b9da6f4b1d77188e71f5be0419277edcbb5d7f0fb72118bd694b70f9dbd513d8ca850f1a369571b8efa365ac25c8ee0dea9074a0d1589fe5c16ba463dbb7c8b0ebedab69f9637bdf69bd317b0c57f74f261f9e3f98e56a0650f2e74cfb3724ba07099d41ab28e41bba0c2ebe7568d5ac65af3d5e64c1e9b52b3932399d16d6a106f68ba270afe2546e75ac0725c6731f241ed8b2edbd8fc9c5f4bf35ea63bf6def6cf52387ac410c89eb0445229d5ebb40ec23d196e9383fe4e9e5bc475d22191dd3a5c90b8d760ba0ccb7447ea79e3986adc9c94f834170510f20f8401079fc13a82e25df98882594adcc15912653cb716aa7363788853a9c6ed58d912fd477f17d5bbc4f593faafe880d9b9ce10619420d63722fcf37d52face83a1f516e0a696457c84b509351d4444c63aafd7cd78434241ca61e27243bb0221258e845e5a256f8492b73252a70af7173bf73dab946789f55a340f7870c0678d99e9af51746ff38684a5ed661f7d46f401a60716be895ffa62c6a4c9e7f9a8c6b1b17eaa13dd76c9934444b9ea3faef2f8c9c8c78b75af420db50aef5e43a3acd130448c3be31e3083ec643035a82a2eec96a7fa85184a489bc9a78ff0291ee8140959e74a299c37bdc41bad35e6b5dac9d047b5ce485dfa096de278fe1cd6ef083dc219bf95649b7baeaf70a7a3fc8e36717ececdeb4acd6c221d4e3f808946405e7c22784bb1589175d2c37e02040dc13f0d5284562a5492f91138c239f9da81ba789a98a44e0c8e848d1007a9aaef90a49b0d18103e438a1fc9689f233d6c25b7b627e39ab426207cdb55a05e2f9c557d1c0810b442d3086c0b3ff6accd25b77337c9493b5c3bcdccbdf698cba0a91f10d77b074b60eef89531c3fbd68ce4b252e394be0e7b0364bae233c41d546b223f915c531a2783de1d43a0d0a586ecad7555d686652c4ed84473008b325a537251a537ee34c618bed98dca40641cfae15fe2486b1eed65fb290b6330b215063fa1631f413dfe8383dc606d60c8094eab363a5724370384040792285f58dd484b6f6eb55bad20937653aa4bd0f3965a3471685cc49c3e83483132e6edf0c4dc6f154930303a88cbc725f9d1121c5dc88293619e30beb3bb0d6a5acb448eae41c5fb9e10057440e304c29c9221fab92ef097435c479bf29c3d12a123b27be5977f8bf46e3d8d0d189ea8cf851c8db708ae53c59b1fe57006c89c66bb27768587f4c8d4cbe91f727e37c14910f0664f429e36f07d124cc8e4a301ca4e073f9dc79389205bd700504564462d25eec63f79f9a69eec82c39fb93a116febabc8bdc1e3eb20e93e0f5b8683e7bde3c1f2bff43d22a219a7e1bb4abdab3fac4787591ea0e875a0d1cb19502b9ff3f25cd878c6b8bd4c77fcb80792c7c7964bad0eba021874fec6cdd479103a0ff7f06c0305af7890fca99879dda47fdb84e0f4fa2183f0dc6ced750ee4d94cf0c1220f0cd9d9e5c8fd945acc72468fe2d22eb7c8f72798c9482fe68db8bc28efe258e71a7db67e88155da66910bb91b43243361d88f0a06e65104892695fbe5a61e1a33cc225f5fbad6cb9efe59f8e706b4d87209a7848bba549f24a3a0200d9d429f4215107426d626c6f372b0003c4d251b99a55dfe73944088d519052046d6a697244acc27f4ab003f68c2670c1409ccd831d6295f716aeaea0c497a8264650659778ee75341bb469249a4a285241de55af629bdf04159eaa6507d0b4e0ee6e3a83d46b0b71837c34af4cce7d0a0dd3b710b1439a0549199f92243be5af0a6866f134fb68776d4b842bf9235255ad108222c75678001ec7eade5f919b7d0da5c44511f503e2d224d80c6274df035753f1d52412187b49e83fd1594ff622f05033f6c116a35ed3206d66ea12bdc4ba1842b0c462c926ed3d700ac7fc870f3c000336cc77bd6208cb29ad8715b190f1404ed26818313b3f2cdea742baacc487417e69e5e91d0ca95ad608a505476c5aa518b8a3621703e07d68e1b01b30c39f56f34b73c846772a968ca480edcd65a5911de558dc2b4e73b8ed9003a4c51890c6b85a3b2611e8bcb2cd9310cb60448d0278dc1d00e23d09e69d89961982ea9c51cebbffa43a16f492b0f62eec74b6ab3d767a209bff9491df5434ff9233c43733c17e502b3d41a4369b6332dd76f61ef5132eaff5de5398568a94877fa63a1291d175e2bb949aa3386ecc9aaa4f46bdb9ed4c9e2f95eb5873f5a425b29f7ff64ab0c94eebcad5c7c0e5f7d9eb17bdb83bfe42b1c32f175d99ed41e0fa4cccbcab8545b673db5a2397d6eae76b7c62931cf4fd58506899cff64038916061a25113505bab41fdfa38d486ab1a884a8f96b5f946610c82e655d94164c0622d374fb38c33365ae19f183e23d1f16cace5f6e38c10d46469b5dc3bdf1e0ddfac27c6873459a77dd227fce072dc76a2323584de4dd9f5b46fcd8e06a518cd13cc3a18b7f6992e24424fa07556d5b5971d46bced0b6911de8c735bfc20018681f0e22015afba27e31a494494d5e15b6f54746104b6dfe0e52253ef52d660fada04bd47848d8c1c242afa07027b25dfafd2e71967413310c2bfa9394d9e769d4e8a3db5f73dc1b7a9a019688c224272a3bdad52ad5b610de9f114ef67530932be9a22251e2c323d193b9c63e2c5e664334ff9dc3ecd4c9c2e74fa210d76367c83e88908586106f35b323bbda702a3ac7163b9f543e9756ec3bd46e377a6dffb10aa3adfc9acba5d046b5506c3402b767e27e84f92645196ff80cedd8949eace787be8e5f91a598891c6718006e86633bf709d6815599c71d9b91253da88b4962367ba77024732c212c01828640e4a1d158027df316f9afc452722cd085707f0e65bbd9daf387e325755b60ae7a1a1ef54e696733dfa079753328e013124d9852087e53a1a5ff206f2cdde06bde6e72c5a1e92bfbf60aa8cff6133e1a48b123e619a6e39e82340d84bd8b33cea44cc621104357b2b725e5cb63d31f8bdc121d4a668f4e0142bab8c4a2a954a8aca85e7a8b5b918394ddb271c6cd3f3ed764c660b6e628aadb3b00831c9173290da10e0cbcaa543f5a4003588478baeb34b28564cf15904a60d376039988407c96e7fca12cd6275de0b5d7e8c1cc9eff4042126c24ae393d5d81ac57259a466b47431554adb0f04daf772a9f02a9568c13e7ac79561c2b1b87004de6fd4f1e6d986a23ce0b2fd6f7149a93f45f816f269c8cfad4b4cd0da6b64a5f4dde54061f1da48739ccb52a029c00ce39b0d32f2e906ae819c7bac1da796a185697b2f6e740e9b7bb8560bc388f454a675bf5be5abd5b3fbf8943649b6598fcfce4e02a9377a40aa5ca7565c4451341e64bf33b05deccb4d52f4244a2be6994177ff82c6cd9e1c90291bc9f997f30c90af9e19e721ebc55fec65fc3da5c56900521674d56e1255fc39f387c9cce1c472c7da0265d007775e6a097f9d80b65ca9d6a2af17d0f6becb13f9440760071a20514d87eb5ad3a13d6535f381a2104977ba287fabb5db695476bc272161217548396c7bb1dceaf0b43ed4e36866e0eacedc2ce83d6b64eaec2a4f56059a2ddec79cb6b7698cb981b2e71b92c71c2ba6", 0x1000}], 0x6, 0xd) bind(r1, &(0x7f0000000040)=@l2={0x1f, 0x6, {0x3, 0x1ff, 0x6, 0x80000001, 0xcca, 0x100000001}, 0x1f}, 0x80) [ 809.777552] binder: 5129:5132 ioctl c018620b 0 returned -14 [ 809.784284] binder: 5111:5134 got reply transaction with no transaction stack [ 809.784373] binder: 5111:5134 transaction failed 29201/-71, size 56-16 line 3026 [ 809.784624] binder: 5111:5134 BC_ACQUIRE_DONE node 887 has no pending acquire request 09:39:15 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) socket$netlink(0x10, 0x3, 0x13) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) [ 809.867701] binder: 5129:5154 got transaction with invalid offset (7, min 0 max 24) or object. [ 809.886770] binder: 5129:5154 transaction failed 29201/-22, size 24-8 line 3349 [ 809.900116] binder: 5129:5154 BC_ACQUIRE_DONE u0000000000000000 no match [ 810.487392] binder: 5112:5164 ioctl c018620b 0 returned -14 [ 810.489677] binder: 5111:5134 ioctl c018620b 0 returned -14 [ 810.490958] binder: 5111:5165 got reply transaction with no transaction stack [ 810.490967] binder: 5111:5165 transaction failed 29201/-71, size 56-16 line 3026 [ 810.491038] binder: 5111:5167 BC_ACQUIRE_DONE node 898 has no pending acquire request [ 810.492319] binder: release 5111:5134 transaction 897 out, still active 09:39:16 executing program 2: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord\x00', 0x482000, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f00000000c0), &(0x7f0000000100)=0x40) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000040)) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0x9) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/context\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x800) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0}) 09:39:16 executing program 4: utime(0x0, 0xfffffffffffffffe) socket$inet6_udp(0xa, 0x2, 0x0) 09:39:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x803) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09631040b561b0142011bd3e4944712e27872db00e663255cfea65d48c4ad1fce8ad84b98eedecc70df616ca7ab2e5410479bad9994ab4d8496c320f54c88469355008d5394ebe05bb008a594526ed9f236e033538ca0105843a16314770ef42286502b59dae3074", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 09:39:16 executing program 3: mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffffff) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000040)={0x222a, &(0x7f00000000c0)=[{0xf2, 0xae, 0x7}]}, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x7c, r1, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0x29}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip_vti0\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x40001) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r2, 0x0, 0x400000000000001) 09:39:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0xa2a707b06845cfee, 0x0, 0x0, 0xfffffffffffffd33, 0x0, &(0x7f0000000080)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) socketpair(0x18, 0x8000a, 0x6, &(0x7f0000000000)={0xffffffffffffffff}) accept4$packet(r1, 0x0, &(0x7f00000000c0), 0x80800) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 810.492325] binder: unexpected work type, 4, not freed [ 810.492328] binder: undelivered TRANSACTION_COMPLETE [ 810.492381] binder: release 5111:5119 transaction 886 out, still active [ 810.492386] binder: unexpected work type, 4, not freed [ 810.492388] binder: undelivered TRANSACTION_COMPLETE [ 810.544731] binder: release 5112:5169 transaction 901 out, still active [ 810.568314] binder: release 5112:5122 transaction 892 out, still active [ 810.586254] binder: 5172:5174 ioctl c018620b 0 returned -14 [ 810.595568] binder: 5172:5174 ioctl c0306201 20000140 returned -11 [ 810.606873] binder: 5177:5179 ioctl c018620b 0 returned -14 [ 810.606996] binder: 5177:5179 ioctl c0306201 20000040 returned -14 [ 810.623972] binder: 5172:5174 ioctl c0306201 20000440 returned -11 [ 810.632499] binder: 5178:5180 ioctl c018620b 0 returned -14 09:39:16 executing program 4: utime(0x0, 0xfffffffffffffffe) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$VT_RELDISP(r0, 0x5605) 09:39:16 executing program 5: clone(0x10000000, &(0x7f0000000080)="3d2372105cc5b14e3e9d9fb24e81df05a4bda9f3e3750a138673f6d72c443e0787eb2ec22d34cc1ec7088310cf5232260fbf40e1ddfae9b1ac3f43499413a465c7480c2ac6e1dc11761f0b4d8a9896e3589c1f9a0d41cde76ccf6a39418218b3d3898c99859e15a654536ab42ad6b5ca9ad8ec5f307c4b2e8305933ea9044fa29520bc5be41dc4d38caba1720bb50d682171af1e52eba33199237417396e299d9ebe0e07a1fa90442e82e08cd567cf16a55d6ee4b2898188fa3e4d8a86a8e799355fb660e3c5ff1a3e63a421862f0997dbec16ef9224660a957dca18c6f1958d76176988da98c8798e1ca398", &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)="22dcf845f2b4211b6476376ecea6c9793a2d5323a2ea2abd99beb63a668140503cefb18e30be4e0687d765104831f1fbaa2fc91b4ed3f443b534632e4d16bec02cb4201a2a2a384a5386bdf119bc8268db20dfb573e45931659970b197bf09718f35d5e6e8931b1ce2bfd4") r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = inotify_init1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fcntl$setown(r1, 0x8, 0xffffffffffffffff) fcntl$getownex(r1, 0x10, &(0x7f0000002bc0)={0x0, 0x0}) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000003, 0x810, r2, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0xc) ptrace$setopts(0x4204, r3, 0x8000000002, 0xa06ff1) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@local, @in=@empty}}, {{@in6=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f0000000380)=0xe8) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r4 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/policy\x00', 0x0, 0x0) gettid() openat$cgroup_int(r4, &(0x7f0000000400)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040), 0x1c) 09:39:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:16 executing program 4: r0 = openat$cgroup_int(0xffffffffffffff9c, &(0x7f0000000000)='cpuset.memory_spread_page\x00', 0x2, 0x0) ftruncate(r0, 0x429) close(r0) utime(0x0, 0xfffffffffffffffe) [ 810.635561] binder: 5172:5174 BC_ACQUIRE_DONE u3ebd112014b061b5 no match [ 810.635965] binder: 5172:5174 ioctl c018620b 0 returned -14 [ 810.636204] binder: 5172:5174 ioctl c0306201 20000440 returned -11 [ 810.637002] binder: release 5172:5174 transaction 910 out, still active 09:39:16 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x10000, 0x7d) lseek(r0, 0x0, 0x400000000000001) 09:39:16 executing program 4: pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000040)={0x1, 0x3085, 0x6, 0x5, 0x7, 0x1, 0x7, 0x10001, 0x18, 0x9, 0x100000000, 0x7}) utime(0x0, 0xfffffffffffffffe) [ 810.637008] binder: unexpected work type, 4, not freed [ 810.637011] binder: undelivered TRANSACTION_COMPLETE [ 810.637063] binder: release 5172:5174 transaction 907 out, still active [ 810.637067] binder: unexpected work type, 4, not freed [ 810.637070] binder: undelivered TRANSACTION_COMPLETE [ 810.656556] binder: 5177:5191 BC_ACQUIRE_DONE node 905 has no pending acquire request [ 810.683323] binder: 5178:5197 ioctl 40046205 9 returned -22 09:39:16 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.events\x00', 0x0, 0x0) fremovexattr(r0, &(0x7f0000000080)=ANY=[@ANYBLOB='hystem@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00']) ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000100)=""/25) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f00000000c0)) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x3ff, 0x505403) [ 810.714554] binder: 5196:5198 ioctl c018620b 0 returned -14 09:39:16 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000000), &(0x7f0000000080)=0x80, 0x80000) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000740)={0x562, {{0xa, 0x4e23, 0x1ff, @remote, 0xac0}}, 0x1, 0x7, [{{0xa, 0x4e22, 0x1ff, @ipv4={[], [], @empty}, 0x7}}, {{0xa, 0x4e22, 0x7, @remote, 0x1}}, {{0xa, 0x4e20, 0x1, @remote, 0x8}}, {{0xa, 0x4e24, 0x5, @mcast1, 0x6}}, {{0xa, 0x4e24, 0x2, @mcast2, 0x2}}, {{0xa, 0x4e24, 0x7, @rand_addr="35ee78fef82ebdd38a316ed1825edff3"}}, {{0xa, 0x4e22, 0x80000001, @loopback, 0x3}}]}, 0x410) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:16 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x2) lseek(r0, 0x0, 0x400000000000001) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000000)={0x0, @aes256, 0x0, "5410c253e29afae5"}) 09:39:16 executing program 4: 09:39:16 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) pipe(&(0x7f0000000040)={0xffffffffffffffff}) write$selinux_user(r1, &(0x7f00000000c0)={'system_u:object_r:syslogd_exec_t:s0', 0x20, 'user_u\x00'}, 0x2b) [ 811.411489] binder: 5177:5191 ioctl c018620b 0 returned -14 [ 811.417360] binder: 5177:5221 ioctl c0306201 20000040 returned -14 [ 811.417720] binder: 5178:5204 ioctl c018620b 0 returned -14 [ 811.417994] binder: 5178:5180 ioctl 40046205 9 returned -22 [ 811.419001] binder: release 5178:5180 transaction 919 out, still active [ 811.419007] binder: unexpected work type, 4, not freed [ 811.419010] binder: undelivered TRANSACTION_COMPLETE [ 811.426983] binder: release 5178:5204 transaction 913 out, still active [ 811.474258] binder: release 5177:5179 transaction 904 out, still active [ 811.474264] binder: unexpected work type, 4, not freed [ 811.474267] binder: undelivered TRANSACTION_COMPLETE [ 811.476111] binder: 5228:5231 ioctl c018620b 0 returned -14 [ 811.501945] binder: 5196:5210 ioctl c018620b 0 returned -14 [ 811.504312] binder: release 5196:5210 transaction 925 out, still active [ 811.504317] binder: unexpected work type, 4, not freed [ 811.504320] binder: undelivered TRANSACTION_COMPLETE [ 811.504369] binder: release 5196:5210 transaction 916 out, still active 09:39:17 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) bind$unix(r1, &(0x7f0000000040)=@file={0x0, './file1\x00'}, 0x6e) 09:39:17 executing program 4: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x400, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, &(0x7f0000000080)={0x20003, 0x10000}) symlink(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0\x00') getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f00000001c0)=0xc) fstat(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="02000000010002000000000002000200", @ANYRES32=r1, @ANYBLOB="040004000000000008000300", @ANYRES32=r2, @ANYBLOB="03000100", @ANYRES32=r3, @ANYBLOB="10000100000000002000070000000000"], 0x3c, 0x3) readlink(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)=""/236, 0xec) utime(0x0, 0xfffffffffffffffe) 09:39:17 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000440)=0x0) r2 = dup(r0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000500)={0x0, 0xffffffffffffff9c, 0x0, 0x7, &(0x7f00000004c0)='cpuset\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r1, r2, 0x0, 0x3, &(0x7f0000000480)='syz', r3}, 0x30) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x1) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$EVIOCGMTSLOTS(r4, 0x8040450a, &(0x7f00000000c0)=""/192) r5 = add_key(&(0x7f0000000200)='logon\x00', &(0x7f0000000240)={'syz', 0x1}, &(0x7f0000000280)="e70edd100c78f3ca9d72e94ada54aa1498a03e5e26ca24f9ed27989ae56fdeba5f12e5dcb4771701614118b600bdc0e373d9b8e8aacec2a8f9b642be4d58ce10128e513b20daea92508f9561b55f82c783fc2ce4a0929b9836d1b9bb950d560c69b68f8ede6443411874c792fab86853c4cde189", 0x74, 0xfffffffffffffffd) r6 = add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000340)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$link(0x8, r5, r6) ioctl$TUNSETSTEERINGEBPF(r4, 0x800454e0, &(0x7f0000000180)=r4) connect$inet6(r0, &(0x7f0000000400)={0xa, 0x0, 0x8, @rand_addr="e5fafc526f0f5b6d6f29943f8fd27e74"}, 0x1c) ioctl$TUNSETSTEERINGEBPF(r4, 0x800454e0, &(0x7f00000001c0)=r4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f0000000380)=0xc) ptrace$peek(0x3, r7, &(0x7f00000003c0)) write$binfmt_aout(r4, &(0x7f0000000640)=ANY=[@ANYBLOB="cc0007006b030000e202000004000000c50200008100000000000000000000000e1d6d9471ef3ef3e4dcd68e6b6083b3ab738d544eb8ee8b0483a462b3ab607447d6294e648f10e07bf05ebc4ef82ad931defb94e1efc177ca141bb8f5bc2675d98cc97e8f447cd4bd0e295417efc60e08d4391c952ec359e63c599021a55688fd6460be57f9b316365c29fcf529057f1285fa95a9fd4b22b753e43de710cf0f502b30c353e977ff00dbda618628e82036c62258727b061bd66411f76c63476740428819b3310040c3ab7ef9933e5285852d9f67976ed54341d2188154d309d468b01ff203d3882f9fc362b883225d54d8691369d947b8e55fe135a540c028b04a66b2d3b09b9f3162510d7ec48329ac8754b289d67936190d3f005a7856ee852b0ba4f37297b5279c4fb2ac6fd37192977875f5271b52d836c93ab799a15e745b150c7eb33161f2048d71191175a1db8641fa520b300e83b79dd5f7830f1a47a65903a8c1045ea447335fe6ba28b1817fd73eff005fb69ae34115356efb14584e1229b9b60c7959ca6ea4636ca544d8f9113296b620e19ea166509d3d7bc88e953c90c108ef6c1d62aac3eb0d133ced8f20d0667ef67319b58b3d78b1fc92175366b682888fedddd2f8fc3736a7a0cb280a2553f71e7932a567d8d808e44fb2e7"], 0x11d) 09:39:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f0000000040)={0x0, 0xfb, 0x6d, 0x3, 0x2, "464ce0f9a5d920c4995dc92d2c3e65d7", "17e60b1ec8144503db19a43d6e6b78474a22c3ad4532192671de60e3e02b1dad06239883caaf12bc04ef21ea1a0e126eb9d6fc1ce04806912fa69d68138f5a9f9123f3a57a154bf18b1dc8970247b5e7fa40043926643e31"}, 0x6d, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB='\t[\b@', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 09:39:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) r1 = socket(0x1d, 0x5, 0x800) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000000080)={'bcsf0\x00', 0x0}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000380)={0x0, @dev, @multicast1}, &(0x7f00000006c0)=0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001ac0)={'\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001cc0)={{{@in6=@mcast2, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000001dc0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001e00)={{{@in=@multicast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@remote}}, &(0x7f0000001f00)=0xe8) getsockname$packet(0xffffffffffffffff, &(0x7f0000001f40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000001f80)=0x14) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000001fc0)={0x0, @loopback, @dev}, &(0x7f0000002000)=0xc) accept4$packet(0xffffffffffffffff, &(0x7f00000049c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004a00)=0x14, 0x80800) getpeername$packet(0xffffffffffffffff, &(0x7f0000004a40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004a80)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000004b80)={0x11, 0x0, 0x0}, &(0x7f0000004bc0)=0x14) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000004d80)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@empty}}, &(0x7f0000004e80)=0xe8) accept$packet(0xffffffffffffff9c, &(0x7f0000004ec0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004f00)=0x14) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f0000004f40)={@remote, 0x0}, &(0x7f0000004f80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000004fc0)={'irlan0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000005080)={{{@in6, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@local}}, &(0x7f0000005180)=0xe8) getpeername$packet(0xffffffffffffffff, &(0x7f00000051c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000005200)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000063c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@mcast2}}, &(0x7f00000064c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000066c0)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffff9c, 0x8933, &(0x7f00000067c0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000006e80)={&(0x7f0000000000), 0xc, &(0x7f0000006e40)={&(0x7f0000006800)={0x610, r2, 0x4, 0x70bd2c, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0x14c, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r4}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xe91}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0x32af508f, 0xe8, 0x7, 0x80000000}, {0x2, 0x9, 0x6, 0x1000}, {0xffffffffffff7335, 0x6, 0x80, 0x7fffffff}, {0x1, 0x101, 0x0, 0x7fffffff}]}}}]}}, {{0x8, 0x1, r7}, {0x170, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xa01b}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0xf10}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xffff}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r10}}}]}}, {{0x8, 0x1, r11}, {0x170, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r13}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xf8}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xfd}}, {0x8, 0x6, r14}}}]}}, {{0x8, 0x1, r15}, {0x3c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}]}}, {{0x8, 0x1, r16}, {0x128, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r18}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r19}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7f}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r20}}}]}}, {{0x8, 0x1, r21}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}]}}]}, 0x610}, 0x1, 0x0, 0x0, 0x10}, 0x0) [ 811.556216] binder: release 5177:5191 transaction 922 out, still active [ 811.562968] binder: unexpected work type, 4, not freed [ 811.571319] binder: undelivered TRANSACTION_COMPLETE [ 811.592261] binder: 5243:5246 ioctl c018620b 0 returned -14 09:39:17 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) connect$unix(r0, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x6e) lseek(r0, 0x0, 0x400000000000001) 09:39:17 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000001540)={'team0\x00', 0x0}) sendto(r0, &(0x7f00000000c0)="2f8f6fc77f67f06c2efc0966b17ce0b36242421f26b984c91143bf2d069aed62114c4da002a8ff6bfe62a5976057b3e7c8107873b1ae3a9cc704bae07d02fce98d0ba28ca3a475f11040502c27e0e8035b6e71b17fa37c530161f86337ad6a9e66", 0x61, 0x4000, &(0x7f0000001580)=@ll={0x11, 0xc, r1, 0x1, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x80) setxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64EXEC\x00', &(0x7f0000000080)='\x00', 0x1, 0x0) 09:39:17 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) sendfile(r0, r0, &(0x7f0000000040), 0x8001) fchmod(r0, 0xb6) [ 811.616283] binder: 5249:5252 ioctl c018620b 0 returned -14 [ 811.654497] binder: 5243:5259 unknown command 1074289417 [ 811.667007] binder: 5243:5259 ioctl c0306201 200003c0 returned -22 [ 811.714331] binder: release 5249:5263 transaction 934 out, still active [ 812.274432] binder: 5228:5273 ioctl c018620b 0 returned -14 09:39:17 executing program 3: bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000080)=0x6, 0x4) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='configfs\x00', 0x2, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) r1 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000380)="c2a09a99d62ff7ace36d73dd37be670eb45df9995f7b3149750ec271c80775be91e624d319629754749dd6bd8a6c975c25d386f730598d99ae511a3dc47f09c1b18de7b6b64061eba7f33b8de9286048a56823b2dc1d5e4284dbfb46f98ee6dc48094b87a6e30d240292dd0752f31b098ba65412f43e9629141df549cbbecb2fac9f3bfb91657ae98a8031286868cf38239bc8d9704d1fa8d9cbbcc4afd376b8b0eda1f5c05290fb32e5e6638ee02281615f303779ba3a2ebb7f01a0ec68a758562001840b6fec7581ebab912f010d5bb6bea98bf5f920805e5683d3cb5f5bf339ed6576031c11f379e3da18001cf37025edb684d054b7d6de6e2632c03e455f48fc9a2eacf805000493b9785fd06f29485a1f4cebb86cbd2b1596f9101f042b17879e1c396f844bce8e41417c0353e9120e45dfd8c7387799fcd5ebd242546e165cedb414675651b7c2219c4b8b3e94656cd98c4504b64d7f4cb65f63bac98f509f8bad4c0d2b4f8db108e689892f0bb0f1cb5bf5d4b5f8cd0b2ad7a5be30ae957c5d7495e913297cd164c6054fbc5775fd71482791924a96d2dc3c02d24004989bc049a4e52d9528bfc418b186e5165b84135c118fef25bb6f8d8b311ff288ebbf8eb2698f919dc1b325764d98916d80113e5901a5aefb2162827318e3c18b0be8427b19cca171065dc240b44d2a84326a7667c35d12af8f36e1858915a8af48b1700a9592a89a70d85434fe802a5f22c14be57896cc908710a3420dcb94a9210b1d60ca69c7ccebb8abc99dd5fbadc86f356f2ecfba7ab526a6d29f4d2f8785be34fef4832d9992ecffaeb70a82b5123ad5240de45f41fbcf7c2aa861920134ff06b0bb3db19abbf32aed1ecbc87dec4a38eb287d56a05d5023d1edff47c1f2d5c4e5bd8c282a95a3c8b4443d1a56821c748ecd2283c17b960e28450e116ee55cb32788897d3a3ed260c665621be66cbc4d9d660227b2702305bea798622d20a70cba401fb3f2b89877df7e4d287e2f40d282f1ffb8a6bab6fdf13518c83d0dbc0cd0be7b8e387c538beadbe81be526d4c1b3c839747b3cc32172142b06db71d45f37b953584494769a7065ab960a0f78e9e9c5cfc063197179419ca6d9807f24465754650c4d7c33a2d3431a274b68cb971259ebe925226e8c7629f9c8359a2de6398b3fc3335e8f3ea7ef93be55753b430452ab590b07b91fc0edfd6acbb2ac69811c12e564d4b548dcfa188adb5b544cf16828fadcaf51ec3b0c23f6df048a66725badc9252f9f919fd440e85acf38b49cacf503c2266a8f9bf799ab30b26fd088f624743b849c3359b384a276dbbee8f92c3fd6fc87f432c4802ef16c85f8699aaa9151b56479098f48d6a3131fec02018ef51780fde2701d9daffbbefa8db4676c042835781f7c0240f2703d3b7e04346151c6250b588f8dbd1cecb480e71d6599f6ce9c3a01dbd3f8f941625f853171c6a97914b42201cc8f583482ca9e2b5278566d81173fe8c7d92e145991bd7d47fc02612daffea6bbb605a63233ab46b0defb5cef83e5af40c4537dfb9f1194a9969eee526a3f15c7bc98430606e546d896fb45c9e45ced1e40175c8d8dfd92e217e8a36d7577f855a88ec1ace679b4165b30f4e6945b1b891008d0be4f3afa944215287e4bd57131ed03c86e180336a820da8f96af261847a67a4ebe6b8793dd6c5565700a01c6dbbb4685d775e16ea436ddd991efb1e1508f48acddb6bee492180132af05874af78e8f9795e8e3d1c08eb71fac23c697b45ab8057ddb6e1b828af0c6a4cc8647c2115160569aeea68dbddf8b04f86c1ef4efd9025970ce848468c1a83fc040c0826b5b2762096c3f7190799b32ac2b018019b8d764c29c211c5131fd273814301de0a16c21169e8d3cc38a3bdd803ae982a3d2eacc07f45f0fe9537699b2a457c36ccb2eefd0ff484efdefe283c905b07b7352a2537fefce0ba8575e5f3b5e9d8ac41997dbb1d354e64723361fa0184b3c6fcfd92a777e8b0d024455165521d24482d93d6beb357386d30549860e8a7c60c5ab583ea95c0789537ae69750cee605441045006bd409aff052ba3a2652ddc1f34621e12bc1d3d7cc31b989e3dbedee738628b1681c31403fe126614e97271e3877ea67ce9c807eb692794617b2618e4d06e9b7ecabf711a7ff2b4a40ffe0fb47b4c83c1483e7d2cc94dc13f82a309e23e1458852d9682f16ba760cb8cad008590f6f464e0b6ecd67a7f999141d489f2f1577d2f177048e207a667546b516711051dfa79f1ad2ef8d8ab0473510c8a69e90866bb4255af905b8f0b19a8e7850bdad2d8e7401700ef7770496a6cbd13fd4a8d46df1aa41476215d9759e232576b8d87329992e1b51e9a951e61d47d3014115010cd6be2e6a095e34d9fc0461969800d5dd7c80df0a24c258b4c6235239f808b25f23f0349d849844caf33eec271da09dd2fefdb6219893bf2fb21ea7854fb5f2085adfd82e07c1174ee4fe65fef6444478eb62b17356685f7237bfc9142101e5036a0445a0584529286c30f908099cc5543f808963670d6f364c07db9b41cc8b3e1e83281eafa526cbc4da7bc0e7cfbffc47366c803048697c9403c25f98f1a4582a20ccfc8586541d5facd1a358359352400dfa8e7ee61e33fc8e7827c371a77a9645a890ce198ea8b35405b880a1e9f63938a9c2baaef7b1f25a11e3ace40f37fab372008893a9b1c1a74ceaf8ab0c970913c693785f3d1189cf41051824f989c7266adfdc2586d12107c977d42ce2090135cd18bd80f7e77e53c7ce62c6efa5dcc5ceddfa064622b9769fc68b9b5c314ef1fbddf4e2f87f2891c8b141b57c4fa553e4fe45ceb25f47fd5a175429df6a86e5edda735dd76d6fb643e8d734af30ae5fe985799fee6dfcb4208ec07a3f8f5f718e981a3edd79f753353e184e9c3129492f79b52147958929c9cee163adb600f15bf54f692e09a7b2c9ef460f8027197877ac6157a9b713bb21fad6825872f5aa9e828fffcd6bd0c13b1faa41ed80fe371ea18daa315f32dd89bfdc8badbbfd7e187524ab2c87d3e4f32899c62a3bd0a267bf7c31bbb07bc3626af21b2b5e426881d9a8822cbece0a477c00707dfd0e0da1e70edfd584c6a0415156f8cc99a49a16f8698c6cbce2e9ad68075a98962e5b2ed3d0ae319275f6a4847b8f5563a64dd3c655fe9deced8ab6736e60084edc90385df2cd5896a34e078089b5de157dc0a4cea796b4d0a61bff9c2d5636b629b54ff639a736d471d14ddbe8ac122cb08e6a0d47d253b4914eed189772d9627f940f13315e09d1b7e47b53deb6219b2ee06ac80d7550fab430ae1984d46c0796d81f63b667b713080db0c0338b876c8acaebcd14c1c9e177dccf43fcbc85c2773a4af7c8b9273a9bcac944bb6f962c00889b85affde07d670e78cb8b67c9cb3f259cc71a4b76f1624ea5daf859c271723c229807e5ad4fb33d22fa5b9774557e0e650660fd9f8b6ba0ad9fb193c3be0a089c1fce2c12d1123ec805c3fd7262df4d2ae512f8352011e7a12d0af051d1cfd81de982c75f24ec86d951698bc74f17194e5c59feaf5e943975ae1f7af71161a324b1bd30dfe166e55320a5833fa63ce89f80f32e68d5d87092d3c8105f37ebf7cd0d76318eb428399fafa2d852eff17e6b64138ef40d2a311479b4f3a328547a7104f629de32628095bc085b06c6ee13dfaf96c0d498f70e480342633ff3ed83b393c08ed427c94bf588f5e3bb36cb734f656c022ec595976b8fbe3b4be53406d26535a5321f8dd108e29358a0bf762f0251a7f69269a730dc5a2f391ecabd9b1bec3049551ea42c3eebea7880dbe9e9e884efb19dc10ad538f87db40a69ff1d91f4052d68704da6bf57e09e13c2f629aa2ac9008c45ae9cfda49070b96fe0f7c24f903f80080404103bf4342c227437979a1a3d78dbe74ff1cb6d95ea09b898f3f7de85bd7e68dbb5751f9d78061f028a329093b4a582a837aa18711ce34152e1090d60eb4abf85d9992e60a78e921aca9dbca8c304abccbe1b3ff73cf93cc544c163b17ae197e0a583dabc427fb88dd864d24ec081806a011e71e771838792e186464b917bb3f6ab765a781968a83d7aed3af76245f91627dd34070f6bc435819737c0b7c01482b00202979ecb79431904c43f76ea040824e698b4f3cfa0e0f80fc6f7f0479a5549602f9b41b4a2ddfed153e85d5d2b54ec717672e50ba6d5b6fd45b892149eda1834b5027682a34a1459ad2d68043a16eb7bc677cb134a92af5928aa7df3532768880c5a3cf9957dbfdd9a0731e257aade0894b6a59e5e96d09f7fc88d2c19094a4c63e1ea68181d9f54f47e11281e167b6608e35c830ebc22595fa365c7e44aadfaa78ad3fc316b37f4014281fc3260b3e38a80327766b0034d651ccdaf8a841e27a7064753128b219ebf130f0f1a0d8fc5fdd1cea322dd3f9694b1302767d48aa6a1b08dad6c2713d5b5ae2169ec45ca7386baaf055f764bf01ec9ac8a7f98c6c9b687f601ea309a95252bcde1f129fc64f6a5bff346ea470f2da271d86b99c52d429f7ae2e27f908ecf9b90e856e2598bc46f8e2e375670bf5f280f26a920dce25432a8b17ff63a23ff747e27ac096ad67001e8aa8876af4afee04df5d642f87ed3673741434de45650bb132524308297c22a24f994b069ef26ef25d50f9595c88115928f87471bbf511d8a98015202c7006d4aea85aa11a5825dee5ecfdd6d5c041ba553acb9e7ec59ebe91364e1ef3e6a61fab4f3f3bbc833814b8600429ba717b6a2a6aefe4a1e8bdef8b5ff7b508bbd9110ffec068200247d9178ead082af6276d8eea6ad0fcf2a4857b2cf9e7ea318be94ce004e302035a0f9e0efc5dff8d42d4842202a140799e1cd57573db405c1f28033c62ff1fe46a00c65c297acd621392578801e4e195eee24f2426cb83614b3230274c306d6da611743de0159b304ded7376bb244aab6c26e083dd1fe11e9649e6ce7018d71e3b63493aa5d0c6c6e0ecc61eda27a738974cb51fefb299132c736d7213b5cab4e4102ae7b6d91b13303dec7d69282bcd8834d512afc070c3a662039643e446078e33228721a86b8ca77efed349903bfd3ea612975bb5933d3cf2ff0e55c120f96d7df3c3bcc6afb99a75a8f31b2d056cf6564a330df4a2f5ebc55013d7e9dcae7180a11bf49c8b36ca7f9291c8c5a777e35a6b08e66368b92bff9e7aac9066e738f0f3bfd7c98252decbac63a38423263b79d2b40a2a86a7907a4aef324777923669158dc75655b0b084692bee8cdb11156af2772515caaa8efdc4855bfb5e2cb8e158bc6cd135ae7a2618f298898bb85fbca0489a975df6db4e437adb6a36274634ceda1039ab498df66899c8196b39db19826bda7c203122e01124b35b1a816fa4d36eac3286b30ada91856b2ca2c47de295891d4f95621c231161e4751e2e5e7aaf77207de5c3fe317a02f9f6144d4f70bde32dcf1f6b9b2217863e4e301a020e0386b6d3a2c9b0a10723dc9b362caaafc036dbd642c25bea0ee409aa2f745f53a7438c5a8cc45f04cdd48583eeee771b10b63c110c921b7917fd32e32dcd46d94768efcc23ba73712a6a092b55f595ca3731decbb038727a0aeb9f60075b4ae3d9d6ddc4abf211bae53ac3d4303571b1c90d42c0022ed1c08329941e8f12ea3cf9af7f500be2080dd83f5658fdf2b2241e52944702b197c7161de5aa8ce5c7edbb9c969a24a0db6f70461c1be3c4441baa42b56095ca719132db88d7fdc54aa165abd697de33c37a782", 0x1000, 0xfffffffffffffff9) keyctl$update(0x2, r1, &(0x7f0000000180)="8fa2a3fa3d1f53b01edb5c88a48d5e220859ea88fe35f8f99dc862f108a453f0e7c87118c7c1dd4ffea1bd1145fb098ab63c3f495f0585130f1ade576d766b71de3395fe6df4d1e132ae9a7401a3cc587771ff6f972f03867781c2577a7a934665703fd2e332662ab01b8db9b7d2199a2325ea7adb4011a4c519d6ee05c636960931e730950bd628f702b2a14c373999de4087e854aae1b7d261894cd0db19516d7db80ca97c761cecd24a082a1c622ddbd99de06dc9e74524bff3b86727d4535d002e80927e1a67884cfcd3026f3a5d3e62c16a9d17d342ac9a208d0b85faaa1c5c72d31b51b265ea28d93be2", 0xed) 09:39:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xfffffd2b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="569c860c"], 0xffffffffffffff98, 0x0, &(0x7f00000003c0)}) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$IOC_PR_CLEAR(r1, 0x401070cd, &(0x7f0000000080)={0x7}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:17 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x80002) ioctl$RTC_RD_TIME(r1, 0x80247009, &(0x7f00000000c0)) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000100)={0x28, 0x2, 0x0, {0x3, 0x7, 0x9}}, 0x28) 09:39:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000180000000000000f0800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:17 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = open(&(0x7f0000000000)='./file0\x00', 0x4000, 0x21) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000040)="4aa99076a27cf8f4b032579c5dac92d60b79bfc199913ec6fefbc3f80fc43b0817a19bb1b981d5f278b7414211bc6c0a0694af3bbd56b30c788757db2beb0e53df58745782a21271404e05746e9920c77423cc565728a3e0eb8772f8e6a5cc9731737c7915312c1922543508a2caa8303b22ea931e3503d4f3f440d71b81a7a0162ee8a31e4a098fa276583e1a2b3d259b1bd6f77779b029c4df3d0403ecb4e633a08990928b75157ef70429e8de60cc2c08e9e0709fbc4e63e254792105ba888111bb3bdb644847454bbc7ef32d2f00abf3e1169c", &(0x7f0000000140)="0389df3f310dc5bed4b3b9072cb5fdb645f6e81fc9265171eeafc226636359443fa10567367e8c8428067bb14a8d774d980bdad4f7390933", 0x1}, 0x20) 09:39:17 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x188) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100), 0x4) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 812.326237] binder: 5228:5274 BC_ACQUIRE_DONE node 938 has no pending acquire request [ 812.334576] binder: release 5228:5239 transaction 928 out, still active [ 812.344082] binder: release 5228:5273 transaction 937 out, still active [ 812.363267] binder: unexpected work type, 4, not freed [ 812.370972] binder: undelivered TRANSACTION_COMPLETE 09:39:17 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = socket(0x9, 0x80007, 0x1) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000002000}, 0x3d1, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, r1, 0x300, 0x70bd2d, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x10) 09:39:17 executing program 3: r0 = accept4$inet(0xffffffffffffff9c, &(0x7f0000001480)={0x2, 0x0, @dev}, &(0x7f00000014c0)=0x10, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000001500)="4aa5c7cc73ca131bbd22509705907ec10aca9c8606fa9c56a83974f1f3123167f6e1976de62cc5d6c7966947", 0x2c) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000001640)='/dev/keychord\x00', 0x1, 0x0) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000001680)) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x400000, 0x1) syz_mount_image$msdos(&(0x7f0000000280)='msdos\x00', &(0x7f0000000380)='./file0\x00', 0x6, 0x1, &(0x7f00000013c0)=[{&(0x7f00000003c0)="4976e6b8a172a3e6016a4ef99785a19776d8089c814ef7ff36b7b8394fabae060c3be41198c251bac47ffb250b7bfdca0508b7b7c4796ff2fec80b0a36f0937b17c5a713c92180ef41f696c26bc67cc88a5874fff288c3babc4d9366f8f0ee0213726fd37d8ae386ee6a715a0b3015d00450ae6c53ecd85c3096f9f52b9a400ba4877d877691df38cb66a042885f9ef7ff3f56500d39e87235d435e39b1ef4b2626af8eaa2fc7be1c25bc86f36966e9fe96e6b8a1194476ba4f44bdf42bdaefc9b0a24ba778c6aa5b99147c92a959a07c500b5981332caaf77af7ac96f08b0fafd7f79a065a5633aae7abcac7eaf864e9eca1da4b9fa524dcc16463ad1e6f8b54f37bd845502cae08810b85fc780f1334fa504ec5001b86f6c70d2129bf327fe98a5f3a686ba336fc6f298855e38f71a5b9d95452b3d81245f01e221afc4e74b6617ce02be1ecaecc38c76e90302f1aa5c4a530a9cd1cb7dc7cf1c3d306e3de7dc55f89048584a79cf2844c7a3ff8d93b72184baa375f7e707802f87e795633a5556eb77c0b831e9952132c663bd372a72a7abd8ed8fe4d108573b5c8d6ab96160270ae7111554eacf62334892164a12775330b16c9e9f167803158b074e8f15d1dea56b9023bcb34837f20b46b181c8af3a3b91dabc9f681e26c64967f31446e0fba6663589939b7620ed5a5b60007cdc13dfc98127dab27d240637beabc4d9687576c7c24b6264f5d6bf6cd03dcfed741d0278d9757ccaf54e68c54db531cb15ce39397519fb4d4b89192766e0f3c597b828be624b4fa08c1a0d9b5ade0ccb84e627e8440d4431ffa892362e01ee6d61c307e44b67352bae8f23af7d380e3b204303f47d40b8cce716c9b3c3d205b4c0e5f27adf405880318761937252069acf9c321d7df530bc6603a53b02e55f69420c0daff12faa30b2a12b68b7f6384ff019ba74f96d7f25c79f1aa722093344bad526fc6fd4cf103863c92c3981195e84e627ae3c4f248d81e95e20bb1d1e9466804bf8586980ed49422d1da686bc26502cc2b222baf56acebe694fa906ea1386374bb49f1efcc96fac0488794f1262e7d4fe81c6fd099c0d45933dce2c4aae48d300885b09b7075841b601297f3a6bf798d77905431a355c3d17935be7bcf7ccca674c6b40c972fdc552893016dbf04510588e63c685fe1b48c78b4ae02daa96a18ae0e2975b104845e3631c27b73ea41f485de61647be3c66efea2f6e6b5de0253054f535af253dba2965a6ebd09e59b38b783412af1e73c90dc0cc6a6c613764e15d5afe198fbe482455ffea30c681110ecccdbc1b6dbc288a2e6ba8a0959944245746c4eb46f5e3dd4b1560f10f99b2656f55b94e9e397d2b6d2cc614d07f09a0cb2333372c0eb17146b61f5773ea51f80bb08a53150f7b0891dadeb12fcdfb05b042078bfdc2091af6b963674b3b901e5ccaf308cc2ca3f4969ec46189b618866a206614819f22d19b8b5d421b8dee3f91ab18bdff3f4a4dfcb2ab48e9a63329b235a4ab395c23877e866f2e9df273309dd6ffdb4093ea20ade93093b70424dadab53d790222227f85360eba95200d694d2c45fb50e707b1b4a1ec152b5ba69821d262e03d0ca42b3da0603a812c195ea56ef182fbae56e28f469ab068568172eec484b23b398164679ed936f1475f4d266a9f301838507e5357ee57928988f55a3303e7c9fddfd707677ae4c1d99d39a197fe91d25dbe97a01d1b14b1f58c2c44afad3a80269b119ec03261e36cb2261ec054f09e2fb4ec742b16889a80f700ea3a5aba05b73ae4bf87132da248886ffe1dc12c539dddb03dffeca72120618d8d319903412ff6d02e17b722e66fddc6c2ba45f4956bfd438cb9a9f1a89cd8e697fa2b0606416c68f3836fd1981668e54c6d2a0f7af7c57231847082b4d43e27d0bbd3c94bed97729afdfb937a8c02a6a1d8bed98648b65f4db181bd03682095c457e34d53929d09db33db570dc4331f9d64ed983d7b233786255c58064c9466cae5376380c101e012a5218af578af10d6b44a82cd84000caf48cb84cc93d23f30bdc5b0785e1bb49b7a0e2cfbb2d1e5db707bc22430edca0675d3d8c5e609f22fd74723ce8c86233e8beeb96e65800461565fccae4a335bdd082d9499484e0f811cdae3aee65309ec5e5cdc09ab8fc3cea656c8772e41694f6828a9c6e66ddfb5c3090722377a28c69ef0fc41d485d1e24780383dbe5a63fcf42c88a2ef10a9eaf6f1710247dc43f9ac101ddbf994e396214e4115824afd42d1359e9f931b182753f828d28312bb2b94ecbbbe45f29af1c3c49ff5efe12e115e5f854993136dc607ec4079a91952eaaaf49d4af1a8b241dd14e38c9edf99bc867bc4fd40ede554410f26f46002a2bef554fa4b797d313dcac177f76ae1afca4339d98e195389c5142d4da4ef038643bd0361a5dafc1f6c76b81697800fcf55878f3a88a14af3b73e51b8cec85b2a6a67af5404df45af60205a42d1256e166ad83c5610f0d76fc9e6099a052faf9afab73e1edcf895757a204cf31bfe65a661dbb6ef6592a1eaf7d28e20c6570549d1c94dea82641f0e76b454db65e0ce1b45e1b2a2f1ce01ca809082005ed8cff9232f5610f554152e693ee68fa0b634516f0f34ab9ed3fa7f1ef1dc54f850670a8556fed7e727031a36e9804bc5af3450bb183c0edb20d280cc8bc705cfebbf1046c98045f4275ad5270bfb82ac77eda60b949c9c3922d73fac6ce41a25f906d21d2c5814db65263a527f51891db9d234262e7809ce89a04dec10930d648edd7bacc6d6b46691bff56284eeb4955a4e5038c47a06cac66fc1764fc30ca9348aea0330df9dfebbc1e857a4d68f34f200e150c7bfb6a1984510949783da04d30681bc8c6231cfbf00ae241369d61f063b5ee3c63b0bb1ae38c63240d0c55137b201216f07b1a137777d5b7294b250b3210cbfa4a212d08b564ee5bed72368eb040ca7339a210872d26321df5d304b9233ad0150c3ef584364974b44229576f4c021afcbec3e562e97c92575ba53823abab773aeffc5be5406b9dd3ff0a28240d7fbeeac147ee261f1b5c84cc304c32a4fbc057252223405d044cb197cfec989bbe6521bb27796ce066e61faaefa9d6ff649a452cbf7a7f67d4e8d4ba8230d3075fec812ea364ec1249211b0b088fd46bdefda0b4b1f4779fe86fd4ec5675eafad39fa2c62c5f77278b09e8a324fab89ce46717ff5dcddeca1162a67cbcbef3794bed7a4c10a2f1fc983da560f7b44e682d0c4f565f14b2349c5c251600dc6228c7f1ce627e1e5adcea43ceb57674660070889b1a98f53ec2a2fbbad2a637babde8c736ff9a6f1163ab66f3f01a949d7026ee4e38aaa11e0e19c492a7a625ffa2d2e65406f9fe7eeb9deb798373e94dc9b22fc65ba52d1f7188e9bb39580ab88848b80c0988229de637d6d321a5683515b1ddca14e064ce32c72464a4d22dd932372eb5b8347774a333a83b2a91db5fdda2af687c6504b914d24603e4ea74b04797c9fa229b21fab10b3370d976ed3428030170520c6562141f01ed9b68074bc5603b85a514047a14e2691f9d171df4b56b8cd97c89be7cfb2241d83a55748b15ceb73c993d0420326f3957bf1e985c26bbbed4fad9093d06cb6946e64740a22622f979aa9cc820b18ab4ab006f6681572c54497ecf1a7556e44f4fff8009cd14b0a38684ea84b14d482d3923c5f557b8d2e5433259a3f3727cf4ef31a057c4f58befa4615596a118e05afb20199699b5810f5a14c204e20b4eb1e885d887547ddbc9104175b89487473003066e533cd94432f22d2690e802d493c44568341875d025177c256781f474d52a37a98b4114125c3af4adb8bdbe17e7ea5482011761e89f5e2c61d7ee25a73991a92d1e105bbec2b9f68e8072664eef227b01aaeab3e6fdc2b84032748d6093ce2de7aaac3785c760b7d854517e61a3f0ef79afa9a32a9d47f0e5f6aee3e141fcc7d43c73ffb003d3ec13bc6c051b43f3e9ffe19fac133cdd786fc51b8637e6744f761bbc7113c3be2baf045819115fa0f1765a6154e6df1a65ce4641f060dcf274ea3896b18bd892d452b94ec2bfee99e5e2b96ea3a64d3163e55b909ba02265e6e5eebff201cb36038617cb3d7505710c0c8bcf61a75f61c8231ce1cc4f1d776f0a4e97d4f666e3b946b48b47830202b93e191125908b229c9c38048379c893dee9f5a44f641e6db22d3375abb9078cd06d993e23fa665334e32ca44b99917b5e3dcfcad981befb03598159671f6272f9b3d5966913cacc32292c66ba3d2210d7e336b0ac81a112b32d1e754ba1c548904bb0ece3664b7f952f4d0785269cde92bac98d4c529309ad05af0b8129f526e73c84841bc9ba367f1e0e6d77388c2d7ac72419a2ad839ee9edd1d93a881571ec56b1e12cbca968c22029294a7230ecb80f7b0fcce1c04ba4244b416432490747e9755e6568b861dfd872fbbe0c07ada87e3ee01a528b481a7d22526bf4e708ad378814e2fb7b75c2cbb6c945e21005e0729de2ebb5e0ce30e29873c60b8f0d0768c75358787cfbce4df801d374bc35c8ae95d1f41ae3cd8c308fba718868fa3436beeb302f088fb358ce5c55f6b427a666f75ecf23447b1549d527f30d821743e5923da69291f070cbee18a0a71268d15ce0aeea9c15f7f2d3012f4b4e0177791c0bbc90d1a92d382aaf02ea10cc0ce22b9cc4ff3fa1301d5ded0b1f7d00f15093d23b75ebb0cf7b84e3d4a2bacbae44055ce042de73a0b50f9064bc666b072f15b1e7f0a0604bef1c626f49de4633698702f966e41d51412671978afe73206657a91e3a5a29c1319ac32f32a63f00eb846d651e694c94858c447816f1fff19d9a1ddaf3572003b7df88a89a5279368ec8e3f928a6a99724d723cfeaa593118c3ad3e2c9cad0568c872488e4a30df3f7300f88df211b514e878cbab1b20ea218820d3988414c47a2d7d11b5a93ee4fd022f6a0ecfb551c15cb13fbc16b77b034223668f61e951c9e322b91670084e111928d67241d765b372547359bb2b9dba6fa6e164f65cea2942ad794a903d1d0516eb04b10bf3f5b4a7b905acbe1ad9c6a8b59b0bf5592d62339f23894a0e86f2f106eabbd24d6b4190cde5ae4153db552299bb5f41daab5d9d1764aa1de7742ea65d65e69a1b31368fd81ae010f16e68f1a63e65fb253b2809e2e06be17cd05db3fe4f560cd63d6c6d096545937dd264d7008792ec89fcbb293f9cbb0931f6ab8c1b3c07886f619e199a8c320afd4558d30aa10b5c21f7bc74df07e422b924b21074a90c49a06747ad7d898cb2dba45ed6c9e64f19792eb29c1733ab6c96fb7204772278c039966b4c53a4d1041ac9b776837d99c587127e7cc9469ede1715822c205121ee6dcd5ff26b5f1acf60d8c59e8f5e5efa11944992f271aaa57e8828a3ccc622123335ad323d5591d020e16170049e06a293ef2a408c7e6517019440351da28e403d0a81ff861e54626c83c54c15e154e5f15477007158f02068e0f0242c876520a159d88daf0b198b345e05ee612673002cefb3e18007bbedd0c09122bdf5325f0e271007d994d83cf092da9bd6b5ad1218cef5baaa5491f14d6112b9a604b57927944cb4308a6222baa3e806aa9b460e8c2d53643f8e2a176e33dec803a10f4d323509248e57b6cb54bf8a2da1574eafe5b481f4df71b3f0a3e95da5ac1acde3e3c18777e498a3cb6bb0d514e22757ebc1741364d6dc49f99782b546b61607045ff95ff1b8c8f0f80f2fd92f6b4deecff4d696d23bf9", 0x1000, 0x40}], 0x40, &(0x7f0000001400)={[{@fat=@codepage={'codepage', 0x3d, '852'}}, {@nodots='nodots'}, {@fat=@flush='flush'}, {@fat=@umask={'umask', 0x3d, 0x800}}, {@fat=@check_strict='check=strict'}, {@nodots='nodots'}, {@dots='dots'}], [{@context={'context', 0x3d, 'unconfined_u'}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'subj_type'}}]}) lseek(r2, 0x0, 0x400000000000001) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x280, 0x0) mount$bpf(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x880c0a, &(0x7f0000000180)={[{@mode={'mode', 0x3d, 0x2}}, {@mode={'mode', 0x3d, 0x6}}, {@mode={'mode', 0x3d, 0x40}}, {@mode={'mode', 0x3d, 0x800}}, {@mode={'mode', 0x3d, 0xffffffffffffff7f}}, {@mode={'mode', 0x3d, 0x400000004000000}}], [{@obj_type={'obj_type'}}, {@subj_type={'subj_type', 0x3d, '(@/'}}, {@seclabel='seclabel'}, {@fsmagic={'fsmagic', 0x3d, 0x100}}]}) ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000080)={0x6, 0x6d7, {0x53, 0x8, 0x6, {0x8, 0xd8}, {0x800, 0x7b4a}, @cond=[{0x1, 0x7f, 0x1, 0x2, 0x6, 0xff}, {0xbf13, 0x46, 0x1, 0xffffffff80000001}]}, {0x0, 0x4, 0x80000, {0x4, 0x6}, {0xfffffffffffffffc, 0x10000}, @cond=[{0x1, 0x32, 0x7fff, 0x7fffffff, 0x800, 0x6}, {0x0, 0x2, 0x0, 0x1000, 0x5, 0x7259}]}}) mount(&(0x7f0000001540)=@loop={'/dev/loop', 0x0}, &(0x7f0000001580)='./file0\x00', &(0x7f00000015c0)='exofs\x00', 0x1080044, &(0x7f0000001600)='-\x00') 09:39:17 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x400, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000002c0)=0x14, 0x80000) bind$packet(r1, &(0x7f0000000440)={0x11, 0xf5, r2, 0x1, 0x8000, 0x6, @link_local}, 0x14) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='attr/sockcreate\x00') ioctl$KDDELIO(r1, 0x4b35, 0x1baa9f41) sendmsg$FOU_CMD_GET(r3, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1cdd46b799a9e1346b37db74a91027e58862863d7180ede4ca219662", @ANYRES16, @ANYBLOB="01002bbd7000ffdbdf2503000000080001004e210000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) [ 812.387487] binder: 5277:5285 ioctl c018620b 0 returned -14 [ 812.388966] binder: 5279:5284 ioctl c018620b 0 returned -14 [ 812.398688] binder: 5282:5287 ioctl c018620b 0 returned -14 09:39:17 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = creat(&(0x7f0000000680)='./file0\x00', 0x10) setsockopt$inet_mreq(r0, 0x0, 0x24, &(0x7f0000000640)={@empty, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x8) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) syz_mount_image$f2fs(&(0x7f0000000040)='f2fs\x00', &(0x7f0000000080)='./file0\x00', 0x6, 0x8, &(0x7f0000000500)=[{&(0x7f00000000c0)="320c87f33722d56c32decd396051117b66a5b1e42b8039505fcbe184c3925d2df602cb7c2b9170282e4e18ec64deafa42747e377945936e56e284683375e27f0b14c491cc4b3a331ac3c876a49577a8e6fdb2e287a742db36f10032f66452f78c23bc060ebc50fe7167f8f6916deee1cf0dd4bd22cbca27f7c276e7fba550271327a0b3e5aaf3bdf327d0edcf4dd49", 0x8f, 0x1}, {&(0x7f0000000180)="6fa01a0e07e7d8b0ba713c39bbf28d1b6ec922f418e7d336fbb765ee8a5a6063680a47873ef86513d5bb13ebc18a87fd8d87b0fcebb17dd885e2ff15ad1a406c052e7aa534391edf8ffcbaa072f0e8e78706f7", 0x53, 0x81}, {&(0x7f0000000200)="1dbab199f00910f79753a123c087ab773d10de17933e36ab28f31de9bd2b0bab21b81f504529a13a8198e2918c3365f9c3e6e8ff742d9137e7632c64a88c1599211585ba34e6806d68442a8a7acb7a1fbf5c27bd1e1623732c32381e91c8", 0x5e, 0x9}, {&(0x7f0000000280)="9b35d62565ca158383784f4bcde4c9d71007e83109eaefc64034fd1624a9320b5aa49472bc991789e2fd077942d164c02c5f", 0x32, 0x6}, {&(0x7f00000002c0)="2a39a7c13b10f532c85246352e65cbf99a84b23acf539311a5814485745cd8c1ecee844869dbb47aa3f7ec51f106f7f6f2a085b7e8c226814894a69125f5eb538112499e1f2b934680f034a225a93c9075d344f0176ec2096533e7c05ed58ca948035f21c7afa96fa252e5e10c83b3a0685ac78c728989dbea5dcad41de376e9aea5c0749e6b04971b23edf9625e4d221fa5169c469789a84c1eec5621499cf0e9ff2e9ef5679f5782019e72ac536caf272c384ac541", 0xb6, 0x5}, {&(0x7f0000000380)="8e699ab0615af604de81d15971c37dbfefadc3d4013516f76645647a031086b6dc91e9282934774e1d1a36dbe96df49b481dbc43ff7941b6195b39a9bc81d69b48bbb129e17e0e9c084a2e55a63f90da6c69db0274566b74de42a16e4fbc908ca8f43bd4c9ad2daefd070221a9b1abcaa4d59bfcad4f6f0d79c3cbf933600230df22e8d43e72b1748b42a2a8b71360", 0x8f, 0x8}, {&(0x7f0000000440)="a44d5a0ac6c48fcc28806f819adf4c485444870edd176c1bc0711947c9e203f5ec3d3679cc64ba3ab818083a198ef3b427efdb93d162295630e7f39f89d4703048722cf2b49406d46ad1e7404c37ccbf", 0x50, 0x1ff}, {&(0x7f00000004c0)="36b14656905cf016857c", 0xa, 0x3}], 0xc24e80d5c544c3ca, &(0x7f00000006c0)=ANY=[@ANYBLOB="6e6f696e6c696e655f646174612c6261636b67726f756e645f67633d6f6e2c646566636f6e746578743d757365725f752c00a281d877ae6b34e41de148e745a679777893b587a6102c6c8b209792f6850d0eeb53b39c9b90e5099812d2f8a219d367606bf0f91ab9c120ef4e80441534b8a15e003358da"]) 09:39:17 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000080)) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x80) openat$cgroup_int(r1, &(0x7f0000000040)='cgroup.max.descendants\x00', 0x2, 0x0) [ 812.437535] binder_alloc: 31434: binder_alloc_buf size 1080863910568919072 failed, no address space [ 812.437615] binder: 5277:5296 unknown command 210148438 [ 812.437626] binder: 5277:5296 ioctl c0306201 20000000 returned -22 [ 812.447817] binder: 5277:5296 BC_ACQUIRE_DONE u0000000000000000 no match 09:39:17 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffffff) execveat(r0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=[&(0x7f0000000040)='-\x00', &(0x7f0000000080)='bdevvmnet1\x00'], &(0x7f0000000100), 0x1000) 09:39:17 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) lseek(r0, 0x0, 0x400000000000001) [ 812.485361] binder_alloc: allocated: 9872 (num: 313 largest: 32), free: 2416 (num: 1 largest: 2416) [ 812.495957] binder: 5279:5308 BC_ACQUIRE_DONE u0000000000000000 no match [ 812.496712] binder: 5282:5311 BC_ACQUIRE_DONE u0000000000000000 no match [ 812.511611] binder: 5279:5297 transaction failed 29201/-28, size 1080863910568919064-8 line 3255 09:39:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:18 executing program 4: utime(0x0, 0xfffffffffffffffe) openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ashmem\x00', 0x0, 0x0) syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x1, 0x0) syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x802) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/create\x00', 0x2, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @remote}, &(0x7f0000000200)=0x10, 0x80000) r0 = epoll_create1(0x80000) r1 = dup(r0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f00000007c0)=@raw={'raw\x00', 0x9, 0x3, 0x330, 0x0, 0x0, 0x0, 0x160, 0x0, 0x298, 0x298, 0x298, 0x298, 0x298, 0x3, &(0x7f0000000000), {[{{@ip={@remote, @empty, 0xff000000, 0xffffffff, 'bridge_slave_0\x00', 'netdevsim0\x00', {0xff}, {}, 0x11, 0x2, 0x10}, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x0, 0xc0d9}}, @common=@addrtype={0x30, 'addrtype\x00', 0x0, {0x2, 0x800, 0x0, 0x7}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1b, 0x8, 0x7ff, 0x0, '\x00', 'syz1\x00', 0x1}}}, {{@ip={@multicast1, @multicast1, 0x0, 0xb2f3c2541e0af3ee, 'hwsim0\x00', 'bridge_slave_1\x00', {0xff}, {0xff}, 0x3f, 0x2, 0x2}, 0x0, 0xd8, 0x138, 0x0, {}, [@common=@set={0x40, 'set\x00', 0x0, {{0x2c4f3a7a, [0x7, 0x2, 0x7, 0x1, 0x7], 0x6, 0x6}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x54, 0x9, 0x4, 0x7, 0x10001, 0x400], 0x7, 0x80000001}, {0x7, [0x6a319904, 0x8, 0x6, 0x5, 0xab, 0x80000000], 0x8, 0x526}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x390) [ 813.188273] binder_alloc: 31434: binder_alloc_buf size 1080863910568919072 failed, no address space [ 813.198027] binder: 5277:5296 ioctl c018620b 0 returned -14 [ 813.198057] binder: 5279:5297 ioctl c018620b 0 returned -14 [ 813.198799] binder: 5277:5296 unknown command 210148438 [ 813.198806] binder: 5277:5296 ioctl c0306201 20000000 returned -22 [ 813.210995] binder: 5282:5328 ioctl c018620b 0 returned -14 [ 813.227695] binder: 5332:5335 ioctl c018620b 0 returned -14 [ 813.250879] binder_alloc: allocated: 9904 (num: 314 largest: 32), free: 2384 (num: 1 largest: 2384) [ 813.260947] binder: 5282:5328 BC_ACQUIRE_DONE u0000000000000000 no match [ 813.261456] binder: release 5282:5301 transaction 941 out, still active [ 813.279010] binder: release 5282:5311 transaction 945 out, still active 09:39:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x22002, 0x0) ioctl$KDGETKEYCODE(r1, 0x4b4c, &(0x7f0000000040)={0x1, 0x3a}) 09:39:18 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x8, 0x1, 0x5, 0x6, 0x8}, 0xc) 09:39:18 executing program 3: r0 = perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0x70, 0x1f, 0xfc, 0x3a, 0x8, 0x0, 0x6, 0x10000, 0xb, 0x2, 0xffffffff, 0x6, 0x4, 0x70, 0x1ff, 0x1000, 0x7, 0x4, 0xffff, 0x100000000, 0x2, 0x9, 0x81, 0x4000000000000000, 0x81, 0x5, 0xfff, 0x4, 0x401, 0x8, 0x101, 0x3, 0x30, 0x4f, 0x8, 0x4, 0x8, 0x0, 0x0, 0x5, @perf_config_ext={0x10000, 0x3}, 0x28, 0xffffffffffffffa5, 0x40, 0xb, 0x6, 0x2, 0x2}, 0xffffffffffffff9c, 0xb, 0xffffffffffffff9c, 0x2) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000080)={0x0, 0x6, 0xff}) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0xfffffffffffffffc) mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1) lseek(r1, 0x0, 0x400000000000001) 09:39:18 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0xfffffffffffffe53, 0x0, 0x0, 0x300, 0x0, &(0x7f00000000c0)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:18 executing program 4: utime(0x0, 0xfffffffffffffffe) syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000040)='./file0\x00', 0x10001, 0x1, &(0x7f0000000100)=[{&(0x7f0000000080)="cfef125e7c5eb6bb22bdc50d11aca34d1afc7ee9b3007873abf21c16411d6df6cd01e721ec70db55e1ce1605c6d143b2821c478afd78799f3651e442c66c8075d3b1c8e88a8179d8f88808c98ae413fdaa5b45a3deada4ab9f5bbfa1d84f750d72", 0x61, 0x4}], 0x80000, &(0x7f0000000140)={[{@noacl='noacl'}, {@grpjquota={'grpjquota', 0x3d, 'wlan0wlan1'}}, {@grpquota={'grpquota', 0x3d, ']}user'}}, {@data_flush='data_flush'}, {@noinline_dentry='noinline_dentry'}, {@jqfmt_vfsv0='jqfmt=vfsv0'}, {@disable_ext_identify='disable_ext_identify'}, {@inline_data='inline_data'}]}) 09:39:18 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000000)={0x3, 0xe1, "a427277c43b830638510b74f6e4cb3223079c9198c26d9a72c99d474d49c1787afc3dbe7f8e1a6d193180f8f9b4fb44a7d167938ef2d6389de131837db0b459c45a38d9047dcc43552ad1e1c8f803cb3499df132593c569656cbeaff32b42f3d82a75f795f5ae341cdda6880da1b9b858bfeb5a91aa3fda36d8068d8cc416c6834ecc49c2f84b32a7e5eda76c908765221e406c11f17c1cd992eac37211555cc40b29c31b2858318dc0b890f161b8ecbbe9d478943e8618a6af810d507465fb8ab66c4551cb84a8c7b60c4f90c4957d3dac62588d551a5ad2675d0e3f31681366d"}) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='rootfs\x00', 0x100000, &(0x7f0000000200)='wlan1\x00') lseek(r0, 0x0, 0x400000000000001) mount(&(0x7f0000000240)=@nullb='/dev/nullb0\x00', &(0x7f0000000280)='./file0\x00', &(0x7f0000000380)='efs\x00', 0x2010, 0x0) r1 = syz_open_dev$mice(&(0x7f00000003c0)='/dev/input/mice\x00', 0x0, 0x101000) connect$unix(r1, &(0x7f0000000400)=@abs={0x1, 0x0, 0x4e23}, 0x6e) [ 813.286793] binder: 5279:5308 transaction failed 29201/-28, size 1080863910568919064-8 line 3255 09:39:18 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000000)=@req={0x80000000, 0x80, 0x100000001, 0x81}, 0x24a) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0xb, 0x90, r0, 0x6) clone(0x0, 0x0, 0x0, 0x0, 0x0) utime(0x0, 0xfffffffffffffffe) getsockopt$packet_buf(r0, 0x107, 0x6, &(0x7f00000000c0), &(0x7f0000000100)) socket$packet(0x11, 0x3, 0x300) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x2, &(0x7f0000fef000/0x3000)=nil) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) write$P9_RLOCK(r1, &(0x7f0000000080)={0x8, 0x35, 0x1, 0x1}, 0x8) 09:39:18 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='ip6gre0\x00', 0x10) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) socket$inet6_tcp(0xa, 0x1, 0x0) 09:39:18 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0xff, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) flistxattr(r0, &(0x7f0000000140)=""/63, 0x3f) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x4) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000100)=@req={0x0, 0xaac, 0xff, 0x3ff}, 0x10) ioctl$PPPIOCATTACH(r1, 0x4004743d, &(0x7f00000000c0)=0x4) 09:39:18 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) [ 813.338857] binder: 5345:5348 ioctl c018620b 0 returned -14 [ 813.347329] binder: 5349:5351 ioctl c018620b 0 returned -14 [ 813.359566] binder: 5345:5348 ioctl c0306201 20000140 returned -14 [ 813.407094] binder: 5345:5368 BC_ACQUIRE_DONE node 952 has no pending acquire request 09:39:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x0}) r2 = mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2, 0x50, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xfffffffffffffebb, 0x0, &(0x7f0000000880)=[@acquire={0x40046305, 0x3}, @reply_sg={0x40486312, {{0x2, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=[0x20, 0x38, 0x18, 0x28, 0x20, 0x78]}, 0xffffffff}}, @free_buffer={0x40086303, r1}, @clear_death, @transaction={0x40406300, {0x1, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@fd={0x66642a85, 0x0, r0}, @flat={0x776a2a85, 0xa, r1, 0x2}, @flat={0x77682a85, 0x100, r2}], &(0x7f0000000180)=[0x18, 0x0, 0x28, 0x30]}}, @reply_sg={0x40486312, {{0x0, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000280)=[0x18]}, 0xcce8}}, @free_buffer={0x40086303, r2}, @request_death={0x400c630e, 0x3, 0x1}, @acquire_done={0x40106309, r2, 0x3}, @transaction={0x40406300, {0x2, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@flat={0x73622a85, 0xa, r1, 0x3}, @fda={0x66646185, 0x6, 0x0, 0xe}], &(0x7f0000000380)=[0x0, 0x78, 0x60, 0x30]}}], 0x0, 0x0, 0x0}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$EVIOCGBITSND(r3, 0x80404532, &(0x7f0000000040)=""/9) 09:39:19 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00a4db647430cdf79a5d329f634040000000000000ca16a9564f23da641f5be1b6e1961c69000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="8000000000000000"]], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 814.034641] binder: 5332:5337 ioctl c018620b 0 returned -14 [ 814.040976] binder: release 5332:5337 transaction 957 out, still active [ 814.048659] binder: unexpected work type, 4, not freed [ 814.062043] binder: undelivered TRANSACTION_COMPLETE [ 814.070905] binder: release 5332:5337 transaction 946 out, still active [ 814.078666] binder: 5381:5382 ioctl c018620b 0 returned -14 [ 814.079011] binder: 5379:5383 ioctl c018620b 0 returned -14 [ 814.126536] binder: 5379:5384 unknown command 1692115968 [ 814.132420] binder: 5379:5384 ioctl c0306201 20000440 returned -22 [ 814.147387] binder: 5349:5370 ioctl c018620b 0 returned -14 [ 814.155369] binder: 5379:5384 BC_ACQUIRE_DONE u0000000000000000 no match [ 814.156041] binder: 5349:5385 BC_ACQUIRE_DONE node 964 has no pending acquire request 09:39:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000008000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:19 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x3) 09:39:19 executing program 4: r0 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) fcntl$setpipe(r0, 0x407, 0x7) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f00000000c0)=0x7, 0x4) setsockopt$netlink_NETLINK_RX_RING(r2, 0x10e, 0x6, &(0x7f0000000040)={0x9, 0xea, 0x3, 0x4}, 0x10) accept4$unix(r1, &(0x7f0000000100)=@abs, &(0x7f0000000180)=0x6e, 0x80000) mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000000) setsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000080)=0x8fe, 0x4) execveat(r2, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), &(0x7f0000000400)=[&(0x7f0000000280)='selfppp0!^selfbdev&em0\x00', &(0x7f00000002c0)='\x00', &(0x7f0000000300)='/proc/thread-self/attr/current\x00', &(0x7f0000000340)='\x00', &(0x7f0000000380)='\x00', &(0x7f00000003c0)='/proc/thread-self/attr/current\x00'], 0x400) [ 814.165739] binder: release 5349:5370 transaction 963 out, still active [ 814.165745] binder: unexpected work type, 4, not freed [ 814.165748] binder: undelivered TRANSACTION_COMPLETE [ 814.165799] binder: release 5349:5370 transaction 954 out, still active [ 814.219597] binder: 5394:5398 ioctl c018620b 0 returned -14 09:39:19 executing program 4: utime(0x0, 0xfffffffffffffffe) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/attr/current\x00', 0x2, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x6, 0x9, 0x0, 0x13, 0x15, 0x1c, "c809aa3255043a2f1ee33c39de868aa294912672fdb7ea441a094b515d94a9041b9f586b224fe80ff652a008630d3197d3ada277300de55446ad31e6ace3cbd6", "59e156fe370c80ba266c924f9b6a6d7b9b590cd31abed79ecc2731da102acbd1edd99938f05d7c02926e1220f79fc4463e521eee5769c2cef60540c6061b4611", "ef4471f691be04e2fe6c42a19ecbc86992d39bd30479e266750326f3c49c9616", [0x7, 0x5]}) fcntl$getown(r0, 0x9) 09:39:19 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/exec\x00', 0x2, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) creat(&(0x7f0000000000)='./file0\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000200)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) request_key(&(0x7f0000000180)='id_legacy\x00', &(0x7f00000001c0)={'syz', 0x2}, &(0x7f0000000200)='\x00', 0xffffffffffffffff) r2 = add_key(&(0x7f0000000280)='logon\x00', &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff8) r3 = add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, r2) keyctl$update(0x2, r3, &(0x7f00000000c0)="9b2da72b2dbb5a10b356c4f302ee6f82a9fa64f4831becb91fc3952c9aeefd392126d05d0a8e29ddb6feea4e0fede634c2d3a418c65658d0ffec09c04f", 0x3d) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f0000000440)={0x0, 0xfb, 0x78, 0x0, 0x81, "2ca2eeff7dfb4c14bf277f1df98aa98a", "b572222df7a77b3e256d95e5843ff5db3222769edbd34f19980dc21b65bcd70a923e620a2ce641a9fa18fe699a7dc80b54ccb2fcd1d86c384b71931b959e79945a010a8e0826dbe8fdfd463c59767cfc2e7631b44ea05bde28c6636299f3b66ec4fce6"}, 0x78, 0x2) lseek(r4, 0x0, 0x400000000000001) 09:39:19 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f00000000c0)=0x3) prctl$PR_GET_FPEMU(0x9, &(0x7f0000000100)) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='highspeed\x00', 0xa) 09:39:19 executing program 4: utime(0x0, 0xfffffffffffffffe) symlink(&(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='./file0\x00') 09:39:19 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e24, 0x9, @mcast2, 0x7}, 0x1c) connect$inet6(r0, &(0x7f0000000080), 0x1c) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000040)=0x9) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/rt6_stats\x00') ioctl$RTC_WKALM_SET(r1, 0x4028700f, &(0x7f0000000100)={0x0, 0x0, {0x38, 0x23, 0x17, 0x3, 0x5, 0x0, 0x5, 0xf9, 0xffffffffffffffff}}) 09:39:19 executing program 4: seccomp(0x0, 0x1, &(0x7f0000000040)={0x6, &(0x7f0000000000)=[{0x6, 0xffff, 0x3e, 0x2}, {0xffff, 0x6, 0x5, 0x5}, {0x3000000, 0x2, 0x6, 0x6}, {0x0, 0x9, 0x2, 0xffffffffffff056c}, {0x3, 0x9, 0x2, 0xfffffffffffffff8}, {0x10000, 0xab90, 0x100, 0xf8}]}) utime(0x0, 0xfffffffffffffffe) [ 814.269263] binder_alloc: 31434: binder_alloc_buf size 34359738400 failed, no address space [ 814.285722] binder_alloc: allocated: 10128 (num: 321 largest: 32), free: 2160 (num: 1 largest: 2160) [ 814.297556] binder: 5394:5409 transaction failed 29201/-28, size 24-34359738376 line 3255 [ 814.312804] binder: 5394:5409 BC_ACQUIRE_DONE u0000000000000000 no match 09:39:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0xac, 0x0, &(0x7f0000000000)="2b92bd7898133eebc4be3932d8e1d39b239ac34c055d4d59a3365f3ef71b81a59ff65e09f5e2ab2aba501729a0fd6b3a5f3bc3495cbda6276908c4c6f2e65292d114138d865803ce40121a7f256b4d295faecacb86b57057aea65013093327bc3d1d00fcd24f684624f2ea5651be8901ad691e8b88f009b2f3bcf833a86461bf59219b33ced6d6d87fd4c6d9878675be6cc6813605547f77b29e71aaa228b7409abb423f69f50c067814c2c4"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="0004000000000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 814.344597] binder: 5418:5421 ioctl c018620b 0 returned -14 [ 814.400468] binder: 5418:5425 got transaction with invalid offset (0, min 0 max 24) or object. [ 814.410070] binder: 5418:5425 transaction failed 29201/-22, size 24-8 line 3349 [ 814.419799] binder: 5418:5425 BC_ACQUIRE_DONE u0000000000000000 no match [ 814.876354] binder: 5381:5386 ioctl c018620b 0 returned -14 [ 814.881466] binder: release 5381:5386 transaction 960 out, still active [ 814.886966] binder: 5379:5432 ioctl c018620b 0 returned -14 [ 814.887150] binder: 5379:5432 unknown command 1692115968 [ 814.887158] binder: 5379:5432 ioctl c0306201 20000440 returned -22 [ 814.887345] binder: 5379:5432 BC_ACQUIRE_DONE u0000000000000000 no match [ 814.917456] binder: release 5381:5428 transaction 968 out, still active 09:39:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ppoll(&(0x7f0000000000)=[{r0, 0x20c}, {r0}, {r0, 0x400}, {r0, 0x8080}], 0x4, 0xfffffffffffffffd, &(0x7f0000000040)={0x8}, 0x8) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) eventfd2(0x50c, 0x80005) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:20 executing program 4: utime(0x0, 0xfffffffffffffffe) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)) 09:39:20 executing program 3: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f00000002c0)='c\b\x00\vT\xd8\x05\x93\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00T\v`\xd6\xd9\x81\xcfK\xe72\xd5\xa9\x9e\xf9\x06\x1f*\xb4\xd4\x80b\xfeS\xae[\xf8w,>\xc6\xef\xff', 0x0, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x6000220}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0xbc, r1, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x8c, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x20}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1fd9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_SOCK={0x14, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK={0x8, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x1}, 0x800) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r2, 0x0, 0x400000000000001) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x10001) 09:39:20 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TIOCLINUX6(r1, 0x541c, &(0x7f00000000c0)) socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:39:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09631040", @ANYRES64=0x0, @ANYBLOB="00000004d16db493652499fb4eb691b95a4f87304d3fa156d52e9d16e1e6b301e445bfe0fc4d"], 0x0, 0x0, 0x0}) 09:39:20 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) set_tid_address(&(0x7f0000000000)) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:20 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x2) llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/34, 0x22) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f00000000c0), &(0x7f0000000100)=0x8) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) 09:39:20 executing program 4: r0 = gettid() r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', 0x0, 0x8}, 0x10) r2 = dup(r1) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000840)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r2, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x68, r3, 0x400, 0x70bd2c, 0x25dfdbfb, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x9, @media='eth\x00'}}}, ["", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x880}, 0x8000) ptrace$getregset(0x4204, r0, 0x207, &(0x7f0000000040)={&(0x7f0000000000)=""/18, 0x12}) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x2801, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f00000001c0)=@nat={'nat\x00', 0x1b, 0x5, 0x5d8, 0x410, 0x410, 0x0, 0x2a0, 0x1d0, 0x540, 0x540, 0x540, 0x540, 0x540, 0x5, &(0x7f0000000140), {[{{@ip={@multicast2, @broadcast, 0xffffffff, 0xffffffff, 'ip6tnl0\x00', 'veth1_to_bond\x00', {0xff}, {0xff}, 0x3e, 0x1, 0x2}, 0x0, 0x188, 0x1d0, 0x0, {}, [@common=@unspec=@conntrack3={0xc8, 'conntrack\x00', 0x3, {{@ipv6=@mcast2, [0xff000000, 0xff000000, 0xffffffff, 0xffffffff], @ipv4=@loopback, [0xff, 0xffffffff, 0xffffffff, 0xff0000ff], @ipv4=@loopback, [0xffffffff, 0xffffffff, 0xffffff00, 0xff], @ipv6=@local, [0xffffffff, 0xffffffff, 0x0, 0xffffff00], 0x3f, 0x8, 0xb6, 0x4e20, 0x4e20, 0x4e23, 0x4e22, 0x8, 0x102}, 0x100, 0x0, 0x4e20, 0x4e24, 0x4e24, 0x4e21}}, @common=@ttl={0x28, 'ttl\x00', 0x0, {0x1, 0x3}}]}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x18}, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @port=0x4e20, @icmp_id=0x67}}}, {{@uncond, 0x0, 0x98, 0xd0}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x8, @local, @rand_addr=0x5, @icmp_id=0x65, @gre_key=0x8001}}}}, {{@ip={@rand_addr, @loopback, 0xffffff00, 0xff, 'ifb0\x00', 'nr0\x00', {}, {0xff}, 0x4, 0x2, 0x40}, 0x0, 0x138, 0x170, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz0\x00', 0xff, 0x8, 0x0, 0x2}}, @common=@osf={0x50, 'osf\x00', 0x0, {'syz0\x00', 0x9, 0xc769ae16bd8152d8}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x1, @loopback, @broadcast, @port=0x4e21, @port=0x4e23}}}}, {{@uncond, 0x0, 0xe8, 0x130, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz0\x00', 0x8, 0x8}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0xf, @ipv6=@dev={0xfe, 0x80, [], 0xd}, @ipv4=@broadcast, @gre_key=0x9, @gre_key=0xffffffffffffff01}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x638) utime(0x0, 0xfffffffffffffffe) [ 814.926749] binder: unexpected work type, 4, not freed [ 814.935183] binder: undelivered TRANSACTION_COMPLETE [ 814.945861] binder: 5435:5439 ioctl c018620b 0 returned -14 09:39:20 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) vmsplice(r0, &(0x7f0000000300)=[{&(0x7f0000000040)="2579ed882ace5a8785af96727f504bd689c66355bcb2533f84caf20f65f99e901173e99e7a6764bfedee", 0x2a}, {&(0x7f00000000c0)="88c719eff3ac9699cec09f2d03fb5fd7e0cb2633cdac192bfa3fcdbf027059197c14bc67459c935c4602da4c6a6f2ee545d6325751c95e5c8c5fe17d70b8abf2bf07bde01f9a9f87a4ea478134bcd3b9318749b6f0b2cd98ab65e043e999b7963fb11d7e76bcde78e91ef791c30c01396e7d78ec9e0250ff5f0dcad07ad6a80072907c1086aed1a48a774eda58bd7f72d3c539c26fc3a92bcd1b580f3809765a32812a1a370d9b5627fb87e68b8fc1f722", 0xb1}, {&(0x7f0000000180)="8311224f9cef1b3880fb53720e8ee61aa02780dac723e9bb81190a41a9328e75340231f4a86c3b7eaea8a465de8eff7d6bfb306df046bb914c6d8c0d6d545ef555751560f8cacde3", 0x48}, {&(0x7f0000000200)="40218bb414f724291331cc5ed94dd7ab9437a809c500d8fdec2c9357fb7369f3e8df21b5d563a21c241e5a0bf3d88e0f9c0248af254e9a2ff006b1b99384187f78f6cf3d23b574b18129cbe51846db2031bf52b0fc613adb38c6a0e0996b2c156b3dadd85233cdb1ade596b6ab6b4ce0e70aa03fc81b7a356815c76aedb22989796bd4c9bbd1f03b36bc4f01a9174607caed82b1a6e735d5bb0d3b683d530624b245242c54673c0b4f2fc674a393901e416ddf1c799566118cd1cbfe7e496c9fd97cdcd7bbb96e089e3c27b1573700e758f4", 0xd2}], 0x4, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:39:20 executing program 3: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$IOC_PR_CLEAR(r0, 0x401070cd, &(0x7f0000000000)={0x5}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff2000/0xe000)=nil, &(0x7f0000ff4000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff3000/0x2000)=nil, &(0x7f00000000c0)="3fce3edb0407b809ae272967e4e112194354dc94fb717e15a841d4edc051742fea89b15ac6f80ddc248ab086619a468dd5dcd86815e60d865c91178d9d80fd3fce3b1c94cc3df5ff6325f62bf297184b", 0x50, r0}, 0x68) utimensat(r0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={{}, {0x77359400}}, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) [ 814.984227] binder: 5436:5448 ioctl c018620b 0 returned -14 [ 815.008059] binder: 5442:5452 ioctl c018620b 0 returned -14 09:39:20 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r1 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) r2 = request_key(&(0x7f0000000100)='asymmetric\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)='selinuxproc!proc/+\x00', 0xfffffffffffffffc) keyctl$negate(0xd, r1, 0x1, r2) unshare(0x40000400) connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:39:20 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x40, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000080)=0x1) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) connect(r0, &(0x7f00000000c0)=@sco={0x1f, {0x1000, 0x8, 0x4, 0x8001, 0x2, 0x7ff}}, 0x80) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f00000001c0)="3e3b9084a5fd33e86c69669ad1d353cf1da88ba6073d620726f3abdf4bc52bef91375441b4ec43712ab28b2afc8143f9c134dde19d77c89ec0f144bbe849394bbc2e2d3184e6c6437f39cffc1699fcc993327c472837c992387a89d0af41d13badbbf96ab5d137c4fcec0443e111ab5e5b3bab22a4fa57dedf261981f200147f734afa078b0f0e5829d0abfee2261ba5e23c5dc869fe87302e4b0ef1debd99d71a734697000000000000000000000000", 0x44d) [ 815.039780] binder: 5436:5464 BC_ACQUIRE_DONE u0000000000000000 node 975 cookie mismatch 93b46dd104000000 != 0000000000000000 [ 815.112789] binder: 5442:5452 BC_ACQUIRE_DONE node 978 has no pending acquire request [ 815.750748] binder: 5435:5489 ioctl c018620b 0 returned -14 [ 815.757667] binder: release 5435:5489 transaction 980 out, still active [ 815.768145] binder: release 5435:5455 transaction 971 out, still active [ 815.782539] binder: 5436:5464 ioctl c018620b 0 returned -14 [ 815.789003] binder: release 5436:5464 transaction 983 out, still active [ 815.797414] binder: 5442:5452 ioctl c018620b 0 returned -14 [ 815.799184] binder: unexpected work type, 4, not freed [ 815.799187] binder: undelivered TRANSACTION_COMPLETE [ 815.799233] binder: release 5436:5464 transaction 974 out, still active [ 815.802735] binder: release 5442:5472 transaction 977 out, still active [ 815.802741] binder: unexpected work type, 4, not freed [ 815.802743] binder: undelivered TRANSACTION_COMPLETE [ 815.839753] binder: release 5442:5494 transaction 986 out, still active 09:39:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x402, 0x0) timerfd_gettime(r1, &(0x7f0000000040)) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:21 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/enforce\x00', 0x3d, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x41408402}, 0xc, &(0x7f0000000300)={&(0x7f0000000080)=@deltaction={0x268, 0x31, 0x20, 0x70bd2d, 0x25dfdbfb, {}, [@TCA_ACT_TAB={0x38, 0x1, [{0x10, 0x9, @TCA_ACT_INDEX={0x8}}, {0x10, 0xf, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x14, 0x14, @TCA_ACT_KIND={0xc, 0x1, 'vlan\x00'}}]}, @TCA_ACT_TAB={0x94, 0x1, [{0x10, 0xc, @TCA_ACT_INDEX={0x8, 0x3, 0xab}}, {0x10, 0xd, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0x10, 0x6, @TCA_ACT_INDEX={0x8, 0x3, 0xffffffff}}, {0x14, 0x4, @TCA_ACT_KIND={0xc, 0x1, 'mirred\x00'}}, {0x14, 0x5, @TCA_ACT_KIND={0xc, 0x1, 'csum\x00'}}, {0x10, 0x15, @TCA_ACT_INDEX={0x8, 0x3, 0xa25}}, {0x14, 0x7, @TCA_ACT_KIND={0xc, 0x1, 'police\x00'}}, {0x14, 0x13, @TCA_ACT_KIND={0xc, 0x1, 'vlan\x00'}}]}, @TCA_ACT_TAB={0x40, 0x1, [{0x14, 0x9, @TCA_ACT_KIND={0xc, 0x1, 'csum\x00'}}, {0x14, 0x1e, @TCA_ACT_KIND={0xc, 0x1, 'skbmod\x00'}}, {0x14, 0x1a, @TCA_ACT_KIND={0xc, 0x1, 'gact\x00'}}]}, @TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1c, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}]}, @TCA_ACT_TAB={0x68, 0x1, [{0x10, 0x1c, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x10, 0x3, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0x10, 0x20, @TCA_ACT_INDEX={0x8, 0x3, 0x100000001}}, {0x10, 0x15, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0x10, 0x20, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x14, 0xd, @TCA_ACT_KIND={0xc, 0x1, 'gact\x00'}}]}, @TCA_ACT_TAB={0x7c, 0x1, [{0x14, 0xb, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0xc, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0x10, 0xe, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0x10, 0x1d, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0xc, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x14, 0x10, @TCA_ACT_KIND={0xc, 0x1, 'sample\x00'}}, {0x10, 0x19, @TCA_ACT_INDEX={0x8, 0x3, 0xc1e5}}]}, @TCA_ACT_TAB={0x28, 0x1, [{0x14, 0x10, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0x17, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}, @TCA_ACT_TAB={0x28, 0x1, [{0x14, 0x12, @TCA_ACT_KIND={0xc, 0x1, 'skbmod\x00'}}, {0x10, 0x19, @TCA_ACT_INDEX={0x8, 0x3, 0x400}}]}]}, 0x268}, 0x1, 0x0, 0x0, 0x40000}, 0x80) utime(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x9, 0x1484}) lsetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000400)='police\x00', 0x7, 0x1) 09:39:21 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000500)={{{@in6=@empty, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast1}}, 0x0, @in=@empty}}, &(0x7f0000000600)=0xe8) syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000040)='./file0\x00', 0xffffffffffffff78, 0x6, &(0x7f0000000440)=[{&(0x7f0000000080)="1381a763f0e45cfde2bd16f83b4d09d1f27f39e565fbe0fe6aab03f003200dcbd3d2e1859d61849c1de52b6917ebaf21fc9aeab46ff3299e4da50f7e3686100cec779698ba0bda53d0e1045d80d524282f465deba9907a4aa14dad45ba6db8cc5e1eb421f6aeb8e093", 0x69, 0x401}, {&(0x7f0000000100)="163438bb3445ed32d509a485cef7ea1a277f887e16a68408c0cba33e42a49305cf48912d7fe26bf7a5aa77c539f336c1", 0x30, 0x100000000000}, {&(0x7f0000000180)="c6f7642c9cad34d0f85b0df30ce129f44ca1d0d8eb7564d4bb28866b4ab0cfa3871b10b8ee0e61896d34b9b4743d52f908e27c43874f1665715d69758d5a0e495a820421ae", 0x45, 0x5}, {&(0x7f0000000200)="b0e2a4cc85e34b27ada32ae364de8c677b44d7ab2f4e106fc9b4a17cc94cd38719de7b", 0x23, 0x20}, {&(0x7f0000000240)="94902f401396a6ee792f06d94293931cd9cd5eedecd2bf6319f603f9012d3adb4bb3b0544e173d24088ccf97eaaba3e924af365f9c3610bd56afa5f87a2e8fc1532f7351c078621a3bcff7924e1d9c1139ca937cf5ebb7a2247dfdd2cf298e61a993a9a01cc8003b87abe22ae8e17beb175110360cc348d66d812af9ef8b", 0x7e, 0xd8}, {&(0x7f0000000380)="c189249733bbd326f4458daea4c7a21b04cebc62c7ff308215b7b529c4f5d2d7cd51b85c338001f0cd8d1865702efaeac42266c68ba3bb4f127bacf246374825d7a61e862be2e59f5633af386d7c4664bc7183e9e803c0cbba336af3e4952ff84d0d59d00b7922d3146c1539535f8820fb35e0d5720a10427658a2b4e96d2765d8fdfb0cdac6c8b5aabab025fb7d08950a136f5bf9705bdf7716cbab5a6bb467ce9b416fecb68b017edf5a95aea92a5dbbe5719f513e4e9b87462291f3769471", 0xc0, 0x3}], 0x4, &(0x7f0000000640)={[{@nobarrier='nobarrier'}, {@noinline_xattr='noinline_xattr'}, {@norecovery='norecovery'}], [{@defcontext={'defcontext', 0x3d, 'system_u'}}, {@uid_lt={'uid<', r0}}, {@appraise_type='appraise_type=imasig'}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}]}) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) 09:39:21 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x1) connect$inet6(r0, &(0x7f0000000080), 0x1c) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) 09:39:21 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0xfde4, 0x0, &(0x7f0000000580)="6b3449b8371cee8f58f703b3aaaf93450901f7574ff4e1f3844080fc33b67577312570bd1146a0932dd80be807765695a9387a2a65197c3bc02db2d8da32b6650b781dfc26aaa12c3184d2c2fcb1ee9f6955fe52df5eaeb98776063939c3332d8cb389f565435dcb1ce940f62714753e5245566ca5249916457087fd7ad525c2f17ff26cba964af403b884ffb0b7298067cf15e24cbc2e86ec1e2c30b9ccfd961139d02f02c998143bce807659b0fdbf897ffbb7bcc2b3eba6595d72141b359cee352172fa295428d403824403eedd7206803ec0dac2a356311555d641295a5f0aa1b47edc5adf1ff4c83b0059c821fd0068781d9009ab56ce97e0caab61d28e3c52b6d77d0c8fb27dfdf301b7ff06507c2b0d2082e445801cb7ec559ae5a782b4daacb7391f3fa3132118a21e20e4e9a796e9a4e85439eed34faae452f2e6006999b17901e09689e829af277e234e326177474773"}) r1 = fcntl$dupfd(r0, 0x406, r0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000002800)={r1, &(0x7f0000001800)="702ec6c5a7676ff89431b672d6ce41aa6dfa833bfb806cfda80eabdacf658bee994906dedf54f1d3056e45c2dbb1920c8c9b8f08dad9a3dd1038e86b7902e72203ea8e8747d12979f00027e7b422bf44e7f2be7ab11b2b1b761f5790605196be65f77e54f581b2d642f7bc5b01b952705802d1a3542ea1deb3d734404c3ca27efe3e295cf3de58b88e926c852117861cdf249faf49bef072bde7daa1dd2b30138e16faac7cd50f5767fd87728a5df33a495376997a5334f6d7bd703dcbf655be514284499161aece438bb9694fec539ae9f9015d83b88d7982c55411f3a7df1b0a67ee69d81967a3ee7296395401beb8bbe2737e19dda09bcb30ae72acf42cb63474b7375990c731e89b80fdd5a8749bafa1e893c23d78a8c9c434800beb0a0f2be4543338bb0aebf95fcb6d8ebb0be44c0b5d22147b4227f577696e170485958ed09e7de54de0231bd113ab0ed034fc78d92cb8e1a6dcca2d6fdc82c7d4168780e74b869cae1c949393af613cb6202e9f300183e309b2e9cc92991f5dd768a8347d805b56bbc75f900c73df84b1e803518c7a7c13cb5c6447410f6a7923ce85222fa1cabc6940d4b73e04928e32c616bb11cbd559ca99e80fa01cc7159d7e0cdc67735b8221ea1e9ac012a92c9f4600a3a3356b4afbfa5f48446c4ff3381602c1671d4f8fe42fd4c0f6c97459ffbf9f810dab484eca66e7f09fce4153b3185aca49e4a8b7033c6d1f3e284bf76f93809b14b01a935e74a431cb74661636ce3a6f7f70172bd67de031bdce9b69ffe1fcbf4277172e3784e26bec42452dcca1c895d9a64756f4af28e0636bd89b1d9de7fe0dffafdd47219a575c7735338c53a52b3f9fd41f509f70fce4e1b250097e83810323470708acc4a33e6d7fc6c7a4b977a60ee0d7d4ddb758125575d0efe3f543c3865a35fa98d8987978ede26bd4ebeedf14c14e3c454c646f29c48c3967b678e0aa52e6e884b6f30fce64e325f02c0d3965c0560ba0dbe0cbfb1e81680ed70eae0bc88a23009df6ce015ee6ce1e443ecd002849a2b489f2b4ca8d677954f6276117660d8056edbb9b98a69f8a134eb57bb9281e5d21cee57811599e47ee62ad40e25efcecf9132b8f7cf3414c2ee4c21f5e427b412db82fea35c4536ad0b73470ddf4cfb84fffa585cec243491aeb63aeab4f3095da725401259646ec855caa0857bf24f68f7b598ed518ccc7d3d25bb545583fa4790a35d85a4ddea728024613d2611197f868353164ec9e5b18a967d5375c0212f3a5236eabfc3ad1acf1c5d4c8225b1afbd22fc1816c79568471c5e2416ca8161db4a9ab2586bd17684cc41a97f5682a0772bc40f1f098a2c0e89ec4674601027c174aa3700a1b0453905c0ebc48ca09f56d6e79eb59f5ea1043558e096183518391aa69ae850fced26fd1b94a13f4a506fcca011e44b136ff7726c82bd4cf4e540e2bbf2d27d966a1ce5f805013f3b745306e014027f61d53caca219c6480e60a94d43e39a893874dd188f78aa83d76a175fc9b3a29fc696c921f51bf6dd8ff8c0ff66efa28c103e89bf80ff6f919977dca112343794a5e464fa58eb10fc26164afba81d9cc885f476ee60bd0d8b6b348aad6aa3e7183ace19782b72bfd388e772a2604cdcdeb7f57d8ecdeed659386f45f9166b3d9c8dc9941ca6b1c1e170b43dc359b9a1c8a173d837fc5911eb4c9b0751121e1581310bd938b63eeb646079b04569ef342fa172642ebc10b6e4fadc61f56b82336d2c0bdca366aef941ca7c14e80c3efbc48d8df5407dbe93e5b1c2a1b0b225791f1e4b9c04fe57b995039f26b6bf3c6aa7d19ec7758d01a11bc5304481efa24114cca92ae07c541a71e939325fb6a1fc18f05f46278d5e9268880840063d59c1f77b1cc8b9f8920d34af1ff9429c629a2a3516094f337b7cded2fec48aa8f159ab2d5519e17b23715573b656243237ce1c038c0f49088edaefbbc75903e36751b19b6440a8e444e4b1ae46c77950b6e91db536415085fabfab6878e1caff5c61016066abb86982e1efb6df94960b7fcfac54d39444a212b4115a6879c6b0bb466e35de99839c41ed0c22dd3e54d6b6ebf003b1203a75ec5004e3e70d135bb8a919d12c18e18231d0d804252e98e01b45e087eb1839ffe8d4aae1879f010012f6912cc4aa4364848915479d0d3c730a914a95a317edbe7dbe4c458acafab5de45e4d3d018b3bc0171c13396b4feb8e0540159f5aeebdc40d0bb01401019fe7c315aba04849f182366c780c122e6a115baced49219d45ea9c157951eec995470adad8a2c9865c1e0b861b413e1808d8b6ef0053a3b11f68c52bcd9d6bd464834a73ff14038a152ced6e94055049ce77df09a36688cd0218ec8bc1bb596813d0356bfb48e58367c8cc83fa4397858baa1d8813ffa263ca7d9148b678380b6da43047590c9ddfd2fb31eea27955411e45d83cc62accd0a4099dd5840bd8a9908cddf16ce1d394bbd25cfd8fc56996d502887610f5ebad6c0589b09475a2e35041db7c3aa2bf7befbb1da456f1f4af8baa1dba805050ca69c867fd5b04efe1f4a989bc2466eebce2ca9e21eb605c034d9f9fde767380ed4d462e66c9da59c1070fc5d800d36a9059ad582ab2716281c48ea30bed8af44f25dac09289a2281d50c1a34d90a6097083c083ed4f6cbc59bc5cf288f3c51921577730c8da208a5c132de903b99202ab76600fe4bf60c3673e8344da78f3767c60fe5375ef1806b31e6a9657ba70f2275623ec377dc14f822f3d72d8bd5bdcd8ba1e95b9b3e78c4214a144d05d659eba160293e9831bdb7b2eea85f1801a012d67c0a92caa170a94789461f1f20a345a15f254b7b9f0836db5ff1eb945d0f7dbf466cd12851ee2198c9b139f7d7bb072459b24841e8dbf039b4c3ca1ca74e6099d1afc324bdd8e60bb3f1001186ae9898f87992a2a2eea3d4d636989f8366a951ba7caec605c3192bed8303df1380198106b54afa91bc4e7c3bb6dce56b156098ee6f806422c617283f4f7b5d8382e2b986e6c150c5975ef4efad54da7c125e5585fa44745fc1b68b6a1bb3fc5f45055e16f934401456f76eb196dffa21381c06f846cc0f8c061624e0199ef7ac13d67fe976bcb82014771c57a1784a0dc0e3812f33866886b8ae5ca3a174a7a86e239f7c6a5b1fbf1ff941acb9044240117bd22dc2d6086eff03ffe785e850584a5165a542f3e32fb60d80c579d04587bd73773027e16731259963dea6a1a012a535ea3c0eac8561ca46ec3a923269f1fdf7aefd7e3dafd57982ca7cb9495ad6753b905ce089eaca11fada5937bd72be43a8d922c5d1d3502d87ac92a55d56bcbcb256877a55ab1c9f30694474e4132dce56e9e991ce9254bff14299e37a870162d45c4ac8b4ef837dced1da0ae7805280298f3006bc71afb3b6a99d8b6fab3957e07aff68090a7a2ff6807567f31b345e19d9c10d55c1e5a077685b1f16dd20ca4da6dc8ae1e315b4226f1f20d86796e106342bf29f46eaa1f983369c7a72aaa4d91f895e088d245c54741bdc20b0f94a839b0288e7fd1854d13c104ce4ad727ac8d1e32c1ecc049572ec34352d6787c000515adca1e5739af7f42a2ae58744ba32e5a5f39fcd7c39488d3b0c22876de030e7d397a9dafe25fb90f0779808c3ddaf67c82c167f6d8d2c7172dbd14afaf95ba79affbb2b5b635974106856ee1603f4f80e7e4160eb8708e79e7e49aa563a7bf8b368a2a7994e27fa1a8e6ccbde24e2b09c21e3a77e44e9a60653f011c5620ca60c0ded72c8797972c2ea1c6e3efb292208c2a96f6053989ce0261ae301e2b99af79e2e1edd834be4038947069b4def209f1c07f78e241ca31f27f471f291633c165cff14b93cec61ae9a7e5bfa89aa9d2afd5364ee49a6d9208b66e69508fa5f19ddd2684eead7ce8fdfd88ff60e98aa8436c90c540fb392c2e04715e58e71c118bf2baad22aca6305c32cd98b6e4ff9c81794c1f9eaa74f959264f348283b52193c6c26862a95fc3ebfa3dae5817fbd422ea758eaf777984a04c9d82a3fbfcd3aae34757e618d13f75b2c39854c5ef0fa9ed2dae168e41efde0bdee9b997b351fefd5828674fae78e401e5c5f8c24b8076fee1471d02a528c4cf85ec9d5d3e03ed9c1b910f11f566f5fbed696f0f2599685f8b784b343d2aa805cdab1d7c44be7daa6099cf7f02b423d7cd7afc43931154d494aae0dec9058f7ac74d4f227c8c25dae6cb77f66a69699aef5e4c6fdadf4db4c7292781eb67c962ad0ec2418ea93d76f0328a4e334549036a04e8573e9b712e84c98457b5d3682eb0cee1fd869b7ea08aeaccb780ea1d9cd77e023355e4c0a92415f0489d983ee3ac3ca81a26bfc676e7f73e37dddec10151f981147c4a021b99072daaeb1c85f60ad15791c82363a2bcfbdcc2397e53eb23c42e311a2e9497a391ae15db14924c2b3f995adb9dd9c745665d95d1e49e3780298ce8f2128bfad51cbdf0235e3b0c77c4c8073f84fa13adc3a6d612ada2455bc3c693dac1c55592f464d629222309ab9cfe2a89d4941b1542aee37643b017e72eeb6dfd2ca393b819095df9ea98be7c3021bccfca9b7f4d288d5f8071eb5c37aa9b7b2c3faa6051cb191257d0a86bb7457e17d09bbe24e14fc0bead190990459cc054621bd3d36df56b131d35a7f834882f8106b87e531b5dfd4298ed67d89864acd407775cfd186c2c97e9736965bb019436f4bbb3b1f5b7e3b663874024a254d651ecd594fcc4cb91acc9e6942f6ba18927051a2729a087b5a993e81a0ef66abbe13a0c8ff368fdf615ee6782c5497cac4b42a5204e44c53d544538465fe4e12398f65c1626e7e411d28f2b0bed6b02ac410985d94d6237c51db30e5978bbd0dcc3dc626e70a25c3b205bb3f940c8ffbec26685a40cac780d35169ed5e6a20062ed3932c2c2c92bd0f0d2554e8e00a1c69ebffb2afbbc1f69b8d6deec7e8375f36c3c45c87cc66b2b338845407148d407da7f1adbc6f161dc0f784ccb96d42655a3b038fb499c2c84fde9561fd63c62190513dfc5346c3d746ec7410c757230ccc2935b8d12fdfb3cc74728682e26e88729602c5242c990629700520e58c308706f1641707bda1c38cf1d2ce9ee32659564fb294c842f4f1ac4f213e9ff3353f9c7c27748acf224df6a7dfb17cadcd868427db8ac19de34b477ff0c0359434cb00230034f4464340ddbed841bf39b8dfb4a58bdd2fe1d261befb0502c5ce7ed17298c0ca1725590e1b13a3905634a1361a4e640042a6c7e1f749eae9e1d05f730d8f1fb1c489d5b8ee94aa9eb00263c5a3d8b13f9072927c0a2d5708cceb88d89b8b14af6ff1879108c1711eb63424b7d32f1375976406d413ee02a8b9c340e68e29c44706ebb563806329b567633d250de784554108b4b0ffb419a6d060527d01631b6737e4d769a6e585fff89a694ec9b8d2edada3b8b5bbd3833849fd9c163b4680b8ca30de3a3b968a9bec59e411f410bd46651ca9bdbe6e926bd2e8bf3b9f87fcefdba799a6237f99a0b1d8762d5ff8041ca630aef667858e4d4af2f89ac6fb9d9b6c5860bcc9deb6871bf5bd882a5bde3b444fc48eb71622da8be4772dfe820edb997c9aed2e5d6458097fe71141d43b43541fa0a3a749a5447fbcd06f49bb076336c2763940ddc2173e89ab242737d114a600ddbafd3219108cfe24ad5519aa23ae0eb3af94fcde05ef8d164ce933d8a985937de96c39b708aa7341e0f599560a8fcd37b8d9cf2da6b539bf3d1cf6741511ce7c88c4ea50782f87696c08a11", &(0x7f0000000540)="3b5c3be25090286ea8cbc58f125bb2309eb72e714d44dd82fe990129e156", 0x2}, 0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000002840)=0xc) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000480), &(0x7f00000004c0)=0x30) capget(&(0x7f0000000080)={0x19980330, r4}, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={r5, 0x10, &(0x7f0000000280)={&(0x7f0000000700)=""/4096, 0x1000}}, 0x10) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) readlinkat(r5, &(0x7f0000000500)='./file0\x00', &(0x7f0000001700)=""/224, 0xe0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000180)=[@transaction={0x40406300, {0x4, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x40, 0x30, &(0x7f0000000080)=[@ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x3, 0x30}, @flat={0x77682a85, 0xa, r6, 0x2}], &(0x7f00000000c0)=[0x18, 0x0, 0x18, 0x30, 0x48, 0x20]}}], 0x0, 0x0, 0x0}) 09:39:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mount(&(0x7f0000000100)=@md0='/dev/md0\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0)='openpromfs\x00', 0x400, &(0x7f0000000380)=',&{$[procposix_acl_access--cgroup/eth0[GPL\x00') ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$BLKBSZSET(r1, 0x40081271, &(0x7f00000003c0)=0x9) openat$cgroup_procs(r1, &(0x7f0000000180)='tasks\x00', 0x2, 0x0) fsetxattr$security_ima(r0, &(0x7f0000000540)='security.ima\x00', &(0x7f0000000080)=@ng={0x4, 0x7, "d033acf516d00fa54902"}, 0xc, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a6280a206000000000000000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0xfffffffffffffd13, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0b670000b360f7d50c9d1aefd6c34f1a30b8b34d2794eda023953e45b7ae53"], 0x0, 0x0, 0x0}) ioctl$LOOP_SET_FD(r1, 0x4c00, r1) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f0000000480)=""/129) [ 815.848865] binder: unexpected work type, 4, not freed [ 815.871585] binder: undelivered TRANSACTION_COMPLETE 09:39:21 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x103000, 0x0) r1 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 09:39:21 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x180, 0x0) write$P9_RMKNOD(r1, &(0x7f0000000040)={0x13, 0x13, 0x2, {0x80, 0x3, 0x1}}, 0x10) [ 815.878045] binder: 5501:5507 ioctl c018620b 0 returned -14 [ 815.882143] binder: 5502:5506 ioctl c018620b 0 returned -14 [ 815.905724] binder: 5508:5511 ioctl c018620b 0 returned -14 [ 815.930537] binder: 5501:5515 got transaction to invalid handle 09:39:21 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) ioctl$int_in(r0, 0x5421, &(0x7f0000000040)=0x7) connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:39:21 executing program 4: utime(0x0, 0xfffffffffffffffe) utime(&(0x7f0000000000)='.\x00', &(0x7f0000000040)={0x1, 0x40}) 09:39:21 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x80000, 0x0) setsockopt$inet6_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f00000000c0), 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) 09:39:21 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000480)={0x0, 0x0, 0x3, 0x0, [], [{0x9, 0xffffffff, 0x9, 0xe51, 0x3, 0x80000001}, {0x5, 0x2, 0x7, 0x1, 0x800, 0x80}], [[], [], []]}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="09230140", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 815.932615] binder: 5502:5519 got transaction with invalid offset (0, min 0 max 24) or object. [ 815.932644] binder: 5502:5519 transaction failed 29201/-22, size 24-8 line 3349 [ 815.959930] binder: 5501:5515 transaction failed 29201/-22, size 64-48 line 3118 [ 815.999054] binder: 5534:5536 ioctl c018620b 0 returned -14 [ 816.063438] binder: 5534:5538 ioctl c0c0583b 20000480 returned -22 [ 816.083525] binder: 5534:5538 unknown command 1073816329 [ 816.090084] binder: 5534:5538 ioctl c0306201 200003c0 returned -22 [ 816.674986] binder: 5502:5541 ioctl c018620b 0 returned -14 [ 816.681264] binder: 5502:5541 got transaction with invalid offset (0, min 0 max 24) or object. [ 816.690085] binder: 5502:5541 transaction failed 29201/-22, size 24-8 line 3349 [ 816.698045] binder: 5508:5526 ioctl c018620b 0 returned -14 [ 816.700380] binder: release 5508:5526 transaction 994 out, still active [ 816.715508] binder: release 5508:5543 transaction 1001 out, still active 09:39:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="1538e87917eb9b0ec2e20200fca42cfa08702891f442df36cee9a624a4d31b5e45cf9149e9fddeca82e0bb4938189965fed207a6b70c61216fea67869142aca3f84e5a64da2aa61a9c597831bc5e4d3d3844b6b7dd136382df58626e5f8436597ee1e4ece0e8394cf70efd290494fab5aa13bd8b8ae61cf62eb384cab4daf34766a459abf86fea1edd9bd688f8ca365d91f8da10294f8ebe8ed7453169656044e1ab87c95197fecd2f13036eb5aa8b1f420b63451535820f1e64997acbf91a93fd93ca24840f33464f1c3357fc60e814e7aa5fe19909e9fb8419dbe302f65d176996bf9728d3ce998bdd62914e2689df00f7b37dce6d48c46561a93f36ca05d8", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f0000000000)=""/214) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:22 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x1) r1 = dup2(r0, r0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x404, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4048001}, 0x4000) lseek(r0, 0x0, 0x400000000000001) 09:39:22 executing program 4: utime(0x0, 0xfffffffffffffffe) fstat(0xffffffffffffff9c, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0}, &(0x7f0000000380)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast2}}, &(0x7f00000004c0)=0xe8) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000040)='./file0\x00', 0x8, 0x3, &(0x7f0000000240)=[{&(0x7f0000000080)="61eb214e448752f0ad31f87ade5bd002ad7247d38739a30e73d58263a39efab6f7f03c7920f1a5aa7951adbfe08aff3ee64b76cc3da3a5177eecfe9c37e536aa2b204c0ba18ce070c09b54b6a3b86698cfa8c6bd9b51d86f3cc87481c8bbe490c5109e20ece3556f36864e87563b771fc9d8ce0997e759806bffae203137ee846f1ec79e82081e5b03306430a768076c04c352388e8787b23677adb53ea014059dd8ca44bbd1fab6ca370bed6cd828047bd61fa7b024152eb440b26eb0640feb9ba204e1c6d6c00868b5d683ab9b717dfe37da76d2d593d8baedf6c8354a8449c0cd9a89b736fdcddbc8f8d47ad750aef5ad970882f28e21", 0xf8, 0x7fff}, {&(0x7f0000000180)="08639e40fd8303e85b9a274a758c91d24c9cd32a2f3cf9a469096e702a3b7b26c0e3c2f00e908ceca83b65d35948b7b48c84edac2aa7452cefa189260340fb62d42fa34bde4c526b887388e8a5a047334a18718ad243f78cbcdb149c486a6859638ded385c526bf765f0554fd83566d21f32ac7f3b019910e9f462c601b88566", 0x80, 0xff}, {&(0x7f0000000200)="97f6eeddea1ee95f95c45c81adc5", 0xe}], 0x2, &(0x7f0000000500)={[{@fat=@errors_remount='errors=remount-ro'}, {@iocharset={'iocharset', 0x3d, 'cp1250'}}, {@iocharset={'iocharset', 0x3d, 'euc-jp'}}, {@utf8='utf8=1'}, {@numtail='nonumtail=0'}, {@numtail='nonumtail=0'}, {@shortname_lower='shortname=lower'}], [{@euid_eq={'euid', 0x3d, r0}}, {@euid_gt={'euid>', r1}}, {@fsname={'fsname', 0x3d, '.eth1*trustedvboxnet1\'ppp0security'}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@smackfsdef={'smackfsdef', 0x3d, '%eth1'}}]}) 09:39:22 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x2}, 0x1c) 09:39:22 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r0, r0, 0x7, 0x8) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x41) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) setsockopt$inet_udp_int(r1, 0x11, 0xb, &(0x7f0000000040)=0x100, 0x4) mkdirat$cgroup(r2, &(0x7f0000000080)='syz0\x00', 0x1ff) ioctl$sock_inet_SIOCGIFADDR(r2, 0x8915, &(0x7f00000000c0)={'\x00', {0x2, 0x4e23, @loopback}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:22 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x8, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2000}]}, &(0x7f0000000400)='GPL\x00', 0x40, 0xcc, &(0x7f0000000440)=""/204, 0x0, 0x1}, 0x33) utime(0x0, 0xfffffffffffffffe) chroot(&(0x7f0000000040)='./file0\x00') [ 816.722406] binder: unexpected work type, 4, not freed [ 816.727681] binder: undelivered TRANSACTION_COMPLETE [ 816.759681] binder: 5552:5556 ioctl c018620b 0 returned -14 09:39:22 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) socket$netlink(0x10, 0x3, 0x16) 09:39:22 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000080)={0x0, @local, @initdev}, &(0x7f00000000c0)=0xc) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000000000000000, 0xd0) fcntl$getownex(r0, 0x10, &(0x7f0000000200)={0x0, 0x0}) syz_open_procfs(r2, &(0x7f0000000240)='net/rt6_stats\x00') mount$bpf(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x0, &(0x7f0000000180)={[{@mode={'mode', 0x3d, 0x100000000}}, {@mode={'mode', 0x3d, 0xffff}}, {@mode={'mode', 0x3d, 0x80000000}}]}) lseek(r1, 0x0, 0x400000000000001) 09:39:22 executing program 4: rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') utime(0x0, 0xfffffffffffffffe) [ 816.764062] binder: 5548:5557 ioctl c018620b 0 returned -14 [ 816.772503] binder: 5553:5559 ioctl c018620b 0 returned -14 [ 816.825334] binder: 5553:5572 got transaction with invalid offset (0, min 0 max 24) or object. 09:39:22 executing program 4: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000040)={0xb59, 0x1, 0x8db}, 0x10) 09:39:22 executing program 4: utime(0x0, 0xfffffffffffffffe) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x407, 0xffffffffffffffff) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000000)) 09:39:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 09:39:22 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x1f, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0xc}, 0x400}, 0x1c) 09:39:22 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='timers\x00') ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000080)=0x1) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) [ 816.836125] binder: 5553:5572 transaction failed 29201/-22, size 24-8 line 3349 [ 816.851320] binder: 5553:5572 ioctl 80084503 20000000 returned -22 [ 816.863854] binder: 5553:5579 BC_ACQUIRE_DONE u0000000000000000 no match 09:39:22 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x200}, 0xa) socket$inet6_tcp(0xa, 0x1, 0x0) [ 816.910755] binder: 5588:5590 ioctl c018620b 0 returned -14 [ 816.964388] binder: 5588:5598 unknown command 0 [ 816.969543] binder: 5588:5598 ioctl c0306201 200003c0 returned -22 09:39:22 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="09631040", @ANYRES64=0x0, @ANYBLOB="0000000000000000951bb69c573d84a45dde942d0e6ca05806062aa9a0f93d45e6e98e5ba0dffcedea198fd1fca1d4d5ba95c2f699998b147af2f02b4b90f7704accccc29a92a17f7775b1d6f89008a834d1d34c3df025b75caa74653dd25e16cd16aa9e0a423045fcfe1152dd5fe0fb318377da095bcbaaae43458238a820ce7bcbf2613a61bc2a834bc351e0925d6189778fb5123befb29734e88f54ba03efe1255fecbcfb6c1c1928af2962f9a20b76aebf5f77e70d538a4d7f2a2a3c1c012f5b7aa7ceddd556a90f27eb83491c6c5f03decc16c0f7b9185fef6b17cc52cc9c44614ead80a4024b0b22161e6e7ac6fc8b9fd690b8ef72562b1153f7808c18ca00fbcc163cc6b51ac8046a07d9ec00ef20913bb7fa06d110d620f6f7248e2925449ca1dcaf31726ccd06b3780f00cc4dbf799122d415e496ca2748d3670060eaf209226eeed9eb2d6b3e4bccf1b0d53145cac5c101726392a94171dfb60de0dc3eded560520a36a0689b24987979e1b1cdacad2a79785c9957608c952d3954210a26c7e3991dec51078a709a6b8718b8cde6"], 0x0, 0x0, 0x0}) [ 817.561707] binder: 5548:5570 ioctl c018620b 0 returned -14 [ 817.562152] binder: 5552:5569 ioctl c018620b 0 returned -14 [ 817.563330] binder: release 5552:5569 transaction 1014 out, still active [ 817.563336] binder: unexpected work type, 4, not freed [ 817.563339] binder: undelivered TRANSACTION_COMPLETE [ 817.567995] binder: release 5552:5569 transaction 1008 out, still active 09:39:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) 09:39:23 executing program 4: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/policy\x00', 0x0, 0x0) getsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f0000000100)=""/81, &(0x7f0000000000)=0x51) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000040)={'raw\x00'}, &(0x7f00000000c0)=0x54) 09:39:23 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) fstat(r0, &(0x7f0000000140)) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000100)=0x8, 0x4) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f00000000c0)=0x2, 0x4) 09:39:23 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) lseek(r0, 0x0, 0x400000000000001) 09:39:23 executing program 4: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000040)='./file0\x00', 0x9, 0x5, &(0x7f0000000300)=[{&(0x7f0000000080)="a2b460033bc47f22650c80c2b351f21ebf10605bcec814f69b8a614cb6b2dd9623706b630fd985d027597cd83e97a3d467ad3fa2f59e548c60d3733dbf74b8ebeb08f0a3e43b5ea023a479560874817eda76f35c0281c4679be8e28c2ff8253af01897c50f7a11220bba60704fcf28c38c35d66759", 0x75, 0xffff}, {&(0x7f0000000100)="642824b868576e7bdf9ced3c0044b9dbfc457d456a126a8c47ced82dc0a27401806179236444fdf15092747c6cbc6057a7f50893347e2a3c1e52091e9ac619b6ac7e0972736668def3bc32d2d60f2017adb460bec64e6c50d63d1b5ccb94d57260db58bdfe6ab2ce674406dc2003f6ea7c472636d6d5a9e46977f337d1bc3bf5ef30b2214ebcb5a89dd4138ed67de708959243ef8985f4ff2c4e302749de28b131053ff9492390c483288cc3c15198d931d05aca0774dd87c3cf27d57a4b", 0xbe, 0x7}, {&(0x7f00000001c0)="4d371e5042a295cb64b279457295250ca9359bc8421c6981aca1760f7cb08103090248b83fdd4cfc9088ff44d59deb729ac73407f921e5c01d9d51614129743e7ef4b04742d0609dc2a00c73", 0x4c, 0x100000001}, {&(0x7f0000000240)="684d97dcbdb5c4e417f6d4e25351b8675ee45455296ef415f657d7442ed5877d60127f9f11f9b4a0d2cb845d0261f68ebf5436", 0x33, 0x2}, {&(0x7f0000000280)="38b3e03172e705c1002d1eb96b4bd94739b10b1525c3035cfb9d70eb0e37ed31327c325c9d43698ef25f396120cc8418a438df5fa51da960edfa7a81a10f3821243c5a23023b444f8fbb7e1c2c52c08172e5f86b19cf945eb25e099848f772e09d8095e5ec752aa65b1609837db9e17b74cfe288", 0x74, 0x4}], 0x800008, &(0x7f0000000380)={[{@uni_xlate='uni_xlate=1'}, {@shortname_lower='shortname=lower'}, {@nonumtail='nnonumtail=1'}, {@shortname_lower='shortname=lower'}, {@utf8='utf8=1'}], [{@audit='audit'}, {@subj_role={'subj_role', 0x3d, 'vmnet0)vboxnet1\'userppp0'}}, {@measure='measure'}]}) utime(0x0, 0xfffffffffffffffe) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000400)='/selinux/avc/cache_stats\x00', 0x0, 0x0) sendmsg(r0, &(0x7f0000000800)={&(0x7f0000000440)=@nl=@kern={0x10, 0x0, 0x0, 0x1000000}, 0x80, &(0x7f0000000680)=[{&(0x7f00000004c0)="1d493da715439e5d3658f85f783c8fb9e63e34ead7e2a3a0503e349f5a0b53d76318b953504070844d4ea8e42d8d1ce6be3ff8", 0x33}, {&(0x7f0000000500)="83cf6e39bd40d5a933de90f608da39a7c60f33cc78f08bc2cca72fbfcd5f240605b9091affe8914459a43d52e4fdf0c3ff709ef14c885b51762f6e82ef11c0d64a52b7e0572960b996cf74fdb2af3b442706b12600ab82ab888c1b4ddf340d1a5eb0d32bd08d1087d0de35cfa9352c60f388d06974a0b5714a504ffc2af2514ba9510086cba4efb7511eb34cff994df2a7c3535cd1c7e8bc03790ca75598311b3a50a5b6ff32d6b07a1c479902ee56987a54e63099d4c7d6346d96553fcc168b90", 0xc1}, {&(0x7f0000000600)="36f0324e7e2c09371c2c04cde95e621f86dac33bb64d516e8bdf3de1a850d67ccb8d8485e5c454ae805054588f44175fbbe5205d1556201c58969f4dd1f983922346cf9f28e31bc5391978f8de2020d07be6b41328278ed739d83bd669661ca63cc4dc606dad3bf6f336adbbe2c26fceff17de66", 0x74}], 0x3, &(0x7f00000006c0)=[{0xf0, 0x3a, 0xb41, "3295a505f60050243f755c4c6b802af5e41699306a8c710472b98f567efa5a1fbb5f68bd8d35e5f60e477d693e77aad44a38dbf35a92ac9128fd6373dfa161d2e7ed7cacec3f938143abe2b3215350bc94ef317e5969a9f93aed2145f56c0ae90cf95d9c0fe299e8c1d7b86dd208bfb3489573886169974d09f684ed2e280bb46557c95383cb6a7271a19ab5092e186ca61d60b4af4d3d178c2b56ff77e6f421879fc0cfd711d09da67ec9bdc463f283accd537812ddcfed808d8dd8ac2e49f5fd2fe86d5f6f22d53800135f19fa6a4f1e219d3020f48cb736f8936146996a"}, {0x30, 0x0, 0x4, "d933a0bf1405b4006b1a53eb70e1cb19515c3301a36d5923323d8a"}], 0x120}, 0x4084) [ 817.569404] binder: 5548:5606 BC_ACQUIRE_DONE node 1018 has no pending acquire request [ 817.569596] binder: release 5548:5570 transaction 1004 out, still active [ 817.619917] binder: 5610:5611 ioctl c018620b 0 returned -14 [ 817.632743] binder: release 5548:5604 transaction 1017 out, still active 09:39:23 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000180)=ANY=[@ANYBLOB="7261770000000000000000000000000000000000000000000000000000000000a70000009387740daca3480fa9cd0f1b7b9305bfecaf6da13e44bce421a13b5ba48e2e84cb0f5ae7179cafb6194c49793fe12cffc18c75fe4b11b3bd71abe8e383b4af7eeef34d0eddd23c7fd07d165c9eeb3c782397c88b41a42178c93361d64091a2f9b949c273750095ca76a36ed8c9e4838a355d8d4782f2e23f63f5db7a96be2299e3c7ef405399a7efc270c6c08a127b0b6ddf67eb7a48572308880217d237cafd52e7df343651b798d941cc0fb64a05b3650d27"], &(0x7f0000000100)=0xcb) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r2, 0x0, 0x400000000000001) 09:39:23 executing program 4: utime(0x0, 0xfffffffffffffffe) syz_mount_image$ext4(&(0x7f0000000000)='ext3\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x2, &(0x7f00000010c0)=[{&(0x7f0000000080)="c2a78f3845c518ca82ec5ccf6e861dec628f288bed59ebfbc75198692608ef2eee762ed858837090", 0x28, 0x1}, {&(0x7f00000000c0)="49175cfe9cfeff6acc9662c30b4ab3095263642f3008a5ed21409f4846a0eeb5729814ab7c44f0b44771aae43e5f18468327ca42319695f74091c7ee61cfdd7cfeb5a6c57d751db61bc3a22081ae1ecfbdc5d1adb4499a30bf507fb3d03fcfb12501ac67246f43ecd7f7237fbdf63aa2fec915ed7b01336768d573bd7180f6202a6ac53dac2b86ad656a8c88960a2cb8ce4a2bd44d4df959a1945ab3e8215da6061999b4fcabbc30c42a0a1c8aa2893ae62f6f026cc13524a8967393bc888eb738885da61e45e858544b4df99acd47d3f9df351a1d160231f0c82fb511f0606afc50517ec911809c82309e9298934ae68b999e851bc19a15cebe371f9781056e15dbe56ce91a39c889b8762f5b02473048ee1c52ffec223fe028e2cd4435409820eb93cfbba10c17a6b0971d43a0c0a915db55a2e1613afefcc4dbe85be833637f5f1b25d5de27bef5a404a690c2a1c46a7a62930511f76161fe77c473d16ab2bfee432a165d43d41de195751fda28dbab829ebb49be5804c39064f5877caa833871527657124f3c5decc2a1e67d355c77f3bd4809179ef84fff1f96b6ae76d3d52fffdb228b658685f893d199dd42e545c6e870c6cd4863af8de8cf807d25360839a881df3caeb5b1366e1fc2067e8ce721f5bd16401a215867ab67f3041d66f59610550fa9ce38298329764e7c402bb242c11dfe182c5ad023f0b2984d94b601de850f66e6daeb7102bfda8df1a437aba0a294b5f49d8b92f02ffda78fd342499cd21adb37fec94dc4beeb799a09695bc77bcc1480bad69a930c668cc9beac0ca403e18f3a4d36c64d5c450f63d86152f68ef37d584eb75692f9c40d8d75eadcc679fe91057bc3f7c4c1830f27dabd15241d7332bb4b6415bd29db150d909b74bf2e1a003a729f766d74a254a0c32eaa02b4840cec0990cd24da2470c3fa34111db93abe26cdb9bcf21fa144d47e3498a6dcb424bcbb24d605ab6410688e68e7f12e0de009b9205bd20ca5c6bb1f24ff1d27238313a4168a24f4e0a0b926a8f6ac5fa2e89dee7f8be4ef427120bcebb1216b5da208036fcd84361297ac2246454bf7bdc9bb49f184da407a5521877ae570e1f2d09c0a8382e5967c631ca9ddbf0847c0d99e4cf1d7dfe9c9caef63cc227fb7f030dd69ee917d79d0dcda0505b9ad4644dd951c3d073826a5fad6b04946aa2a1fa32a501bf4fd6df3c614d1ed3d3762780eb721d770cdc255c755bdbdd8f91878ebb3455becda9205b84fc0fba8a9f3d8153fd3f215acdb6c7cd6b7a676ca620f7c3a386e635156d08b8803428ec6288a6234aaff35d2cb6be7128865ae74b1bf4cb5872fb734b79372af863e22dcd1f2126891d9056b7acb3f394439eb85ad78cc380e7cb1bfc89421703e579651937e35d34f02034dc5da5ed6159d9cb4f468b987953e7fab7aa6f1e8f4921ab1fc8de8088e88686155d0efda92680d2dbbbd8a121ef87e6da9c0f77b578fb48df2c02e7e51bcb9f0045882e2a890feb4c55d01f4bfa5598347dccee755596232d4c69aff169271bbf3c84c1c06b7487aca445d0af0ec61f7ebbef28f8cb128cbb991067d16c11eb3d8fae56b4c7d8edfcb176dab43b4c89fcb6ae49a98075aab13f4b0e97c9220aac60ca0c2b81bc224760859d0156d85221367363b83c34b79abf24ac971febcbf97663463ea56391cb9a5e2b0ec01922f96d9f85cfd642b287242c5c7797ff379b7c6bb4d6c9c62405004ae5dcca6962f4790d9cfd4b8f919a0adb23ed784ea26621d34e59fe95a4ad5a06b3f631d27de71369d580a27bb55efb38f874152319f4cbf7a6f1c8d39f765204aa42c648d13c566397e42795a3b3b9cc7443379cb8b12707c179f57addbb076d4d395dce0add1a512a98b9e3c5d57aefaf0744b8a49c5b8fd8ad3077ace9077ce9d6fe317a8ce8b756f624b033f3894ffa6fb75c7a17240e07a09722209bd8a2d110198a6b42f3c178e480c86d5a0a5b6ba9d1a94b16995594866ba86119c44d219d70e109a7ba2e6a5c872c80869539e750d1da5acc70e3ee785c96e75984e1d9ae565fb29b35d7b0551278d9b95c75c04885cce54845d2eb51ad65d44a15ef50a23655a857e6f167b48154556196543814fe253719cc46690764a825c291ce8eaad3ad640f6eda538282daf82d438d4163e98eff249594925bdb99b6c153b6816b6f886e832bf6e00ae3f690ae97789db7d31d007de04a07db82dff07b307d4d5c0e439941f34e1ba6f35a9405ae64924d59829a6872f7c2846285331c61136902ff3f604efb6a1f11deeb8765b797f5d26d7446c78bd6508d77078bffdc2a61d9f7ae2716269bc380abe0014caec097ecdba89ab0db21ebf1e47c14c32a29a755ff79ddb8e377dafa1c9ed5bd83643e9ac49ca0363c8beec5d10ec934cc65e8e626e14916bba9dcb98ad9527069fcc335c0419d32498c8c783df0759b302739fb851fc9abe69f8c6bc758270395147729d431020911e32ce960b39bc5e723659efd50467d9d2ffea53c1c42e4e74e659e96afa6da72a518f8e614a6928b7e9c017d0c886cb41b54689e9e10eafda03e296aa723daeed0cda9d1180b90f97d5568213601898b7d47536b2479fb56545ac5aab0a9cb1541980a4ca807fe1c525ad41fc769bdd2587864f027d42e4559877e3609342c46a26be7e57e51d97a51dacc2b4ea0ad3b13ca78232abb45bc406d9976b05f4e1de815b90b79ab18a9fc09e5bad685a511f5baa5e5ba418fa2d920ec0e94163948bc251b61c977ed2a7d4b2ccc3f1988ed9372137605025274b6d5a03291086d24b35a73dbbb753b134b0cdcc03b8490f3b2611d309b5a8ff69bc11ba4d02662f18b15f8143871eb50c6a1f81adde8cc377c4fa415f13a310fce843769482cc7517b984b4c1365d7c6b0fccbfe593adcb2230a3b71cfcdf3185bc721de6254ce3faf7d01ce72d826ca4e42648f02ff0adc46855efe367991f52192538d685fcdcfe484bbfb90e70bc9e50f3e631ec018a578d41ae534c55b7b5db644531efc0f4264a453feb6f927d4d6c4f706949c501326bd4fee862cf9520819bdd93bbc90f742ff5d5813a5fbb309ac7bdd1ff2428c299f09139f8f497d3c395378454f08acd47a2d2b18c6a2930bec202b6ee3119357de03f6e92f3f75204fa8a11306956f4e10f92b0204ee7cd690dd4e69a72f08e843f653dcf8240bab37d8856afc5fb2efa45589455e84a99de1c095728919eadc753286e9e5f55f8f516684bb041548264220a2ef2606a6e8b4bb28b26ed8612e2523249e93dfc489f6bd0d9b8b84594e9b483be76afe2a42475c31a80e3b5dbc1b3459e5867d3b417816a5911c10fdf93ff60299fc60c55ab08fa3c3d5ecfdce99b0c84e75ce5a3f8395de19f932cdbe61ca2f8bc750da176f2350db7bb01aa6cd42e20f91e6c802f02f9e2a7f8b30e0d08e57ea271676b7704ae3eac5481e4e965a71c21efc500dcf572c86db07941433dba12b9d9b9bc810492ae203115125397a550f370c0c1a8a12295f9b29b3ff4fc37258c2a9915fec7ae751c031b939c63413e647b12eea70178d9da7b5172ea14f700ef5a2100590e2bf0b100e557d959a0fdad5016dda89f054ababc1d60ff7d6fc0ed700629abc2d95ae33f1a8ca39b835b531aacd7c88f74c311f839bcb9200dea9c9b72ac166b6f8922c8f46ca5bdbe386675189eb6dfc2c580b0fb673a42f7ccbd0d733ed3982e48e5d439d3dad45e74ccafc2f599229d7c08b27589619d5d43e164c8f46fb81ef18e6ab55d7e9e389ed8edfac91393d95a5a9bb5f87b89bc5ca366c351a777f328d254bd1c63fdeb4c18c2c38090afda343b8952c92fa91eb68ddd8e15f4c2275ecaf7080682f1910767718e9421c635816e15576057938214e371bd2c10180b6c5bfbe50613f2e599f4214b1bb0dc5b6a3e2c784a8871e57b9d1fabadb565d378fe033eeb627b4ef0f4862ee49590937fe03bce2cfaab0a2c68d681d49faa56f47bd4f29a413eec02b3e4c30a2436d30ac33a33fc9b364ca3a93ae816e59d750f360286bdfc1e5ddd6cdd56252a9ec11e4e1ef7efb1fe521420b10ef7bbbf37eb561f5ec3bb63b1952c120668553ce3df8939569df6e50251d4361d4e404cadc36a8fc558db94e64781ddad67604091d7aad4fe9e11015daf4ebb921f3fd6ae593e107776acc12814c3771adad211d004eae234501cc3278a1224176f888beb18930a653b653b2d06137280864f52a3c6f1f6d3ee2225ea4e7d7412058756d4ed3d6fbfc43586b47c3350f2ed2e0afab2640f0af30ff970870a5b8dc21f5f1b07bec01061b0308e066b632087a2282e4129784481281d8d07c9ae43afe9283fb4b1f64d22c49ffcfe9d28982976c2404fa71713e6977863782d4dfac1d2d3abf00edfcdcf5fdd74b11ebc298f185d764f8b877470d2f31f4c378eddaf34568f721f3376d04851fbff64368eb797c00af2a873805d412b249e05323cb12a2f96c71fa4c5fa397940556c810ee6ddb510bfbba34b7e78e97e83e2f38ac3d3d0c9b4a09e40a45ccf3ac424675a49fe029c2e0a3a78b2b9a38ee52236b5ee720159b6d823b60e257b38f43ad51ab1912508f4cb0993c7d9c37f0e6adb67ef3f6d433231a653528d5bc3c33c773e259860b12f88f3683b4df1e257e3f6a199652132cc07212c6df0fa468849cedb1d71fa945690118a400bcfe61be3fa78154aca86f839317ec772ba25f579584264761ea9adc90857a5b546b4df6f5b54a941812e9c4b8c1d27d87c12589a7868aa9e2d3eea1c86295541445912d0ca6adff4ebd67552c973d7ec21e313d366727240c7d66faeee60707c527d64d5e60b2d62edb485c69a0ec19c2d2ed783c93d60e7fe395a0152a06130861cea905498f38352c546c14261479dd6c6eb603818b56294ee18d2978df1a2aee35a75335f150835edf24e68fd33156a38baf7289e0b2a56e0e3ef2fc1acf328cc0d2b58245bfe3ee9728490616f5cbf0a00ec1843c830d045ed0630456554ea0a127ece977efc47baef3fff6a15fc7506a6cffdd173ab36261daf3c724831178559ad613d64a85d132761f64def7b38d5fa8e6380c867ee9078ef0c20a0ec5d08a36a8b5dcabb4b0ce71d89cc8c2b69c3e72f624883b33c3493ac55802d2149041cb3273a870ab934fdaa2ce8d985cf4bc475f1520d07222cffed974a9bf57a29adc116155b9a807b8766fb10240f79511b8c6e1081f0a23d5b9cda81a53900a65b257d8b0f3493ee4739ce22003fa5373ba7bae3b051faa250ce35b3343bbc23fe7a3de84c0bf1070e4b4968d6429dad489004eaf6d512289566cec63e5f39083eec34dac93ac11dff88b529fa25347e388e393e01100efda516d00ed958db43edf377db1698f984e58b46d4a1348eaf2e7ad81796809875c529b8b123b98a5b28dc84ec447504ecfe40654b98c3690cbf2fc813ce89b152de30f4be26b3fb4740d6f653c036aa20c21f435fadfbb020441ba9b1f62b6c7a94da86c41a7e0ec1a6ded1fcaea5e6093cb5d8c3702767d24deb8e45ac829e0fc50f346cf3a86ceb2ebeed069dd78e1b65306b5fbd551b6fa205047b8b7a442d448fbda0c56bc358c176e11752031e3f88e8ba025a214c5840d38d28293c727d0acd6324634598b708061199d79b2770f519410d9f551fcff664ecb02914e261b5fcacb9e528c002832f9b314ce38a98ee30758f636c8d118b082995c2c7741c1f5228175a80421f0f8c262dc254d554bee77718acb01fc7a4", 0x1000, 0x8834}], 0x100000, &(0x7f0000001100)={[{@bsdgroups='bsdgroups'}, {@data_journal='data=journal'}], [{@dont_appraise='dont_appraise'}, {@appraise='appraise'}]}) [ 817.682786] binder: 5616:5621 ioctl c018620b 0 returned -14 [ 817.717693] binder: 5588:5598 ioctl c018620b 0 returned -14 09:39:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:23 executing program 5: openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r1 = getpgid(0x0) ptrace$peekuser(0x3, r1, 0x6f3c) connect$inet6(r0, &(0x7f0000000080), 0x1c) fcntl$lock(r0, 0x27, &(0x7f0000000040)={0x2, 0x4, 0x3, 0x866a, r1}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x80000, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f00000000c0)) 09:39:23 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000040)=""/220) utime(0x0, 0xfffffffffffffffe) 09:39:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000380)) ioctl$sock_proto_private(r1, 0x89ea, &(0x7f0000000540)="91351963b86e17a032121f54388c359b09b994467e201c2347ce51cada9ccf5e43b9960e70eda7341518602badf95a77af565df2b88cb2ab815f7cf6f0106435952b19590da6decd3051474b4a5a5cba763580e1f96ad27443824c961b790054a8fb4aefcac4847e49aacda75562548a02767e8edcf6bde03aff4ffc6c1b52189489e15149c20e8119633bfa68400735bfad9f8609033819313d518fd5e06eec06bcbe65a780c499934bafd09bd1b6316c9ffdcb0fc781f2f51113e40c514129891064e931f94c62672e6873eaca0a945bd27871af367ab4cb291bf6888b69c976751f07a6702bed5831e7b63af049b812716f70bcf7") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x8001, 0x80) ioctl$RTC_AIE_ON(r2, 0x7001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 817.726487] binder: release 5588:5598 transaction 1011 out, still active [ 817.734583] binder: release 5588:5598 transaction 1023 out, still active [ 817.759813] binder: unexpected work type, 4, not freed [ 817.770943] binder: 5639:5640 ioctl c018620b 0 returned -14 [ 817.771136] binder: 5639:5640 ioctl c0306201 20000140 returned -11 [ 817.771334] binder: 5639:5640 ioctl c0306201 20000440 returned -11 [ 817.771680] binder: 5639:5640 BC_ACQUIRE_DONE node 1030 has no pending acquire request [ 817.773529] binder: 5639:5640 ioctl c018620b 0 returned -14 [ 817.824253] binder: 5651:5653 ioctl c018620b 0 returned -14 [ 817.836538] binder: undelivered TRANSACTION_COMPLETE [ 817.842286] binder: release 5639:5640 transaction 1029 out, still active [ 817.851481] binder: unexpected work type, 4, not freed [ 817.856810] binder: undelivered TRANSACTION_COMPLETE 09:39:23 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x6, 0x8, 0x2, 0x40000000000, 0x100}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 818.400958] binder: 5610:5657 ioctl c018620b 0 returned -14 [ 818.407607] binder: release 5610:5657 transaction 1035 out, still active [ 818.418290] binder: release 5610:5620 transaction 1020 out, still active [ 818.438973] binder: 5660:5661 ioctl c018620b 0 returned -14 [ 818.445278] binder: 5660:5661 ioctl 401c5820 20000000 returned -22 09:39:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) prctl$PR_SET_PDEATHSIG(0x1, 0x26) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:23 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x802, 0x0) lseek(r0, 0x0, 0x400000000000001) 09:39:23 executing program 4: utime(0x0, 0xfffffffffffffffe) lsetxattr$trusted_overlay_origin(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f0000000080)='y\x00', 0x2, 0x1) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl(r0, 0x7f, &(0x7f0000000180)="c07faf28f3ee0995c570bb5c24e82c7e6779923fb56d8b68070a72500c4c1a5ebeda2d63cf37d7872b4bcd5c4acc2f2eab8823bf65cb8e38b2ebde68e823a326680b680e1532e371702837b63caa32905d2cf9581ea1fac7265e8d64dd02197ecc910d7a484ba99069c7b10dd0c95e7adb8ff13f1d21ef20e635c8b21ac96312e837089338c955b5bb55ee742956ffb87ec6c970d67fbdf72623f49bab5368d31d41e20f59382fb3955da0e6ef") lsetxattr$trusted_overlay_redirect(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.redirect\x00', &(0x7f0000000140)='./file0\x00', 0x8, 0x2) 09:39:23 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000040), 0x1c) getresuid(&(0x7f0000000080)=0x0, &(0x7f00000000c0), &(0x7f0000000100)) ioprio_set$uid(0x3, r1, 0x10000) [ 818.480965] binder: 5616:5636 ioctl c018620b 0 returned -14 [ 818.487623] binder: 5616:5662 BC_ACQUIRE_DONE node 1039 has no pending acquire request [ 818.496635] binder: release 5616:5636 transaction 1038 out, still active [ 818.504364] binder: unexpected work type, 4, not freed 09:39:23 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) getpeername(r0, &(0x7f0000000240)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast2}}, &(0x7f00000002c0)=0x80) utime(0x0, 0xfffffffffffffffe) getresuid(&(0x7f0000000040)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) fstat(0xffffffffffffff9c, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x400, 0x80) ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, &(0x7f0000000200)={0x80000001, 0x5, 0x3, 0x3, 0x3, 0x2}) chown(&(0x7f0000000000)='./file0\x00', r1, r2) r4 = socket$nl_route(0x10, 0x3, 0x0) sched_yield() ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000180)) socket$nl_route(0x10, 0x3, 0x0) 09:39:23 executing program 3: r0 = creat(&(0x7f0000000040)='./file0/../file0\x00', 0xc0) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000000080)=0xfffffffffffffff8) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x400000000000001) mkdir(&(0x7f0000000000)='./file0\x00', 0x8) 09:39:23 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f0000000140), &(0x7f0000000100)=0x4) 09:39:23 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpuacct.usage_all\x00', 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x0, 0x1) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) r2 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10, 0x0) ioctl$sock_inet_udp_SIOCINQ(r2, 0x541b, &(0x7f0000000080)) 09:39:24 executing program 5: r0 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/current\x00', 0x2, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) [ 818.528140] binder: undelivered TRANSACTION_COMPLETE [ 818.539131] binder: 5673:5675 ioctl c018620b 0 returned -14 [ 818.558931] binder: release 5616:5636 transaction 1026 out, still active 09:39:24 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/policy\x00', 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000001c0)=0x14) r2 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x10000, 0x1) recvfrom$packet(r2, &(0x7f0000000080)=""/159, 0x9f, 0x0, &(0x7f0000000140)={0x11, 0x19, r1, 0x1, 0x4}, 0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000005f00)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x18, r1}) utime(0x0, 0xfffffffffffffffe) syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x4, 0x44980) 09:39:24 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x2f) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="054fcff8f1a02fc73cb00040efb7ee236bec5def00fffffffffffff20700000002000000000000fa4b46299e751761077bfd3d1b096c8ffc7c"], 0x39) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r1, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 818.630835] binder: 5651:5655 ioctl c018620b 0 returned -14 [ 818.633833] binder: release 5651:5655 transaction 1032 out, still active [ 818.655313] binder: release 5651:5699 transaction 1047 out, still active 09:39:24 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000180)={'filter\x00', 0x4}, 0x68) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x440, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x4}, 0x68) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f0000000480)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x20, r3, 0x4, 0x70bd27, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x9}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x6c6742c123a95f1a) [ 819.245069] binder: 5660:5709 ioctl c018620b 0 returned -14 [ 819.251060] binder: 5660:5665 ioctl 401c5820 20000000 returned -22 [ 819.258100] binder: release 5660:5665 transaction 1050 out, still active [ 819.267999] binder: unexpected work type, 4, not freed [ 819.275634] binder: undelivered TRANSACTION_COMPLETE [ 819.280873] binder: release 5660:5665 transaction 1041 out, still active [ 819.291389] binder: 5711:5713 ioctl c018620b 0 returned -14 09:39:24 executing program 1: ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) r0 = inotify_init1(0x800) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000740)={0x2, 0x8000, 0x4, 0x638, 0xa, [{0x3, 0x400, 0x1, 0x0, 0x0, 0x108}, {0x94, 0x4, 0xd70c, 0x0, 0x0, 0x1}, {0x7ff, 0x10000, 0x8, 0x0, 0x0, 0x8}, {0x5, 0x7, 0x80000000, 0x0, 0x0, 0x902}, {0x3, 0x4, 0x3, 0x0, 0x0, 0x900}, {0x8000000000, 0x8, 0x14000000000, 0x0, 0x0, 0x1000}, {0x3, 0xff, 0x80000001, 0x0, 0x0, 0x400}, {0x8, 0x26ca, 0x7, 0x0, 0x0, 0x2906}, {0x1f, 0x0, 0x1, 0x0, 0x0, 0x2}, {0x800, 0x5, 0x80, 0x0, 0x0, 0x3103}]}) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000280)='trusted.overlay.redirect\x00', &(0x7f00000002c0)='./file0\x00', 0x8, 0x3) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000380)='fou\x00') sendmsg$FOU_CMD_GET(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x2c, r2, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@FOU_ATTR_PORT={0x8, 0x1, 0x4e23}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x1000000, &(0x7f0000000480)="f4d067190f9d3760e136a522da40c92cc6999981cfa4e8742374b97b798337696e80e3559b34ed8f35df3c3a6fe2fef55a601c8817403475cc95976ec3c0a41b31ed6f83060007f6573b6f3aa28cc92fe298a63cad8444898996790ba1f650e97e1422a675b1ccf4fa4043a7b3af6e37dca6a8a4e25c3f5eaee7cd7f55706ae6f6607acc99adec1e8efbd070fe212823e432c261995a3c95154866323b5d828803ba5540ba7a74d53fe782dc7edd32e3713f7be3d48bfb40590e375f7512900044c4e3d897e8f04f0526ce68f823f6c9b0fc6770d4f40db6dbe5786250dbd7195f9246cbc6194d", &(0x7f00000000c0), &(0x7f0000000400), &(0x7f0000000580)="fa94a36509c652d508fcec3fa593cbb658a37e7fe80d3898798f1493093d83b7ee1b60d7133b6589bf4b36d6641b74feea3112d9e9c810a0063924216ada9f27a265f224edf325c90105dbb459d58f4aaf1d97e66b06570ee26a026a0e9befa65faff75c24daee2e63a88554c719e476ee60067e7d3b4c511c79312f2ab3522a6c69c8dfe70c8c6fac3694cf710e8ee88e52aae3af513c3b853bc96ea36c8e2920395be6ca357a282c2041151d37f02d561459023511243f0384b1381c95c8a5b171041cde45511103c73e087fd4e8") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PPPIOCSDEBUG(r1, 0x40047440, &(0x7f00000006c0)=0x4) 09:39:24 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KDENABIO(r1, 0x4b36) 09:39:24 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000280)='/dev/keychord\x00', 0x325081, 0x0) ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000000)=""/66) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f00000002c0)=ANY=[@ANYBLOB="6d616e676c650000000000000000000000000000000000000000000000f245e8bf28f1cf107ac3f994ff2f3b00000003690000000000000000000000000000000000000000000000e7ffffff0000000000000000"], 0x58) sendto$inet6(r0, &(0x7f0000000080)="4a8a877ff4b2c29df3fa21970b2e5974229ff96db150c9f7f72b3b3de6730a3b20a28dc96b5e58714a23bb07375bbb852e885e6f70a5df367733b5e72c8f5f652f66c2f435cd97f9f440c39a7f7ee085b9cd5adf2a11e87924d6d26169847134921d2c579ce9dbd228bd68fdb9d3ec355866255667c67423de9f116060023a6eb9d37dde6c7217b0e3cd68177a6152bdb77d04f076f2be0076367b0e5c88092315828303d8f530ef69f57d317b0f74c4048d70fcc0d65e86cbb97b2b431ac32c34f805f86792455c6bd2e4baee7b9a76", 0xd0, 0x40, &(0x7f0000000180)={0xa, 0x4e21, 0x6, @loopback, 0xe}, 0x1c) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000400)=@mangle={'mangle\x00', 0x1f, 0x6, 0x6d8, 0x228, 0x4f0, 0x138, 0x0, 0x228, 0x608, 0x608, 0x608, 0x608, 0x608, 0x6, &(0x7f0000000380), {[{{@uncond, 0x0, 0xf0, 0x138, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x2}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@remote, @ipv4=@broadcast, 0xe, 0xa, 0x5}}}, {{@ipv6={@ipv4={[], [], @broadcast}, @rand_addr="e8b5f7d963285a0af9cce1db0295a50c", [0xffffff00, 0xff0000ff, 0xff0000ff, 0xff], [0xff, 0xff000000, 0x0, 0xff0000ff], 'sit0\x00', 'team_slave_1\x00', {0xff}, {}, 0xc, 0x5, 0x2, 0x40}, 0x0, 0xc8, 0xf0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@remote, @rand_addr="ba8a93ec09448b7b3abf1930f4a0ca15", [0x0, 0xff, 0xffffffff, 0xff000000], [0x0, 0x0, 0xffffffff, 0xff000000], 'veth1_to_bond\x00', 'ip6tnl0\x00', {}, {}, 0x0, 0xffff, 0x1, 0x4f}, 0x0, 0x120, 0x148, 0x0, {}, [@common=@srh={0x30, 'srh\x00', 0x0, {0x3c, 0x0, 0x3, 0x7, 0x1, 0x8, 0x1008}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0xa}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@loopback, @mcast1, [0x0, 0x0, 0xffffff00, 0xffffffff], [0xffffffff, 0xffffff00, 0xff, 0xffffffff], 'bcsf0\x00', 'veth0_to_team\x00', {}, {0xff}, 0x73, 0x7fff, 0x2, 0x28}, 0x0, 0x138, 0x180, 0x0, {}, [@common=@dst={0x48, 'dst\x00', 0x0, {0xf3e6, 0x0, 0x1, [0x3, 0x0, 0xe0b, 0x2, 0x1f, 0x8, 0x9, 0x6, 0x8000, 0x7, 0x6a54, 0x8, 0x4, 0x0, 0x4, 0x8], 0xf}}, @common=@hl={0x28, 'hl\x00', 0x0, {0x3}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty, @ipv6=@ipv4={[], [], @remote}, 0x3b, 0x35, 0x7}}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@ipv6header={0x28, 'ipv6header\x00', 0x0, {0x8, 0x21}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x738) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)) write$binfmt_misc(r0, &(0x7f00000001c0)={'syz1', "1161456113ca2dc063627813a811e824e6c8f449d914b42ce969a1c26334dd00a7092d32f82f3db3bd6a09cf97409db4d13dcdc3b07ea8bb76faff53851692ffc8ee51f33b1235a2ec233502a6ea66f63bedf650e94192b8263f663b150c6287d5e58a76bbfd3a47cfb53a09bae9c4c274a6c519fa4eef05489fcbf60f07d92abf3f50bf0ec4cd27554a6e"}, 0x8f) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000b40)={{{@in6, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@loopback}}, &(0x7f0000000c40)=0xe8) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000c80)={r1, 0x1, 0x6, @broadcast}, 0x10) 09:39:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_buf(r1, 0x0, 0x29, &(0x7f0000000480)=""/160, &(0x7f0000000100)=0xa0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x7a, 0x0, &(0x7f0000000180)="df6949ff9e98db1ccce094364ded832c750604f7981f628d68c39df25cad677645cfeac9910b1054cd769683c47d1dc195e0b59d3d34691dc310ca20605c79b09a73e1b58db1276b405e55e5a21acede1dfecb62f497d7690e875b36b7769dca2a00925156bdfa2c7b9589da2b9bcb112f8162adb52626a50000"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09631040", @ANYRES64=0x0, @ANYBLOB="00000001cc00000bd328dd249d82ef5927f42c2315892f42f41021c213e87d9ea9a9d935e446abcb04ab9b3a84c5527d91fdaacc27cf441490b94c6f0f900b48f890031ac77dff80d945355383134162c251ad5cad3c5cffee74cd0edac4a31278ccfe9e98cac76636e515275406d659f554d1359792f6c9281b1c6a0c802013ed339e4a193592cc3e85559d7b568e7a4f5e2470ae5a070000000000007a9a7d0f455857bb531bd7561a3424b055f64f98f5490ec9d310828a408c9ac99fed05c0159859f04ddef9aa048b7243910ee718b24a"], 0x0, 0x0, 0x0}) 09:39:24 executing program 3: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x3960d5549c66fdf2, 0xffffffffffffff9c) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='configfs\x00'}, 0x10) r4 = eventfd(0x4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000440)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r7 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000480)='/dev/uhid\x00', 0x2, 0x0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000003940)={0x0}, &(0x7f0000003980)=0xc) getresuid(&(0x7f00000039c0)=0x0, &(0x7f0000003a00), &(0x7f0000003a40)) getgroups(0x1, &(0x7f0000003a80)=[0x0]) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000003ac0)={0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000003b00)={{{@in6=@dev, @in6=@ipv4={[], [], @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast1}}, &(0x7f0000003c00)=0xe8) r14 = getegid() r15 = getpgid(0xffffffffffffffff) r16 = getuid() lstat(&(0x7f00000004c0)='./file1\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000003d00)={0x0, 0x0}) r19 = geteuid() lstat(&(0x7f0000003d40)='./file0\x00', &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r21 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000004380)='./cgroup/syz1\x00', 0x200002, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000004400)={0x0, 0xffffffffffffff9c, 0x0, 0x9, &(0x7f00000043c0)='configfs\x00', 0xffffffffffffffff}, 0x30) r23 = socket$nl_netfilter(0x10, 0x3, 0xc) r24 = openat$dir(0xffffffffffffff9c, &(0x7f0000004500)='./file0\x00', 0x2000, 0x145) r25 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) r26 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000004740)='ns/cgroup\x00') r27 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000004780)='/selinux/validatetrans\x00', 0x1, 0x0) r28 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000047c0)='/proc/self/net/pfkey\x00', 0x1, 0x0) r29 = getpgid(0x0) fstat(0xffffffffffffffff, &(0x7f0000004800)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000004880)='./file0\x00', &(0x7f00000048c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000004980)={0x0, 0xffffffffffffff9c, 0x0, 0x1, &(0x7f0000004940)='\x00', 0xffffffffffffffff}, 0x30) getresuid(&(0x7f00000049c0), &(0x7f0000004a00), &(0x7f0000004a40)=0x0) r34 = getegid() r35 = openat$null(0xffffffffffffff9c, &(0x7f0000004a80)='/dev/null\x00', 0x80, 0x0) r36 = socket$inet6_udplite(0xa, 0x2, 0x88) r37 = open(&(0x7f0000004ac0)='./file0\x00', 0x440000, 0x40) r38 = inotify_init() r39 = openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000004b00)='cgroup.type\x00', 0x2, 0x0) r40 = syz_open_dev$mice(&(0x7f0000004b40)='/dev/input/mice\x00', 0x0, 0x8100) r41 = openat$ppp(0xffffffffffffff9c, &(0x7f0000004c40)='/dev/ppp\x00', 0x10000, 0x0) r42 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000004c80)='/selinux/mls\x00', 0x0, 0x0) r43 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000004cc0)=0xffffffffffffffff, 0x4) r44 = syz_open_pts(0xffffffffffffffff, 0x4000) r45 = creat(&(0x7f00000054c0)='./file0\x00', 0x33) r46 = memfd_create(&(0x7f0000005500)='\x00', 0x6) r47 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000005540)='cgroup.type\x00', 0x2, 0x0) r48 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000055c0)={&(0x7f0000005580)='configfs\x00'}, 0x10) r49 = syz_open_procfs(0x0, &(0x7f0000005bc0)='net/mcfilter\x00') r50 = getpgrp(0xffffffffffffffff) fstat(0xffffffffffffff9c, &(0x7f0000005c00)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000005c80), &(0x7f0000005cc0), &(0x7f0000005d00)=0x0) r53 = openat$ion(0xffffffffffffff9c, &(0x7f0000005d40)='/dev/ion\x00', 0x400, 0x0) r54 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000005d80)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000006fc0)={0x0, 0x0}) stat(&(0x7f0000007000)='./file1\x00', &(0x7f0000007040)={0x0, 0x0, 0x0, 0x0, 0x0}) r57 = getgid() r58 = socket$netlink(0x10, 0x3, 0x14) r59 = accept4$inet(0xffffffffffffffff, &(0x7f00000070c0)={0x2, 0x0, @loopback}, &(0x7f0000007100)=0x10, 0x80800) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000007140)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000007180)={{{@in=@multicast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@dev}}, &(0x7f0000007280)=0xe8) lstat(&(0x7f00000072c0)='./file1\x00', &(0x7f0000007300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r63 = fcntl$getown(0xffffffffffffffff, 0x9) getresuid(&(0x7f0000007380)=0x0, &(0x7f00000073c0), &(0x7f0000007400)) r65 = getegid() r66 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) r67 = accept$unix(0xffffffffffffffff, &(0x7f0000007ac0), &(0x7f0000007b40)=0x6e) r68 = eventfd2(0x8, 0x800) r69 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000008a00)='/dev/ptmx\x00', 0x80, 0x0) r70 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000008a40)='/dev/ashmem\x00', 0x0, 0x0) r71 = epoll_create1(0x80000) r72 = socket$inet6_tcp(0xa, 0x1, 0x0) r73 = accept4$inet(0xffffffffffffff9c, &(0x7f0000008a80)={0x2, 0x0, @broadcast}, &(0x7f0000008ac0)=0x10, 0x80000) r74 = signalfd(0xffffffffffffffff, &(0x7f0000008b00)={0x200}, 0x8) r75 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000008b80)={&(0x7f0000008b40)='./file0\x00'}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000008bc0)=0x0) getresuid(&(0x7f0000008c00)=0x0, &(0x7f0000008c40), &(0x7f0000008c80)) getgroups(0x8, &(0x7f0000008cc0)=[0xffffffffffffffff, 0xee00, 0x0, 0xee01, 0xee01, 0xffffffffffffffff, 0x0, 0xee00]) r79 = eventfd2(0x4, 0x0) r80 = socket$inet(0x2, 0x80f, 0x7) r81 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000008d00)='net/unix\x00') r82 = socket$inet_udplite(0x2, 0x2, 0x88) r83 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000008d80)={&(0x7f0000008d40)=']ppp1vboxnet1eth1/+uservboxnet1{trusted\x00', 0xffffffffffffff9c}, 0x10) r84 = openat$ion(0xffffffffffffff9c, &(0x7f0000008dc0)='/dev/ion\x00', 0x208042, 0x0) r85 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000008e00)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername(0xffffffffffffffff, &(0x7f0000008e40)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, &(0x7f0000008ec0)=0x80) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000008f00)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000008f40)={{{@in6=@ipv4={[], [], @empty}, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000009040)=0xe8) r90 = getgid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000090c0)={0x0, 0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000500)='posix_acl_access\x00', 0xffffffffffffffff}, 0x30) lstat(&(0x7f0000009100)='./file0\x00', &(0x7f0000009140)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffffff, &(0x7f00000091c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r94 = getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000009240)={{{@in=@remote, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@initdev}}, &(0x7f0000009340)=0xe8) r96 = getgid() ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000009380)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000093c0)={0x0, 0x0}, &(0x7f0000009400)=0xc) fstat(0xffffffffffffffff, &(0x7f0000009440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f00000094c0)={0x0, 0x0}) fstat(0xffffffffffffffff, &(0x7f0000009500)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f0000009580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r0, &(0x7f0000009740)=[{&(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000380)=[{&(0x7f0000000180)="c036f232cefc1ac252c4bb935206a3e85614f802355fb228d7f4a48476907b09116478bebcfff4229c073a91cbf717d2397dab55054fd18b3e08a0e745c726d1d6742cd3aa02dcddc52f51b39a591d724b9c05c0ca8d73c13253f083f430dd62cd685d8d0f6d59239cde3a6f12028899629424", 0x73}, {&(0x7f0000000200)="5a05b138b240eb4d0b087ae53b235df6e1a93c192937a1bf22dc9976b694add7a10fee3a0f656d308543fe60159f774401ab97d304d98e85623239d9e8ef80cdf72afe16f17d68121a68e67a312889e5dcbe3b8d4801a7312c1c429fe9a18522ed410d7b27c32cd5efffd876c8f3a3fbe795f0137a46522fefa574533fba5c1b6ca70dbddecc1535d3b3b019a5b3f8b68a9c48ce2478977d2cfbe56b", 0x9c}], 0x2, &(0x7f0000003e00)=[@rights={0x28, 0x1, 0x1, [r1, r2, r3, r4, r5, r6]}, @rights={0x18, 0x1, 0x1, [r7, r8]}, @cred={0x20, 0x1, 0x2, r9, r10, r11}, @cred={0x20, 0x1, 0x2, r12, r13, r14}, @cred={0x20, 0x1, 0x2, r15, r16, r17}, @cred={0x20, 0x1, 0x2, r18, r19, r20}], 0xc0, 0x4000880}, {&(0x7f0000003ec0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000004300)=[{&(0x7f0000003f40)="9ec0688559fe80cb3018d8b1e5db8ac5936a9bf2163dcf737b2be5c0afb8d207b0ecd09356dde541f7e3195ae8df43c5fb73dde5c656b4ca4027d019516bee05e49ec829d25d56ac181e0f4f14712dceb4328d218f5071c0e362d20364593e82969bb9e99415", 0x66}, {&(0x7f0000003fc0)="0261a8ac6b9c27ff1fa3842c773aabd48dc636eb9bacb3a5f66dfbf57b399d81c6d3e6dd76782c42bd36c2fe1817a8345d97950b8d478237a0d494540aec5acedcd870fe1987fbc4ce7ecb260169bf9959fb098076908246f127cf5f4a4899191e02b396be78d4feae5ea308811e2ac4c9280264439be507d85dd140c9a573e5974e1ab30e85fbf8fa82bb7570500a94b59ac25cffaec834ffce267cb53bc40ab5faa312ea13a10515046931f1d285a4be9d3ae41eb573b51338921d1554c1f1e33d00289633043039d1ac52916a2e439e1445772b7f2d668195cb26d3d1dc8e6cfdc0182ae2b6f9", 0xe8}, {&(0x7f00000040c0)="bec370d0f26a4dfff488c56c88114efac89c0e4f8cf898a5b61472e4368e524485dde330b3807f8da491d657c0d4524f1dddbd4d7445b20959a36fd70846845a1f6aeaf6cd47e185dab0ba3e7b410ad8afdafee2573b292477546a3306578aa8f115a68242381483d633e6d7a22e37a4401643a47e2d5b40a13c18518f8fbecb14584799dc84f166c64942790bcd8adbb37624b0ca41037bcc3b25366acaa029b4f9b03c842fc4912c82ffa977e743", 0xaf}, {&(0x7f0000004180)="560fab80c3c5b6d885d662909ce51b264b6596e0e9ebb38a5bb29350fbe9aa204689ab1f897e41a6da14352b4e50ffdeba01c1ff8fd2a1e76bcf900a0506e333ef7e09e31e7a7d89cbd024eaee5cccdc7819a6ac3be973a4908076610df4ae3e8ea0e9cb1c33da7f4e58d6230465389810897b72b8475d891c22d00722a8216b1fdb13ccdb686de857d2cb9db918a5d1a8fd75445e047547a95375d06f57b875170214dc96f5f7077e6f7108639a29219ae145293f8d7db6d700cec0401fbdfd508f84a3e1c0ee735ae5f745b3631b7bc21832446446db4eefbd48fc8bb4464ef5c8", 0xe2}, {&(0x7f0000004280)="cedc3f768537418f89f4ca1f580d61d60e0914bd5dd63f5ff533a0537e185d9fc2aab37ec378f5b369bf5fa1f068a789443b465bcbc7895ffc3064c0658498937fa92c5f5961f1f4036bc94a0a53d322edc1dd8ce2ec93fc8e19a5529f990f1a43e126e264ca12c67b77", 0x6a}], 0x5, &(0x7f0000004540)=[@rights={0x20, 0x1, 0x1, [r21, r22, r23, r24]}], 0x20, 0x80}, {&(0x7f0000004580)=@file={0x1, './file1\x00'}, 0x6e, &(0x7f0000004700)=[{&(0x7f0000004600)="16bd536069e0ec76ae36697204772e57fda2da10802d1a29460a6c61dc8b7ebc740781c0032b36377027d9ddcef6a2ef9a0e8f2104c6fca12d030f04308552c5cb1bb94994d041d8c8365de44ebdea4b25f803cd57aa1f3144c2104134457f977df1c7421a3f63f2ac769336864e637447c4b460e7500ad92296b72de076f6918b20f2b09af4800304201dc3e72b805498ea5a8654745477fe9ce975ff5ac9eca66a26eccca77a8f79144c564fef28e713f7ac8dbcb187c9e1d7cf5da146c6e0d05a4c0dd0bc5dcd42e904f76a5b53ff02b48f6cd92d915d6e3863b78b04d8303ad9e69164755e2c0a6f53e8", 0xec}], 0x1, &(0x7f0000004dc0)=[@rights={0x20, 0x1, 0x1, [r25, r26, r27, r28]}, @cred={0x20, 0x1, 0x2, r29, r30, r31}, @cred={0x20, 0x1, 0x2, r32, r33, r34}, @rights={0x38, 0x1, 0x1, [r35, r36, r37, r38, r39, r40, r41, r42, r43, r44]}], 0x98, 0x8000}, {&(0x7f0000004e80)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000005440)=[{&(0x7f0000004f00)="23655803e644e9360c82ef51db47fa346e204cfa44a34950ff77901bffbdaa908d3ca5a2aecaca3def68099152c2f2d1f737353037899bcbda95cf3ea9375e4275d5c725340e90bb2c48785b53d4262b1c406c3babae2b311ddd1fcbe5ad3f47eb131ebc2d5e8c2eb9adce3d5ee75ef433f230006254", 0x76}, {&(0x7f0000004f80)="26eaaf30dc29b7dc8ae747fed0815ae1a89fc71d492ea40d7203bd0e0b6f0dc92704b1cb7df66ae33eff898467ebf622544db050203faf8032171b02367aab48a03e396740a0ba7c32b5e8c10487aefd56137ad225adce6ec967f3a048043788bb7c467b5e78ac691e4094b56c30ccf975568e3878791bb33ff40e9e6816ae3f9059cc080d4fa08099c3741731391fc6f6d8b31e0f7bbdfd72c8cd4aaaf94a1d5c8cc97471ff2715e516dd866495f9eaf3f7941f1fdb6e78b8bdfa3a9925509263bd808fefac68d0520121d7a2b0", 0xce}, {&(0x7f0000005080)="0f5fb8be83b49265feae382bbb1e77ddd0413d2aa384cc63064c0b05fa3902d93bed0dceb137b146661dbfe2edf807e63f2bab964b168037ca603a3c3b0054448416b99f3011bc243213ec26003bb997a9d455384b2a2f213b4d1e2d62d1b661cf2dbc6ec38e0e721a5e46bf0f2db35811b240a403e40bf84ed6f3773a61af770d", 0x81}, {&(0x7f0000005140)="162950333d82fd0c2f0dd438195a3bbebf3ff39b4925060b5db601aded98c3bc2f6418078cea2c4b26a42d3317406475f33503774488ad393189d24fb18f0061acf6d7ade7c17a062b63fc0957d68710af4f8100770341612eefcac3aae7321cab9815e4ce675309c93b0ea06339b055855d783b322e0c1b810b8b2e2607c0ee3b00acadec4193b44e66fd58f3a8473e35a71aeb69e4f3", 0x97}, {&(0x7f0000005200)="a0672eac88375e12a4185d4af05555f9b093f53aabb85f3f7357e915e8891fdc61107892ed9e67424eb66802ead608159523832e4e17e2a6e7844966227de12c8431f3fca97b64686b9c5ce6fb4a5e80afd52cb5dbfbb5aea12c2f48bcd2edc9db81956f999e9936d63bf9b12a616709879a263dc42c4ef2b4377b3b537e6611b674ff37a46963ccb2f7595831751927de055fb816b92712a218911151184248f87be36861a42574681b9246be27e57a2a118819d0a01c29298d95a8c602b528ba0f8429fc35de", 0xc7}, {&(0x7f0000005300)="f4174b4698b7aa47092545abc815b6557884d483d5c3b0642e9bb22971389c6d49d09722cac19ce4fa2e140f8ebc9a70210473ccd4155dd60c11b8c2fb3219e3b8b48fed6d7f242c30a31e885f73f7baf5e4af864f40eda827145a8627d7f8315124af0edab2401e900881990638954fd83fa49a5fa096a4833becd2cc740be6338291de9b5909557231264dff30cb71e868ecf583615aeac33a838c3267f5084aee2aaacbf5b01bad4106e4b41a6ea19c34ee6662bb4d0cb1dfddf43e0b16e64b676253ba1fa95f49556ff09493eeed4477859447cf89ae331c26d9473585bc76d7d06146f6a009", 0xe8}, {&(0x7f0000005400)="6488306db7f185bef88994f137", 0xd}], 0x7, &(0x7f0000005600)=[@rights={0x10}, @rights={0x20, 0x1, 0x1, [r45, r46, r47]}, @rights={0x18, 0x1, 0x1, [r48]}], 0x48, 0x4000000}, {&(0x7f0000005680)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000005b40)=[{&(0x7f0000005700)="d01fb4ad932267127d3290e6fa15bedc3742ce1462bfc9207458c62249ed79c15de051e1d76adfe49f122a5f5d403019", 0x30}, {&(0x7f0000005740)="2550f6bc9ab3e681916bf3f3015df8894dca7a2179e66074ca26a5f3a53bc03802fb698560a44929bcd9bd42ef33f44f256ef3e3cca6bede1e32784a872c0529ad9bdf6e2702d0d6a3860bf67bf8dfd13bfff7bf9a258f604d6de4447f3f509c5bf3d1d358ff", 0x66}, {&(0x7f00000057c0)="40c1e414f6a5b5630e18db87e962b40533aabe2a21783679c7c2a69b5f6c66681ce72501112f1874beb7ffd87ea3d7a363111b07c6fe610b0e284a8827c912bb406f3cd1db9fc550f6850987b2f9ad5591bd1243207edb310537361ac6904227b31eef43d5ae9967449babea30f3fe2af89fc0c7ebdfa3dea9c800852b6627a73140ad75877f4cf3590e88ded7cad04af6cdc23d72c10fec9400db18800c5bfaf7800af2b649db943a608578342307850438c8085f33049b068d755492c918285a131273c968f1db2183c8f9585e3e0d6c5f0c82", 0xd4}, {&(0x7f00000058c0)="637ff51abac4d81003cd4052fcc74a96312e35e6a6bc52a8154721", 0x1b}, {&(0x7f0000005900)="9c620c27d1c334a60bc2e3de4b7f9d8995", 0x11}, {&(0x7f0000005940)="40d004247117b3c13645466ee168f0e79b4b437df2aca22fdd75b4db3c25787fac77c00901099a568249e04f1ee0f851b2f50aef65ef3e05b6cb3ab02547b67affbddd76150e8941d4b70b5a89d2e176cfcd3f0d6f6f8526f20308e429acff3e6ac066877d81c8e5aca784350ca825182b661747970391deeeaf4a28bf4963c6653d", 0x82}, {&(0x7f0000005a00)="7521cada3d47da1f5f18d5cf1d69fb1b09761af1f5c5343b66a2fd3a5f50c861025205c02ca70304bed724fb67ebe1b655a490a369992714e198bd6d9ff38722af133d18f04ab5987c539beba43c511f8188fbe5206a632fbdf2ce5ed9baccee376e43fe5ab7dd2e6fe728eacf998d3ee414093a23c78f9bea2d86494aaa941ad6e988d2f1bb5ec197be3807a1", 0x8d}, {&(0x7f0000005ac0)="2ef0700426783abd06d6e3ca67f2015b10df1b7965a1ba04e9c158edd47a91e0a490a54cfd41bf2059dfef114d1b9a4fb25d234a350b8b4d813a874e57bc0cc1ea4e4b25e9adb00fece0fa5257", 0x4d}], 0x8, &(0x7f0000005dc0)=[@rights={0x18, 0x1, 0x1, [r49]}, @cred={0x20, 0x1, 0x2, r50, r51, r52}, @rights={0x18, 0x1, 0x1, [r53, r54]}], 0x50, 0x4000004}, {&(0x7f0000005e40)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000006f80)=[{&(0x7f0000005ec0)}, {&(0x7f0000005f00)="335426e00b88b671f40302569c6c0372d0e697dee0e04d43506a5478cbf28a60bef3ca5aaecae153eb8d77ca028bd66123c97b0622697755bd22932b721c51f3aa7659c728e92fee4df01101b9c3a948ad6304bc95c3e94dd14382fb9437f0bafc9ddd73ad4331fd9b45bb234f9db8420001f9d38c5b9a507d870454562185cbfe842bca115fde206d762dec503618f63e9490cd3af5ecb10fe30ede222d81b1b346f4275d3291a9a2e7bfa04e1b047b58527c2d2474ab85906b578e1900d37b4595d4a94f64a381a699f861a693222139a51021dc883d1ff9ebfdd79345d319d221f34aaa5d401c6f34a59c903f445749ee637aacda8a8a491206a3b981e6256c1e633ed22f968d3635183ef10eaad79b9adca461d36e621979380efec1842ed9e72d2fe172bf3bf39b9313c22eb8ef9e923258d0d095bc91336896291b61a57f8cc597109884684a8356ce92151a8c52fa3fbbca7beeef1af5f316bf90e7a5af9945ba1239548cb66a6b96dc2cf55e59f0250023c08149ede5fb53a0a339a3e63d53185514567f71e7ea331248efe4a5b9511a027fa2dc7a24545b5b385e02c5d721ceb14efe27d5d772aac94fb4cafb5ddb0ffe46bb639a5e4680370d530c1dcd9fc95c15e4b0ab09a61595f0e49ee3389730ba2e7f1de64753fc4b67ec10f5b337f0c56c2d8a1c3aaa1e307335e467eebc42fd07808a527ac0f21dcbc693af05fb2465fb26b073f6c3168f9a7c387c24c025b2755f7ba95bb634e165d08fddbb6dca8afe827911d22d8590649e9b32bea34c694716b93169e31cde1bbac9dd033083a185629c68ab1a08067fb93ffb4fef6e07abccb19d5fc8653bfff04de079db4a4480ede3f21c4b9082c303b78b4777259b5f7da4f70be33689678db451244ad3ca04146cd765b0fddf76055c6d62447582cc6a14a104135d4f643c9a5aff817a03316ef0cd8b260e1e05800c65c994b6929b9cd06a57d206e2b909b068d9d188522f4457a95681961df04f540d17a12c24f6666237af5efc361abce3220e02a88f984fec941433a332645d2aa4858071e5b21d3d6d2b19cd4bb224e82a5b1519758fb12372111a0e0e21471fe52b3320991180b71bcb85dc166316c1ce51ce0f8a56f60514a2bd5dc704860935eddd4952c71e7b640eaac0cb637e71bd26094da9aa6485eed605745c237203b8407edc5d2c10abaf6e4ed389eca4265e5f8dc19d9e3802e6b69eb974e5d68be8bd1d3d1eb2e2065d2b2b495107f1dc9fb97659985b9b703f8a1fa66442572b46847d1aa360c0a5a03ffcd918401b85e932f9540e0735b497f8d3a57269f08f959aba4bf5f22088e5c1a1e59f06aa2fa5aa84a6f0e627523bd5eeae32d71863a08dd9f449d379323da4aa2139579436916030f6407a75d74921e3714526fe619c742904283274c911e96f8fdc90662302c65432c0e4d9f314dfd5e21cff7c2046056a146031f34b81b892521b622e64ec85f58f367ec12bc1c1e01accfa01f9fa6581883e0974dd4d689e09c4b3147bbc6cdda2b57f513ab60f2ddb340048e55f796807552a34b700aec9233f23b62209b465e3d784dc84a27284de6e0525204b1e854037fd19e25e9dea801f4475b4475587a83ca02cf3d88ab0bcaef0a2249a4205e0a1af15cdd923a6fdc11f0c342f76071ea005fd2851ba470258d28017d4d8a10100dab8d2145f5e0ea563b7d10870e5fecbe3d513a5305124a8a2be36771dd020066d8a1f5e1e0b7716bf8b6a87eb61a4f95d405098eda189983fb30299d5d6b2c3aa8e17dc5c7e32d581c059601eee2c359622425537f78e955c9dcced967de6cd5cb5444ae6e5b89c25b0e5f9178ebc44a5889ca2024eb0436bb63b7b8db219859ce0f8db1fbe173588dd2408fc0e11208df609f1810cd06d22deb9013ddec355d3bcbe65d0dc798d58e973407593de96064da6c81bbdd74586429c4e3cd5fef4573bf74f274e9b4184c7f372192e0f972e032e841cfab284a54daaa1249fd9705a1c9002824b7c1f2c61604aa490ae8a053403a3de9703203422c575ad53654bb1b1ac979f8ed1eefdf9de77619a3f9f39dd9f89b319d2f47befa08e26ae03b1aee9323ed179a32b9a7f5defed77697ba2ddcaa97ec570b96debd2ee04060504b903e08f94c6b9c9b3c49d34932ae4b9f85f2610af02f19cc51156f31a6ae41e561f0803f71d9695408c4377723c6dccf5aff0193995178fb4895173d20bd790bdd7c5404c248807d7a2489cab84f294fb74291abe90033d33e97a9831003743955708f26111e861d445e07f55709ea82ec6d19e3bb2f8790a792f79ab89f30f8952ce5f5b6dd83973eb2e2243cc0c7cb683fcb92f421a95437dc159f3a16c190b0b50962325bf6698210a177fc75459c295d3a0305e7f7c6811c0dab3abe6d8bebc35b26d02d726d7562b79da912ae92735531e1c7dfcd7131d44fdfca2d13cb81b3b3c733338176a3036f515ceeba4dea2c2bdef8d2794cebf1aa0f5cd1818916fb6ee507b8690c6a11a49f523a60a02e2549bd7961f8c4acb9876d6942bbe72cb74866ebea75554961ac7d91936c7f469c538551cc63953760360489242da57140e0f25b1abd71b1e113dd4760535d00d6fb2e2d5bcc7bbd93b1e725e479d2313508699f16585fe8c4998865e36ce66d8ad3feaf0a644ffa13376fc3b3efb5d7211b783f34f1e2aef72460768ce989826f4d1ae0bb144f0ae67bcd45d52a85dae5f1c784677a2736886be6805c2f90f14fdd1a2f393e144522247f5431c281680faa37da9ebd866db52366d9241ed266585506f44475d6873a4684fd98682251f847a6cb7bf819f07905d2b0b39ff3fe7a0583625b8dd6414d25b95ef3e45c16fa545086bad53f52f09be31a3581e4d94139585539cbbb28b16c89c5a6e57bcae7af329a9851c852842fa101533649c1154279f41b32344f4244075dccbe4b027a896b2f84760b8b166f1d7b20ee5b822be8cd4966a19c2ee0c1643d97bbe38b09d03799c9f708c580ece4856183ffd4a2300888b8e2b96558064026b7c8dee6edba45d8185e6d04218a5b36a0834aa4d8c4a4d9b8303a77b634552dff88b705d6741f6361288e6384b1240c7f14d1d86c91ead7b84aa8ced01b7bf9f49585117075fe28b55672724d178b794eb4befe71f36567523f5519554fdc060a1cb3ff4c4e0be487eba499795e8355b563c0622d9b3bd874d03fe616183ff9824450b907ec37df58b51ff6f2c5222e94800da940fd6a387e81565b609bd69177c16da824680975c797312de04f15ac744968d0fcd96712681993aca263e9ce251ec80d84dc85bd7581e547aea3a0f6181a98773e49824da8d161fd3525bbff0cb9f546e100e085b2631bbdd37023aeae47da18d4b759a9828e93b24cfe46374158b0b71d091bf30e0e2c1b01c597e383271f6b3a731c123bad95cd4a36138f6455f49b95cb1fbf8729f22b8b838bb5714c898df104916b3fecd622257bd71876515616d0c620f13008337d6868715f66eaf30fe57f14f89cf54085b9bceb4f68f49be009fa22aa5944de5c3dc5c658ef83af234c672eb6f8c6f69b05369458703b3eb663e51fa342ac06b851fc989c292345a096221b711d7d0a322b621953f125f81d5388c808e604ff0b7ec764fab04a27b60d3b6c5debae1e7b74753cbe04a69b5118a394d30a820a0ca28514ad6e191d4203084ed14b5bd3226d57f294da642192db8ec04d12e8245299183ff170e183467049562a516d9bcd2a6d45da942a02c1b81751e20b5ae127e1ee0fa96d8b19c60986fd3725424d6e6f192364a1de3989f4a592a0984738bc3c57b1447dbfd81074531486612358d2ecffc1137164d7935e389e5b6238a2670f19f138ac7625f846d95ed9e3e97d8b83a89f392835c1e0ca2b573d56fa09721004f39bc2a3a964a4bec3eada83cc948082f3b5e1968975975bca9fef873a8b4c3943036d5213ab484ebcc7fdfb6ae6c3cdf69d21ae34c626845ac0d78fff5759a6eb5818a0146a00c8e02a384b1e545b5acd6f1774497404192fe449903787c9f7caf221d508b8ec547c09a33a682024e27ea6f1cec2152e4ae7a7965b42c5f78f868724e81d728045b74ece793394ee7fb9b7b2de99b7be79bf2db1829b7c0c3009ba13fcfb0f9b1f29ca0b9ef7838bdbbc24c835889ea28f4462c90a89ec02100f3b7f3a5567c376f33b71fa346dd1e846bdfe72f6c91164d8c6e97cd13c43109e6f6b5b8dbc5ab7e220ea05faef65554142915d3d32f162dc6cd800047f412b9c125037a10c53d64d82daecc743a8339457e1b73f3f3fc47e5b04ccaf58280c4875026b248a8a28c6fa7cb5b96ff71341c954b368e471694ffcc02178c34f452d5d7824be1a453b8ce7b62815a90444e6445ca4801e543363496f16975c1a11a3bcf2b69785db32d018bb302b4cce6e403b3d508b7c9dfbf7ceb5b9f2ba2cbd7ea7ca476f683739cbf524909d6e3800d377ad1d0570fb584ead43cd84b26c436a69f1ea9496f31ad7aadbdffe0fe148fe1e50af4e03a33ff2244c15ab9a08a0791a4dd5879ba6e1608fbeac3ce743f4b4e9afa0dd30e683b41623965cdd8611e9b79f81b97702778f2a347539fba988eb22897e1d35c3ac99ed7bcb3ddcdd64febecdbb1336c9ee9a01af156e639864903df099b195b1f676d5ca13a8f3ab69780207b9d7a382444aef7e6d9f9c47e92fc9e9ea0e72c3288439332f2cb879f85bfe3f8abbbfcdc04323d64dbd0c7bee7e45834a0578459c68d3d1bf9a35bdf7d0a8e7f61934dd181e4ddd3bab27ef1dc785438c3c2ee1a5c2bfafe5bb77760171bd9d410bd3bb5ac3e5ba1090c688135aa055ff0d85ec81fa937523f7e7052368fc17c1871639eb8286e85211d00d39b281ee3b5ea8b012ff113b1367c7f7bc3b1ff369583a581f49956eb435c08c87477ad91feaa5d68e9906eb01722476ca8bd9d1bd135d76add2828f573b4b5d3fc9ac96294977f0c1a530bccfe1463bb342ff1f747db854fd76a57c634eb9a88999b6f45659c5c60e51631c39016083a7a00f7855f1750ca521e8d00e817aebe21766750e72f9086b1b246c5fa9e2bcd6489b156796593aa5496e3f2e1e821dbb3afd4b7cbdad129a2d2b23eacd0e281800de8d2446695e831f43c099034269425fb260272558f95b63231a8c83c3242792d9f06816b657a8904f755955b28ac7cad670f6257d4d0b57941732e3e00ba570c2c5140942c16969b0bb9add0c3bfb77b5a0a7efdb49ad24f19d7fae3be1a0e6a53875c139db803baa416650262637e768707ed5f6265fddff5f517e628e0b2f01b2487821ef9273bda7786faa355a3238f6d73e0eb5b54b16401419978eb7a9cb873ac03c82c87c7110bacfd29f29d1a3ae6d7810e84711b2bb280d576a21a3d79c7be1f0a7269e100f4920456538814fa04586e808c0bb558f2cec079cd5a9b6e83e75856097955fa9a64b537b97f8d20932ad6a05c492b5396cfaebe71c79f8a86ea3879bbc9bdc40925e5572b845f1783eb9f85fd558e967699caeabd144577c47cab7ad343ae190ba18cbbc53f17cb3feead9dedbd1d37e9211cfaae6b60a512ca5f33d803f3dd1c43f6fce89faf41cda8c4edf3a4d4b7055c08af40ca46fabc9dcbcf367eaf22d48979d49b9362a3164a4a2dfae4fdb900cddc63797e574b97c529150fa45980fe0180675d8ab8500cfde64a3da35f8d19f6f74dd9e4659fa7ded77fa384c237851e416c1414987f6e5e3704f81d9b7947882c78ed", 0x1000}, {&(0x7f0000006f00)="cf697d03021ec8076e0e899dea19c8cf78711c87f302d7911717d971fe102630cc3a2fd85db434aacca68393756724fe021a6764715d8521f9afc7706be87184686eaf2577c7a1f288826937580d36e4", 0x50}], 0x3, &(0x7f0000007440)=[@cred={0x20, 0x1, 0x2, r55, r56, r57}, @rights={0x18, 0x1, 0x1, [r58, r59]}, @cred={0x20, 0x1, 0x2, r60, r61, r62}, @cred={0x20, 0x1, 0x2, r63, r64, r65}], 0x78, 0x4000084}, {&(0x7f00000074c0)=@file={0xc60ed95338881463, './file0\x00'}, 0x6e, &(0x7f0000007a40)=[{&(0x7f0000007540)="ee99f9ca88e6ccaf3d023bbf6ab70990a02afde1d8ae183ae9b9b704543f6f1da5937151f29e993268dd5c7a7f6720db81fbf008b3c2b1de4aeb90f7642aa33e2fcce301e113bd1f55366950db35ed57fa8f15af2fdc4f1812bb2e1421a093a3ac258b2c0f1935eb651f6f0e121f98aa06e393eb396e90cef6d8ba0d8523575ce97d349793f253735df80b519686fda30f2db90240d2ef12597680a8e527803de51cc9758d74d45c3f0815e4a6", 0xad}, {&(0x7f0000007600)="b64a17ac818024d8c9e086d9ac6f84981b45dea11ed638dfc791b4bf4de8c602a9665753946ebf566e4452fcdc0d0b6d25b93b02ad7f5877122340b21bb3b5c5198c00a43482baf976cc81fb65947358d2209c82d436c5746b56a5f440ccf8320d2271fcbe650310a539ebda6eab84b2558e1da1b58fb3754399fa814a4f", 0x7e}, {&(0x7f0000007680)="74caf001147223ab3d79efdd227e6b25aff6d4066cc37fbbad650f4fafc2686745db875a6212bf9fbd94f3082b41ea3d45cdb90ebdf645106095127ac147727b2cc910ef479f542dd13383a6918df6e20bdcb087b2b619fb6fc65ea9d5f2c0d9ed7f525f9b6162fcfae3251a65fe6ebf9721bbdad2ea07ebca7591ce15f3ba6dbd7a7daa38417be0d27e7c08a5a619e51bbb7431a379d3a0394b6f4a31d7f34841bda542115eba48fee9c1f532d8e84942c5294e15c3df838e157e78c184a6aa8f9157e53cfde7c09c2f752eb112a8d34bb9872ea89664c6d0ebd0ecd4d918d92a132024e44f97b763", 0xe9}, {&(0x7f0000007780)="573de5ce96f91cb2efeef0361cb6e162f030b8f002ae068393d7edf7e06e367293bc0e3a49fa339f59fe83df678b42234647011a", 0x34}, {&(0x7f00000077c0)="b059bb1f76448d8cf5b75db0026110636d27114fc1da7cfeab12bce1143a26a56827f7dfffc764e952e9deec06ec7ebbae89790732894cb3eac76d0ff2d3138f72389101048b672a894d14228dbdee61661dbab699664bbf5a07bdf9fed547509829ebfcc31adf963162b9a0e0f9ea8997df23a69a4fe0909ca14facfd7807f5e3c27270ac5a46d192a18dc1717cd951979684bcb354507f48f2d5e816024505fb3e281d560437faa6f8fe69c273051eccba993defd580d6182d30c8f3eaf73a0753805f454da9983f716cf55eb8cc31f75cc316286c2352ebfa5ae64b26e98e8b72465d34881992ef6d5e56722b045c85db0bea1038", 0xf6}, {&(0x7f00000078c0)="2758d69a3aee2fb55a53754f6162f1d7969f1921b76d3b2d75cd26751b38cd58ede96ad3745ecec87038b689acb5eaa92fc4127032dcdc351b9c3b78fa48af394ef7c761d0dc7fd020ac2445ab7829d5693293bee8a719fc35b84caf699ab6da4bb67b68684449c379dc59732d5a54eb9bf2fa3ecb8e560d8e6ffb5d582c5a5778d534cca909d9d036345078ced287222a9732b7d9298ea79adb6de073b8f0a7856267aef0cf38ecf9f881b7967a6ae54761958037be1fd8e54514e8cb9505109ab36c263cf1af560d35790f6d52897bbe4715e4af5e29dd8127209890bcf4ca1664b5371b5e0e425516", 0xea}, {&(0x7f00000079c0)="2e1884c4e3a329104f38a34f52caeb490791", 0x12}, {&(0x7f0000007a00)="09e50382ea9883c2cb8640adc13bfcd02b2253", 0x13}], 0x8, &(0x7f0000007b80)=[@rights={0x20, 0x1, 0x1, [r66, r67, r68]}], 0x20, 0x50}, {&(0x7f0000007bc0)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000008300)=[{&(0x7f0000007c40)="047cd9cfa48c8cd0ee9c701d6a4c7e25df5773b8552f913cf58f6d37fcb8dd78ccb270d5c99e34ef2b0566a87d07346571f67d056e6fc2c2427f443665db204b65b8624a3d66dac482bc4e8f398906cb699cc7399bdff8479e423dbb", 0x5c}, {&(0x7f0000007cc0)="9c523656a6af91e80256d571a2405f6ac7885749c3e2092ec761c668c93b946511c6888f", 0x24}, {&(0x7f0000007d00)="c9f0fdee2acb6b458eeba442eb50f2d47adf624f9657d8d531106df6a5c712ca616492760b5aadf9a56f164a76cb6ca8ce2244ae8a52dcd67ceb224ea432c0b1a10716c6ef6bc5c3151a8ec97057ab0467f0d471c032a70e311066ceede39235f1adcc0a677f7c1ddeeb5b1c83041495f7ecd27d8439305ae0197abf3b7bf81acdaf701be29bccf66b008bb9d72c45f3eeeec1c5320f368c04eb610ccd40deca4aca0a4d7d57a2d02c3b479522a88c524be9dad5352bbaed391141a7121a40e6690b717bcd3bfec7acfdca36d80f6f83", 0xd0}, {&(0x7f0000007e00)="57268123f872aee565d27f864a4992fd788df337105869e516af320023bf42564170649d7f2bf91d95e5b9be3f615b22b93f3dfe073e6fea96bfc3cb2b9f9b781f19c1fe231fb7794cdcc7bdd24733d009d4f9bf86c6004959ef9d49c960dbcf78be6cef2d31648fee30bcdf5473632854483dbe03136e9b795bd9acd01ff49091843780a97274436c4b9777449524e49e8825e7de2a8f1fa92404efa74820c650ce4b22a62d2e23fe6bd5ce00defe7e25f09842165e63031342fd477e5a7b70ab17b2c7ee4a2d1d630696478b2f203e8776e2887ac1db7c8188dac6694469372fe34f10a39dbd4c054d831760", 0xed}, {&(0x7f0000007f00)}, {&(0x7f0000007f40)="e0ce0c7370b1b51bae5cce9bc6b471296c0f23b179a4057d9cfb53ffef", 0x1d}, {&(0x7f0000007f80)="cda11e5105581e27ae17873e226bb08aab1489251b56eb78d13412eb47bce9ee6bd1e49cef9b9b53288101a3da66f0a5191f53a3274de1fd29a5ef2158c7af534b04ee8853418577a7b519e5750dc47ce9e42319369f009f2f31cbb6b0411afecc5af5b9bbd8b112c50d1cd529911e83d22314d9f72af30faa75c11ce3bb5df07c0f9516b72fbc3d6bf224f7737af660", 0x90}, {&(0x7f0000008040)="9785c47036ce500cda96d1ab7b45c815447899cad87e9d2322ad0877cc6fbf0180b2a74603afe98570415f17dc75dd08d9f78dbab19bae7b0492feba1df0b98b28aa69641a10b81610739faf5f6def8ff8d9d00961180e4d645785eee078c1e88732ab2dad357b0c3eb6a8503e20d810af6b51d14a718aea15c5216dab1dd18d7f5dd399fcf2f9e1918c9fc3525ad84fd0bb3eff77cb1d1eecc07ce7a3dca5e2254302b5dc3a928c731fa7a1ee6cc61c1dd9005d50803bf8dd797e48d34cbdb2d3ee26c00bc2f048175e0301fb8d424d092fe6d200c2ee7422f821a5b77ef753134fa1926f5226693e8f69cf1c8b", 0xee}, {&(0x7f0000008140)="70b6eebf3a4910393cfc7d5b139bc60e6393f6790fb326f4004873b6e7c21a37f07561ba002e2bdb52553e9ba9762da432a955aa2cf1004b77f54636cf822d9cf90e81f2d3cedd1602c6969785e7524b46422532f630d260a21b23a1fb1a49aad1cf6d53c258d8dd6142ead1069b1db2f745a6d862f70dcb8a481e31f6d724eb9a75a9742b90f67ceacd5a172d6b062d1271e718d6a0ab289c3b03f526dead0901e5ad5f66366219c16fefd3f6f7959cd508c217d75df71fa2709ac872e81853d6f81e6439092d522891d00efe907796c2df7dfa4bd33be73bee0f16746a0eb82c0c4d6f224a2e6b820e8dad0f166769601a5ea335d5dabbdee110108962", 0xfe}, {&(0x7f0000008240)="eaf5baf053ca43a47f0ee83bdeb3ba4c51b318642a6b6801ec4fc85f01231a50e80b9d2f28989c02c5c45c9a0adb50d6f01491eccbe5dc1d6d540bf69e30e87de3bc1ab848c72add96791859e45c25c7ed1d2b6794ebc1d15fb613a61bfe097b027f91251b2845da997c1ebbeab1ce6e42053ca3ce326faf0dbe2f9a1bdf964cc11d2475851abad302148df0f857d793e078595eb10038dc02aacff53544fdbbcc2382c651a43e265659f4aeb107", 0xae}], 0xa, &(0x7f00000083c0), 0x0, 0x4}, {&(0x7f0000008400)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000008980)=[{&(0x7f0000008480)="24c24ea4905013895a6f4bff03a553e04547e3fa79cff0e60e3fe2e7932aee8535e90109a8", 0x25}, {&(0x7f00000084c0)="02ea6c8bc5093f6904dcbb0a4661e8855fe622a85f922ac053c19b38c685ecb56c87d84564c7304d7dc7e9ea466e7baf58fc8dbaaaa134545d07e4e74abf9b8612d5124010f3cd8d7840f79f03c1529ee8140a37a8f1d68060eddefdc225d20349b17f8a10530e4121875693acb20428ece2ccdcb5ac587578ce27bd4ebbc9ae6d2a619c717c8e454b0f298e4e4f63e0d522a144d0fc056bcfaa85c4eda968a6c7c0113fa16b4a1676d192b01a38e4101e9551e514d34c283bc703fe729930b747818a3fe1ff19b399b147594af8550ef75bd826e1b8c215f15aa919a242d5f7df38e8b413b8ccd2", 0xe8}, {&(0x7f00000085c0)="96c2c147eaad460ac0a978d1e3d6c132b15590fc5bec3c5253cfac008f305e853c0d9dc00b950beb5138256f76cb1d9d2bf91957e01afbbc2b6a766a87b872630bd28ef7d5cec05ed163c800", 0x4c}, {&(0x7f0000008640)="ef7bbb546c0c27eebe6d37a4ed088f4542d2f660340695ca021e8e801617bce3c3052db0d16806517425964c26ab5a1cccbf0dd3af34978d606a7fca43620b642cd6a295eee3dca62f1e90ce1182e0e1d0130d171bcbd2887a4aa70eacb7dee811ee52abea6ebb26f9925861e8d150abc7f219f99f06d7b03ef4fbbc2493dda0ae28293392c96c435c3f03403be113fd9963b585404bb650fc8dbe732534dbdf8ce1d568b33fbfc6ca1a2c1d5b91486009b7d8d2ddf1d77684a9d1382d51eceec44eab50b23f4284d9ea3802d682e4", 0xcf}, {&(0x7f0000008740)="5c248632a0e9f71f77527252336e84dc96014c7212ed7f5052f63eecbda2d60efa56dcddd089699b95459c8f4a0617f45ce61752", 0x34}, {&(0x7f0000008780)="6277b7a846815eca684bac3b7b4b0ad65297262922f1904eea6d224936f10155c728cde91bf378ee09661536304f29f9d3b7c00d7a6df5549345fa881bbc6fd2c431af17c129f54f72441e4446df6a61d9c0c4226f8ac4c91ad3a99d2da1e4c98b3d759c24f8d58715afa54ad382c65da2832fe149bf2fa98918ebfce9b8563a4e4709fd451a34345ada2e5c7eab391f12ec5bb5b3b03bbae81e7f34ae7518ec6e0a4db87044046ddb3138488862610a9a1732882b3bcd25f7604079a5b2e8", 0xbf}, {&(0x7f0000008840)="1c4ea3237e9fde879060d0d4936aeebd842a124ae7", 0x15}, {&(0x7f0000008880)="8cdccdb42b29d91e90050c047bc7ced5eb1043ceea146009150b2f4767bc7951d04ebb16b83d7c536118d07f969ddab6a3d0c5984fd968db489b7f07b4101ff9470827b79d5ea5fe98b5598076cd5c882e2dde42dd538eed9744b53991a3e822bef5502c0b54644a2248c5edd10027223ccf56db1a40368d32e8929018700bc7b12a6c359ed7987eadccb2b4cd97bf7b07b032f7a303570b548d5908bbdab5c5810e5125f6ebf3eeaada3c658beeb75cc720937618c0ba198b6b09aa460ad7efc9113825db58b0e0fede9595804f", 0xce}], 0x8, &(0x7f0000009600)=[@rights={0x18, 0x1, 0x1, [r69]}, @rights={0x28, 0x1, 0x1, [r70, r71, r72, r73, r74, r75]}, @cred={0x20, 0x1, 0x2, r76, r77, r78}, @rights={0x38, 0x1, 0x1, [r79, r80, r81, r82, r83, r84, r85, r86, r87]}, @cred={0x20, 0x1, 0x2, r88, r89, r90}, @cred={0x20, 0x1, 0x2, r91, r92, r93}, @cred={0x20, 0x1, 0x2, r94, r95, r96}, @cred={0x20, 0x1, 0x2, r97, r98, r99}, @cred={0x20, 0x1, 0x2, r100, r101, r102}], 0x138, 0x4000000}], 0x9, 0x44) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r103 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r104 = open(&(0x7f0000000000)='./file0\x00', 0x400, 0xf55c41aa3d04f782) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r104, 0x6, 0x21, &(0x7f0000000040)="2c28cb4c0f74738844703137a961df89", 0x10) lseek(r103, 0x0, 0x400000000000001) [ 819.346284] binder: 5673:5684 ioctl c018620b 0 returned -14 [ 819.353397] binder: 5673:5719 BC_ACQUIRE_DONE node 1057 has no pending acquire request [ 819.361772] binder: release 5673:5684 transaction 1044 out, still active [ 819.371927] binder: release 5673:5684 transaction 1056 out, still active 09:39:24 executing program 4: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1269, &(0x7f00000000c0)={0x6, 0x0, 0x54, &(0x7f0000000040)="160c98ead88ef2ec0473ca899594f20261f42dabbc801df1be5321bf136c9cb1bc24bb2c506275613e1aa649fb804c4c10770ba41d24fe803214be5dd8f54eb541373c04fe3f7508360e36f64899baadbda593ff"}) 09:39:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000000)=[@acquire_done], 0x0, 0x0, 0x0}) [ 819.395945] binder: unexpected work type, 4, not freed [ 819.407998] binder: undelivered TRANSACTION_COMPLETE [ 819.417544] binder: 5722:5729 ioctl c018620b 0 returned -14 [ 819.471888] binder: 5722:5742 BC_ACQUIRE_DONE u0000000000000000 node 1060 cookie mismatch 0b0000cc01000000 != 0000000000000000 09:39:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:24 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x7, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:39:24 executing program 4: getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000000)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}}}, &(0x7f0000000100)=0xe8) ioprio_set$uid(0x0, r0, 0x7ff) utime(0x0, 0xfffffffffffffffe) 09:39:24 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='configfs\x00') lseek(r0, 0x0, 0x400000000000001) [ 819.514539] binder: 5747:5749 ioctl c018620b 0 returned -14 [ 819.565406] binder: 5754:5756 ioctl c018620b 0 returned -14 [ 820.098516] binder: 5711:5766 ioctl c018620b 0 returned -14 09:39:25 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="610bb2a6", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 09:39:25 executing program 4: utime(0x0, 0xfffffffffffffffe) unlink(&(0x7f0000000000)='./file0\x00') 09:39:25 executing program 3: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0xfde4, 0x0, &(0x7f0000000580)="6b3449b8371cee8f58f703b3aaaf93450901f7574ff4e1f3844080fc33b67577312570bd1146a0932dd80be807765695a9387a2a65197c3bc02db2d8da32b6650b781dfc26aaa12c3184d2c2fcb1ee9f6955fe52df5eaeb98776063939c3332d8cb389f565435dcb1ce940f62714753e5245566ca5249916457087fd7ad525c2f17ff26cba964af403b884ffb0b7298067cf15e24cbc2e86ec1e2c30b9ccfd961139d02f02c998143bce807659b0fdbf897ffbb7bcc2b3eba6595d72141b359cee352172fa295428d403824403eedd7206803ec0dac2a356311555d641295a5f0aa1b47edc5adf1ff4c83b0059c821fd0068781d9009ab56ce97e0caab61d28e3c52b6d77d0c8fb27dfdf301b7ff06507c2b0d2082e445801cb7ec559ae5a782b4daacb7391f3fa3132118a21e20e4e9a796e9a4e85439eed34faae452f2e6006999b17901e09689e829af277e234e326177474773"}) r1 = fcntl$dupfd(r0, 0x406, r0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000002800)={r1, &(0x7f0000001800)="702ec6c5a7676ff89431b672d6ce41aa6dfa833bfb806cfda80eabdacf658bee994906dedf54f1d3056e45c2dbb1920c8c9b8f08dad9a3dd1038e86b7902e72203ea8e8747d12979f00027e7b422bf44e7f2be7ab11b2b1b761f5790605196be65f77e54f581b2d642f7bc5b01b952705802d1a3542ea1deb3d734404c3ca27efe3e295cf3de58b88e926c852117861cdf249faf49bef072bde7daa1dd2b30138e16faac7cd50f5767fd87728a5df33a495376997a5334f6d7bd703dcbf655be514284499161aece438bb9694fec539ae9f9015d83b88d7982c55411f3a7df1b0a67ee69d81967a3ee7296395401beb8bbe2737e19dda09bcb30ae72acf42cb63474b7375990c731e89b80fdd5a8749bafa1e893c23d78a8c9c434800beb0a0f2be4543338bb0aebf95fcb6d8ebb0be44c0b5d22147b4227f577696e170485958ed09e7de54de0231bd113ab0ed034fc78d92cb8e1a6dcca2d6fdc82c7d4168780e74b869cae1c949393af613cb6202e9f300183e309b2e9cc92991f5dd768a8347d805b56bbc75f900c73df84b1e803518c7a7c13cb5c6447410f6a7923ce85222fa1cabc6940d4b73e04928e32c616bb11cbd559ca99e80fa01cc7159d7e0cdc67735b8221ea1e9ac012a92c9f4600a3a3356b4afbfa5f48446c4ff3381602c1671d4f8fe42fd4c0f6c97459ffbf9f810dab484eca66e7f09fce4153b3185aca49e4a8b7033c6d1f3e284bf76f93809b14b01a935e74a431cb74661636ce3a6f7f70172bd67de031bdce9b69ffe1fcbf4277172e3784e26bec42452dcca1c895d9a64756f4af28e0636bd89b1d9de7fe0dffafdd47219a575c7735338c53a52b3f9fd41f509f70fce4e1b250097e83810323470708acc4a33e6d7fc6c7a4b977a60ee0d7d4ddb758125575d0efe3f543c3865a35fa98d8987978ede26bd4ebeedf14c14e3c454c646f29c48c3967b678e0aa52e6e884b6f30fce64e325f02c0d3965c0560ba0dbe0cbfb1e81680ed70eae0bc88a23009df6ce015ee6ce1e443ecd002849a2b489f2b4ca8d677954f6276117660d8056edbb9b98a69f8a134eb57bb9281e5d21cee57811599e47ee62ad40e25efcecf9132b8f7cf3414c2ee4c21f5e427b412db82fea35c4536ad0b73470ddf4cfb84fffa585cec243491aeb63aeab4f3095da725401259646ec855caa0857bf24f68f7b598ed518ccc7d3d25bb545583fa4790a35d85a4ddea728024613d2611197f868353164ec9e5b18a967d5375c0212f3a5236eabfc3ad1acf1c5d4c8225b1afbd22fc1816c79568471c5e2416ca8161db4a9ab2586bd17684cc41a97f5682a0772bc40f1f098a2c0e89ec4674601027c174aa3700a1b0453905c0ebc48ca09f56d6e79eb59f5ea1043558e096183518391aa69ae850fced26fd1b94a13f4a506fcca011e44b136ff7726c82bd4cf4e540e2bbf2d27d966a1ce5f805013f3b745306e014027f61d53caca219c6480e60a94d43e39a893874dd188f78aa83d76a175fc9b3a29fc696c921f51bf6dd8ff8c0ff66efa28c103e89bf80ff6f919977dca112343794a5e464fa58eb10fc26164afba81d9cc885f476ee60bd0d8b6b348aad6aa3e7183ace19782b72bfd388e772a2604cdcdeb7f57d8ecdeed659386f45f9166b3d9c8dc9941ca6b1c1e170b43dc359b9a1c8a173d837fc5911eb4c9b0751121e1581310bd938b63eeb646079b04569ef342fa172642ebc10b6e4fadc61f56b82336d2c0bdca366aef941ca7c14e80c3efbc48d8df5407dbe93e5b1c2a1b0b225791f1e4b9c04fe57b995039f26b6bf3c6aa7d19ec7758d01a11bc5304481efa24114cca92ae07c541a71e939325fb6a1fc18f05f46278d5e9268880840063d59c1f77b1cc8b9f8920d34af1ff9429c629a2a3516094f337b7cded2fec48aa8f159ab2d5519e17b23715573b656243237ce1c038c0f49088edaefbbc75903e36751b19b6440a8e444e4b1ae46c77950b6e91db536415085fabfab6878e1caff5c61016066abb86982e1efb6df94960b7fcfac54d39444a212b4115a6879c6b0bb466e35de99839c41ed0c22dd3e54d6b6ebf003b1203a75ec5004e3e70d135bb8a919d12c18e18231d0d804252e98e01b45e087eb1839ffe8d4aae1879f010012f6912cc4aa4364848915479d0d3c730a914a95a317edbe7dbe4c458acafab5de45e4d3d018b3bc0171c13396b4feb8e0540159f5aeebdc40d0bb01401019fe7c315aba04849f182366c780c122e6a115baced49219d45ea9c157951eec995470adad8a2c9865c1e0b861b413e1808d8b6ef0053a3b11f68c52bcd9d6bd464834a73ff14038a152ced6e94055049ce77df09a36688cd0218ec8bc1bb596813d0356bfb48e58367c8cc83fa4397858baa1d8813ffa263ca7d9148b678380b6da43047590c9ddfd2fb31eea27955411e45d83cc62accd0a4099dd5840bd8a9908cddf16ce1d394bbd25cfd8fc56996d502887610f5ebad6c0589b09475a2e35041db7c3aa2bf7befbb1da456f1f4af8baa1dba805050ca69c867fd5b04efe1f4a989bc2466eebce2ca9e21eb605c034d9f9fde767380ed4d462e66c9da59c1070fc5d800d36a9059ad582ab2716281c48ea30bed8af44f25dac09289a2281d50c1a34d90a6097083c083ed4f6cbc59bc5cf288f3c51921577730c8da208a5c132de903b99202ab76600fe4bf60c3673e8344da78f3767c60fe5375ef1806b31e6a9657ba70f2275623ec377dc14f822f3d72d8bd5bdcd8ba1e95b9b3e78c4214a144d05d659eba160293e9831bdb7b2eea85f1801a012d67c0a92caa170a94789461f1f20a345a15f254b7b9f0836db5ff1eb945d0f7dbf466cd12851ee2198c9b139f7d7bb072459b24841e8dbf039b4c3ca1ca74e6099d1afc324bdd8e60bb3f1001186ae9898f87992a2a2eea3d4d636989f8366a951ba7caec605c3192bed8303df1380198106b54afa91bc4e7c3bb6dce56b156098ee6f806422c617283f4f7b5d8382e2b986e6c150c5975ef4efad54da7c125e5585fa44745fc1b68b6a1bb3fc5f45055e16f934401456f76eb196dffa21381c06f846cc0f8c061624e0199ef7ac13d67fe976bcb82014771c57a1784a0dc0e3812f33866886b8ae5ca3a174a7a86e239f7c6a5b1fbf1ff941acb9044240117bd22dc2d6086eff03ffe785e850584a5165a542f3e32fb60d80c579d04587bd73773027e16731259963dea6a1a012a535ea3c0eac8561ca46ec3a923269f1fdf7aefd7e3dafd57982ca7cb9495ad6753b905ce089eaca11fada5937bd72be43a8d922c5d1d3502d87ac92a55d56bcbcb256877a55ab1c9f30694474e4132dce56e9e991ce9254bff14299e37a870162d45c4ac8b4ef837dced1da0ae7805280298f3006bc71afb3b6a99d8b6fab3957e07aff68090a7a2ff6807567f31b345e19d9c10d55c1e5a077685b1f16dd20ca4da6dc8ae1e315b4226f1f20d86796e106342bf29f46eaa1f983369c7a72aaa4d91f895e088d245c54741bdc20b0f94a839b0288e7fd1854d13c104ce4ad727ac8d1e32c1ecc049572ec34352d6787c000515adca1e5739af7f42a2ae58744ba32e5a5f39fcd7c39488d3b0c22876de030e7d397a9dafe25fb90f0779808c3ddaf67c82c167f6d8d2c7172dbd14afaf95ba79affbb2b5b635974106856ee1603f4f80e7e4160eb8708e79e7e49aa563a7bf8b368a2a7994e27fa1a8e6ccbde24e2b09c21e3a77e44e9a60653f011c5620ca60c0ded72c8797972c2ea1c6e3efb292208c2a96f6053989ce0261ae301e2b99af79e2e1edd834be4038947069b4def209f1c07f78e241ca31f27f471f291633c165cff14b93cec61ae9a7e5bfa89aa9d2afd5364ee49a6d9208b66e69508fa5f19ddd2684eead7ce8fdfd88ff60e98aa8436c90c540fb392c2e04715e58e71c118bf2baad22aca6305c32cd98b6e4ff9c81794c1f9eaa74f959264f348283b52193c6c26862a95fc3ebfa3dae5817fbd422ea758eaf777984a04c9d82a3fbfcd3aae34757e618d13f75b2c39854c5ef0fa9ed2dae168e41efde0bdee9b997b351fefd5828674fae78e401e5c5f8c24b8076fee1471d02a528c4cf85ec9d5d3e03ed9c1b910f11f566f5fbed696f0f2599685f8b784b343d2aa805cdab1d7c44be7daa6099cf7f02b423d7cd7afc43931154d494aae0dec9058f7ac74d4f227c8c25dae6cb77f66a69699aef5e4c6fdadf4db4c7292781eb67c962ad0ec2418ea93d76f0328a4e334549036a04e8573e9b712e84c98457b5d3682eb0cee1fd869b7ea08aeaccb780ea1d9cd77e023355e4c0a92415f0489d983ee3ac3ca81a26bfc676e7f73e37dddec10151f981147c4a021b99072daaeb1c85f60ad15791c82363a2bcfbdcc2397e53eb23c42e311a2e9497a391ae15db14924c2b3f995adb9dd9c745665d95d1e49e3780298ce8f2128bfad51cbdf0235e3b0c77c4c8073f84fa13adc3a6d612ada2455bc3c693dac1c55592f464d629222309ab9cfe2a89d4941b1542aee37643b017e72eeb6dfd2ca393b819095df9ea98be7c3021bccfca9b7f4d288d5f8071eb5c37aa9b7b2c3faa6051cb191257d0a86bb7457e17d09bbe24e14fc0bead190990459cc054621bd3d36df56b131d35a7f834882f8106b87e531b5dfd4298ed67d89864acd407775cfd186c2c97e9736965bb019436f4bbb3b1f5b7e3b663874024a254d651ecd594fcc4cb91acc9e6942f6ba18927051a2729a087b5a993e81a0ef66abbe13a0c8ff368fdf615ee6782c5497cac4b42a5204e44c53d544538465fe4e12398f65c1626e7e411d28f2b0bed6b02ac410985d94d6237c51db30e5978bbd0dcc3dc626e70a25c3b205bb3f940c8ffbec26685a40cac780d35169ed5e6a20062ed3932c2c2c92bd0f0d2554e8e00a1c69ebffb2afbbc1f69b8d6deec7e8375f36c3c45c87cc66b2b338845407148d407da7f1adbc6f161dc0f784ccb96d42655a3b038fb499c2c84fde9561fd63c62190513dfc5346c3d746ec7410c757230ccc2935b8d12fdfb3cc74728682e26e88729602c5242c990629700520e58c308706f1641707bda1c38cf1d2ce9ee32659564fb294c842f4f1ac4f213e9ff3353f9c7c27748acf224df6a7dfb17cadcd868427db8ac19de34b477ff0c0359434cb00230034f4464340ddbed841bf39b8dfb4a58bdd2fe1d261befb0502c5ce7ed17298c0ca1725590e1b13a3905634a1361a4e640042a6c7e1f749eae9e1d05f730d8f1fb1c489d5b8ee94aa9eb00263c5a3d8b13f9072927c0a2d5708cceb88d89b8b14af6ff1879108c1711eb63424b7d32f1375976406d413ee02a8b9c340e68e29c44706ebb563806329b567633d250de784554108b4b0ffb419a6d060527d01631b6737e4d769a6e585fff89a694ec9b8d2edada3b8b5bbd3833849fd9c163b4680b8ca30de3a3b968a9bec59e411f410bd46651ca9bdbe6e926bd2e8bf3b9f87fcefdba799a6237f99a0b1d8762d5ff8041ca630aef667858e4d4af2f89ac6fb9d9b6c5860bcc9deb6871bf5bd882a5bde3b444fc48eb71622da8be4772dfe820edb997c9aed2e5d6458097fe71141d43b43541fa0a3a749a5447fbcd06f49bb076336c2763940ddc2173e89ab242737d114a600ddbafd3219108cfe24ad5519aa23ae0eb3af94fcde05ef8d164ce933d8a985937de96c39b708aa7341e0f599560a8fcd37b8d9cf2da6b539bf3d1cf6741511ce7c88c4ea50782f87696c08a11", &(0x7f0000000540)="3b5c3be25090286ea8cbc58f125bb2309eb72e714d44dd82fe990129e156", 0x2}, 0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000002840)=0xc) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000480), &(0x7f00000004c0)=0x30) capget(&(0x7f0000000080)={0x19980330, r4}, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={r5, 0x10, &(0x7f0000000280)={&(0x7f0000000700)=""/4096, 0x1000}}, 0x10) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) readlinkat(r5, &(0x7f0000000500)='./file0\x00', &(0x7f0000001700)=""/224, 0xe0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000180)=[@transaction={0x40406300, {0x4, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x40, 0x30, &(0x7f0000000080)=[@ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x3, 0x30}, @flat={0x77682a85, 0xa, r6, 0x2}], &(0x7f00000000c0)=[0x18, 0x0, 0x18, 0x30, 0x48, 0x20]}}], 0x0, 0x0, 0x0}) 09:39:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f0000000480)="4e524d29dcc4fb7f97b79d2ac79860de137d31fa00962f10c14154ded7370696f5d3df3eb2d1f2cde9c5f67e0cd00e5f2d574ee3838b4b7d68e0b588d8563b05b3cfa8dc64a6f5b62e750391e7196ce6f39642e9245ce9dd721b8da5530512f81d4c530e59a1e7ef18fffc3c32d4b5fbac41e68f58bd3c6d1f7b926cd23b4f3ca067656130a51cac399ba8e0fdfd7b0a0aa03d03e8fd6f57838a6465", 0x9c, 0xfffffffffffffffe) keyctl$get_security(0x11, r1, &(0x7f0000000540)=""/9, 0x9) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x0, 0x0) openat$cgroup_type(r2, &(0x7f00000000c0)='cgroup.type\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0xffffffffffffffff, r2, 0x0, 0xc, &(0x7f0000000100)='/dev/ashmem\x00'}, 0x30) setpriority(0x1, r3, 0x1ff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='net/icmp\x00') openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x200, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f00000002c0)=0x2, 0x4) mkdirat(r4, &(0x7f0000000580)='./file0\x00', 0x1b1) prctl$PR_CAPBSET_READ(0x17, 0x6) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000740)={@in={{0x2, 0x4e24, @rand_addr=0x101}}, 0x0, 0x4, 0x0, "f651dfd696ef4b90be0ca5e68e670ea911fc1755cde681c5b53c01a70217dc01922e63fdc13a346eb4db919f62eedb441f137096832a701e8e86c8762db3d53f5e1574b7eda3d32a3dfc02c29b122e45"}, 0xd8) clone(0x800000800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:25 executing program 4: r0 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)=0xffffffffffffffff, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r0, 0x0, 0x7c, 0x35, &(0x7f0000000040)="6b0389510d4426b7b6739f98ebca05328a2bc72ac06cee0ca25b6e2ed90509b758583f0abbee45d58dafb9d843bea02d03ae2d28a638d26089a17b3b1a719a6a74de7777c4ad4187a03c0632f10e8ff720e45bf29d7584f6e29a684ba761b6a3608ff630cf837e4be4e0d464e340233ab6529181e6344dccbce9e8ba", &(0x7f00000000c0)=""/53, 0xfff}, 0x28) utime(0x0, 0xfffffffffffffffe) 09:39:25 executing program 3: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0xfde4, 0x0, &(0x7f0000000580)="6b3449b8371cee8f58f703b3aaaf93450901f7574ff4e1f3844080fc33b67577312570bd1146a0932dd80be807765695a9387a2a65197c3bc02db2d8da32b6650b781dfc26aaa12c3184d2c2fcb1ee9f6955fe52df5eaeb98776063939c3332d8cb389f565435dcb1ce940f62714753e5245566ca5249916457087fd7ad525c2f17ff26cba964af403b884ffb0b7298067cf15e24cbc2e86ec1e2c30b9ccfd961139d02f02c998143bce807659b0fdbf897ffbb7bcc2b3eba6595d72141b359cee352172fa295428d403824403eedd7206803ec0dac2a356311555d641295a5f0aa1b47edc5adf1ff4c83b0059c821fd0068781d9009ab56ce97e0caab61d28e3c52b6d77d0c8fb27dfdf301b7ff06507c2b0d2082e445801cb7ec559ae5a782b4daacb7391f3fa3132118a21e20e4e9a796e9a4e85439eed34faae452f2e6006999b17901e09689e829af277e234e326177474773"}) r1 = fcntl$dupfd(r0, 0x406, r0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000002800)={r1, &(0x7f0000001800)="702ec6c5a7676ff89431b672d6ce41aa6dfa833bfb806cfda80eabdacf658bee994906dedf54f1d3056e45c2dbb1920c8c9b8f08dad9a3dd1038e86b7902e72203ea8e8747d12979f00027e7b422bf44e7f2be7ab11b2b1b761f5790605196be65f77e54f581b2d642f7bc5b01b952705802d1a3542ea1deb3d734404c3ca27efe3e295cf3de58b88e926c852117861cdf249faf49bef072bde7daa1dd2b30138e16faac7cd50f5767fd87728a5df33a495376997a5334f6d7bd703dcbf655be514284499161aece438bb9694fec539ae9f9015d83b88d7982c55411f3a7df1b0a67ee69d81967a3ee7296395401beb8bbe2737e19dda09bcb30ae72acf42cb63474b7375990c731e89b80fdd5a8749bafa1e893c23d78a8c9c434800beb0a0f2be4543338bb0aebf95fcb6d8ebb0be44c0b5d22147b4227f577696e170485958ed09e7de54de0231bd113ab0ed034fc78d92cb8e1a6dcca2d6fdc82c7d4168780e74b869cae1c949393af613cb6202e9f300183e309b2e9cc92991f5dd768a8347d805b56bbc75f900c73df84b1e803518c7a7c13cb5c6447410f6a7923ce85222fa1cabc6940d4b73e04928e32c616bb11cbd559ca99e80fa01cc7159d7e0cdc67735b8221ea1e9ac012a92c9f4600a3a3356b4afbfa5f48446c4ff3381602c1671d4f8fe42fd4c0f6c97459ffbf9f810dab484eca66e7f09fce4153b3185aca49e4a8b7033c6d1f3e284bf76f93809b14b01a935e74a431cb74661636ce3a6f7f70172bd67de031bdce9b69ffe1fcbf4277172e3784e26bec42452dcca1c895d9a64756f4af28e0636bd89b1d9de7fe0dffafdd47219a575c7735338c53a52b3f9fd41f509f70fce4e1b250097e83810323470708acc4a33e6d7fc6c7a4b977a60ee0d7d4ddb758125575d0efe3f543c3865a35fa98d8987978ede26bd4ebeedf14c14e3c454c646f29c48c3967b678e0aa52e6e884b6f30fce64e325f02c0d3965c0560ba0dbe0cbfb1e81680ed70eae0bc88a23009df6ce015ee6ce1e443ecd002849a2b489f2b4ca8d677954f6276117660d8056edbb9b98a69f8a134eb57bb9281e5d21cee57811599e47ee62ad40e25efcecf9132b8f7cf3414c2ee4c21f5e427b412db82fea35c4536ad0b73470ddf4cfb84fffa585cec243491aeb63aeab4f3095da725401259646ec855caa0857bf24f68f7b598ed518ccc7d3d25bb545583fa4790a35d85a4ddea728024613d2611197f868353164ec9e5b18a967d5375c0212f3a5236eabfc3ad1acf1c5d4c8225b1afbd22fc1816c79568471c5e2416ca8161db4a9ab2586bd17684cc41a97f5682a0772bc40f1f098a2c0e89ec4674601027c174aa3700a1b0453905c0ebc48ca09f56d6e79eb59f5ea1043558e096183518391aa69ae850fced26fd1b94a13f4a506fcca011e44b136ff7726c82bd4cf4e540e2bbf2d27d966a1ce5f805013f3b745306e014027f61d53caca219c6480e60a94d43e39a893874dd188f78aa83d76a175fc9b3a29fc696c921f51bf6dd8ff8c0ff66efa28c103e89bf80ff6f919977dca112343794a5e464fa58eb10fc26164afba81d9cc885f476ee60bd0d8b6b348aad6aa3e7183ace19782b72bfd388e772a2604cdcdeb7f57d8ecdeed659386f45f9166b3d9c8dc9941ca6b1c1e170b43dc359b9a1c8a173d837fc5911eb4c9b0751121e1581310bd938b63eeb646079b04569ef342fa172642ebc10b6e4fadc61f56b82336d2c0bdca366aef941ca7c14e80c3efbc48d8df5407dbe93e5b1c2a1b0b225791f1e4b9c04fe57b995039f26b6bf3c6aa7d19ec7758d01a11bc5304481efa24114cca92ae07c541a71e939325fb6a1fc18f05f46278d5e9268880840063d59c1f77b1cc8b9f8920d34af1ff9429c629a2a3516094f337b7cded2fec48aa8f159ab2d5519e17b23715573b656243237ce1c038c0f49088edaefbbc75903e36751b19b6440a8e444e4b1ae46c77950b6e91db536415085fabfab6878e1caff5c61016066abb86982e1efb6df94960b7fcfac54d39444a212b4115a6879c6b0bb466e35de99839c41ed0c22dd3e54d6b6ebf003b1203a75ec5004e3e70d135bb8a919d12c18e18231d0d804252e98e01b45e087eb1839ffe8d4aae1879f010012f6912cc4aa4364848915479d0d3c730a914a95a317edbe7dbe4c458acafab5de45e4d3d018b3bc0171c13396b4feb8e0540159f5aeebdc40d0bb01401019fe7c315aba04849f182366c780c122e6a115baced49219d45ea9c157951eec995470adad8a2c9865c1e0b861b413e1808d8b6ef0053a3b11f68c52bcd9d6bd464834a73ff14038a152ced6e94055049ce77df09a36688cd0218ec8bc1bb596813d0356bfb48e58367c8cc83fa4397858baa1d8813ffa263ca7d9148b678380b6da43047590c9ddfd2fb31eea27955411e45d83cc62accd0a4099dd5840bd8a9908cddf16ce1d394bbd25cfd8fc56996d502887610f5ebad6c0589b09475a2e35041db7c3aa2bf7befbb1da456f1f4af8baa1dba805050ca69c867fd5b04efe1f4a989bc2466eebce2ca9e21eb605c034d9f9fde767380ed4d462e66c9da59c1070fc5d800d36a9059ad582ab2716281c48ea30bed8af44f25dac09289a2281d50c1a34d90a6097083c083ed4f6cbc59bc5cf288f3c51921577730c8da208a5c132de903b99202ab76600fe4bf60c3673e8344da78f3767c60fe5375ef1806b31e6a9657ba70f2275623ec377dc14f822f3d72d8bd5bdcd8ba1e95b9b3e78c4214a144d05d659eba160293e9831bdb7b2eea85f1801a012d67c0a92caa170a94789461f1f20a345a15f254b7b9f0836db5ff1eb945d0f7dbf466cd12851ee2198c9b139f7d7bb072459b24841e8dbf039b4c3ca1ca74e6099d1afc324bdd8e60bb3f1001186ae9898f87992a2a2eea3d4d636989f8366a951ba7caec605c3192bed8303df1380198106b54afa91bc4e7c3bb6dce56b156098ee6f806422c617283f4f7b5d8382e2b986e6c150c5975ef4efad54da7c125e5585fa44745fc1b68b6a1bb3fc5f45055e16f934401456f76eb196dffa21381c06f846cc0f8c061624e0199ef7ac13d67fe976bcb82014771c57a1784a0dc0e3812f33866886b8ae5ca3a174a7a86e239f7c6a5b1fbf1ff941acb9044240117bd22dc2d6086eff03ffe785e850584a5165a542f3e32fb60d80c579d04587bd73773027e16731259963dea6a1a012a535ea3c0eac8561ca46ec3a923269f1fdf7aefd7e3dafd57982ca7cb9495ad6753b905ce089eaca11fada5937bd72be43a8d922c5d1d3502d87ac92a55d56bcbcb256877a55ab1c9f30694474e4132dce56e9e991ce9254bff14299e37a870162d45c4ac8b4ef837dced1da0ae7805280298f3006bc71afb3b6a99d8b6fab3957e07aff68090a7a2ff6807567f31b345e19d9c10d55c1e5a077685b1f16dd20ca4da6dc8ae1e315b4226f1f20d86796e106342bf29f46eaa1f983369c7a72aaa4d91f895e088d245c54741bdc20b0f94a839b0288e7fd1854d13c104ce4ad727ac8d1e32c1ecc049572ec34352d6787c000515adca1e5739af7f42a2ae58744ba32e5a5f39fcd7c39488d3b0c22876de030e7d397a9dafe25fb90f0779808c3ddaf67c82c167f6d8d2c7172dbd14afaf95ba79affbb2b5b635974106856ee1603f4f80e7e4160eb8708e79e7e49aa563a7bf8b368a2a7994e27fa1a8e6ccbde24e2b09c21e3a77e44e9a60653f011c5620ca60c0ded72c8797972c2ea1c6e3efb292208c2a96f6053989ce0261ae301e2b99af79e2e1edd834be4038947069b4def209f1c07f78e241ca31f27f471f291633c165cff14b93cec61ae9a7e5bfa89aa9d2afd5364ee49a6d9208b66e69508fa5f19ddd2684eead7ce8fdfd88ff60e98aa8436c90c540fb392c2e04715e58e71c118bf2baad22aca6305c32cd98b6e4ff9c81794c1f9eaa74f959264f348283b52193c6c26862a95fc3ebfa3dae5817fbd422ea758eaf777984a04c9d82a3fbfcd3aae34757e618d13f75b2c39854c5ef0fa9ed2dae168e41efde0bdee9b997b351fefd5828674fae78e401e5c5f8c24b8076fee1471d02a528c4cf85ec9d5d3e03ed9c1b910f11f566f5fbed696f0f2599685f8b784b343d2aa805cdab1d7c44be7daa6099cf7f02b423d7cd7afc43931154d494aae0dec9058f7ac74d4f227c8c25dae6cb77f66a69699aef5e4c6fdadf4db4c7292781eb67c962ad0ec2418ea93d76f0328a4e334549036a04e8573e9b712e84c98457b5d3682eb0cee1fd869b7ea08aeaccb780ea1d9cd77e023355e4c0a92415f0489d983ee3ac3ca81a26bfc676e7f73e37dddec10151f981147c4a021b99072daaeb1c85f60ad15791c82363a2bcfbdcc2397e53eb23c42e311a2e9497a391ae15db14924c2b3f995adb9dd9c745665d95d1e49e3780298ce8f2128bfad51cbdf0235e3b0c77c4c8073f84fa13adc3a6d612ada2455bc3c693dac1c55592f464d629222309ab9cfe2a89d4941b1542aee37643b017e72eeb6dfd2ca393b819095df9ea98be7c3021bccfca9b7f4d288d5f8071eb5c37aa9b7b2c3faa6051cb191257d0a86bb7457e17d09bbe24e14fc0bead190990459cc054621bd3d36df56b131d35a7f834882f8106b87e531b5dfd4298ed67d89864acd407775cfd186c2c97e9736965bb019436f4bbb3b1f5b7e3b663874024a254d651ecd594fcc4cb91acc9e6942f6ba18927051a2729a087b5a993e81a0ef66abbe13a0c8ff368fdf615ee6782c5497cac4b42a5204e44c53d544538465fe4e12398f65c1626e7e411d28f2b0bed6b02ac410985d94d6237c51db30e5978bbd0dcc3dc626e70a25c3b205bb3f940c8ffbec26685a40cac780d35169ed5e6a20062ed3932c2c2c92bd0f0d2554e8e00a1c69ebffb2afbbc1f69b8d6deec7e8375f36c3c45c87cc66b2b338845407148d407da7f1adbc6f161dc0f784ccb96d42655a3b038fb499c2c84fde9561fd63c62190513dfc5346c3d746ec7410c757230ccc2935b8d12fdfb3cc74728682e26e88729602c5242c990629700520e58c308706f1641707bda1c38cf1d2ce9ee32659564fb294c842f4f1ac4f213e9ff3353f9c7c27748acf224df6a7dfb17cadcd868427db8ac19de34b477ff0c0359434cb00230034f4464340ddbed841bf39b8dfb4a58bdd2fe1d261befb0502c5ce7ed17298c0ca1725590e1b13a3905634a1361a4e640042a6c7e1f749eae9e1d05f730d8f1fb1c489d5b8ee94aa9eb00263c5a3d8b13f9072927c0a2d5708cceb88d89b8b14af6ff1879108c1711eb63424b7d32f1375976406d413ee02a8b9c340e68e29c44706ebb563806329b567633d250de784554108b4b0ffb419a6d060527d01631b6737e4d769a6e585fff89a694ec9b8d2edada3b8b5bbd3833849fd9c163b4680b8ca30de3a3b968a9bec59e411f410bd46651ca9bdbe6e926bd2e8bf3b9f87fcefdba799a6237f99a0b1d8762d5ff8041ca630aef667858e4d4af2f89ac6fb9d9b6c5860bcc9deb6871bf5bd882a5bde3b444fc48eb71622da8be4772dfe820edb997c9aed2e5d6458097fe71141d43b43541fa0a3a749a5447fbcd06f49bb076336c2763940ddc2173e89ab242737d114a600ddbafd3219108cfe24ad5519aa23ae0eb3af94fcde05ef8d164ce933d8a985937de96c39b708aa7341e0f599560a8fcd37b8d9cf2da6b539bf3d1cf6741511ce7c88c4ea50782f87696c08a11", &(0x7f0000000540)="3b5c3be25090286ea8cbc58f125bb2309eb72e714d44dd82fe990129e156", 0x2}, 0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000002840)=0xc) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000480), &(0x7f00000004c0)=0x30) capget(&(0x7f0000000080)={0x19980330, r4}, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={r5, 0x10, &(0x7f0000000280)={&(0x7f0000000700)=""/4096, 0x1000}}, 0x10) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) readlinkat(r5, &(0x7f0000000500)='./file0\x00', &(0x7f0000001700)=""/224, 0xe0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000180)=[@transaction={0x40406300, {0x4, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x40, 0x30, &(0x7f0000000080)=[@ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x3, 0x30}, @flat={0x77682a85, 0xa, r6, 0x2}], &(0x7f00000000c0)=[0x18, 0x0, 0x18, 0x30, 0x48, 0x20]}}], 0x0, 0x0, 0x0}) 09:39:25 executing program 4: removexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'trusted.', 'em1,{/md5sum\x00'}) removexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@random={'btrfs.', 'vmnet0em0\x00'}) utime(0x0, 0xfffffffffffffffe) [ 820.151483] binder: 5711:5767 BC_ACQUIRE_DONE node 1069 has no pending acquire request [ 820.160301] binder: release 5711:5714 transaction 1053 out, still active [ 820.171432] binder: release 5711:5766 transaction 1068 out, still active [ 820.184397] binder: unexpected work type, 4, not freed [ 820.195870] binder: undelivered TRANSACTION_COMPLETE [ 820.235156] binder: 5774:5784 ioctl c018620b 0 returned -14 [ 820.242511] binder: 5778:5786 ioctl c018620b 0 returned -14 09:39:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 09:39:25 executing program 3: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0xfde4, 0x0, &(0x7f0000000580)="6b3449b8371cee8f58f703b3aaaf93450901f7574ff4e1f3844080fc33b67577312570bd1146a0932dd80be807765695a9387a2a65197c3bc02db2d8da32b6650b781dfc26aaa12c3184d2c2fcb1ee9f6955fe52df5eaeb98776063939c3332d8cb389f565435dcb1ce940f62714753e5245566ca5249916457087fd7ad525c2f17ff26cba964af403b884ffb0b7298067cf15e24cbc2e86ec1e2c30b9ccfd961139d02f02c998143bce807659b0fdbf897ffbb7bcc2b3eba6595d72141b359cee352172fa295428d403824403eedd7206803ec0dac2a356311555d641295a5f0aa1b47edc5adf1ff4c83b0059c821fd0068781d9009ab56ce97e0caab61d28e3c52b6d77d0c8fb27dfdf301b7ff06507c2b0d2082e445801cb7ec559ae5a782b4daacb7391f3fa3132118a21e20e4e9a796e9a4e85439eed34faae452f2e6006999b17901e09689e829af277e234e326177474773"}) r1 = fcntl$dupfd(r0, 0x406, r0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000002800)={r1, &(0x7f0000001800)="702ec6c5a7676ff89431b672d6ce41aa6dfa833bfb806cfda80eabdacf658bee994906dedf54f1d3056e45c2dbb1920c8c9b8f08dad9a3dd1038e86b7902e72203ea8e8747d12979f00027e7b422bf44e7f2be7ab11b2b1b761f5790605196be65f77e54f581b2d642f7bc5b01b952705802d1a3542ea1deb3d734404c3ca27efe3e295cf3de58b88e926c852117861cdf249faf49bef072bde7daa1dd2b30138e16faac7cd50f5767fd87728a5df33a495376997a5334f6d7bd703dcbf655be514284499161aece438bb9694fec539ae9f9015d83b88d7982c55411f3a7df1b0a67ee69d81967a3ee7296395401beb8bbe2737e19dda09bcb30ae72acf42cb63474b7375990c731e89b80fdd5a8749bafa1e893c23d78a8c9c434800beb0a0f2be4543338bb0aebf95fcb6d8ebb0be44c0b5d22147b4227f577696e170485958ed09e7de54de0231bd113ab0ed034fc78d92cb8e1a6dcca2d6fdc82c7d4168780e74b869cae1c949393af613cb6202e9f300183e309b2e9cc92991f5dd768a8347d805b56bbc75f900c73df84b1e803518c7a7c13cb5c6447410f6a7923ce85222fa1cabc6940d4b73e04928e32c616bb11cbd559ca99e80fa01cc7159d7e0cdc67735b8221ea1e9ac012a92c9f4600a3a3356b4afbfa5f48446c4ff3381602c1671d4f8fe42fd4c0f6c97459ffbf9f810dab484eca66e7f09fce4153b3185aca49e4a8b7033c6d1f3e284bf76f93809b14b01a935e74a431cb74661636ce3a6f7f70172bd67de031bdce9b69ffe1fcbf4277172e3784e26bec42452dcca1c895d9a64756f4af28e0636bd89b1d9de7fe0dffafdd47219a575c7735338c53a52b3f9fd41f509f70fce4e1b250097e83810323470708acc4a33e6d7fc6c7a4b977a60ee0d7d4ddb758125575d0efe3f543c3865a35fa98d8987978ede26bd4ebeedf14c14e3c454c646f29c48c3967b678e0aa52e6e884b6f30fce64e325f02c0d3965c0560ba0dbe0cbfb1e81680ed70eae0bc88a23009df6ce015ee6ce1e443ecd002849a2b489f2b4ca8d677954f6276117660d8056edbb9b98a69f8a134eb57bb9281e5d21cee57811599e47ee62ad40e25efcecf9132b8f7cf3414c2ee4c21f5e427b412db82fea35c4536ad0b73470ddf4cfb84fffa585cec243491aeb63aeab4f3095da725401259646ec855caa0857bf24f68f7b598ed518ccc7d3d25bb545583fa4790a35d85a4ddea728024613d2611197f868353164ec9e5b18a967d5375c0212f3a5236eabfc3ad1acf1c5d4c8225b1afbd22fc1816c79568471c5e2416ca8161db4a9ab2586bd17684cc41a97f5682a0772bc40f1f098a2c0e89ec4674601027c174aa3700a1b0453905c0ebc48ca09f56d6e79eb59f5ea1043558e096183518391aa69ae850fced26fd1b94a13f4a506fcca011e44b136ff7726c82bd4cf4e540e2bbf2d27d966a1ce5f805013f3b745306e014027f61d53caca219c6480e60a94d43e39a893874dd188f78aa83d76a175fc9b3a29fc696c921f51bf6dd8ff8c0ff66efa28c103e89bf80ff6f919977dca112343794a5e464fa58eb10fc26164afba81d9cc885f476ee60bd0d8b6b348aad6aa3e7183ace19782b72bfd388e772a2604cdcdeb7f57d8ecdeed659386f45f9166b3d9c8dc9941ca6b1c1e170b43dc359b9a1c8a173d837fc5911eb4c9b0751121e1581310bd938b63eeb646079b04569ef342fa172642ebc10b6e4fadc61f56b82336d2c0bdca366aef941ca7c14e80c3efbc48d8df5407dbe93e5b1c2a1b0b225791f1e4b9c04fe57b995039f26b6bf3c6aa7d19ec7758d01a11bc5304481efa24114cca92ae07c541a71e939325fb6a1fc18f05f46278d5e9268880840063d59c1f77b1cc8b9f8920d34af1ff9429c629a2a3516094f337b7cded2fec48aa8f159ab2d5519e17b23715573b656243237ce1c038c0f49088edaefbbc75903e36751b19b6440a8e444e4b1ae46c77950b6e91db536415085fabfab6878e1caff5c61016066abb86982e1efb6df94960b7fcfac54d39444a212b4115a6879c6b0bb466e35de99839c41ed0c22dd3e54d6b6ebf003b1203a75ec5004e3e70d135bb8a919d12c18e18231d0d804252e98e01b45e087eb1839ffe8d4aae1879f010012f6912cc4aa4364848915479d0d3c730a914a95a317edbe7dbe4c458acafab5de45e4d3d018b3bc0171c13396b4feb8e0540159f5aeebdc40d0bb01401019fe7c315aba04849f182366c780c122e6a115baced49219d45ea9c157951eec995470adad8a2c9865c1e0b861b413e1808d8b6ef0053a3b11f68c52bcd9d6bd464834a73ff14038a152ced6e94055049ce77df09a36688cd0218ec8bc1bb596813d0356bfb48e58367c8cc83fa4397858baa1d8813ffa263ca7d9148b678380b6da43047590c9ddfd2fb31eea27955411e45d83cc62accd0a4099dd5840bd8a9908cddf16ce1d394bbd25cfd8fc56996d502887610f5ebad6c0589b09475a2e35041db7c3aa2bf7befbb1da456f1f4af8baa1dba805050ca69c867fd5b04efe1f4a989bc2466eebce2ca9e21eb605c034d9f9fde767380ed4d462e66c9da59c1070fc5d800d36a9059ad582ab2716281c48ea30bed8af44f25dac09289a2281d50c1a34d90a6097083c083ed4f6cbc59bc5cf288f3c51921577730c8da208a5c132de903b99202ab76600fe4bf60c3673e8344da78f3767c60fe5375ef1806b31e6a9657ba70f2275623ec377dc14f822f3d72d8bd5bdcd8ba1e95b9b3e78c4214a144d05d659eba160293e9831bdb7b2eea85f1801a012d67c0a92caa170a94789461f1f20a345a15f254b7b9f0836db5ff1eb945d0f7dbf466cd12851ee2198c9b139f7d7bb072459b24841e8dbf039b4c3ca1ca74e6099d1afc324bdd8e60bb3f1001186ae9898f87992a2a2eea3d4d636989f8366a951ba7caec605c3192bed8303df1380198106b54afa91bc4e7c3bb6dce56b156098ee6f806422c617283f4f7b5d8382e2b986e6c150c5975ef4efad54da7c125e5585fa44745fc1b68b6a1bb3fc5f45055e16f934401456f76eb196dffa21381c06f846cc0f8c061624e0199ef7ac13d67fe976bcb82014771c57a1784a0dc0e3812f33866886b8ae5ca3a174a7a86e239f7c6a5b1fbf1ff941acb9044240117bd22dc2d6086eff03ffe785e850584a5165a542f3e32fb60d80c579d04587bd73773027e16731259963dea6a1a012a535ea3c0eac8561ca46ec3a923269f1fdf7aefd7e3dafd57982ca7cb9495ad6753b905ce089eaca11fada5937bd72be43a8d922c5d1d3502d87ac92a55d56bcbcb256877a55ab1c9f30694474e4132dce56e9e991ce9254bff14299e37a870162d45c4ac8b4ef837dced1da0ae7805280298f3006bc71afb3b6a99d8b6fab3957e07aff68090a7a2ff6807567f31b345e19d9c10d55c1e5a077685b1f16dd20ca4da6dc8ae1e315b4226f1f20d86796e106342bf29f46eaa1f983369c7a72aaa4d91f895e088d245c54741bdc20b0f94a839b0288e7fd1854d13c104ce4ad727ac8d1e32c1ecc049572ec34352d6787c000515adca1e5739af7f42a2ae58744ba32e5a5f39fcd7c39488d3b0c22876de030e7d397a9dafe25fb90f0779808c3ddaf67c82c167f6d8d2c7172dbd14afaf95ba79affbb2b5b635974106856ee1603f4f80e7e4160eb8708e79e7e49aa563a7bf8b368a2a7994e27fa1a8e6ccbde24e2b09c21e3a77e44e9a60653f011c5620ca60c0ded72c8797972c2ea1c6e3efb292208c2a96f6053989ce0261ae301e2b99af79e2e1edd834be4038947069b4def209f1c07f78e241ca31f27f471f291633c165cff14b93cec61ae9a7e5bfa89aa9d2afd5364ee49a6d9208b66e69508fa5f19ddd2684eead7ce8fdfd88ff60e98aa8436c90c540fb392c2e04715e58e71c118bf2baad22aca6305c32cd98b6e4ff9c81794c1f9eaa74f959264f348283b52193c6c26862a95fc3ebfa3dae5817fbd422ea758eaf777984a04c9d82a3fbfcd3aae34757e618d13f75b2c39854c5ef0fa9ed2dae168e41efde0bdee9b997b351fefd5828674fae78e401e5c5f8c24b8076fee1471d02a528c4cf85ec9d5d3e03ed9c1b910f11f566f5fbed696f0f2599685f8b784b343d2aa805cdab1d7c44be7daa6099cf7f02b423d7cd7afc43931154d494aae0dec9058f7ac74d4f227c8c25dae6cb77f66a69699aef5e4c6fdadf4db4c7292781eb67c962ad0ec2418ea93d76f0328a4e334549036a04e8573e9b712e84c98457b5d3682eb0cee1fd869b7ea08aeaccb780ea1d9cd77e023355e4c0a92415f0489d983ee3ac3ca81a26bfc676e7f73e37dddec10151f981147c4a021b99072daaeb1c85f60ad15791c82363a2bcfbdcc2397e53eb23c42e311a2e9497a391ae15db14924c2b3f995adb9dd9c745665d95d1e49e3780298ce8f2128bfad51cbdf0235e3b0c77c4c8073f84fa13adc3a6d612ada2455bc3c693dac1c55592f464d629222309ab9cfe2a89d4941b1542aee37643b017e72eeb6dfd2ca393b819095df9ea98be7c3021bccfca9b7f4d288d5f8071eb5c37aa9b7b2c3faa6051cb191257d0a86bb7457e17d09bbe24e14fc0bead190990459cc054621bd3d36df56b131d35a7f834882f8106b87e531b5dfd4298ed67d89864acd407775cfd186c2c97e9736965bb019436f4bbb3b1f5b7e3b663874024a254d651ecd594fcc4cb91acc9e6942f6ba18927051a2729a087b5a993e81a0ef66abbe13a0c8ff368fdf615ee6782c5497cac4b42a5204e44c53d544538465fe4e12398f65c1626e7e411d28f2b0bed6b02ac410985d94d6237c51db30e5978bbd0dcc3dc626e70a25c3b205bb3f940c8ffbec26685a40cac780d35169ed5e6a20062ed3932c2c2c92bd0f0d2554e8e00a1c69ebffb2afbbc1f69b8d6deec7e8375f36c3c45c87cc66b2b338845407148d407da7f1adbc6f161dc0f784ccb96d42655a3b038fb499c2c84fde9561fd63c62190513dfc5346c3d746ec7410c757230ccc2935b8d12fdfb3cc74728682e26e88729602c5242c990629700520e58c308706f1641707bda1c38cf1d2ce9ee32659564fb294c842f4f1ac4f213e9ff3353f9c7c27748acf224df6a7dfb17cadcd868427db8ac19de34b477ff0c0359434cb00230034f4464340ddbed841bf39b8dfb4a58bdd2fe1d261befb0502c5ce7ed17298c0ca1725590e1b13a3905634a1361a4e640042a6c7e1f749eae9e1d05f730d8f1fb1c489d5b8ee94aa9eb00263c5a3d8b13f9072927c0a2d5708cceb88d89b8b14af6ff1879108c1711eb63424b7d32f1375976406d413ee02a8b9c340e68e29c44706ebb563806329b567633d250de784554108b4b0ffb419a6d060527d01631b6737e4d769a6e585fff89a694ec9b8d2edada3b8b5bbd3833849fd9c163b4680b8ca30de3a3b968a9bec59e411f410bd46651ca9bdbe6e926bd2e8bf3b9f87fcefdba799a6237f99a0b1d8762d5ff8041ca630aef667858e4d4af2f89ac6fb9d9b6c5860bcc9deb6871bf5bd882a5bde3b444fc48eb71622da8be4772dfe820edb997c9aed2e5d6458097fe71141d43b43541fa0a3a749a5447fbcd06f49bb076336c2763940ddc2173e89ab242737d114a600ddbafd3219108cfe24ad5519aa23ae0eb3af94fcde05ef8d164ce933d8a985937de96c39b708aa7341e0f599560a8fcd37b8d9cf2da6b539bf3d1cf6741511ce7c88c4ea50782f87696c08a11", &(0x7f0000000540)="3b5c3be25090286ea8cbc58f125bb2309eb72e714d44dd82fe990129e156", 0x2}, 0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000002840)=0xc) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000480), &(0x7f00000004c0)=0x30) capget(&(0x7f0000000080)={0x19980330, r4}, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={r5, 0x10, &(0x7f0000000280)={&(0x7f0000000700)=""/4096, 0x1000}}, 0x10) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) readlinkat(r5, &(0x7f0000000500)='./file0\x00', &(0x7f0000001700)=""/224, 0xe0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000180)=[@transaction={0x40406300, {0x4, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x40, 0x30, &(0x7f0000000080)=[@ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x3, 0x30}, @flat={0x77682a85, 0xa, r6, 0x2}], &(0x7f00000000c0)=[0x18, 0x0, 0x18, 0x30, 0x48, 0x20]}}], 0x0, 0x0, 0x0}) [ 820.293218] binder: 5774:5784 ioctl c018620b 0 returned -14 [ 820.296207] binder: 5778:5791 unknown command -1498281119 [ 820.296216] binder: 5778:5791 ioctl c0306201 200003c0 returned -22 [ 820.319114] binder: 5747:5759 ioctl c018620b 0 returned -14 [ 820.325903] binder: release 5747:5759 transaction 1062 out, still active [ 820.333739] binder: release 5747:5759 transaction 1080 out, still active 09:39:25 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.origin\x00', &(0x7f0000000100)='y\x00', 0x2, 0x3) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:39:25 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='oom_score_adj\x00') ioctl$KDMKTONE(r0, 0x4b30, 0x6) 09:39:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="301f000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 820.348051] binder: unexpected work type, 4, not freed [ 820.365086] binder: undelivered TRANSACTION_COMPLETE [ 820.372585] binder: 5802:5807 ioctl c018620b 0 returned -14 [ 820.408707] binder: 5809:5810 ioctl c018620b 0 returned -14 [ 820.431007] binder: 5802:5807 ioctl c018620b 0 returned -14 [ 820.432543] binder: release 5802:5816 transaction 1083 out, still active [ 820.444189] binder: release 5802:5816 transaction 1086 out, still active [ 820.454703] binder: unexpected work type, 4, not freed [ 820.464741] binder: undelivered TRANSACTION_COMPLETE 09:39:26 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x20) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000001540)={0x0, @multicast2, @local}, &(0x7f0000001580)=0xc) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f00000015c0)={@loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, r1}, 0xc) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, 0x0) r3 = getpgid(0xffffffffffffffff) r4 = dup(r2) perf_event_open(&(0x7f0000000040)={0x5, 0x70, 0x8, 0x10001, 0x54, 0xffffffffffffff12, 0x0, 0x81, 0x40004, 0x5, 0xfffffffffffffffb, 0x7546, 0x9, 0x7, 0x2, 0x401, 0x7ff, 0x6a2b, 0x5, 0x10000, 0xfff, 0x7, 0x4, 0x101, 0x9, 0x2, 0x759e, 0x0, 0x9, 0x4, 0xadd, 0xf9, 0x401, 0x100000001, 0x1448, 0x5, 0x6, 0x7, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x8}, 0x404, 0x1000, 0x3, 0x7, 0x7fff, 0x4, 0x1}, r3, 0x2, r4, 0xb) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="09631040", @ANYRES64=0x0, @ANYBLOB="6953c2a6ff5a6e6acc2026f2468ba2239c8fe5cd16c62781369776f30af146495e7fbc35d51c6b11bf5175d85d68b241deb7a1ea0b9c9a07cc846afe747c2b62a811665fddaaca47b26b06570bdfd49e9d88bc02a73947c6c54e383e7b1a8e03e36a2a443e1ca920ea64aed1dda451dde3b873fa6e530b4cb3c0f8ec8b2a43e75bca4527ef70cc3e4e588598bb690a16810315b35d9f891fe47aeeac96"], 0x0, 0x0, 0x0}) 09:39:26 executing program 3: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0xfde4, 0x0, &(0x7f0000000580)="6b3449b8371cee8f58f703b3aaaf93450901f7574ff4e1f3844080fc33b67577312570bd1146a0932dd80be807765695a9387a2a65197c3bc02db2d8da32b6650b781dfc26aaa12c3184d2c2fcb1ee9f6955fe52df5eaeb98776063939c3332d8cb389f565435dcb1ce940f62714753e5245566ca5249916457087fd7ad525c2f17ff26cba964af403b884ffb0b7298067cf15e24cbc2e86ec1e2c30b9ccfd961139d02f02c998143bce807659b0fdbf897ffbb7bcc2b3eba6595d72141b359cee352172fa295428d403824403eedd7206803ec0dac2a356311555d641295a5f0aa1b47edc5adf1ff4c83b0059c821fd0068781d9009ab56ce97e0caab61d28e3c52b6d77d0c8fb27dfdf301b7ff06507c2b0d2082e445801cb7ec559ae5a782b4daacb7391f3fa3132118a21e20e4e9a796e9a4e85439eed34faae452f2e6006999b17901e09689e829af277e234e326177474773"}) r1 = fcntl$dupfd(r0, 0x406, r0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000002800)={r1, &(0x7f0000001800)="702ec6c5a7676ff89431b672d6ce41aa6dfa833bfb806cfda80eabdacf658bee994906dedf54f1d3056e45c2dbb1920c8c9b8f08dad9a3dd1038e86b7902e72203ea8e8747d12979f00027e7b422bf44e7f2be7ab11b2b1b761f5790605196be65f77e54f581b2d642f7bc5b01b952705802d1a3542ea1deb3d734404c3ca27efe3e295cf3de58b88e926c852117861cdf249faf49bef072bde7daa1dd2b30138e16faac7cd50f5767fd87728a5df33a495376997a5334f6d7bd703dcbf655be514284499161aece438bb9694fec539ae9f9015d83b88d7982c55411f3a7df1b0a67ee69d81967a3ee7296395401beb8bbe2737e19dda09bcb30ae72acf42cb63474b7375990c731e89b80fdd5a8749bafa1e893c23d78a8c9c434800beb0a0f2be4543338bb0aebf95fcb6d8ebb0be44c0b5d22147b4227f577696e170485958ed09e7de54de0231bd113ab0ed034fc78d92cb8e1a6dcca2d6fdc82c7d4168780e74b869cae1c949393af613cb6202e9f300183e309b2e9cc92991f5dd768a8347d805b56bbc75f900c73df84b1e803518c7a7c13cb5c6447410f6a7923ce85222fa1cabc6940d4b73e04928e32c616bb11cbd559ca99e80fa01cc7159d7e0cdc67735b8221ea1e9ac012a92c9f4600a3a3356b4afbfa5f48446c4ff3381602c1671d4f8fe42fd4c0f6c97459ffbf9f810dab484eca66e7f09fce4153b3185aca49e4a8b7033c6d1f3e284bf76f93809b14b01a935e74a431cb74661636ce3a6f7f70172bd67de031bdce9b69ffe1fcbf4277172e3784e26bec42452dcca1c895d9a64756f4af28e0636bd89b1d9de7fe0dffafdd47219a575c7735338c53a52b3f9fd41f509f70fce4e1b250097e83810323470708acc4a33e6d7fc6c7a4b977a60ee0d7d4ddb758125575d0efe3f543c3865a35fa98d8987978ede26bd4ebeedf14c14e3c454c646f29c48c3967b678e0aa52e6e884b6f30fce64e325f02c0d3965c0560ba0dbe0cbfb1e81680ed70eae0bc88a23009df6ce015ee6ce1e443ecd002849a2b489f2b4ca8d677954f6276117660d8056edbb9b98a69f8a134eb57bb9281e5d21cee57811599e47ee62ad40e25efcecf9132b8f7cf3414c2ee4c21f5e427b412db82fea35c4536ad0b73470ddf4cfb84fffa585cec243491aeb63aeab4f3095da725401259646ec855caa0857bf24f68f7b598ed518ccc7d3d25bb545583fa4790a35d85a4ddea728024613d2611197f868353164ec9e5b18a967d5375c0212f3a5236eabfc3ad1acf1c5d4c8225b1afbd22fc1816c79568471c5e2416ca8161db4a9ab2586bd17684cc41a97f5682a0772bc40f1f098a2c0e89ec4674601027c174aa3700a1b0453905c0ebc48ca09f56d6e79eb59f5ea1043558e096183518391aa69ae850fced26fd1b94a13f4a506fcca011e44b136ff7726c82bd4cf4e540e2bbf2d27d966a1ce5f805013f3b745306e014027f61d53caca219c6480e60a94d43e39a893874dd188f78aa83d76a175fc9b3a29fc696c921f51bf6dd8ff8c0ff66efa28c103e89bf80ff6f919977dca112343794a5e464fa58eb10fc26164afba81d9cc885f476ee60bd0d8b6b348aad6aa3e7183ace19782b72bfd388e772a2604cdcdeb7f57d8ecdeed659386f45f9166b3d9c8dc9941ca6b1c1e170b43dc359b9a1c8a173d837fc5911eb4c9b0751121e1581310bd938b63eeb646079b04569ef342fa172642ebc10b6e4fadc61f56b82336d2c0bdca366aef941ca7c14e80c3efbc48d8df5407dbe93e5b1c2a1b0b225791f1e4b9c04fe57b995039f26b6bf3c6aa7d19ec7758d01a11bc5304481efa24114cca92ae07c541a71e939325fb6a1fc18f05f46278d5e9268880840063d59c1f77b1cc8b9f8920d34af1ff9429c629a2a3516094f337b7cded2fec48aa8f159ab2d5519e17b23715573b656243237ce1c038c0f49088edaefbbc75903e36751b19b6440a8e444e4b1ae46c77950b6e91db536415085fabfab6878e1caff5c61016066abb86982e1efb6df94960b7fcfac54d39444a212b4115a6879c6b0bb466e35de99839c41ed0c22dd3e54d6b6ebf003b1203a75ec5004e3e70d135bb8a919d12c18e18231d0d804252e98e01b45e087eb1839ffe8d4aae1879f010012f6912cc4aa4364848915479d0d3c730a914a95a317edbe7dbe4c458acafab5de45e4d3d018b3bc0171c13396b4feb8e0540159f5aeebdc40d0bb01401019fe7c315aba04849f182366c780c122e6a115baced49219d45ea9c157951eec995470adad8a2c9865c1e0b861b413e1808d8b6ef0053a3b11f68c52bcd9d6bd464834a73ff14038a152ced6e94055049ce77df09a36688cd0218ec8bc1bb596813d0356bfb48e58367c8cc83fa4397858baa1d8813ffa263ca7d9148b678380b6da43047590c9ddfd2fb31eea27955411e45d83cc62accd0a4099dd5840bd8a9908cddf16ce1d394bbd25cfd8fc56996d502887610f5ebad6c0589b09475a2e35041db7c3aa2bf7befbb1da456f1f4af8baa1dba805050ca69c867fd5b04efe1f4a989bc2466eebce2ca9e21eb605c034d9f9fde767380ed4d462e66c9da59c1070fc5d800d36a9059ad582ab2716281c48ea30bed8af44f25dac09289a2281d50c1a34d90a6097083c083ed4f6cbc59bc5cf288f3c51921577730c8da208a5c132de903b99202ab76600fe4bf60c3673e8344da78f3767c60fe5375ef1806b31e6a9657ba70f2275623ec377dc14f822f3d72d8bd5bdcd8ba1e95b9b3e78c4214a144d05d659eba160293e9831bdb7b2eea85f1801a012d67c0a92caa170a94789461f1f20a345a15f254b7b9f0836db5ff1eb945d0f7dbf466cd12851ee2198c9b139f7d7bb072459b24841e8dbf039b4c3ca1ca74e6099d1afc324bdd8e60bb3f1001186ae9898f87992a2a2eea3d4d636989f8366a951ba7caec605c3192bed8303df1380198106b54afa91bc4e7c3bb6dce56b156098ee6f806422c617283f4f7b5d8382e2b986e6c150c5975ef4efad54da7c125e5585fa44745fc1b68b6a1bb3fc5f45055e16f934401456f76eb196dffa21381c06f846cc0f8c061624e0199ef7ac13d67fe976bcb82014771c57a1784a0dc0e3812f33866886b8ae5ca3a174a7a86e239f7c6a5b1fbf1ff941acb9044240117bd22dc2d6086eff03ffe785e850584a5165a542f3e32fb60d80c579d04587bd73773027e16731259963dea6a1a012a535ea3c0eac8561ca46ec3a923269f1fdf7aefd7e3dafd57982ca7cb9495ad6753b905ce089eaca11fada5937bd72be43a8d922c5d1d3502d87ac92a55d56bcbcb256877a55ab1c9f30694474e4132dce56e9e991ce9254bff14299e37a870162d45c4ac8b4ef837dced1da0ae7805280298f3006bc71afb3b6a99d8b6fab3957e07aff68090a7a2ff6807567f31b345e19d9c10d55c1e5a077685b1f16dd20ca4da6dc8ae1e315b4226f1f20d86796e106342bf29f46eaa1f983369c7a72aaa4d91f895e088d245c54741bdc20b0f94a839b0288e7fd1854d13c104ce4ad727ac8d1e32c1ecc049572ec34352d6787c000515adca1e5739af7f42a2ae58744ba32e5a5f39fcd7c39488d3b0c22876de030e7d397a9dafe25fb90f0779808c3ddaf67c82c167f6d8d2c7172dbd14afaf95ba79affbb2b5b635974106856ee1603f4f80e7e4160eb8708e79e7e49aa563a7bf8b368a2a7994e27fa1a8e6ccbde24e2b09c21e3a77e44e9a60653f011c5620ca60c0ded72c8797972c2ea1c6e3efb292208c2a96f6053989ce0261ae301e2b99af79e2e1edd834be4038947069b4def209f1c07f78e241ca31f27f471f291633c165cff14b93cec61ae9a7e5bfa89aa9d2afd5364ee49a6d9208b66e69508fa5f19ddd2684eead7ce8fdfd88ff60e98aa8436c90c540fb392c2e04715e58e71c118bf2baad22aca6305c32cd98b6e4ff9c81794c1f9eaa74f959264f348283b52193c6c26862a95fc3ebfa3dae5817fbd422ea758eaf777984a04c9d82a3fbfcd3aae34757e618d13f75b2c39854c5ef0fa9ed2dae168e41efde0bdee9b997b351fefd5828674fae78e401e5c5f8c24b8076fee1471d02a528c4cf85ec9d5d3e03ed9c1b910f11f566f5fbed696f0f2599685f8b784b343d2aa805cdab1d7c44be7daa6099cf7f02b423d7cd7afc43931154d494aae0dec9058f7ac74d4f227c8c25dae6cb77f66a69699aef5e4c6fdadf4db4c7292781eb67c962ad0ec2418ea93d76f0328a4e334549036a04e8573e9b712e84c98457b5d3682eb0cee1fd869b7ea08aeaccb780ea1d9cd77e023355e4c0a92415f0489d983ee3ac3ca81a26bfc676e7f73e37dddec10151f981147c4a021b99072daaeb1c85f60ad15791c82363a2bcfbdcc2397e53eb23c42e311a2e9497a391ae15db14924c2b3f995adb9dd9c745665d95d1e49e3780298ce8f2128bfad51cbdf0235e3b0c77c4c8073f84fa13adc3a6d612ada2455bc3c693dac1c55592f464d629222309ab9cfe2a89d4941b1542aee37643b017e72eeb6dfd2ca393b819095df9ea98be7c3021bccfca9b7f4d288d5f8071eb5c37aa9b7b2c3faa6051cb191257d0a86bb7457e17d09bbe24e14fc0bead190990459cc054621bd3d36df56b131d35a7f834882f8106b87e531b5dfd4298ed67d89864acd407775cfd186c2c97e9736965bb019436f4bbb3b1f5b7e3b663874024a254d651ecd594fcc4cb91acc9e6942f6ba18927051a2729a087b5a993e81a0ef66abbe13a0c8ff368fdf615ee6782c5497cac4b42a5204e44c53d544538465fe4e12398f65c1626e7e411d28f2b0bed6b02ac410985d94d6237c51db30e5978bbd0dcc3dc626e70a25c3b205bb3f940c8ffbec26685a40cac780d35169ed5e6a20062ed3932c2c2c92bd0f0d2554e8e00a1c69ebffb2afbbc1f69b8d6deec7e8375f36c3c45c87cc66b2b338845407148d407da7f1adbc6f161dc0f784ccb96d42655a3b038fb499c2c84fde9561fd63c62190513dfc5346c3d746ec7410c757230ccc2935b8d12fdfb3cc74728682e26e88729602c5242c990629700520e58c308706f1641707bda1c38cf1d2ce9ee32659564fb294c842f4f1ac4f213e9ff3353f9c7c27748acf224df6a7dfb17cadcd868427db8ac19de34b477ff0c0359434cb00230034f4464340ddbed841bf39b8dfb4a58bdd2fe1d261befb0502c5ce7ed17298c0ca1725590e1b13a3905634a1361a4e640042a6c7e1f749eae9e1d05f730d8f1fb1c489d5b8ee94aa9eb00263c5a3d8b13f9072927c0a2d5708cceb88d89b8b14af6ff1879108c1711eb63424b7d32f1375976406d413ee02a8b9c340e68e29c44706ebb563806329b567633d250de784554108b4b0ffb419a6d060527d01631b6737e4d769a6e585fff89a694ec9b8d2edada3b8b5bbd3833849fd9c163b4680b8ca30de3a3b968a9bec59e411f410bd46651ca9bdbe6e926bd2e8bf3b9f87fcefdba799a6237f99a0b1d8762d5ff8041ca630aef667858e4d4af2f89ac6fb9d9b6c5860bcc9deb6871bf5bd882a5bde3b444fc48eb71622da8be4772dfe820edb997c9aed2e5d6458097fe71141d43b43541fa0a3a749a5447fbcd06f49bb076336c2763940ddc2173e89ab242737d114a600ddbafd3219108cfe24ad5519aa23ae0eb3af94fcde05ef8d164ce933d8a985937de96c39b708aa7341e0f599560a8fcd37b8d9cf2da6b539bf3d1cf6741511ce7c88c4ea50782f87696c08a11", &(0x7f0000000540)="3b5c3be25090286ea8cbc58f125bb2309eb72e714d44dd82fe990129e156", 0x2}, 0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000002840)=0xc) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000480), &(0x7f00000004c0)=0x30) capget(&(0x7f0000000080)={0x19980330, r4}, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={r5, 0x10, &(0x7f0000000280)={&(0x7f0000000700)=""/4096, 0x1000}}, 0x10) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) readlinkat(r5, &(0x7f0000000500)='./file0\x00', &(0x7f0000001700)=""/224, 0xe0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000180)=[@transaction={0x40406300, {0x4, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x40, 0x30, &(0x7f0000000080)=[@ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x3, 0x30}, @flat={0x77682a85, 0xa, r6, 0x2}], &(0x7f00000000c0)=[0x18, 0x0, 0x18, 0x30, 0x48, 0x20]}}], 0x0, 0x0, 0x0}) 09:39:26 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x4, @local, 0x8001}, 0x1c) 09:39:26 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e21, @empty}, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x91, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000040)='team_slave_1\x00', 0x3, 0x6, 0x7}) finit_module(r0, &(0x7f0000000100)='em0\x00', 0x0) 09:39:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) r1 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000000)) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000480)={0x1d4, r2, 0x706, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x4}, @TIPC_NLA_BEARER={0xbc, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xcb}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @rand_addr=0x1ff}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x800, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x5}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0x18, 0x1, @l2={'eth', 0x3a, 'team_slave_1\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @empty}}, {0x14, 0x2, @in={0x2, 0x4e20, @multicast2}}}}]}, @TIPC_NLA_LINK={0x1c, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NET={0x2c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x100}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}]}, @TIPC_NLA_LINK={0x74, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x37a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffffffffffc0}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xcc}]}]}, @TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xff}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1000}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x1d4}}, 0x1) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 821.041503] binder: 5778:5823 ioctl c018620b 0 returned -14 [ 821.047834] binder: 5778:5823 unknown command -1498281119 [ 821.053372] binder: 5778:5823 ioctl c0306201 200003c0 returned -22 [ 821.060173] binder: release 5778:5823 transaction 1092 out, still active [ 821.067535] binder: release 5778:5791 transaction 1074 out, still active 09:39:26 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) setsockopt$inet6_tcp_buf(r0, 0x6, 0xe, &(0x7f00000000c0)="2ceed25b2551bde0c6b7e8e86a83f5cd06c860e5b8e15ae365cf6ca323d839117a2ff906b7b927e3e747e5d6ea14eff9e413b00f3b34cab3c2d5c7822012d3acfb7d99406c594c2fcf7f915686ca2c7849359f827b0922808a5035e82f4982605f678166c120573e1623e0357606cb861c11f7710212c74cfac0e0d1e01a4b98fb11bb586a6bc7a49453645835d2ceabedc845d8a7cd0d1f26ea096204dfd3030416dde43fd9c7e81d64ca458e883643a0dd923a124b9813b3b6137e5b877628efb626393a70ac14aa6467dd779d0b0b1f359088da8403752912", 0xda) connect$inet6(r0, &(0x7f0000000080), 0xfffffc96) accept4$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000200)=0x14, 0x80000) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000240)={@loopback, 0x7a, r1}) 09:39:26 executing program 3: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0xfde4, 0x0, &(0x7f0000000580)="6b3449b8371cee8f58f703b3aaaf93450901f7574ff4e1f3844080fc33b67577312570bd1146a0932dd80be807765695a9387a2a65197c3bc02db2d8da32b6650b781dfc26aaa12c3184d2c2fcb1ee9f6955fe52df5eaeb98776063939c3332d8cb389f565435dcb1ce940f62714753e5245566ca5249916457087fd7ad525c2f17ff26cba964af403b884ffb0b7298067cf15e24cbc2e86ec1e2c30b9ccfd961139d02f02c998143bce807659b0fdbf897ffbb7bcc2b3eba6595d72141b359cee352172fa295428d403824403eedd7206803ec0dac2a356311555d641295a5f0aa1b47edc5adf1ff4c83b0059c821fd0068781d9009ab56ce97e0caab61d28e3c52b6d77d0c8fb27dfdf301b7ff06507c2b0d2082e445801cb7ec559ae5a782b4daacb7391f3fa3132118a21e20e4e9a796e9a4e85439eed34faae452f2e6006999b17901e09689e829af277e234e326177474773"}) r1 = fcntl$dupfd(r0, 0x406, r0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000002800)={r1, &(0x7f0000001800)="702ec6c5a7676ff89431b672d6ce41aa6dfa833bfb806cfda80eabdacf658bee994906dedf54f1d3056e45c2dbb1920c8c9b8f08dad9a3dd1038e86b7902e72203ea8e8747d12979f00027e7b422bf44e7f2be7ab11b2b1b761f5790605196be65f77e54f581b2d642f7bc5b01b952705802d1a3542ea1deb3d734404c3ca27efe3e295cf3de58b88e926c852117861cdf249faf49bef072bde7daa1dd2b30138e16faac7cd50f5767fd87728a5df33a495376997a5334f6d7bd703dcbf655be514284499161aece438bb9694fec539ae9f9015d83b88d7982c55411f3a7df1b0a67ee69d81967a3ee7296395401beb8bbe2737e19dda09bcb30ae72acf42cb63474b7375990c731e89b80fdd5a8749bafa1e893c23d78a8c9c434800beb0a0f2be4543338bb0aebf95fcb6d8ebb0be44c0b5d22147b4227f577696e170485958ed09e7de54de0231bd113ab0ed034fc78d92cb8e1a6dcca2d6fdc82c7d4168780e74b869cae1c949393af613cb6202e9f300183e309b2e9cc92991f5dd768a8347d805b56bbc75f900c73df84b1e803518c7a7c13cb5c6447410f6a7923ce85222fa1cabc6940d4b73e04928e32c616bb11cbd559ca99e80fa01cc7159d7e0cdc67735b8221ea1e9ac012a92c9f4600a3a3356b4afbfa5f48446c4ff3381602c1671d4f8fe42fd4c0f6c97459ffbf9f810dab484eca66e7f09fce4153b3185aca49e4a8b7033c6d1f3e284bf76f93809b14b01a935e74a431cb74661636ce3a6f7f70172bd67de031bdce9b69ffe1fcbf4277172e3784e26bec42452dcca1c895d9a64756f4af28e0636bd89b1d9de7fe0dffafdd47219a575c7735338c53a52b3f9fd41f509f70fce4e1b250097e83810323470708acc4a33e6d7fc6c7a4b977a60ee0d7d4ddb758125575d0efe3f543c3865a35fa98d8987978ede26bd4ebeedf14c14e3c454c646f29c48c3967b678e0aa52e6e884b6f30fce64e325f02c0d3965c0560ba0dbe0cbfb1e81680ed70eae0bc88a23009df6ce015ee6ce1e443ecd002849a2b489f2b4ca8d677954f6276117660d8056edbb9b98a69f8a134eb57bb9281e5d21cee57811599e47ee62ad40e25efcecf9132b8f7cf3414c2ee4c21f5e427b412db82fea35c4536ad0b73470ddf4cfb84fffa585cec243491aeb63aeab4f3095da725401259646ec855caa0857bf24f68f7b598ed518ccc7d3d25bb545583fa4790a35d85a4ddea728024613d2611197f868353164ec9e5b18a967d5375c0212f3a5236eabfc3ad1acf1c5d4c8225b1afbd22fc1816c79568471c5e2416ca8161db4a9ab2586bd17684cc41a97f5682a0772bc40f1f098a2c0e89ec4674601027c174aa3700a1b0453905c0ebc48ca09f56d6e79eb59f5ea1043558e096183518391aa69ae850fced26fd1b94a13f4a506fcca011e44b136ff7726c82bd4cf4e540e2bbf2d27d966a1ce5f805013f3b745306e014027f61d53caca219c6480e60a94d43e39a893874dd188f78aa83d76a175fc9b3a29fc696c921f51bf6dd8ff8c0ff66efa28c103e89bf80ff6f919977dca112343794a5e464fa58eb10fc26164afba81d9cc885f476ee60bd0d8b6b348aad6aa3e7183ace19782b72bfd388e772a2604cdcdeb7f57d8ecdeed659386f45f9166b3d9c8dc9941ca6b1c1e170b43dc359b9a1c8a173d837fc5911eb4c9b0751121e1581310bd938b63eeb646079b04569ef342fa172642ebc10b6e4fadc61f56b82336d2c0bdca366aef941ca7c14e80c3efbc48d8df5407dbe93e5b1c2a1b0b225791f1e4b9c04fe57b995039f26b6bf3c6aa7d19ec7758d01a11bc5304481efa24114cca92ae07c541a71e939325fb6a1fc18f05f46278d5e9268880840063d59c1f77b1cc8b9f8920d34af1ff9429c629a2a3516094f337b7cded2fec48aa8f159ab2d5519e17b23715573b656243237ce1c038c0f49088edaefbbc75903e36751b19b6440a8e444e4b1ae46c77950b6e91db536415085fabfab6878e1caff5c61016066abb86982e1efb6df94960b7fcfac54d39444a212b4115a6879c6b0bb466e35de99839c41ed0c22dd3e54d6b6ebf003b1203a75ec5004e3e70d135bb8a919d12c18e18231d0d804252e98e01b45e087eb1839ffe8d4aae1879f010012f6912cc4aa4364848915479d0d3c730a914a95a317edbe7dbe4c458acafab5de45e4d3d018b3bc0171c13396b4feb8e0540159f5aeebdc40d0bb01401019fe7c315aba04849f182366c780c122e6a115baced49219d45ea9c157951eec995470adad8a2c9865c1e0b861b413e1808d8b6ef0053a3b11f68c52bcd9d6bd464834a73ff14038a152ced6e94055049ce77df09a36688cd0218ec8bc1bb596813d0356bfb48e58367c8cc83fa4397858baa1d8813ffa263ca7d9148b678380b6da43047590c9ddfd2fb31eea27955411e45d83cc62accd0a4099dd5840bd8a9908cddf16ce1d394bbd25cfd8fc56996d502887610f5ebad6c0589b09475a2e35041db7c3aa2bf7befbb1da456f1f4af8baa1dba805050ca69c867fd5b04efe1f4a989bc2466eebce2ca9e21eb605c034d9f9fde767380ed4d462e66c9da59c1070fc5d800d36a9059ad582ab2716281c48ea30bed8af44f25dac09289a2281d50c1a34d90a6097083c083ed4f6cbc59bc5cf288f3c51921577730c8da208a5c132de903b99202ab76600fe4bf60c3673e8344da78f3767c60fe5375ef1806b31e6a9657ba70f2275623ec377dc14f822f3d72d8bd5bdcd8ba1e95b9b3e78c4214a144d05d659eba160293e9831bdb7b2eea85f1801a012d67c0a92caa170a94789461f1f20a345a15f254b7b9f0836db5ff1eb945d0f7dbf466cd12851ee2198c9b139f7d7bb072459b24841e8dbf039b4c3ca1ca74e6099d1afc324bdd8e60bb3f1001186ae9898f87992a2a2eea3d4d636989f8366a951ba7caec605c3192bed8303df1380198106b54afa91bc4e7c3bb6dce56b156098ee6f806422c617283f4f7b5d8382e2b986e6c150c5975ef4efad54da7c125e5585fa44745fc1b68b6a1bb3fc5f45055e16f934401456f76eb196dffa21381c06f846cc0f8c061624e0199ef7ac13d67fe976bcb82014771c57a1784a0dc0e3812f33866886b8ae5ca3a174a7a86e239f7c6a5b1fbf1ff941acb9044240117bd22dc2d6086eff03ffe785e850584a5165a542f3e32fb60d80c579d04587bd73773027e16731259963dea6a1a012a535ea3c0eac8561ca46ec3a923269f1fdf7aefd7e3dafd57982ca7cb9495ad6753b905ce089eaca11fada5937bd72be43a8d922c5d1d3502d87ac92a55d56bcbcb256877a55ab1c9f30694474e4132dce56e9e991ce9254bff14299e37a870162d45c4ac8b4ef837dced1da0ae7805280298f3006bc71afb3b6a99d8b6fab3957e07aff68090a7a2ff6807567f31b345e19d9c10d55c1e5a077685b1f16dd20ca4da6dc8ae1e315b4226f1f20d86796e106342bf29f46eaa1f983369c7a72aaa4d91f895e088d245c54741bdc20b0f94a839b0288e7fd1854d13c104ce4ad727ac8d1e32c1ecc049572ec34352d6787c000515adca1e5739af7f42a2ae58744ba32e5a5f39fcd7c39488d3b0c22876de030e7d397a9dafe25fb90f0779808c3ddaf67c82c167f6d8d2c7172dbd14afaf95ba79affbb2b5b635974106856ee1603f4f80e7e4160eb8708e79e7e49aa563a7bf8b368a2a7994e27fa1a8e6ccbde24e2b09c21e3a77e44e9a60653f011c5620ca60c0ded72c8797972c2ea1c6e3efb292208c2a96f6053989ce0261ae301e2b99af79e2e1edd834be4038947069b4def209f1c07f78e241ca31f27f471f291633c165cff14b93cec61ae9a7e5bfa89aa9d2afd5364ee49a6d9208b66e69508fa5f19ddd2684eead7ce8fdfd88ff60e98aa8436c90c540fb392c2e04715e58e71c118bf2baad22aca6305c32cd98b6e4ff9c81794c1f9eaa74f959264f348283b52193c6c26862a95fc3ebfa3dae5817fbd422ea758eaf777984a04c9d82a3fbfcd3aae34757e618d13f75b2c39854c5ef0fa9ed2dae168e41efde0bdee9b997b351fefd5828674fae78e401e5c5f8c24b8076fee1471d02a528c4cf85ec9d5d3e03ed9c1b910f11f566f5fbed696f0f2599685f8b784b343d2aa805cdab1d7c44be7daa6099cf7f02b423d7cd7afc43931154d494aae0dec9058f7ac74d4f227c8c25dae6cb77f66a69699aef5e4c6fdadf4db4c7292781eb67c962ad0ec2418ea93d76f0328a4e334549036a04e8573e9b712e84c98457b5d3682eb0cee1fd869b7ea08aeaccb780ea1d9cd77e023355e4c0a92415f0489d983ee3ac3ca81a26bfc676e7f73e37dddec10151f981147c4a021b99072daaeb1c85f60ad15791c82363a2bcfbdcc2397e53eb23c42e311a2e9497a391ae15db14924c2b3f995adb9dd9c745665d95d1e49e3780298ce8f2128bfad51cbdf0235e3b0c77c4c8073f84fa13adc3a6d612ada2455bc3c693dac1c55592f464d629222309ab9cfe2a89d4941b1542aee37643b017e72eeb6dfd2ca393b819095df9ea98be7c3021bccfca9b7f4d288d5f8071eb5c37aa9b7b2c3faa6051cb191257d0a86bb7457e17d09bbe24e14fc0bead190990459cc054621bd3d36df56b131d35a7f834882f8106b87e531b5dfd4298ed67d89864acd407775cfd186c2c97e9736965bb019436f4bbb3b1f5b7e3b663874024a254d651ecd594fcc4cb91acc9e6942f6ba18927051a2729a087b5a993e81a0ef66abbe13a0c8ff368fdf615ee6782c5497cac4b42a5204e44c53d544538465fe4e12398f65c1626e7e411d28f2b0bed6b02ac410985d94d6237c51db30e5978bbd0dcc3dc626e70a25c3b205bb3f940c8ffbec26685a40cac780d35169ed5e6a20062ed3932c2c2c92bd0f0d2554e8e00a1c69ebffb2afbbc1f69b8d6deec7e8375f36c3c45c87cc66b2b338845407148d407da7f1adbc6f161dc0f784ccb96d42655a3b038fb499c2c84fde9561fd63c62190513dfc5346c3d746ec7410c757230ccc2935b8d12fdfb3cc74728682e26e88729602c5242c990629700520e58c308706f1641707bda1c38cf1d2ce9ee32659564fb294c842f4f1ac4f213e9ff3353f9c7c27748acf224df6a7dfb17cadcd868427db8ac19de34b477ff0c0359434cb00230034f4464340ddbed841bf39b8dfb4a58bdd2fe1d261befb0502c5ce7ed17298c0ca1725590e1b13a3905634a1361a4e640042a6c7e1f749eae9e1d05f730d8f1fb1c489d5b8ee94aa9eb00263c5a3d8b13f9072927c0a2d5708cceb88d89b8b14af6ff1879108c1711eb63424b7d32f1375976406d413ee02a8b9c340e68e29c44706ebb563806329b567633d250de784554108b4b0ffb419a6d060527d01631b6737e4d769a6e585fff89a694ec9b8d2edada3b8b5bbd3833849fd9c163b4680b8ca30de3a3b968a9bec59e411f410bd46651ca9bdbe6e926bd2e8bf3b9f87fcefdba799a6237f99a0b1d8762d5ff8041ca630aef667858e4d4af2f89ac6fb9d9b6c5860bcc9deb6871bf5bd882a5bde3b444fc48eb71622da8be4772dfe820edb997c9aed2e5d6458097fe71141d43b43541fa0a3a749a5447fbcd06f49bb076336c2763940ddc2173e89ab242737d114a600ddbafd3219108cfe24ad5519aa23ae0eb3af94fcde05ef8d164ce933d8a985937de96c39b708aa7341e0f599560a8fcd37b8d9cf2da6b539bf3d1cf6741511ce7c88c4ea50782f87696c08a11", &(0x7f0000000540)="3b5c3be25090286ea8cbc58f125bb2309eb72e714d44dd82fe990129e156", 0x2}, 0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000002840)=0xc) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000480), &(0x7f00000004c0)=0x30) capget(&(0x7f0000000080)={0x19980330, r4}, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={r5, 0x10, &(0x7f0000000280)={&(0x7f0000000700)=""/4096, 0x1000}}, 0x10) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) readlinkat(r5, &(0x7f0000000500)='./file0\x00', &(0x7f0000001700)=""/224, 0xe0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000180)=[@transaction={0x40406300, {0x4, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x40, 0x30, &(0x7f0000000080)=[@ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x3, 0x30}, @flat={0x77682a85, 0xa, r6, 0x2}], &(0x7f00000000c0)=[0x18, 0x0, 0x18, 0x30, 0x48, 0x20]}}], 0x0, 0x0, 0x0}) 09:39:26 executing program 4: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x8001, 0x0) ioctl$KDDELIO(r0, 0x4b35, 0x9d) utime(0x0, 0xfffffffffffffffe) 09:39:26 executing program 3: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0xfde4, 0x0, &(0x7f0000000580)="6b3449b8371cee8f58f703b3aaaf93450901f7574ff4e1f3844080fc33b67577312570bd1146a0932dd80be807765695a9387a2a65197c3bc02db2d8da32b6650b781dfc26aaa12c3184d2c2fcb1ee9f6955fe52df5eaeb98776063939c3332d8cb389f565435dcb1ce940f62714753e5245566ca5249916457087fd7ad525c2f17ff26cba964af403b884ffb0b7298067cf15e24cbc2e86ec1e2c30b9ccfd961139d02f02c998143bce807659b0fdbf897ffbb7bcc2b3eba6595d72141b359cee352172fa295428d403824403eedd7206803ec0dac2a356311555d641295a5f0aa1b47edc5adf1ff4c83b0059c821fd0068781d9009ab56ce97e0caab61d28e3c52b6d77d0c8fb27dfdf301b7ff06507c2b0d2082e445801cb7ec559ae5a782b4daacb7391f3fa3132118a21e20e4e9a796e9a4e85439eed34faae452f2e6006999b17901e09689e829af277e234e326177474773"}) r1 = fcntl$dupfd(r0, 0x406, r0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000002800)={r1, &(0x7f0000001800)="702ec6c5a7676ff89431b672d6ce41aa6dfa833bfb806cfda80eabdacf658bee994906dedf54f1d3056e45c2dbb1920c8c9b8f08dad9a3dd1038e86b7902e72203ea8e8747d12979f00027e7b422bf44e7f2be7ab11b2b1b761f5790605196be65f77e54f581b2d642f7bc5b01b952705802d1a3542ea1deb3d734404c3ca27efe3e295cf3de58b88e926c852117861cdf249faf49bef072bde7daa1dd2b30138e16faac7cd50f5767fd87728a5df33a495376997a5334f6d7bd703dcbf655be514284499161aece438bb9694fec539ae9f9015d83b88d7982c55411f3a7df1b0a67ee69d81967a3ee7296395401beb8bbe2737e19dda09bcb30ae72acf42cb63474b7375990c731e89b80fdd5a8749bafa1e893c23d78a8c9c434800beb0a0f2be4543338bb0aebf95fcb6d8ebb0be44c0b5d22147b4227f577696e170485958ed09e7de54de0231bd113ab0ed034fc78d92cb8e1a6dcca2d6fdc82c7d4168780e74b869cae1c949393af613cb6202e9f300183e309b2e9cc92991f5dd768a8347d805b56bbc75f900c73df84b1e803518c7a7c13cb5c6447410f6a7923ce85222fa1cabc6940d4b73e04928e32c616bb11cbd559ca99e80fa01cc7159d7e0cdc67735b8221ea1e9ac012a92c9f4600a3a3356b4afbfa5f48446c4ff3381602c1671d4f8fe42fd4c0f6c97459ffbf9f810dab484eca66e7f09fce4153b3185aca49e4a8b7033c6d1f3e284bf76f93809b14b01a935e74a431cb74661636ce3a6f7f70172bd67de031bdce9b69ffe1fcbf4277172e3784e26bec42452dcca1c895d9a64756f4af28e0636bd89b1d9de7fe0dffafdd47219a575c7735338c53a52b3f9fd41f509f70fce4e1b250097e83810323470708acc4a33e6d7fc6c7a4b977a60ee0d7d4ddb758125575d0efe3f543c3865a35fa98d8987978ede26bd4ebeedf14c14e3c454c646f29c48c3967b678e0aa52e6e884b6f30fce64e325f02c0d3965c0560ba0dbe0cbfb1e81680ed70eae0bc88a23009df6ce015ee6ce1e443ecd002849a2b489f2b4ca8d677954f6276117660d8056edbb9b98a69f8a134eb57bb9281e5d21cee57811599e47ee62ad40e25efcecf9132b8f7cf3414c2ee4c21f5e427b412db82fea35c4536ad0b73470ddf4cfb84fffa585cec243491aeb63aeab4f3095da725401259646ec855caa0857bf24f68f7b598ed518ccc7d3d25bb545583fa4790a35d85a4ddea728024613d2611197f868353164ec9e5b18a967d5375c0212f3a5236eabfc3ad1acf1c5d4c8225b1afbd22fc1816c79568471c5e2416ca8161db4a9ab2586bd17684cc41a97f5682a0772bc40f1f098a2c0e89ec4674601027c174aa3700a1b0453905c0ebc48ca09f56d6e79eb59f5ea1043558e096183518391aa69ae850fced26fd1b94a13f4a506fcca011e44b136ff7726c82bd4cf4e540e2bbf2d27d966a1ce5f805013f3b745306e014027f61d53caca219c6480e60a94d43e39a893874dd188f78aa83d76a175fc9b3a29fc696c921f51bf6dd8ff8c0ff66efa28c103e89bf80ff6f919977dca112343794a5e464fa58eb10fc26164afba81d9cc885f476ee60bd0d8b6b348aad6aa3e7183ace19782b72bfd388e772a2604cdcdeb7f57d8ecdeed659386f45f9166b3d9c8dc9941ca6b1c1e170b43dc359b9a1c8a173d837fc5911eb4c9b0751121e1581310bd938b63eeb646079b04569ef342fa172642ebc10b6e4fadc61f56b82336d2c0bdca366aef941ca7c14e80c3efbc48d8df5407dbe93e5b1c2a1b0b225791f1e4b9c04fe57b995039f26b6bf3c6aa7d19ec7758d01a11bc5304481efa24114cca92ae07c541a71e939325fb6a1fc18f05f46278d5e9268880840063d59c1f77b1cc8b9f8920d34af1ff9429c629a2a3516094f337b7cded2fec48aa8f159ab2d5519e17b23715573b656243237ce1c038c0f49088edaefbbc75903e36751b19b6440a8e444e4b1ae46c77950b6e91db536415085fabfab6878e1caff5c61016066abb86982e1efb6df94960b7fcfac54d39444a212b4115a6879c6b0bb466e35de99839c41ed0c22dd3e54d6b6ebf003b1203a75ec5004e3e70d135bb8a919d12c18e18231d0d804252e98e01b45e087eb1839ffe8d4aae1879f010012f6912cc4aa4364848915479d0d3c730a914a95a317edbe7dbe4c458acafab5de45e4d3d018b3bc0171c13396b4feb8e0540159f5aeebdc40d0bb01401019fe7c315aba04849f182366c780c122e6a115baced49219d45ea9c157951eec995470adad8a2c9865c1e0b861b413e1808d8b6ef0053a3b11f68c52bcd9d6bd464834a73ff14038a152ced6e94055049ce77df09a36688cd0218ec8bc1bb596813d0356bfb48e58367c8cc83fa4397858baa1d8813ffa263ca7d9148b678380b6da43047590c9ddfd2fb31eea27955411e45d83cc62accd0a4099dd5840bd8a9908cddf16ce1d394bbd25cfd8fc56996d502887610f5ebad6c0589b09475a2e35041db7c3aa2bf7befbb1da456f1f4af8baa1dba805050ca69c867fd5b04efe1f4a989bc2466eebce2ca9e21eb605c034d9f9fde767380ed4d462e66c9da59c1070fc5d800d36a9059ad582ab2716281c48ea30bed8af44f25dac09289a2281d50c1a34d90a6097083c083ed4f6cbc59bc5cf288f3c51921577730c8da208a5c132de903b99202ab76600fe4bf60c3673e8344da78f3767c60fe5375ef1806b31e6a9657ba70f2275623ec377dc14f822f3d72d8bd5bdcd8ba1e95b9b3e78c4214a144d05d659eba160293e9831bdb7b2eea85f1801a012d67c0a92caa170a94789461f1f20a345a15f254b7b9f0836db5ff1eb945d0f7dbf466cd12851ee2198c9b139f7d7bb072459b24841e8dbf039b4c3ca1ca74e6099d1afc324bdd8e60bb3f1001186ae9898f87992a2a2eea3d4d636989f8366a951ba7caec605c3192bed8303df1380198106b54afa91bc4e7c3bb6dce56b156098ee6f806422c617283f4f7b5d8382e2b986e6c150c5975ef4efad54da7c125e5585fa44745fc1b68b6a1bb3fc5f45055e16f934401456f76eb196dffa21381c06f846cc0f8c061624e0199ef7ac13d67fe976bcb82014771c57a1784a0dc0e3812f33866886b8ae5ca3a174a7a86e239f7c6a5b1fbf1ff941acb9044240117bd22dc2d6086eff03ffe785e850584a5165a542f3e32fb60d80c579d04587bd73773027e16731259963dea6a1a012a535ea3c0eac8561ca46ec3a923269f1fdf7aefd7e3dafd57982ca7cb9495ad6753b905ce089eaca11fada5937bd72be43a8d922c5d1d3502d87ac92a55d56bcbcb256877a55ab1c9f30694474e4132dce56e9e991ce9254bff14299e37a870162d45c4ac8b4ef837dced1da0ae7805280298f3006bc71afb3b6a99d8b6fab3957e07aff68090a7a2ff6807567f31b345e19d9c10d55c1e5a077685b1f16dd20ca4da6dc8ae1e315b4226f1f20d86796e106342bf29f46eaa1f983369c7a72aaa4d91f895e088d245c54741bdc20b0f94a839b0288e7fd1854d13c104ce4ad727ac8d1e32c1ecc049572ec34352d6787c000515adca1e5739af7f42a2ae58744ba32e5a5f39fcd7c39488d3b0c22876de030e7d397a9dafe25fb90f0779808c3ddaf67c82c167f6d8d2c7172dbd14afaf95ba79affbb2b5b635974106856ee1603f4f80e7e4160eb8708e79e7e49aa563a7bf8b368a2a7994e27fa1a8e6ccbde24e2b09c21e3a77e44e9a60653f011c5620ca60c0ded72c8797972c2ea1c6e3efb292208c2a96f6053989ce0261ae301e2b99af79e2e1edd834be4038947069b4def209f1c07f78e241ca31f27f471f291633c165cff14b93cec61ae9a7e5bfa89aa9d2afd5364ee49a6d9208b66e69508fa5f19ddd2684eead7ce8fdfd88ff60e98aa8436c90c540fb392c2e04715e58e71c118bf2baad22aca6305c32cd98b6e4ff9c81794c1f9eaa74f959264f348283b52193c6c26862a95fc3ebfa3dae5817fbd422ea758eaf777984a04c9d82a3fbfcd3aae34757e618d13f75b2c39854c5ef0fa9ed2dae168e41efde0bdee9b997b351fefd5828674fae78e401e5c5f8c24b8076fee1471d02a528c4cf85ec9d5d3e03ed9c1b910f11f566f5fbed696f0f2599685f8b784b343d2aa805cdab1d7c44be7daa6099cf7f02b423d7cd7afc43931154d494aae0dec9058f7ac74d4f227c8c25dae6cb77f66a69699aef5e4c6fdadf4db4c7292781eb67c962ad0ec2418ea93d76f0328a4e334549036a04e8573e9b712e84c98457b5d3682eb0cee1fd869b7ea08aeaccb780ea1d9cd77e023355e4c0a92415f0489d983ee3ac3ca81a26bfc676e7f73e37dddec10151f981147c4a021b99072daaeb1c85f60ad15791c82363a2bcfbdcc2397e53eb23c42e311a2e9497a391ae15db14924c2b3f995adb9dd9c745665d95d1e49e3780298ce8f2128bfad51cbdf0235e3b0c77c4c8073f84fa13adc3a6d612ada2455bc3c693dac1c55592f464d629222309ab9cfe2a89d4941b1542aee37643b017e72eeb6dfd2ca393b819095df9ea98be7c3021bccfca9b7f4d288d5f8071eb5c37aa9b7b2c3faa6051cb191257d0a86bb7457e17d09bbe24e14fc0bead190990459cc054621bd3d36df56b131d35a7f834882f8106b87e531b5dfd4298ed67d89864acd407775cfd186c2c97e9736965bb019436f4bbb3b1f5b7e3b663874024a254d651ecd594fcc4cb91acc9e6942f6ba18927051a2729a087b5a993e81a0ef66abbe13a0c8ff368fdf615ee6782c5497cac4b42a5204e44c53d544538465fe4e12398f65c1626e7e411d28f2b0bed6b02ac410985d94d6237c51db30e5978bbd0dcc3dc626e70a25c3b205bb3f940c8ffbec26685a40cac780d35169ed5e6a20062ed3932c2c2c92bd0f0d2554e8e00a1c69ebffb2afbbc1f69b8d6deec7e8375f36c3c45c87cc66b2b338845407148d407da7f1adbc6f161dc0f784ccb96d42655a3b038fb499c2c84fde9561fd63c62190513dfc5346c3d746ec7410c757230ccc2935b8d12fdfb3cc74728682e26e88729602c5242c990629700520e58c308706f1641707bda1c38cf1d2ce9ee32659564fb294c842f4f1ac4f213e9ff3353f9c7c27748acf224df6a7dfb17cadcd868427db8ac19de34b477ff0c0359434cb00230034f4464340ddbed841bf39b8dfb4a58bdd2fe1d261befb0502c5ce7ed17298c0ca1725590e1b13a3905634a1361a4e640042a6c7e1f749eae9e1d05f730d8f1fb1c489d5b8ee94aa9eb00263c5a3d8b13f9072927c0a2d5708cceb88d89b8b14af6ff1879108c1711eb63424b7d32f1375976406d413ee02a8b9c340e68e29c44706ebb563806329b567633d250de784554108b4b0ffb419a6d060527d01631b6737e4d769a6e585fff89a694ec9b8d2edada3b8b5bbd3833849fd9c163b4680b8ca30de3a3b968a9bec59e411f410bd46651ca9bdbe6e926bd2e8bf3b9f87fcefdba799a6237f99a0b1d8762d5ff8041ca630aef667858e4d4af2f89ac6fb9d9b6c5860bcc9deb6871bf5bd882a5bde3b444fc48eb71622da8be4772dfe820edb997c9aed2e5d6458097fe71141d43b43541fa0a3a749a5447fbcd06f49bb076336c2763940ddc2173e89ab242737d114a600ddbafd3219108cfe24ad5519aa23ae0eb3af94fcde05ef8d164ce933d8a985937de96c39b708aa7341e0f599560a8fcd37b8d9cf2da6b539bf3d1cf6741511ce7c88c4ea50782f87696c08a11", &(0x7f0000000540)="3b5c3be25090286ea8cbc58f125bb2309eb72e714d44dd82fe990129e156", 0x2}, 0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000002840)=0xc) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000480), &(0x7f00000004c0)=0x30) capget(&(0x7f0000000080)={0x19980330, r4}, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={r5, 0x10, &(0x7f0000000280)={&(0x7f0000000700)=""/4096, 0x1000}}, 0x10) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) readlinkat(r5, &(0x7f0000000500)='./file0\x00', &(0x7f0000001700)=""/224, 0xe0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000180)=[@transaction={0x40406300, {0x4, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x40, 0x30, &(0x7f0000000080)=[@ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x3, 0x30}, @flat={0x77682a85, 0xa, r6, 0x2}], &(0x7f00000000c0)=[0x18, 0x0, 0x18, 0x30, 0x48, 0x20]}}], 0x0, 0x0, 0x0}) 09:39:26 executing program 3: clone(0x10000000, &(0x7f0000000080)="3d2372105cc5b14e3e9d9fb24e81df05a4bda9f3e3750a138673f6d72c443e0787eb2ec22d34cc1ec7088310cf5232260fbf40e1ddfae9b1ac3f43499413a465c7480c2ac6e1dc11761f0b4d8a9896e3589c1f9a0d41cde76ccf6a39418218b3d3898c99859e15a654536ab42ad6b5ca9ad8ec5f307c4b2e8305933ea9044fa29520bc5be41dc4d38caba1720bb50d682171af1e52eba33199237417396e299d9ebe0e07a1fa90442e82e08cd567cf16a55d6ee4b2898188fa3e4d8a86a8e799355fb660e3c5ff1a3e63a421862f0997dbec16ef9224660a957dca18c6f1958d76176988da98c8798e1ca398", &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)="22dcf845f2b4211b6476376ecea6c9793a2d5323a2ea2abd99beb63a668140503cefb18e30be4e0687d765104831f1fbaa2fc91b4ed3f443b534632e4d16bec02cb4201a2a2a384a5386bdf119bc8268db20dfb573e45931659970b197bf09718f35d5e6e8931b1ce2bfd4") r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = inotify_init1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fcntl$setown(r1, 0x8, 0xffffffffffffffff) fcntl$getownex(r1, 0x10, &(0x7f0000002bc0)={0x0, 0x0}) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000003, 0x810, r2, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0xc) ptrace$setopts(0x4204, r3, 0x8000000002, 0xa06ff1) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@local, @in=@empty}}, {{@in6=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f0000000380)=0xe8) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r4 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/policy\x00', 0x0, 0x0) gettid() openat$cgroup_int(r4, &(0x7f0000000400)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040), 0x1c) 09:39:26 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) [ 821.104100] binder: 5828:5832 ioctl c018620b 0 returned -14 [ 821.126613] binder: 5830:5834 ioctl c018620b 0 returned -14 09:39:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000002c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pipe(&(0x7f0000000040)={0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') ioctl$sock_inet_SIOCSIFBRDADDR(r1, 0x891a, &(0x7f00000003c0)={'ip6gre0\x00', {0x2, 0x4e23, @remote}}) sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x74, r2, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x6}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x4}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xb23}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x100}]}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8, 0x1}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x80}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) write$P9_RVERSION(r1, &(0x7f0000000380)={0x15, 0x65, 0xffff, 0xfffffffffffffffd, 0x8, '9P2000.L'}, 0x15) write$cgroup_subtree(r1, &(0x7f0000000480)={[{0x0, 'memory'}, {0x2b, 'io'}, {0x2a4d3bbd493be3f5, 'pids'}, {0x0, 'cpu'}, {0x2b, 'memory'}, {0x0, 'io'}, {0x2d, 'memory'}]}, 0x2b) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x23, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="7d11652c7a2fb2446d7944edffe4510989d440", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 09:39:26 executing program 3: clone(0x10000000, &(0x7f0000000080)="3d2372105cc5b14e3e9d9fb24e81df05a4bda9f3e3750a138673f6d72c443e0787eb2ec22d34cc1ec7088310cf5232260fbf40e1ddfae9b1ac3f43499413a465c7480c2ac6e1dc11761f0b4d8a9896e3589c1f9a0d41cde76ccf6a39418218b3d3898c99859e15a654536ab42ad6b5ca9ad8ec5f307c4b2e8305933ea9044fa29520bc5be41dc4d38caba1720bb50d682171af1e52eba33199237417396e299d9ebe0e07a1fa90442e82e08cd567cf16a55d6ee4b2898188fa3e4d8a86a8e799355fb660e3c5ff1a3e63a421862f0997dbec16ef9224660a957dca18c6f1958d76176988da98c8798e1ca398", &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)="22dcf845f2b4211b6476376ecea6c9793a2d5323a2ea2abd99beb63a668140503cefb18e30be4e0687d765104831f1fbaa2fc91b4ed3f443b534632e4d16bec02cb4201a2a2a384a5386bdf119bc8268db20dfb573e45931659970b197bf09718f35d5e6e8931b1ce2bfd4") r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = inotify_init1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fcntl$setown(r1, 0x8, 0xffffffffffffffff) fcntl$getownex(r1, 0x10, &(0x7f0000002bc0)={0x0, 0x0}) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000003, 0x810, r2, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0xc) ptrace$setopts(0x4204, r3, 0x8000000002, 0xa06ff1) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@local, @in=@empty}}, {{@in6=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f0000000380)=0xe8) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r4 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/policy\x00', 0x0, 0x0) gettid() openat$cgroup_int(r4, &(0x7f0000000400)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040), 0x1c) 09:39:26 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='pagemap\x00') ioctl$PIO_FONTX(r1, 0x4b6c, &(0x7f00000000c0)="a1f8a2e004084a29b80baab11eb49a2a00fccbfb6cc812d26a039a7a1fdbe65dd74dc6c1146c686ed7f047fe82a173f1ca6a7c2956517e956d95c8a515ff410678750bb2ea067f8050dabe754d47819066c2053bd8bbf15ddb66b6925e9ad5e0ce8c3434d9389644611b8f98fe32a70c690c0776b16e90e1534ff686d9abd31eddbfa1e12d3d355eeec4c9bb962747c553a0a94505bc15983de048fa0c45") connect$inet6(r0, &(0x7f0000000080), 0x1c) 09:39:26 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0xffffffffffffffe6, 0x0, &(0x7f0000000180)}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="09591040", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r1 = open(&(0x7f0000000040)='./file0\x00', 0x87fd, 0x20) r2 = getpgrp(0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000480)={{{@in6, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000000080)=0xe8) r4 = getgid() setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={r2, r3, r4}, 0xc) 09:39:26 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x181000, 0x0) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000040)) [ 821.198853] binder: 5830:5856 BC_ACQUIRE_DONE u0000000000000000 node 1099 cookie mismatch 6a6e5affa6c25369 != 0000000000000000 [ 821.216679] binder: 5809:5821 ioctl c018620b 0 returned -14 [ 821.228635] binder: release 5809:5861 transaction 1101 out, still active [ 821.245451] binder: unexpected work type, 4, not freed [ 821.263216] binder: 5866:5870 ioctl c018620b 0 returned -14 [ 821.265066] binder: 5868:5871 ioctl c018620b 0 returned -14 [ 821.293407] binder: undelivered TRANSACTION_COMPLETE [ 821.299376] binder: release 5809:5821 transaction 1089 out, still active [ 821.311059] binder: 5866:5878 unknown command 1074813193 [ 821.316851] binder: 5866:5878 ioctl c0306201 200003c0 returned -22 [ 821.333383] binder: release 5868:5880 transaction 1107 out, still active [ 821.342448] binder: unexpected work type, 4, not freed [ 821.348496] binder: undelivered TRANSACTION_COMPLETE 09:39:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="aeb1ad38120813a2a2ddbc983b8d39fef818cecaad48350c9b21b004256a38c7bf15b603c0a18be7a9105c53d3c28104326b7451aa269314b3490271", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 09:39:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x400000, 0x0) write$P9_RWSTAT(r1, &(0x7f0000000080)={0x7, 0x7f, 0x1}, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\a\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000100)={'syz_tun\x00', {0x2, 0x4e24, @empty}}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000180)={0x0, 0x70, 0x101, 0x1, 0x7, 0x9, 0x0, 0x3f, 0x10, 0x8, 0x0, 0xb0, 0xbadf, 0xee, 0x2326c5f2, 0xd72, 0x3, 0x8a38, 0x6, 0x6, 0x2, 0x101, 0x1, 0x42ae, 0x1, 0x6, 0x81, 0xffffffffffffff8b, 0x8, 0x6, 0x1, 0x78be, 0x10001, 0x0, 0x7, 0x9, 0x6, 0xd7dd, 0x0, 0x6, 0x1, @perf_bp={&(0x7f00000000c0), 0x2}, 0x1, 0x9, 0x200, 0x2, 0x7fffffff, 0xa46, 0xf12a}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) 09:39:27 executing program 4: utime(0x0, 0xfffffffffffffffe) r0 = openat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x4001, 0x2) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80004}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="879869b3", @ANYRES16=r1, @ANYBLOB="000125bd7000fcdbdf25010000000000000002410000001000137564703a73797a3000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x48040}, 0x40000) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x8000, 0x0) ioctl$IOC_PR_CLEAR(r2, 0x401070cd, &(0x7f00000000c0)={0x1}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="02012cbd7000fbdbdf250600000008000500050000002000030008000100020076657468305f746f5f68737200000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4005}, 0x4000) setsockopt$inet6_MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000040)={0x5, 0x1, 0x1, 0xb3, 0x4c4}, 0xc) 09:39:27 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0xfffffffffffffffe}, 0xffffffffffffffd1) 09:39:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000040)={0x0, @broadcast, @remote}, &(0x7f0000000080)=0xc) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 821.902330] binder: 5828:5846 ioctl c018620b 0 returned -14 [ 821.913131] binder: 5828:5887 BC_ACQUIRE_DONE node 1111 has no pending acquire request [ 821.921831] binder: release 5828:5846 transaction 1095 out, still active [ 821.928742] binder: release 5828:5846 transaction 1110 out, still active [ 821.936105] binder: unexpected work type, 4, not freed 09:39:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x400000, 0x0) write$P9_RWSTAT(r1, &(0x7f0000000080)={0x7, 0x7f, 0x1}, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\a\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000100)={'syz_tun\x00', {0x2, 0x4e24, @empty}}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000180)={0x0, 0x70, 0x101, 0x1, 0x7, 0x9, 0x0, 0x3f, 0x10, 0x8, 0x0, 0xb0, 0xbadf, 0xee, 0x2326c5f2, 0xd72, 0x3, 0x8a38, 0x6, 0x6, 0x2, 0x101, 0x1, 0x42ae, 0x1, 0x6, 0x81, 0xffffffffffffff8b, 0x8, 0x6, 0x1, 0x78be, 0x10001, 0x0, 0x7, 0x9, 0x6, 0xd7dd, 0x0, 0x6, 0x1, @perf_bp={&(0x7f00000000c0), 0x2}, 0x1, 0x9, 0x200, 0x2, 0x7fffffff, 0xa46, 0xf12a}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) [ 821.954145] binder: undelivered TRANSACTION_COMPLETE [ 821.971143] binder: 5890:5894 ioctl c018620b 0 returned -14 [ 821.978338] binder: 5893:5896 ioctl c018620b 0 returned -14 [ 821.995520] binder: 5890:5894 ioctl c0306201 20000140 returned -11 09:39:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x400000, 0x0) write$P9_RWSTAT(r1, &(0x7f0000000080)={0x7, 0x7f, 0x1}, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\a\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000100)={'syz_tun\x00', {0x2, 0x4e24, @empty}}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000180)={0x0, 0x70, 0x101, 0x1, 0x7, 0x9, 0x0, 0x3f, 0x10, 0x8, 0x0, 0xb0, 0xbadf, 0xee, 0x2326c5f2, 0xd72, 0x3, 0x8a38, 0x6, 0x6, 0x2, 0x101, 0x1, 0x42ae, 0x1, 0x6, 0x81, 0xffffffffffffff8b, 0x8, 0x6, 0x1, 0x78be, 0x10001, 0x0, 0x7, 0x9, 0x6, 0xd7dd, 0x0, 0x6, 0x1, @perf_bp={&(0x7f00000000c0), 0x2}, 0x1, 0x9, 0x200, 0x2, 0x7fffffff, 0xa46, 0xf12a}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) 09:39:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="00000000eff0c6aa"]], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) times(&(0x7f0000000000)) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000002080)={0x0, @initdev, @multicast2}, &(0x7f00000020c0)=0xc) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000002100)={@dev={0xfe, 0x80, [], 0x15}, 0xd, r2}) 09:39:27 executing program 4: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000200)={0x0, {0x2, 0x400000000004e1d, @rand_addr=0x32f}, {0x2, 0x4e22, @local}, {0x2, 0x4e24, @broadcast}, 0x22, 0x0, 0x0, 0x0, 0x9, &(0x7f00000001c0)='syzkaller0\x00', 0x1, 0x8, 0x8}) utime(0x0, 0xfffffffffffffffe) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000300)=""/208, &(0x7f0000000080)=0xd0) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000100)=0x8) 09:39:27 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) r3 = creat(0x0, 0x0) open(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0) ftruncate(r4, 0x208200) r5 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) read(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r5, 0x0) fcntl$dupfd(r3, 0x0, r3) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) read(r5, &(0x7f0000000180)=""/19, 0xfffffe47) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000240)={0x28}, 0x28) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r7 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r7, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r6}) dup2(r1, r6) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 822.010827] binder: 5890:5894 ioctl c0306201 20000440 returned -11 [ 822.019699] binder: 5890:5894 BC_ACQUIRE_DONE node 1114 has no pending acquire request [ 822.031727] binder: 5907:5907 ioctl c018620b 0 returned -14 [ 822.043808] binder: release 5890:5894 transaction 1113 out, still active 09:39:27 executing program 2: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000000000)='wlan1*.\x00', 0x4) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0963b44f8440000000000000", @ANYRES64=0x0, @ANYBLOB="000004000000000044e53e76981c3d06e8a99844e42f91f02617c0372639517453f7fc5946b1a1c9c236a7423bbd8977c586"], 0x0, 0x0, 0x0}) 09:39:27 executing program 4: utime(0x0, 0xfffffffffffffffe) chroot(&(0x7f0000000000)='./file0\x00') [ 822.043814] binder: unexpected work type, 4, not freed [ 822.043817] binder: undelivered TRANSACTION_COMPLETE [ 822.057767] binder: 5893:5909 unknown command 950907310 [ 822.057776] binder: 5893:5909 ioctl c0306201 200003c0 returned -22 [ 822.067356] binder: 5866:5919 ioctl c018620b 0 returned -14 [ 822.069565] binder: 5866:5919 unknown command 1074813193 [ 822.069574] binder: 5866:5919 ioctl c0306201 200003c0 returned -22 [ 822.090970] binder: release 5866:5878 transaction 1122 out, still active [ 822.090976] binder: unexpected work type, 4, not freed [ 822.090979] binder: undelivered TRANSACTION_COMPLETE [ 822.091029] binder: release 5866:5878 transaction 1104 out, still active [ 822.100328] binder: 5917:5924 ioctl c018620b 0 returned -14 [ 822.120432] binder: 5928:5930 ioctl c018620b 0 returned -14 [ 822.148286] ------------[ cut here ]------------ [ 822.148293] kernel BUG at drivers/android/binder_alloc.c:1105! [ 822.148302] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 822.148308] Modules linked in: [ 822.148320] CPU: 0 PID: 5934 Comm: syz-executor.0 Not tainted 4.9.165+ #29 [ 822.148327] task: ffff8801acdbaf80 task.stack: ffff8801a7790000 [ 822.148350] RIP: 0010:[] [] binder_alloc_do_buffer_copy+0xcb/0x500 [ 822.148356] RSP: 0018:ffff8801a7797518 EFLAGS: 00010202 [ 822.148363] RAX: 0000000000040000 RBX: 0000000020003df0 RCX: ffffc90000d19000 [ 822.148369] RDX: 00000000000002f0 RSI: ffffffff8221c34b RDI: ffff8801c4b5d358 [ 822.148374] RBP: ffff8801a7797598 R08: ffff8801a7797870 R09: 0000000000000028 [ 822.148380] R10: ffffed0034ef2efe R11: ffff8801a77977f7 R12: 0000000000000020 [ 822.148385] R13: ffff8801c52caf98 R14: 0000000000000028 R15: ffff8801a7797870 [ 822.148393] FS: 00007f2efd4c7700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 822.148397] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 822.148402] CR2: 00007fff75ec2090 CR3: 000000019225b000 CR4: 00000000001606b0 [ 822.148413] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 822.148419] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 822.148421] Stack: [ 822.148440] ffff8801a77977f0 ffff8801a7797548 ffffffff814f79e6 0000000000000008 [ 822.148457] dffffc0000000000 ffff8801ce80d1d8 00ff8801a77975d8 ffff8801ce80d180 [ 822.148471] ffff8801acdbc1e0 ffff8801c52caf00 aac6f0ef00000000 ffff8801a7797870 [ 822.148473] Call Trace: [ 822.148484] [] ? memcpy+0x46/0x50 [ 822.148510] [] binder_alloc_copy_from_buffer+0x37/0x42 [ 822.148561] [] binder_get_object+0xa2/0x1a0 [ 822.148572] [] binder_transaction+0x1fdf/0x5840 [ 822.148582] [] ? binder_transaction+0x1141/0x5840 [ 822.148593] [] ? binder_inc_ref_for_node+0xba0/0xba0 [ 822.148604] [] ? perf_trace_lock_acquire+0x530/0x530 [ 822.148613] [] ? depot_save_stack+0x13c/0x4a0 [ 822.148620] [] ? __might_fault+0x114/0x1d0 [ 822.148625] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 822.148630] [] ? __might_fault+0x114/0x1d0 [ 822.148635] [] binder_thread_write+0x593/0x2110 [ 822.148641] [] ? debug_smp_processor_id+0x1c/0x20 [ 822.148646] [] ? perf_trace_lock+0x11e/0x540 [ 822.148652] [] ? binder_transaction+0x5840/0x5840 [ 822.148657] [] ? __might_fault+0x114/0x1d0 [ 822.148662] [] binder_ioctl+0xecd/0x1720 [ 822.148667] [] ? binder_poll+0x240/0x240 [ 822.148671] [] ? __lock_acquire+0x5e5/0x4350 [ 822.148677] [] ? check_preemption_disabled+0x3c/0x200 [ 822.148683] [] ? __might_sleep+0x95/0x1a0 [ 822.148688] [] ? binder_poll+0x240/0x240 [ 822.148693] [] do_vfs_ioctl+0xb87/0x11d0 [ 822.148699] [] ? selinux_file_ioctl+0x103/0x550 [ 822.148705] [] ? ioctl_preallocate+0x210/0x210 [ 822.148711] [] ? selinux_parse_skb.constprop.0+0x16b0/0x16b0 [ 822.148717] [] ? __fget+0x208/0x370 [ 822.148722] [] ? __fget+0x22f/0x370 [ 822.148728] [] ? __fget+0x47/0x370 [ 822.148734] [] ? security_file_ioctl+0x8f/0xc0 [ 822.148739] [] SyS_ioctl+0x8f/0xc0 [ 822.148745] [] ? do_vfs_ioctl+0x11d0/0x11d0 [ 822.148750] [] do_syscall_64+0x1ad/0x570 [ 822.148756] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 822.148853] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 0a 04 00 00 4d 8b 64 24 58 49 29 dc e8 0f 0a 10 ff 4d 39 e6 76 07 e8 05 0a 10 ff <0f> 0b e8 fe 09 10 ff 4c 8b 6d d0 4d 29 f4 4d 39 e5 77 e8 e8 ed [ 822.148861] RIP [] binder_alloc_do_buffer_copy+0xcb/0x500 [ 822.148863] RSP [ 822.148868] ---[ end trace 096ae37c742facc4 ]--- [ 822.148872] Kernel panic - not syncing: Fatal exception [ 822.149400] Kernel Offset: disabled [ 822.608743] Rebooting in 86400 seconds..