IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2664.314445] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2665.893420] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2666.034895] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2666.131621] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2666.256513] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2666.375704] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2666.381867] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2666.391802] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2666.475328] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2666.481502] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2666.494991] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2666.670748] 8021q: adding VLAN 0 to HW filter on device team0
[ 2666.704699] 8021q: adding VLAN 0 to HW filter on device team0
02:38:16 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7, 0x0, 0xffffffffffffffff})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:38:16 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='aut\nfs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:16 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x6000000, &(0x7f0000000500)})

02:38:16 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb="2f6465762f6e756c6c6230ff", &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:16 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f0000000000)=@sack_info={<r3=>0x0, 0x7, 0x9}, &(0x7f0000000040)=0xc)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f00000000c0)={r3, 0xfffffffffffffffb, 0x30, 0xff, 0x7cc}, &(0x7f0000000180)=0x18)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2667.949731] ion_mmap: failure mapping buffer to userspace
[ 2668.021874] binder: release 21524:21525 transaction 7830 out, still active
[ 2668.029613] binder_transaction: 23 callbacks suppressed
[ 2668.029629] binder: 21524:21525 transaction failed 29189/0, size 0-0 line 2787
[ 2668.052101] binder: BINDER_SET_CONTEXT_MGR already set
[ 2668.052964] binder: undelivered TRANSACTION_COMPLETE
[ 2668.081451] binder: 21526:21527 ioctl 40046207 0 returned -16
[ 2668.082403] binder: send failed reply for transaction 7830, target dead
[ 2668.106129] ion_mmap: failure mapping buffer to userspace
[ 2668.128166] binder: BINDER_SET_CONTEXT_MGR already set
[ 2668.140237] binder: 21524:21538 ioctl 40046207 0 returned -16
[ 2668.146394] binder_alloc_new_buf_locked: 2 callbacks suppressed
[ 2668.146402] binder_alloc: 21524: binder_alloc_buf, no vma
[ 2668.160821] binder_alloc: 21524: binder_alloc_buf, no vma
[ 2668.166944] binder: 21526:21539 transaction failed 29189/-3, size 0-0 line 2970
[ 2668.174600] binder: 21524:21525 transaction failed 29189/-3, size 0-0 line 2970
[ 2668.179729] autofs4:pid:21529:autofs_fill_super: called with bogus options
[ 2668.206628] binder_transaction: 5 callbacks suppressed
[ 2668.206638] binder: 21524:21544 got reply transaction with no transaction stack
[ 2668.212053] binder_release_work: 23 callbacks suppressed
[ 2668.212060] binder: undelivered TRANSACTION_ERROR: 29189
[ 2668.230941] binder: 21524:21544 transaction failed 29201/-71, size 0-0 line 2762
[ 2668.237752] binder: 21526:21545 got reply transaction with no transaction stack
[ 2668.242930] binder: undelivered TRANSACTION_ERROR: 29189
[ 2668.256402] autofs4:pid:21540:autofs_fill_super: called with bogus options
[ 2668.275368] binder: undelivered TRANSACTION_ERROR: 29190
[ 2668.291959] binder: undelivered TRANSACTION_ERROR: 29201
[ 2668.301782] binder: 21526:21545 transaction failed 29201/-71, size 0-0 line 2762
02:38:17 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof*\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:17 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='aut\nfs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:17 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x0, 0x0, 0xffffffffffffffff})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:38:17 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="040000007165021aa66b729c50390353b391c0a78f4bcc1431a37398255d07c2492ba71d3ff4eafce599f7a121ab964438310207e7bcb4e21feb65ae44eed1b19f2f2caabbeef9e267dffc7d41e834f53099e6267db5a3e62bd4fc98050c7d0e8188fd761de3a164b2cd84c86b838214cb2c5f14792ad8022afdc9a92527a2c5c75352648879b6c91a1bca87b0debc2a9dcded35d8f0d2071c88603d4afb99864097f79d18b7df37d6a52d416cd3c7393865e6b1315601edaca7639cba6df8c9ad5340185ab96d8604697cad8ce48516efaabbd481825253c8afdaa78ee9cbbb140d798d8703"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:38:17 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x0, 0x0, 0xffffffffffffffff})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:38:17 executing program 1:

02:38:17 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2668.462464] ion_mmap: failure mapping buffer to userspace
[ 2668.470404] binder: 21560:21561 unknown command 4
[ 2668.485306] binder: 21560:21561 ioctl c0306201 20000440 returned -22
[ 2668.552494] binder: 21560:21572 got reply transaction with no transaction stack
02:38:17 executing program 1:

02:38:17 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x0, 0x0, 0xffffffffffffffff})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

[ 2668.594748] binder: 21560:21572 transaction failed 29201/-71, size 0-0 line 2762
[ 2668.680928] ion_mmap: failure mapping buffer to userspace
[ 2668.689435] autofs4:pid:21586:autofs_fill_super: called with bogus options
[ 2668.741105] autofs4:pid:21586:autofs_fill_super: called with bogus options
[ 2668.812768] binder_alloc: binder_alloc_mmap_handler: 21526 20001000-20004000 already mapped failed -16
[ 2668.822768] binder_alloc: 21560: binder_alloc_buf, no vma
[ 2668.828943] binder: 21526:21545 transaction failed 29189/-3, size 0-0 line 2970
[ 2668.836930] binder: BINDER_SET_CONTEXT_MGR already set
[ 2668.842443] binder: 21526:21539 ioctl 40046207 0 returned -16
[ 2668.849759] binder: undelivered TRANSACTION_ERROR: 29189
[ 2668.856039] binder: 21526:21545 got reply transaction with no transaction stack
[ 2668.863784] binder: undelivered TRANSACTION_ERROR: 29201
[ 2668.869948] binder: 21526:21545 transaction failed 29201/-71, size 0-0 line 2762
02:38:17 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x7a00000000000000, &(0x7f0000000500)})

02:38:17 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofo\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:17 executing program 1:

02:38:17 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:38:17 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\t', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:17 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2668.914620] binder: undelivered TRANSACTION_ERROR: 29201
[ 2668.954052] ion_mmap: failure mapping buffer to userspace
[ 2669.005309] ion_mmap: failure mapping buffer to userspace
[ 2669.018017] binder: BINDER_SET_CONTEXT_MGR already set
[ 2669.023337] binder: 21599:21600 ioctl 40046207 0 returned -16
[ 2669.079489] binder_alloc: 21560: binder_alloc_buf, no vma
[ 2669.096881] autofs4:pid:21610:autofs_fill_super: called with bogus options
[ 2669.104544] binder: 21599:21612 transaction failed 29189/-3, size 0-0 line 2970
[ 2669.160849] binder: 21599:21612 got reply transaction with no transaction stack
[ 2669.168433] binder: undelivered TRANSACTION_ERROR: 29189
[ 2669.184432] binder: 21599:21612 transaction failed 29201/-71, size 0-0 line 2762
[ 2669.249418] binder: BINDER_SET_CONTEXT_MGR already set
[ 2669.256002] binder: 21560:21614 ioctl 40046207 0 returned -16
[ 2669.269810] binder: 21560:21572 unknown command 4
[ 2669.288273] binder: 21560:21572 ioctl c0306201 20000440 returned -22
02:38:18 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0163404000000000000000000000000000000000000000000000000000063ab8a70f7c20150000000000000000000000000000002fe8a975d2e59d9b407a013ee3e7fcd7cfa531cde7fc3c65e21fe3a35c6829616ae1e524242d2119c8f1fe5c3b535217402be6a2ade1e2fb282f0beef299ee523ed2412d134b0834378f488f72510971", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

02:38:18 executing program 1:

02:38:18 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r1=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r1, 0x0)

02:38:18 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof#\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:18 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2669.315553] binder: 21560:21615 got reply transaction with no transaction stack
[ 2669.323418] binder: undelivered TRANSACTION_ERROR: 29201
[ 2669.329007] binder: undelivered TRANSACTION_ERROR: 29201
02:38:18 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x0, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2669.453208] binder: release 21627:21628 transaction 7844 out, still active
[ 2669.461623] binder: send failed reply for transaction 7844, target dead
[ 2669.469014] binder: undelivered TRANSACTION_COMPLETE
[ 2669.476868] binder: BINDER_SET_CONTEXT_MGR already set
[ 2669.482340] binder: 21627:21630 ioctl 40046207 0 returned -16
[ 2669.489091] binder_alloc: 21627: binder_alloc_buf, no vma
[ 2669.526199] autofs4:pid:21631:autofs_fill_super: called with bogus options
[ 2669.536026] binder: 21627:21633 got reply transaction with no transaction stack
[ 2669.630197] autofs4:pid:21631:autofs_fill_super: called with bogus options
[ 2669.795488] binder_alloc: binder_alloc_mmap_handler: 21599 20001000-20004000 already mapped failed -16
[ 2669.805342] binder_alloc: 21599: binder_alloc_buf, no vma
[ 2669.811700] binder: 21599:21635 got reply transaction with no transaction stack
02:38:18 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x500000000000000, &(0x7f0000000500)})

02:38:18 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofl\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:18 executing program 1:

02:38:18 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x0, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:38:18 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x482402, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000002c0)={&(0x7f0000000040)=[0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1, 0x5, 0x1, 0x6})
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, &(0x7f0000000300)})

02:38:18 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb="2f6465762f6e756c6c623002", &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:18 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x10, r2, 0x0)

02:38:18 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofp\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:18 executing program 1:

[ 2670.036112] binder: release 21640:21641 transaction 7852 out, still active
[ 2670.043364] binder: undelivered TRANSACTION_COMPLETE
[ 2670.050099] binder: BINDER_SET_CONTEXT_MGR already set
[ 2670.084101] binder: 21640:21647 ioctl 40046207 0 returned -16
[ 2670.090806] binder: BINDER_SET_CONTEXT_MGR already set
[ 2670.111992] binder: 21648:21649 ioctl 40046207 0 returned -16
[ 2670.113180] binder_alloc: 21640: binder_alloc_buf, no vma
02:38:19 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, 0xffffffffffffffff, 0x0)

02:38:19 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofc\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:19 executing program 1:

[ 2670.133733] autofs4:pid:21658:autofs_fill_super: called with bogus options
[ 2670.143688] binder_alloc: 21640: binder_alloc_buf, no vma
[ 2670.149992] binder: release 21640:21641 transaction 7852 in, still active
[ 2670.174417] binder: send failed reply for transaction 7852, target dead
[ 2670.239805] binder: 21648:21661 got reply transaction with no transaction stack
[ 2670.860266] binder_alloc: binder_alloc_mmap_handler: 21648 20001000-20004000 already mapped failed -16
[ 2670.870174] binder_alloc: 21648: binder_alloc_buf, no vma
[ 2670.877019] binder: 21648:21673 got reply transaction with no transaction stack
02:38:20 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x48000000, &(0x7f0000000500)})

02:38:20 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$PPPIOCGMRU(r1, 0x80047453, &(0x7f0000000000))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:38:20 executing program 1:

02:38:20 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofX\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:20 executing program 5:

02:38:20 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\n', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:20 executing program 5:

02:38:20 executing program 1:

[ 2671.200522] binder: 21676:21680 ioctl 80047453 20000000 returned -22
[ 2671.213871] binder: BINDER_SET_CONTEXT_MGR already set
[ 2671.235456] binder_alloc: 21676: binder_alloc_buf, no vma
[ 2671.241060] binder: send failed reply for transaction 7860 to 21676:21680
[ 2671.253134] binder: undelivered TRANSACTION_COMPLETE
[ 2671.258482] binder: 21683:21684 ioctl 40046207 0 returned -16
[ 2671.299809] binder: BINDER_SET_CONTEXT_MGR already set
[ 2671.306945] binder: 21676:21694 ioctl 40046207 0 returned -16
[ 2671.318440] binder: 21676:21694 ioctl 80047453 20000000 returned -22
[ 2671.336067] autofs4:pid:21675:autofs_fill_super: called with bogus options
02:38:20 executing program 5:

02:38:20 executing program 1:

[ 2671.343875] binder: release 21683:21693 transaction 7862 out, still active
[ 2671.351086] binder: undelivered TRANSACTION_COMPLETE
[ 2671.361531] binder: send failed reply for transaction 7862, target dead
02:38:20 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofx\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:20 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r2, 0x40405515, &(0x7f0000000040)={0x9, 0x6, 0x7, 0x1d13, 'syz1\x00'})
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f00000002c0)={0x200, {{0x2, 0x4e24, @rand_addr=0x3}}}, 0x88)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2671.556664] binder: release 21702:21704 transaction 7866 out, still active
[ 2671.564181] binder: send failed reply for transaction 7866, target dead
[ 2671.582172] binder: undelivered TRANSACTION_COMPLETE
[ 2671.603122] binder: BINDER_SET_CONTEXT_MGR already set
[ 2671.610840] binder: 21702:21708 ioctl 40046207 0 returned -16
[ 2671.998759] binder_alloc: binder_alloc_mmap_handler: 21683 20001000-20004000 already mapped failed -16
02:38:21 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x6c000000, &(0x7f0000000500)})

02:38:21 executing program 1:

02:38:21 executing program 5:

02:38:21 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:21 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofd\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:21 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r1, r0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:38:21 executing program 5:

02:38:21 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:21 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof0\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:21 executing program 1:

[ 2672.323813] binder: release 21716:21717 transaction 7873 out, still active
[ 2672.332239] binder: send failed reply for transaction 7873, target dead
[ 2672.344398] binder: undelivered TRANSACTION_COMPLETE
[ 2672.386011] binder: BINDER_SET_CONTEXT_MGR already set
02:38:21 executing program 5:

02:38:21 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2672.419804] binder: BINDER_SET_CONTEXT_MGR already set
[ 2672.426107] binder: 21719:21725 ioctl 40046207 0 returned -16
[ 2672.455137] binder: 21716:21728 ioctl 40046207 0 returned -16
[ 2672.699264] autofs4:pid:21740:autofs_fill_super: called with bogus options
[ 2673.161934] binder_alloc: binder_alloc_mmap_handler: 21719 20001000-20004000 already mapped failed -16
[ 2673.173767] binder_alloc_new_buf_locked: 5 callbacks suppressed
[ 2673.173775] binder_alloc: 21719: binder_alloc_buf, no vma
[ 2673.185898] binder_transaction: 23 callbacks suppressed
[ 2673.185915] binder: 21719:21748 transaction failed 29189/-3, size 0-0 line 2970
[ 2673.204327] binder: 21719:21748 transaction failed 29201/-71, size 0-0 line 2762
02:38:22 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x7000000, &(0x7f0000000500)})

02:38:22 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040ccaa62e5f4d9274bce3ac41183842b1c1f974b78550e2d99b1d6c05e8942a472e75df091ec9490dc68ba7e4329a6b00e456f6a76cbc00d288dd0e656441149719ee4772d3290bb4bea253999940d08990461ef8f0c4581c6ddc8dcc6da14a4a3f5f16c4b6778db78507d9e18cd1566035d399c9409ed0a7769918b107d"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})
getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r3, 0x84, 0x4, &(0x7f0000000000), &(0x7f0000000040)=0x4)
ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r3, 0xc0105303, &(0x7f00000000c0)={0x2, 0x1f, 0x1f000000000})

02:38:22 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof*\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:22 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof+\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:22 executing program 1:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x20015, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0163404000010000000000186862285a082c0b8ce298fbffffffffffffff000000000000000000000000000000000000001f4fb5fe6949a4b2c431b8dedb4f14be4f1df7ebbf3ae7", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

02:38:22 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2673.316438] binder_release_work: 25 callbacks suppressed
[ 2673.316444] binder: undelivered TRANSACTION_ERROR: 29201
02:38:22 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof-\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2673.362821] binder: 21749:21750 got transaction to invalid handle
[ 2673.382806] binder: BINDER_SET_CONTEXT_MGR already set
[ 2673.395557] binder: 21749:21750 transaction failed 29201/-22, size -2553377244937429529-1058528608588315240 line 2855
[ 2673.409763] binder: 21753:21757 ioctl 40046207 0 returned -16
[ 2673.438115] binder: undelivered TRANSACTION_ERROR: 29201
[ 2673.443779] binder_transaction: 5 callbacks suppressed
[ 2673.443788] binder: 21749:21750 got reply transaction with no transaction stack
[ 2673.450541] binder: BINDER_SET_CONTEXT_MGR already set
[ 2673.479214] binder: 21760:21761 ioctl 40046207 0 returned -16
[ 2673.485535] binder: 21749:21750 transaction failed 29201/-71, size 0-0 line 2762
[ 2673.485560] binder: release 21753:21762 transaction 7884 out, still active
[ 2673.485763] binder: 21753:21762 got reply transaction with no transaction stack
[ 2673.498076] binder: undelivered TRANSACTION_COMPLETE
02:38:22 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof*\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2673.524464] binder: 21753:21762 transaction failed 29201/-71, size 0--5382048944823992320 line 2762
[ 2673.533834] device bridge_slave_1 left promiscuous mode
[ 2673.541169] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2673.566225] binder: BINDER_SET_CONTEXT_MGR already set
[ 2673.586174] binder: 21749:21768 ioctl 40046207 0 returned -16
[ 2673.594585] binder: release 21760:21761 transaction 7887 out, still active
[ 2673.601705] binder: 21760:21772 got reply transaction with no transaction stack
[ 2673.615568] binder: undelivered TRANSACTION_COMPLETE
[ 2673.621019] device bridge_slave_0 left promiscuous mode
[ 2673.628081] binder: 21749:21775 got reply transaction with no transaction stack
02:38:22 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='au%ofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2673.632830] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2673.657822] binder: 21760:21772 transaction failed 29201/-71, size 0-0 line 2762
[ 2673.666623] IPVS: ftp: loaded support on port[0] = 21
[ 2673.674520] binder: undelivered TRANSACTION_ERROR: 29201
[ 2673.675705] binder: 21749:21775 transaction failed 29201/-71, size 0-0 line 2762
[ 2673.680042] binder: release 21749:21764 transaction 7884 in, still active
[ 2673.680055] binder: send failed reply for transaction 7884, target dead
02:38:22 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof.\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:22 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof-\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2673.728888] binder: send failed reply for transaction 7887, target dead
02:38:22 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2673.784586] binder: undelivered TRANSACTION_ERROR: 29201
[ 2673.827604] team0 (unregistering): Port device team_slave_1 removed
[ 2673.848282] team0 (unregistering): Port device team_slave_0 removed
[ 2673.856460] binder: 21786:21787 transaction failed 29189/-22, size 0-0 line 2855
[ 2673.934203] binder: undelivered TRANSACTION_ERROR: 29189
[ 2673.939764] binder: 21786:21789 got reply transaction with no transaction stack
[ 2673.979786] binder: 21786:21789 transaction failed 29201/-71, size 0-0 line 2762
[ 2674.058122] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2674.102752] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2674.174529] binder: undelivered TRANSACTION_ERROR: 29201
[ 2674.230897] binder_alloc: binder_alloc_mmap_handler: 21760 20001000-20004000 already mapped failed -16
[ 2674.262336] bond0 (unregistering): Released all slaves
[ 2674.269126] binder: BINDER_SET_CONTEXT_MGR already set
[ 2674.275535] binder: 21760:21790 got reply transaction with no transaction stack
[ 2674.283018] binder: 21760:21790 transaction failed 29201/-71, size 0-0 line 2762
[ 2674.322706] binder: release 21760:21790 transaction 7893 out, still active
[ 2674.329903] binder: BINDER_SET_CONTEXT_MGR already set
[ 2674.340163] binder: 21786:21792 got reply transaction with no transaction stack
[ 2674.347850] binder: 21760:21772 ioctl 40046207 0 returned -16
[ 2674.353809] binder: undelivered TRANSACTION_COMPLETE
[ 2674.362579] binder: undelivered TRANSACTION_ERROR: 29189
02:38:23 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x2, &(0x7f0000000500)})

02:38:23 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof-\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:23 executing program 1:
socket$inet6(0xa, 0x1000000000002, 0x0)
r0 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7, 0x0, 0xffffffffffffffff})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2674.375753] binder: 21786:21787 ioctl 40046207 0 returned -16
[ 2674.382056] binder: release 21786:21787 transaction 7893 in, still active
[ 2674.390570] binder: send failed reply for transaction 7893, target dead
[ 2674.401930] binder: undelivered TRANSACTION_ERROR: 29201
[ 2674.418302] binder: undelivered TRANSACTION_ERROR: 29201
[ 2674.438710] binder: undelivered TRANSACTION_ERROR: 29201
[ 2674.453480] ion_mmap: failure mapping buffer to userspace
02:38:23 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2674.527133] binder: release 21799:21801 transaction 7898 out, still active
[ 2674.535739] binder: send failed reply for transaction 7898, target dead
[ 2674.542629] binder: undelivered TRANSACTION_COMPLETE
02:38:23 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = pkey_alloc(0x0, 0x3)
pkey_free(r3)
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2674.625907] binder_alloc: binder_alloc_mmap_handler: 21799 20001000-20004000 already mapped failed -16
[ 2674.654607] binder_alloc: 21799: binder_alloc_buf, no vma
[ 2674.660591] binder: BINDER_SET_CONTEXT_MGR already set
[ 2674.674374] binder: 21802:21803 ioctl 40046207 0 returned -16
[ 2674.680387] binder: BINDER_SET_CONTEXT_MGR already set
[ 2674.694448] binder: 21799:21801 ioctl 40046207 0 returned -16
[ 2674.705430] binder_alloc: 21799: binder_alloc_buf, no vma
[ 2674.716074] binder: 21799:21806 got reply transaction with no transaction stack
[ 2674.771043] binder: 21802:21810 got reply transaction with no transaction stack
[ 2674.859474] autofs4:pid:21805:autofs_fill_super: called with bogus options
[ 2675.422948] binder_alloc: 21802: binder_alloc_buf, no vma
[ 2675.428738] binder: release 21802:21810 transaction 7905 out, still active
[ 2675.444806] binder: undelivered TRANSACTION_COMPLETE
[ 2675.450061] binder: send failed reply for transaction 7905, target dead
[ 2675.840167] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2675.846839] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2675.854075] device bridge_slave_0 entered promiscuous mode
[ 2675.924819] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2675.931274] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2675.938937] device bridge_slave_1 entered promiscuous mode
[ 2675.976943] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2676.014686] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2676.136043] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2676.177350] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2676.355722] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2676.362958] team0: Port device team_slave_0 added
[ 2676.400929] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2676.408836] team0: Port device team_slave_1 added
[ 2676.414053] device bridge_slave_1 left promiscuous mode
[ 2676.419667] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2676.465176] device bridge_slave_0 left promiscuous mode
[ 2676.470668] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2676.546084] team0 (unregistering): Port device team_slave_1 removed
[ 2676.556934] team0 (unregistering): Port device team_slave_0 removed
[ 2676.568545] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2676.627857] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2676.712823] bond0 (unregistering): Released all slaves
[ 2676.792209] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2676.829440] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[ 2676.836680] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 2676.844884] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2676.887274] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 2676.894692] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 2676.910133] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2676.939285] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 2676.946690] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 2676.963118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2677.570773] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2677.577221] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2677.583852] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2677.590235] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2677.598403] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2677.834459] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2678.985518] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2679.108897] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2679.234927] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2679.241106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2679.256672] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2679.378331] 8021q: adding VLAN 0 to HW filter on device team0
[ 2680.236080] autofs4:pid:22067:autofs_fill_super: called with bogus options
[ 2680.286427] autofs4:pid:22067:autofs_fill_super: called with bogus options
02:38:29 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:29 executing program 1:
socket$inet6(0xa, 0x1000000000002, 0x0)
r0 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7, 0x0, 0xffffffffffffffff})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:38:29 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x6c, &(0x7f0000000500)})

02:38:29 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:29 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofu\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:29 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="01634040000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

[ 2680.393475] binder: BINDER_SET_CONTEXT_MGR already set
[ 2680.402269] ion_mmap: failure mapping buffer to userspace
[ 2680.406108] binder_alloc: 22072: binder_alloc_buf, no vma
[ 2680.424780] binder_transaction: 8 callbacks suppressed
[ 2680.424798] binder: 22072:22074 transaction failed 29189/-3, size 0-0 line 2970
[ 2680.443258] autofs4:pid:22077:autofs_fill_super: called with bogus options
[ 2680.451087] binder: release 22072:22074 transaction 7908 out, still active
[ 2680.458205] binder: send failed reply for transaction 7908, target dead
[ 2680.476452] binder: 22078:22079 ioctl 40046207 0 returned -16
[ 2680.482424] binder: undelivered TRANSACTION_COMPLETE
02:38:29 executing program 1:
socket$inet6(0xa, 0x1000000000002, 0x0)
r0 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7, 0x0, 0xffffffffffffffff})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:38:29 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2680.482592] binder: 22078:22085 got reply transaction with no transaction stack
[ 2680.511699] binder: release 22078:22085 transaction 7910 out, still active
[ 2680.525553] binder: undelivered TRANSACTION_COMPLETE
[ 2680.543335] autofs4:pid:22084:autofs_fill_super: called with bogus options
[ 2680.554768] binder_alloc: binder_alloc_mmap_handler: 22072 20001000-20004000 already mapped failed -16
[ 2680.557390] ion_mmap: failure mapping buffer to userspace
[ 2680.570537] binder: 22078:22085 transaction failed 29201/-71, size 0-0 line 2762
[ 2680.583070] binder_alloc: 22072: binder_alloc_buf, no vma
02:38:29 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb="2f6465762f6e756c6c6230f6", &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2680.595161] binder: BINDER_SET_CONTEXT_MGR already set
[ 2680.600490] binder: 22072:22074 ioctl 40046207 0 returned -16
[ 2680.607691] autofs4:pid:22087:autofs_fill_super: called with bogus options
[ 2680.621512] binder: BINDER_SET_CONTEXT_MGR already set
[ 2680.628938] autofs4:pid:22092:autofs_fill_super: called with bogus options
[ 2680.636926] binder: 22072:22089 transaction failed 29189/-3, size 0-0 line 2970
[ 2680.650145] binder: 22078:22096 ioctl 40046207 0 returned -16
[ 2680.672101] binder_alloc: 22072: binder_alloc_buf, no vma
[ 2680.679344] binder_release_work: 7 callbacks suppressed
[ 2680.679351] binder: undelivered TRANSACTION_ERROR: 29190
[ 2680.680124] binder: 22072:22074 got reply transaction with no transaction stack
02:38:29 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2680.685315] binder: send failed reply for transaction 7910, target dead
[ 2680.698121] IPVS: ftp: loaded support on port[0] = 21
[ 2680.715076] binder: 22078:22079 transaction failed 29189/-3, size 0-0 line 2970
[ 2680.717643] binder: 22078:22103 got reply transaction with no transaction stack
[ 2680.728254] binder: 22072:22074 transaction failed 29201/-71, size 0-0 line 2762
02:38:29 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:29 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2680.790669] binder: undelivered TRANSACTION_ERROR: 29189
[ 2680.796319] binder: 22078:22103 transaction failed 29201/-71, size 0-0 line 2762
[ 2680.807953] binder: undelivered TRANSACTION_ERROR: 29189
[ 2680.855646] binder: undelivered TRANSACTION_ERROR: 29201
02:38:29 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x3f00000000000000, &(0x7f0000000500)})

[ 2680.897967] binder: undelivered TRANSACTION_ERROR: 29201
02:38:29 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00040000"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a16d6eff33e512da218f1e1f7211c09b681017894ed18a100c2e6fd9a2ed005821f4bd819fe117bd7544c7e7fe0d36ecc8375bf38d3a03f6cdf43d72dd6d59e8944ecdea652de055789496dae0ba9739ca73f2faa159ae313b8005344a9805df2a1e621e42dd05befba17ac5969d184f7517de329c81bc297d8f64c71a81b92e1a2b9132828a6db99f31f36b74eb1bcf9d8cff1cb25f04b060c0edd9597bafd0e433ed77176c839204fd2c5c869387274e2037f3b5670d37ccd66dbbba5e56fc30ed94c4f06827930512e8f76bd434167acf8c7c930517d1847e5d01f65c531e84b1ea6da71c64ad6be5a0e5012b9304f14767a0c03b7658befde0a0f855172ce03781515e5d5155b8", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

[ 2680.991277] binder: undelivered TRANSACTION_ERROR: 29201
[ 2681.006228] binder_alloc: 22117: binder_alloc_buf, no vma
[ 2681.006921] binder: release 22117:22118 transaction 7917 out, still active
[ 2681.016691] autofs4:pid:22110:autofs_fill_super: called with bogus options
[ 2681.026477] binder: 22117:22118 transaction failed 29189/-3, size 0-0 line 2970
[ 2681.035466] autofs4:pid:22108:autofs_fill_super: called with bogus options
[ 2681.053742] binder: send failed reply for transaction 7917, target dead
[ 2681.068299] binder: undelivered TRANSACTION_COMPLETE
[ 2681.075385] autofs4:pid:22120:autofs_fill_super: called with bogus options
[ 2681.092550] autofs4:pid:22112:autofs_fill_super: called with bogus options
[ 2681.095535] binder_alloc: binder_alloc_mmap_handler: 22117 20001000-20004000 already mapped failed -16
[ 2681.124475] binder: BINDER_SET_CONTEXT_MGR already set
[ 2681.169836] binder: 22125:22127 ioctl 40046207 0 returned -16
[ 2681.181643] binder_alloc: 22117: binder_alloc_buf, no vma
[ 2681.199227] binder: BINDER_SET_CONTEXT_MGR already set
02:38:30 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\a', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2681.217118] binder_alloc: 22117: binder_alloc_buf, no vma
[ 2681.222840] binder: 22125:22130 transaction failed 29189/-3, size 0-0 line 2970
[ 2681.225543] binder: 22117:22118 ioctl 40046207 0 returned -16
02:38:30 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb="2f6465762f6e756c6c623003", &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2681.265668] binder: 22117:22126 transaction failed 29189/-3, size 0-0 line 2970
[ 2681.278494] binder: 22125:22127 unknown command 1024
[ 2681.304563] binder: 22125:22127 ioctl c0306201 20000140 returned -22
[ 2681.324384] binder: undelivered TRANSACTION_ERROR: 29189
[ 2681.333312] binder: 22125:22127 got reply transaction with no transaction stack
[ 2681.341518] binder: undelivered TRANSACTION_ERROR: 29189
[ 2681.367324] binder: undelivered TRANSACTION_ERROR: 29190
[ 2681.369431] autofs4:pid:22137:autofs_fill_super: called with bogus options
[ 2681.373850] binder: 22125:22127 transaction failed 29201/-71, size 0-0 line 2762
[ 2681.397946] binder: 22117:22118 got reply transaction with no transaction stack
[ 2681.445273] binder: undelivered TRANSACTION_ERROR: 29201
[ 2681.451238] binder: 22125:22130 unknown command 1024
[ 2681.467935] binder: 22125:22130 ioctl c0306201 20000140 returned -22
[ 2681.515227] binder: 22125:22146 got reply transaction with no transaction stack
[ 2681.515550] binder: release 22125:22127 transaction 7924 out, still active
[ 2681.535390] binder: undelivered TRANSACTION_COMPLETE
[ 2681.574946] autofs4:pid:22149:autofs_fill_super: called with bogus options
[ 2681.641249] binder: send failed reply for transaction 7924, target dead
[ 2681.687346] autofs4:pid:22140:autofs_fill_super: called with bogus options
[ 2682.070278] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2682.076778] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2682.083889] device bridge_slave_0 entered promiscuous mode
[ 2682.120129] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2682.126861] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2682.134046] device bridge_slave_1 entered promiscuous mode
[ 2682.168841] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2682.203406] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2682.308773] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2682.346793] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2682.514956] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2682.522288] team0: Port device team_slave_0 added
[ 2682.558554] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2682.566204] team0: Port device team_slave_1 added
[ 2682.600567] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2682.639774] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2682.677242] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2682.714241] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2683.083771] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2683.090208] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2683.096871] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2683.103433] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2683.112253] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2683.914615] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2684.477121] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2684.600703] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2684.721711] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2684.728238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2684.742892] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2684.861720] 8021q: adding VLAN 0 to HW filter on device team0
02:38:34 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofi\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:34 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x0, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r1 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

02:38:34 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\a', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:34 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x6c00, &(0x7f0000000500)})

02:38:34 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
setsockopt$IP_VS_SO_SET_TIMEOUT(r3, 0x0, 0x48a, &(0x7f0000000000)={0x7f, 0x2, 0x5ca5e0}, 0xc)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:38:34 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb="2f6465762f6e756c6c6230c0", &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2685.715461] vhci_hcd: invalid port number 0
[ 2685.725239] binder: release 22408:22409 transaction 7927 out, still active
[ 2685.733853] binder_transaction: 2 callbacks suppressed
[ 2685.733870] binder: 22408:22409 transaction failed 29189/0, size 0-0 line 2787
[ 2685.747593] binder: BINDER_SET_CONTEXT_MGR already set
[ 2685.752888] binder: 22407:22412 ioctl 40046207 0 returned -16
02:38:34 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x0, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r1 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2685.767864] binder: undelivered TRANSACTION_COMPLETE
[ 2685.791128] autofs4:pid:22414:autofs_fill_super: called with bogus options
[ 2685.824151] binder: send failed reply for transaction 7927, target dead
[ 2685.843352] binder: BINDER_SET_CONTEXT_MGR already set
[ 2685.855061] vhci_hcd: invalid port number 0
[ 2685.861174] autofs4:pid:22411:autofs_fill_super: called with bogus options
[ 2685.880535] binder: 22408:22425 ioctl 40046207 0 returned -16
[ 2685.886944] binder: 22407:22423 got reply transaction with no transaction stack
[ 2685.894563] binder: release 22407:22423 transaction 7929 out, still active
[ 2685.901609] binder: undelivered TRANSACTION_COMPLETE
[ 2685.917807] binder: 22407:22423 transaction failed 29201/-71, size 0-0 line 2762
[ 2685.939754] binder_alloc: 22408: binder_alloc_buf, no vma
[ 2685.957592] binder: 22408:22409 transaction failed 29189/-3, size 0-0 line 2970
02:38:34 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f6673fe", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2685.985371] autofs4:pid:22419:autofs_fill_super: called with bogus options
[ 2685.998928] binder_release_work: 2 callbacks suppressed
[ 2685.998935] binder: undelivered TRANSACTION_ERROR: 29190
[ 2686.010510] binder: send failed reply for transaction 7929, target dead
02:38:34 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\a', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:34 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:34 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
io_setup(0x401, &(0x7f0000000280)=<r3=>0x0)
clock_gettime(0x0, &(0x7f0000000400)={<r4=>0x0, <r5=>0x0})
io_getevents(r3, 0x4, 0x2, &(0x7f0000000340)=[{}, {}], &(0x7f00000005c0)={r4, r5+30000000})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040227dcc1fa931e2fe6b563233d804afa228a4c6286c38c2fece3de542c656a8fc7788c69bb72a3d156a99a77bd71b88b138b6476d0c4a6422dd6966c03097c1fcc93df1802836faee98a8ee0c639f9f9dd50c837c743b290f0a6eb4056e307bed708d90df1a6e52e09151cce96d1e0597c2b3c5390f61c7cfe305a162c253fa55debb0b23a343da440acb0759e831b54d743c7c000000000000000000"], 0x0, 0x0, &(0x7f0000000040)})
r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000680)='/dev/autofs\x00', 0x400200, 0x0)
setsockopt$inet_sctp_SCTP_EVENTS(r6, 0x84, 0xb, &(0x7f00000006c0)={0x0, 0xfffffffffffffff8, 0x3, 0x9, 0x100, 0x8, 0xfffffffffffffffa, 0x8000, 0xffffffffffff0000, 0x81, 0x8001}, 0xb)
openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000640)='/proc/self/attr/current\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r7 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8)
r8 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})
fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f00000000c0))
clock_gettime(0x0, &(0x7f0000000180)={<r9=>0x0, <r10=>0x0})
clock_gettime(0x0, &(0x7f00000001c0)={<r11=>0x0, <r12=>0x0})
timerfd_settime(r8, 0x1, &(0x7f00000002c0)={{r9, r10+10000000}, {r11, r12+30000000}}, &(0x7f0000000300))

[ 2686.044546] binder: undelivered TRANSACTION_ERROR: 29189
02:38:35 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:35 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:35 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2686.154114] autofs4:pid:22439:autofs_fill_super: called with bogus options
[ 2686.181016] binder: 22446:22451 got transaction to invalid handle
[ 2686.211771] binder: 22446:22451 transaction failed 29201/-22, size 1530426416456697975--5654238719857157782 line 2855
02:38:35 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb="2f6465762f6e756c6c62307f", &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2686.262948] autofs4:pid:22460:autofs_fill_super: called with bogus options
[ 2686.287407] autofs4:pid:22458:autofs_fill_super: called with bogus options
[ 2686.323583] binder: 22446:22462 got reply transaction with no transaction stack
[ 2686.325278] autofs4:pid:22459:autofs_fill_super: called with bogus options
[ 2686.331175] binder: undelivered TRANSACTION_ERROR: 29201
[ 2686.352595] autofs4:pid:22464:autofs_fill_super: called with bogus options
[ 2686.367424] autofs4:pid:22460:autofs_fill_super: called with bogus options
[ 2686.376664] binder: 22446:22462 transaction failed 29201/-71, size 0-0 line 2762
[ 2686.497432] binder_alloc: binder_alloc_mmap_handler: 22407 20001000-20004000 already mapped failed -16
[ 2686.524812] binder: BINDER_SET_CONTEXT_MGR already set
[ 2686.530112] binder: 22407:22423 ioctl 40046207 0 returned -16
[ 2686.553396] binder: BINDER_SET_CONTEXT_MGR already set
[ 2686.560084] autofs4:pid:22473:autofs_fill_super: called with bogus options
[ 2686.568570] binder: 22446:22462 ioctl 40046207 0 returned -16
[ 2686.568720] binder: release 22407:22478 transaction 7935 out, still active
[ 2686.581597] binder: undelivered TRANSACTION_COMPLETE
[ 2686.590677] binder: undelivered TRANSACTION_ERROR: 29201
[ 2686.596789] binder: 22407:22478 got reply transaction with no transaction stack
[ 2686.604821] binder: 22446:22472 got transaction to invalid handle
[ 2686.614880] binder: 22407:22478 transaction failed 29201/-71, size 0-0 line 2762
[ 2686.619085] binder: 22446:22472 transaction failed 29201/-22, size 1530426416456697975--5654238719857157782 line 2855
02:38:35 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x700, &(0x7f0000000500)})

02:38:35 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:35 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb="2f6465762f6e756c6c623002", &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:35 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2686.654640] binder: undelivered TRANSACTION_ERROR: 29201
[ 2686.682226] binder: 22446:22472 got reply transaction with no transaction stack
[ 2686.702986] binder: undelivered TRANSACTION_ERROR: 29201
[ 2686.729212] binder: 22446:22472 transaction failed 29201/-71, size 0-0 line 2762
02:38:35 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\n', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2686.779205] autofs4:pid:22480:autofs_fill_super: called with bogus options
[ 2686.786798] binder: BINDER_SET_CONTEXT_MGR already set
[ 2686.792113] binder: 22488:22489 ioctl 40046207 0 returned -16
[ 2686.807727] autofs4:pid:22484:autofs_fill_super: called with bogus options
[ 2686.816207] binder: release 22446:22451 transaction 7935 in, still active
[ 2686.824481] binder: send failed reply for transaction 7935, target dead
[ 2686.839253] binder: undelivered TRANSACTION_ERROR: 29201
[ 2686.875664] binder: 22488:22489 transaction failed 29189/-22, size 0-0 line 2855
[ 2686.887247] autofs4:pid:22493:autofs_fill_super: called with bogus options
[ 2686.903705] autofs4:pid:22492:autofs_fill_super: called with bogus options
02:38:35 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
ioctl$TIOCCONS(r3, 0x541d)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:38:35 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\n', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2686.921466] autofs4:pid:22485:autofs_fill_super: called with bogus options
[ 2686.921992] binder: undelivered TRANSACTION_ERROR: 29201
[ 2686.934758] binder: 22488:22498 got reply transaction with no transaction stack
[ 2686.951087] binder: undelivered TRANSACTION_ERROR: 29189
[ 2686.955144] binder: 22488:22498 transaction failed 29201/-71, size 0-0 line 2762
02:38:35 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:35 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d7660")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r1 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2686.987482] autofs4:pid:22496:autofs_fill_super: called with bogus options
[ 2686.998256] binder: release 22502:22503 transaction 7942 out, still active
[ 2687.015280] binder: send failed reply for transaction 7942, target dead
[ 2687.024529] binder: undelivered TRANSACTION_COMPLETE
02:38:35 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\n', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:35 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2687.043424] binder: BINDER_SET_CONTEXT_MGR already set
[ 2687.055571] vhci_hcd: invalid port number 0
02:38:36 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f6673ff", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2687.086128] binder: 22502:22509 ioctl 40046207 0 returned -16
[ 2687.088701] binder_alloc: 22502: binder_alloc_buf, no vma
[ 2687.118186] binder: 22502:22508 got reply transaction with no transaction stack
[ 2687.147805] autofs4:pid:22519:autofs_fill_super: called with bogus options
[ 2687.155387] binder: undelivered TRANSACTION_ERROR: 29189
[ 2687.163093] autofs4:pid:22522:autofs_fill_super: called with bogus options
[ 2687.556132] binder_alloc: binder_alloc_mmap_handler: 22488 20001000-20004000 already mapped failed -16
[ 2687.566756] binder_alloc: 22488: binder_alloc_buf, no vma
[ 2687.573195] binder: 22488:22533 got reply transaction with no transaction stack
02:38:36 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:36 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:36 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x200000000000000, &(0x7f0000000500)})

02:38:36 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:36 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:36 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\fd\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x5, 0x40)
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2687.755335] binder: 22539:22540 unknown command 25612
[ 2687.792436] autofs4:pid:22536:autofs_fill_super: called with bogus options
[ 2687.801345] binder: 22539:22540 ioctl c0306201 20000140 returned -22
[ 2687.820789] autofs4:pid:22543:autofs_fill_super: called with bogus options
02:38:36 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2687.847896] binder: BINDER_SET_CONTEXT_MGR already set
[ 2687.854126] binder: 22539:22540 got reply transaction with no transaction stack
[ 2687.869772] binder: release 22539:22540 transaction 7950 out, still active
[ 2687.877753] binder: 22549:22551 ioctl 40046207 0 returned -16
[ 2687.885812] binder: BINDER_SET_CONTEXT_MGR already set
[ 2687.894365] binder: undelivered TRANSACTION_COMPLETE
[ 2687.906772] autofs4:pid:22557:autofs_fill_super: called with bogus options
[ 2687.924465] binder_alloc: 22539: binder_alloc_buf, no vma
[ 2687.930107] binder: 22539:22550 ioctl 40046207 0 returned -16
[ 2687.944570] binder_alloc: 22539: binder_alloc_buf, no vma
[ 2687.962100] binder: 22539:22561 unknown command 25612
[ 2687.973827] autofs4:pid:22538:autofs_fill_super: called with bogus options
[ 2687.981690] binder: 22549:22562 got reply transaction with no transaction stack
[ 2687.982172] autofs4:pid:22559:autofs_fill_super: called with bogus options
02:38:36 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d76")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r1 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2687.990639] binder: send failed reply for transaction 7950, target dead
[ 2688.002017] binder: 22539:22561 ioctl c0306201 20000140 returned -22
[ 2688.013126] autofs4:pid:22557:autofs_fill_super: called with bogus options
02:38:37 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="017b4040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

02:38:37 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d76")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r1 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

02:38:37 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f667305", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:37 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb="2f6465762f6e756c6c6230f6", &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2688.107584] autofs4:pid:22559:autofs_fill_super: called with bogus options
[ 2688.149106] vhci_hcd: invalid port number 0
02:38:37 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2688.180751] binder: release 22570:22573 transaction 7956 out, still active
[ 2688.188165] binder: 22570:22573 unknown command 1077967617
[ 2688.195282] binder: undelivered TRANSACTION_COMPLETE
[ 2688.243462] binder: 22570:22573 ioctl c0306201 20000600 returned -22
02:38:37 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2688.317295] binder: BINDER_SET_CONTEXT_MGR already set
[ 2688.335890] autofs4:pid:22582:autofs_fill_super: called with bogus options
[ 2688.343823] binder: 22570:22590 ioctl 40046207 0 returned -16
[ 2688.351046] autofs4:pid:22591:autofs_fill_super: called with bogus options
[ 2688.359539] binder_alloc: 22570: binder_alloc_buf, no vma
[ 2688.377384] binder: 22570:22590 unknown command 1077967617
[ 2688.398908] binder: 22570:22590 ioctl c0306201 20000600 returned -22
[ 2688.409096] autofs4:pid:22595:autofs_fill_super: called with bogus options
[ 2688.419916] binder: release 22570:22573 transaction 7956 in, still active
[ 2688.429202] binder: send failed reply for transaction 7956, target dead
[ 2688.437187] autofs4:pid:22591:autofs_fill_super: called with bogus options
[ 2688.616024] binder_alloc: binder_alloc_mmap_handler: 22549 20001000-20004000 already mapped failed -16
[ 2688.626211] binder_alloc: 22549: binder_alloc_buf, no vma
[ 2688.632666] binder: 22549:22601 got reply transaction with no transaction stack
02:38:37 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x6c00000000000000, &(0x7f0000000500)})

02:38:37 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0o', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:37 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:37 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
r3 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f00000000c0)=0x60)
bind(r3, &(0x7f0000000180)=@pppoe={0x18, 0x0, {0x3, @empty, 'syz_tun\x00'}}, 0x80)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:38:37 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:37 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2688.845240] autofs4:pid:22604:autofs_fill_super: called with bogus options
[ 2688.847189] binder: release 22608:22611 transaction 7962 out, still active
[ 2688.860760] binder: send failed reply for transaction 7962, target dead
[ 2688.889547] autofs4:pid:22609:autofs_fill_super: called with bogus options
[ 2688.897856] binder: BINDER_SET_CONTEXT_MGR already set
[ 2688.903155] binder: 22614:22615 ioctl 40046207 0 returned -16
[ 2688.904578] binder: undelivered TRANSACTION_COMPLETE
[ 2688.927235] binder: BINDER_SET_CONTEXT_MGR already set
[ 2688.967472] binder_alloc: 22608: binder_alloc_buf, no vma
[ 2688.974121] binder: 22608:22616 ioctl 40046207 0 returned -16
02:38:37 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f6673ff", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2689.020057] binder_alloc: binder_alloc_mmap_handler: 22614 20001000-20004000 already mapped failed -16
[ 2689.040518] binder_alloc: 22608: binder_alloc_buf, no vma
02:38:38 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:38 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000340)={0x5c, 0x0, &(0x7f00000002c0)=[@reply_sg={0x40486312, {{0x3, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000180)=[@fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x1, 0x37}, @ptr={0x70742a85, 0x1, &(0x7f0000000040), 0x1, 0x0, 0x1}], &(0x7f00000000c0)=[0x28, 0x0, 0x30]}, 0x3}}, @clear_death={0x400c630f, 0x4, 0x3}], 0xfc, 0x0, &(0x7f0000000500)="231215fd919743deefdd4feeed2a25de54ba42bdc37313c842b01e87ad13f19977e6e28adbe9ed0811c5778d2d44da2829da337228bee64f28ffbae01fbc6e97517674345b56366c7856023601de224184a8100baaf55c6364fa4fbfa4e562431c5d0cc6ebe15ec81c16b8699941311da576007f34e5bd036e2e0ececf490e877c56c845f951914ccc3497546278b51d51414cada24c91cc3761c5d3611c9aaf8e7a42fc0d90cececaa6d7633ec0439dc80b5c88c54d39ef4312d893e72518e0f015c66faa3859efbee3d552c00b6c8904f280405e9c3d87ac9dab76d4e706eea43e79b8988851e6e9fad1e0a28c4c24fb704b18bd156ab3655bf803"})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2689.077055] binder: BINDER_SET_CONTEXT_MGR already set
[ 2689.097222] autofs4:pid:22610:autofs_fill_super: called with bogus options
[ 2689.110574] binder: 22614:22620 ioctl 40046207 0 returned -16
[ 2689.246311] autofs4:pid:22636:autofs_fill_super: called with bogus options
02:38:38 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2689.322196] binder: release 22634:22637 transaction 7971 out, still active
[ 2689.335174] binder: send failed reply for transaction 7971, target dead
[ 2689.343424] binder: undelivered TRANSACTION_COMPLETE
02:38:38 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x700000000000000, &(0x7f0000000500)})

[ 2689.456701] binder: BINDER_SET_CONTEXT_MGR already set
[ 2689.462020] binder: 22634:22641 ioctl 40046207 0 returned -16
02:38:38 executing program 1:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x300, &(0x7f0000000500)})

[ 2689.501465] binder_alloc: 22634: binder_alloc_buf, no vma
02:38:38 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2689.576966] binder: BINDER_SET_CONTEXT_MGR already set
02:38:38 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2689.630438] binder: 22642:22644 ioctl 40046207 0 returned -16
[ 2689.646289] binder: undelivered TRANSACTION_COMPLETE
[ 2689.652044] binder: send failed reply for transaction 7976, target dead
[ 2689.681888] binder: undelivered TRANSACTION_COMPLETE
[ 2689.697025] binder_alloc: binder_alloc_mmap_handler: 22642 20001000-20004000 already mapped failed -16
02:38:38 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c7700001fbda62c7a9ce8ed6a8070b00048b14404f1cf0cf298982faaa58f865b4835e929737d6e409ea0a131b4d886e87873376863559d40e3a78e391fe0de27585d882a4c4f0c61b7dd74fb5de6aac1dc"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:38:38 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2689.755028] binder: BINDER_SET_CONTEXT_MGR already set
[ 2689.760400] binder: 22642:22644 ioctl 40046207 0 returned -16
[ 2689.785874] autofs4:pid:22652:autofs_fill_super: called with bogus options
02:38:38 executing program 1:
r0 = socket$inet6(0xa, 0x0, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r1 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2689.832686] binder: BINDER_SET_CONTEXT_MGR already set
[ 2689.843814] binder: 22657:22660 ioctl 40046207 0 returned -16
[ 2689.843829] binder: send failed reply for transaction 7978, target dead
[ 2689.863177] binder: 22657:22660 unknown command 30476
[ 2689.878446] binder: 22657:22660 ioctl c0306201 20000140 returned -22
02:38:38 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2689.955216] vhci_hcd: invalid port number 0
[ 2689.964790] binder: 22657:22660 unknown command 30476
02:38:38 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x5000000, &(0x7f0000000500)})

[ 2690.012325] binder: 22657:22660 ioctl c0306201 20000140 returned -22
02:38:39 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2690.099778] autofs4:pid:22671:autofs_fill_super: called with bogus options
[ 2690.124663] binder: BINDER_SET_CONTEXT_MGR already set
02:38:39 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2690.150323] binder: 22673:22675 ioctl 40046207 0 returned -16
02:38:39 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2690.201314] binder: send failed reply for transaction 7986 to 22673:22678
02:38:39 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2690.317964] autofs4:pid:22682:autofs_fill_super: called with bogus options
02:38:39 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:39 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:39 executing program 1:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2690.745989] vhci_hcd: invalid port number 0
02:38:39 executing program 1:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2690.820266] autofs4:pid:22692:autofs_fill_super: called with bogus options
02:38:39 executing program 5:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2690.894218] binder_alloc: binder_alloc_mmap_handler: 22673 20001000-20004000 already mapped failed -16
[ 2690.923700] vhci_hcd: invalid port number 0
[ 2690.936913] binder_transaction: 31 callbacks suppressed
[ 2690.936930] binder: 22673:22700 transaction failed 29189/-3, size 0-0 line 2970
[ 2690.982911] binder_transaction: 10 callbacks suppressed
[ 2690.982921] binder: 22673:22702 got reply transaction with no transaction stack
[ 2691.025404] binder_release_work: 29 callbacks suppressed
[ 2691.025412] binder: undelivered TRANSACTION_ERROR: 29201
[ 2691.048790] binder: undelivered TRANSACTION_ERROR: 29189
02:38:40 executing program 1:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2691.076687] binder: BINDER_SET_CONTEXT_MGR already set
[ 2691.082046] binder: 22680:22684 ioctl 40046207 0 returned -16
[ 2691.093308] binder: 22673:22702 transaction failed 29201/-71, size 0-0 line 2762
02:38:40 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x3, &(0x7f0000000500)})

[ 2691.125181] binder_alloc_new_buf_locked: 1 callbacks suppressed
[ 2691.125188] binder_alloc: 22673: binder_alloc_buf, no vma
[ 2691.125669] binder: 22680:22705 got reply transaction with no transaction stack
[ 2691.144414] binder: undelivered TRANSACTION_ERROR: 29201
[ 2691.155391] binder: 22680:22684 transaction failed 29189/-3, size 0-0 line 2970
[ 2691.224532] binder: undelivered TRANSACTION_ERROR: 29201
[ 2691.230260] binder: 22680:22705 transaction failed 29201/-71, size 0-0 line 2762
[ 2691.237171] binder: undelivered TRANSACTION_ERROR: 29189
[ 2691.313936] binder_thread_release: 3 callbacks suppressed
[ 2691.313946] binder: release 22706:22707 transaction 7997 out, still active
[ 2691.326685] binder: 22706:22707 transaction failed 29189/0, size 0-0 line 2787
[ 2691.334061] binder_send_failed_reply: 1 callbacks suppressed
[ 2691.334069] binder: send failed reply for transaction 7997, target dead
02:38:40 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})
ioctl$PERF_EVENT_IOC_REFRESH(r3, 0x2402, 0xfffffffffdfffffc)

[ 2691.367140] binder_release_work: 2 callbacks suppressed
[ 2691.367146] binder: undelivered TRANSACTION_COMPLETE
[ 2691.404403] binder: undelivered TRANSACTION_ERROR: 29201
[ 2691.412243] binder_alloc: binder_alloc_mmap_handler: 22706 20001000-20004000 already mapped failed -16
[ 2691.424106] binder: BINDER_SET_CONTEXT_MGR already set
[ 2691.449362] binder: 22709:22710 ioctl 40046207 0 returned -16
[ 2691.456091] binder: BINDER_SET_CONTEXT_MGR already set
[ 2691.461390] binder: 22706:22707 ioctl 40046207 0 returned -16
[ 2691.468391] binder_alloc: 22706: binder_alloc_buf, no vma
[ 2691.484424] binder: 22709:22710 transaction failed 29189/-3, size 0-0 line 2970
[ 2691.492022] binder_alloc: 22706: binder_alloc_buf, no vma
[ 2691.506413] binder: 22706:22708 transaction failed 29189/-3, size 0-0 line 2970
[ 2691.506507] binder: 22706:22711 got reply transaction with no transaction stack
[ 2691.507892] binder: undelivered TRANSACTION_ERROR: 29190
[ 2691.528859] binder: 22706:22711 transaction failed 29201/-71, size 0-0 line 2762
[ 2691.544493] binder: undelivered TRANSACTION_ERROR: 29189
[ 2691.552158] binder: 22709:22713 got reply transaction with no transaction stack
[ 2691.558071] binder: undelivered TRANSACTION_ERROR: 29189
[ 2691.581228] binder: 22709:22713 transaction failed 29201/-71, size 0-0 line 2762
[ 2691.617351] binder: undelivered TRANSACTION_ERROR: 29201
02:38:40 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x74, &(0x7f0000000500)})

02:38:40 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:40 executing program 5:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

02:38:41 executing program 1:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

02:38:41 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2692.108309] binder: release 22717:22718 transaction 8004 out, still active
[ 2692.117096] binder: 22717:22718 transaction failed 29189/0, size 0-0 line 2787
[ 2692.129252] binder: undelivered TRANSACTION_COMPLETE
[ 2692.166538] binder: send failed reply for transaction 8004, target dead
[ 2692.192578] binder_alloc: binder_alloc_mmap_handler: 22717 20001000-20004000 already mapped failed -16
[ 2692.203350] binder: BINDER_SET_CONTEXT_MGR already set
[ 2692.215218] binder: 22709:22713 ioctl 40046207 0 returned -16
[ 2692.244915] binder: 22709:22724 got reply transaction with no transaction stack
[ 2692.254570] binder: BINDER_SET_CONTEXT_MGR already set
[ 2692.259916] binder: 22717:22718 ioctl 40046207 0 returned -16
[ 2692.293576] IPVS: ftp: loaded support on port[0] = 21
02:38:41 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x800)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2692.314448] binder: 22717:22718 got reply transaction with no transaction stack
[ 2692.351441] IPVS: ftp: loaded support on port[0] = 21
[ 2692.383096] IPVS: ftp: loaded support on port[0] = 21
02:38:41 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x100000000000000, &(0x7f0000000500)})

[ 2692.422239] IPVS: ftp: loaded support on port[0] = 21
[ 2692.427679] binder: release 22731:22732 transaction 8009 out, still active
[ 2692.435188] binder: send failed reply for transaction 8009, target dead
[ 2692.442036] binder: undelivered TRANSACTION_COMPLETE
[ 2692.457344] device bridge_slave_1 left promiscuous mode
[ 2692.462824] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2692.479224] binder: BINDER_SET_CONTEXT_MGR already set
[ 2692.491133] binder: 22731:22733 ioctl 40046207 0 returned -16
[ 2692.500521] binder: 22731:22733 ioctl c0306201 20000140 returned -11
[ 2692.507566] binder_alloc: 22731: binder_alloc_buf, no vma
[ 2692.513554] binder: 22731:22733 got reply transaction with no transaction stack
02:38:41 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r3, 0xc02c5341, &(0x7f0000000000))

[ 2692.525889] device bridge_slave_0 left promiscuous mode
[ 2692.531366] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2692.541529] binder: release 22734:22735 transaction 8014 out, still active
[ 2692.549101] binder: send failed reply for transaction 8014, target dead
[ 2692.556129] binder: undelivered TRANSACTION_COMPLETE
[ 2692.564255] binder_alloc: binder_alloc_mmap_handler: 22734 20001000-20004000 already mapped failed -16
[ 2692.573973] binder: BINDER_SET_CONTEXT_MGR already set
[ 2692.582510] binder: 22734:22735 ioctl 40046207 0 returned -16
[ 2692.589576] binder_alloc: 22734: binder_alloc_buf, no vma
[ 2692.596323] binder: 22734:22736 got reply transaction with no transaction stack
[ 2692.605114] binder: release 22737:22738 transaction 8019 out, still active
[ 2692.612434] binder: send failed reply for transaction 8019, target dead
[ 2692.619483] binder: undelivered TRANSACTION_COMPLETE
02:38:41 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x74000000, &(0x7f0000000500)})

[ 2692.639558] binder: BINDER_SET_CONTEXT_MGR already set
[ 2692.650352] team0 (unregistering): Port device team_slave_1 removed
[ 2692.657221] binder: 22737:22740 ioctl 40046207 0 returned -16
[ 2692.667817] binder_alloc: 22737: binder_alloc_buf, no vma
[ 2692.667911] binder: 22737:22740 got reply transaction with no transaction stack
[ 2692.682822] team0 (unregistering): Port device team_slave_0 removed
02:38:41 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
socketpair$packet(0x11, 0x0, 0x300, &(0x7f0000000080))
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080), 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000500)={{{@in6=@remote, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{}, 0x0, @in6}}, &(0x7f00000000c0)=0xe8)
r5 = getpgrp(0x0)
wait4(r5, &(0x7f00000002c0), 0x20000000, 0x0)
getsockopt$inet6_mreq(r3, 0x29, 0xe5cf363705acf420, &(0x7f0000000180)={@local, <r6=>0x0}, &(0x7f00000001c0)=0x14)
accept4$packet(r3, &(0x7f0000000400)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000001d40)=0x14, 0x80000)
getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000001d80)={<r8=>0x0, @rand_addr, @rand_addr}, &(0x7f0000001dc0)=0xc)
accept4$packet(r3, &(0x7f0000001e00)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000001e40)=0x14, 0x800)
getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000001e80)={{{@in6=@loopback, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in6=@mcast1}, 0x0, @in6=@dev}}, &(0x7f0000001f80)=0xe8)
sendmsg$nl_route(r3, &(0x7f0000002080)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000002040)={&(0x7f0000001fc0)=@mpls_getnetconf={0x64, 0x52, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r4}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x1}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r6}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x81}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}, @NETCONFA_IFINDEX={0x8, 0x1, r9}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x9}, @NETCONFA_IFINDEX={0x8, 0x1, r10}]}, 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x4000)
ioctl$DRM_IOCTL_RM_MAP(r3, 0x4028641b, &(0x7f0000000000)={&(0x7f0000002000/0x4000)=nil, 0x3, 0x4, 0xc1, &(0x7f0000ffb000/0x4000)=nil})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2692.698361] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2692.706124] binder: BINDER_SET_CONTEXT_MGR already set
[ 2692.716011] binder: 22741:22742 ioctl 40046207 0 returned -16
[ 2692.748789] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2692.781610] binder: 22741:22745 got reply transaction with no transaction stack
[ 2692.813425] binder: release 22743:22744 transaction 8025 out, still active
[ 2692.825291] binder: undelivered TRANSACTION_COMPLETE
[ 2692.838311] bond0 (unregistering): Released all slaves
[ 2693.493896] binder_alloc: binder_alloc_mmap_handler: 22741 20001000-20004000 already mapped failed -16
[ 2693.515233] binder: BINDER_SET_CONTEXT_MGR already set
[ 2693.529018] binder: 22741:22745 ioctl 40046207 0 returned -16
[ 2693.564566] binder: release 22741:22785 transaction 8028 out, still active
[ 2693.565954] binder: BINDER_SET_CONTEXT_MGR already set
[ 2693.571648] binder: undelivered TRANSACTION_COMPLETE
[ 2693.620905] binder: 22743:22746 ioctl 40046207 0 returned -16
[ 2693.621491] binder_alloc: 22743: binder_alloc_buf, no vma
02:38:42 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x4c000000, &(0x7f0000000500)})

[ 2693.694419] binder: send failed reply for transaction 8025, target dead
[ 2693.701190] binder: send failed reply for transaction 8028, target dead
02:38:42 executing program 3:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2, 0x200)
ioctl$RTC_UIE_ON(r0, 0x7003)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000180)={{0x2, 0x4e20, @loopback}, {0x306}, 0x8, {0x2, 0x4e24, @multicast2}, 'bpq0\x00'})
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r1, r2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2693.770045] binder: release 22803:22806 transaction 8033 out, still active
[ 2693.783292] binder: send failed reply for transaction 8033, target dead
[ 2693.794383] binder: undelivered TRANSACTION_COMPLETE
[ 2693.839032] binder_alloc: binder_alloc_mmap_handler: 22803 20001000-20004000 already mapped failed -16
[ 2693.857664] binder: BINDER_SET_CONTEXT_MGR already set
[ 2693.862968] binder: 22812:22813 ioctl 40046207 0 returned -16
[ 2693.890122] binder: BINDER_SET_CONTEXT_MGR already set
[ 2693.917750] binder: 22803:22806 ioctl 40046207 0 returned -16
[ 2693.935487] binder_alloc: 22803: binder_alloc_buf, no vma
[ 2693.941572] binder_alloc: 22803: binder_alloc_buf, no vma
02:38:42 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x7a00, &(0x7f0000000500)})

[ 2694.121360] binder: release 22834:22835 transaction 8040 out, still active
[ 2694.129744] binder: send failed reply for transaction 8040, target dead
[ 2694.140663] binder: undelivered TRANSACTION_COMPLETE
[ 2694.184638] binder_alloc: binder_alloc_mmap_handler: 22834 20001000-20004000 already mapped failed -16
[ 2694.238305] binder: BINDER_SET_CONTEXT_MGR already set
[ 2694.254858] binder: 22834:22835 ioctl 40046207 0 returned -16
[ 2694.273198] binder_alloc: 22834: binder_alloc_buf, no vma
[ 2694.638920] binder: send failed reply for transaction 8045 to 22812:22821
[ 2694.645951] binder: undelivered TRANSACTION_COMPLETE
[ 2695.057065] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2695.070141] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2695.077964] device bridge_slave_0 entered promiscuous mode
[ 2695.086699] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2695.093068] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2695.115337] device bridge_slave_0 entered promiscuous mode
[ 2695.135505] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2695.141877] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2695.159643] device bridge_slave_0 entered promiscuous mode
[ 2695.177300] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2695.183649] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2695.200055] device bridge_slave_0 entered promiscuous mode
[ 2695.213562] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2695.224546] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2695.231657] device bridge_slave_1 entered promiscuous mode
[ 2695.265569] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2695.272421] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2695.291556] device bridge_slave_1 entered promiscuous mode
[ 2695.307211] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2695.313603] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2695.325169] device bridge_slave_1 entered promiscuous mode
[ 2695.350876] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2695.361483] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2695.369313] device bridge_slave_1 entered promiscuous mode
[ 2695.377805] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2695.393532] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2695.436767] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2695.466678] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2695.475278] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2695.493786] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2695.542187] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2695.557221] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2696.167436] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2696.179076] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2696.197455] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2696.338736] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2696.349670] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2696.363123] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2696.416731] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2696.562375] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2696.587008] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[ 2696.728996] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 2696.738742] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 2696.747650] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 2696.757459] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 2696.774575] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 2696.782328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 2696.798886] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 2696.917875] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[ 2696.948280] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 2697.129624] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 2697.160933] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 2697.296768] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2697.304062] team0: Port device team_slave_0 added
[ 2697.317654] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2697.334993] team0: Port device team_slave_0 added
[ 2697.340393] device bridge_slave_1 left promiscuous mode
[ 2697.346775] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2697.375542] device bridge_slave_0 left promiscuous mode
[ 2697.381034] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2697.455463] device bridge_slave_1 left promiscuous mode
[ 2697.460953] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2697.515175] device bridge_slave_0 left promiscuous mode
[ 2697.520663] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2697.575487] device bridge_slave_1 left promiscuous mode
[ 2697.580993] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2697.634933] device bridge_slave_0 left promiscuous mode
[ 2697.640416] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2699.458089] team0 (unregistering): Port device team_slave_1 removed
[ 2699.468009] team0 (unregistering): Port device team_slave_0 removed
[ 2699.479349] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2699.538833] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2699.623951] bond0 (unregistering): Released all slaves
[ 2699.687842] team0 (unregistering): Port device team_slave_1 removed
[ 2699.698973] team0 (unregistering): Port device team_slave_0 removed
[ 2699.709881] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2699.767648] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2699.853275] bond0 (unregistering): Released all slaves
[ 2699.927922] team0 (unregistering): Port device team_slave_1 removed
[ 2699.939375] team0 (unregistering): Port device team_slave_0 removed
[ 2699.950401] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2700.007689] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2700.092699] bond0 (unregistering): Released all slaves
[ 2700.168041] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2700.176441] team0: Port device team_slave_0 added
[ 2700.198327] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2700.207073] team0: Port device team_slave_1 added
[ 2700.230412] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2700.244944] team0: Port device team_slave_1 added
[ 2700.304422] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2700.324724] team0: Port device team_slave_1 added
[ 2700.331976] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2700.354894] team0: Port device team_slave_0 added
[ 2700.361920] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[ 2700.378310] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[ 2700.403682] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 2700.424954] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2700.434905] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 2700.459637] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2700.478546] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[ 2700.492634] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[ 2700.508150] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2700.516855] team0: Port device team_slave_1 added
[ 2700.524850] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 2700.543227] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2700.569238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 2700.584902] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2700.606481] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[ 2700.616677] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[ 2700.623710] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[ 2700.638075] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 2700.653159] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2700.684865] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 2700.704788] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2700.734646] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 2700.742411] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2700.767081] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 2700.775917] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 2700.785370] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 2700.795172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 2700.802976] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2700.835144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 2700.843014] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2700.858518] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 2700.866869] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2700.875223] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[ 2700.893886] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 2700.914972] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 2700.922061] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 2700.935084] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2700.961511] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 2700.984808] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2700.992593] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 2701.006064] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2701.016473] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 2701.024725] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 2701.032530] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2701.056434] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 2701.064305] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 2701.072458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2701.169933] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 2701.181917] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 2701.192071] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2702.066063] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2702.072467] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2702.079138] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2702.085529] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2702.110525] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2702.120119] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2702.126509] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2702.133125] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2702.139512] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2702.161286] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2702.244405] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2702.252065] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2702.262393] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2702.268778] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2702.275430] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2702.281801] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2702.290452] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2702.302275] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2702.308656] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2702.315377] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2702.321735] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2702.348927] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2703.274411] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2703.284762] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2705.445569] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2705.585708] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2705.637379] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2705.685532] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2705.772301] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2705.885108] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2705.960790] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2705.989521] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2706.096493] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2706.102921] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2706.112385] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2706.155701] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2706.161877] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2706.175235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2706.284066] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2706.294838] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2706.305287] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2706.377189] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2706.385419] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2706.392398] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2706.495741] 8021q: adding VLAN 0 to HW filter on device team0
[ 2706.514471] 8021q: adding VLAN 0 to HW filter on device team0
[ 2706.627817] 8021q: adding VLAN 0 to HW filter on device team0
[ 2706.699579] 8021q: adding VLAN 0 to HW filter on device team0
02:38:57 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2708.376211] vhci_hcd: invalid port number 0
02:38:57 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2708.491897] autofs4:pid:23782:autofs_fill_super: called with bogus options
[ 2708.548125] autofs4:pid:23786:autofs_fill_super: called with bogus options
02:38:57 executing program 1:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2708.648926] autofs4:pid:23790:autofs_fill_super: called with bogus options
[ 2708.656892] autofs4:pid:23780:autofs_fill_super: called with bogus options
[ 2708.661057] vhci_hcd: invalid port number 0
02:38:57 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:38:57 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x300, &(0x7f0000000500)})

02:38:57 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x40000000)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x402000, 0x0)
r4 = getpid()
ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r3, 0xc1105518, &(0x7f0000000640)={{0x4, 0x2, 0x100000000, 0x3, '\x00', 0x2c06}, 0x1, 0x20000220, 0x100000001, r4, 0x2, 0x9, 'syz1\x00', &(0x7f0000000040)=['/dev/binder#\x00', ')\x00'], 0xf, [], [0x2, 0x2, 0x1, 0x4]})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000280)=ANY=[], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:38:57 executing program 1:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})

02:38:57 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:57 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2708.725668] autofs4:pid:23795:autofs_fill_super: called with bogus options
[ 2708.758173] vhci_hcd: invalid port number 0
[ 2708.826142] binder: BINDER_SET_CONTEXT_MGR already set
[ 2708.831494] binder: 23809:23811 ioctl 40046207 0 returned -16
[ 2708.856527] binder_alloc_new_buf_locked: 1 callbacks suppressed
[ 2708.856534] binder_alloc: 23809: binder_alloc_buf, no vma
[ 2708.861212] autofs4:pid:23810:autofs_fill_super: called with bogus options
02:38:57 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2708.862785] binder_transaction: 26 callbacks suppressed
[ 2708.862800] binder: 23803:23804 transaction failed 29189/-3, size 0-0 line 2970
[ 2708.893924] autofs4:pid:23806:autofs_fill_super: called with bogus options
[ 2708.902655] binder_transaction: 6 callbacks suppressed
[ 2708.902664] binder: 23809:23817 got reply transaction with no transaction stack
[ 2708.915668] binder: release 23809:23811 transaction 8048 out, still active
[ 2708.933746] autofs4:pid:23816:autofs_fill_super: called with bogus options
[ 2708.935061] binder: undelivered TRANSACTION_COMPLETE
[ 2708.941478] vhci_hcd: invalid port number 0
[ 2708.965476] binder: 23809:23817 transaction failed 29201/-71, size 0-0 line 2762
[ 2708.977027] binder: send failed reply for transaction 8048, target dead
02:38:57 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:57 executing program 1:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

02:38:57 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2708.995340] autofs4:pid:23815:autofs_fill_super: called with bogus options
[ 2709.029143] binder: BINDER_SET_CONTEXT_MGR already set
[ 2709.036852] autofs4:pid:23822:autofs_fill_super: called with bogus options
[ 2709.068801] binder: 23803:23827 ioctl 40046207 0 returned -16
[ 2709.076562] binder_release_work: 29 callbacks suppressed
[ 2709.076568] binder: undelivered TRANSACTION_ERROR: 29190
02:38:58 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

02:38:58 executing program 1:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2709.123192] autofs4:pid:23830:autofs_fill_super: called with bogus options
[ 2709.144704] autofs4:pid:23834:autofs_fill_super: called with bogus options
02:38:58 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2709.202727] autofs4:pid:23841:autofs_fill_super: called with bogus options
[ 2709.326168] autofs4:pid:23851:autofs_fill_super: called with bogus options
[ 2709.366690] autofs4:pid:23853:autofs_fill_super: called with bogus options
[ 2709.604023] binder_alloc: binder_alloc_mmap_handler: 23809 20001000-20004000 already mapped failed -16
[ 2709.613820] binder_alloc: 23809: binder_alloc_buf, no vma
[ 2709.619909] binder: 23809:23856 transaction failed 29189/-3, size 0-0 line 2970
[ 2709.628014] binder: undelivered TRANSACTION_ERROR: 29189
[ 2709.633804] binder: 23809:23856 got reply transaction with no transaction stack
[ 2709.641822] binder: undelivered TRANSACTION_ERROR: 29201
[ 2709.647454] binder: 23809:23856 transaction failed 29201/-71, size 0-0 line 2762
02:38:58 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x600, &(0x7f0000000500)})

02:38:58 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="122ebe5ae0a04a5b6a2a0ddd66b7"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:38:58 executing program 1:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

02:38:58 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f667302", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:58 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:58 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2709.854842] binder: undelivered TRANSACTION_ERROR: 29201
02:38:58 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:38:58 executing program 1:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2709.939215] binder: 23863:23865 unknown command 1522413074
[ 2709.947497] binder: BINDER_SET_CONTEXT_MGR already set
[ 2709.970351] autofs4:pid:23861:autofs_fill_super: called with bogus options
[ 2709.979154] binder: 23863:23865 ioctl c0306201 20000140 returned -22
[ 2709.979675] binder: 23870:23872 ioctl 40046207 0 returned -16
[ 2710.004953] vhci_hcd: invalid port number 0
[ 2710.023211] binder: 23863:23865 got reply transaction with no transaction stack
[ 2710.030849] binder: release 23863:23865 transaction 8055 out, still active
[ 2710.047278] binder: 23863:23865 transaction failed 29201/-71, size 0-0 line 2762
[ 2710.048046] binder: undelivered TRANSACTION_COMPLETE
[ 2710.065322] autofs4:pid:23864:autofs_fill_super: called with bogus options
[ 2710.074159] binder: 23870:23879 got reply transaction with no transaction stack
[ 2710.088498] binder: release 23870:23879 transaction 8057 out, still active
02:38:59 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
sync()

02:38:59 executing program 1:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2710.088749] binder: 23870:23879 transaction failed 29201/-71, size 0-0 line 2762
[ 2710.109165] autofs4:pid:23877:autofs_fill_super: called with bogus options
[ 2710.118887] binder: BINDER_SET_CONTEXT_MGR already set
[ 2710.124426] binder: undelivered TRANSACTION_COMPLETE
[ 2710.129210] binder: 23863:23881 ioctl 40046207 0 returned -16
[ 2710.163195] autofs4:pid:23882:autofs_fill_super: called with bogus options
[ 2710.163228] binder_alloc: 23863: binder_alloc_buf, no vma
[ 2710.196899] autofs4:pid:23883:autofs_fill_super: called with bogus options
02:38:59 executing program 1:
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2710.209665] vhci_hcd: invalid port number 0
[ 2710.220108] binder: 23863:23881 unknown command 1522413074
02:38:59 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f667303", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2710.259276] binder: 23863:23893 got reply transaction with no transaction stack
[ 2710.314787] binder: undelivered TRANSACTION_ERROR: 29201
[ 2710.320377] binder: send failed reply for transaction 8055, target dead
[ 2710.327877] binder: 23863:23881 ioctl c0306201 20000140 returned -22
[ 2710.344451] binder: 23863:23865 transaction failed 29189/-3, size 0-0 line 2970
[ 2710.353062] binder: send failed reply for transaction 8057, target dead
[ 2710.366835] binder: 23863:23893 transaction failed 29201/-71, size 0-0 line 2762
[ 2710.384488] binder: undelivered TRANSACTION_ERROR: 29189
[ 2710.413148] vhci_hcd: invalid port number 0
[ 2710.425440] binder: undelivered TRANSACTION_ERROR: 29201
[ 2710.736961] binder_alloc: binder_alloc_mmap_handler: 23870 20001000-20004000 already mapped failed -16
[ 2710.747173] binder_alloc: 23870: binder_alloc_buf, no vma
[ 2710.752821] binder: 23870:23907 transaction failed 29189/-3, size 0-0 line 2970
[ 2710.760643] binder: undelivered TRANSACTION_ERROR: 29189
[ 2710.766541] binder: 23870:23907 got reply transaction with no transaction stack
[ 2710.774175] binder: undelivered TRANSACTION_ERROR: 29201
[ 2710.779871] binder: 23870:23907 transaction failed 29201/-71, size 0-0 line 2762
02:39:00 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x48, &(0x7f0000000500)})

02:39:00 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:00 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:00 executing program 1:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

02:39:00 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x4000, 0x0)
accept4$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, &(0x7f00000000c0)=0x1c, 0x800)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000180)={'vcan0\x00', <r4=>0x0})
connect$packet(r3, &(0x7f00000001c0)={0x11, 0x0, r4, 0x1, 0x40000000000, 0x6, @random="83197c594663"}, 0x14)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:00 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofsz', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2711.314430] binder: undelivered TRANSACTION_ERROR: 29201
[ 2711.379330] binder: release 23912:23913 transaction 8065 out, still active
[ 2711.387803] binder: send failed reply for transaction 8065, target dead
[ 2711.398510] binder: undelivered TRANSACTION_COMPLETE
[ 2711.411576] autofs4:pid:23910:autofs_fill_super: called with bogus options
[ 2711.436417] binder: BINDER_SET_CONTEXT_MGR already set
[ 2711.441743] binder: 23912:23925 ioctl 40046207 0 returned -16
[ 2711.443249] binder: BINDER_SET_CONTEXT_MGR already set
[ 2711.471264] binder: 23921:23922 ioctl 40046207 0 returned -16
02:39:00 executing program 1:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x0)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

02:39:00 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofst', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2711.482297] binder_alloc: 23912: binder_alloc_buf, no vma
[ 2711.500403] binder: 23912:23925 got reply transaction with no transaction stack
02:39:00 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb="2f6465762f6e756c6c6230c0", &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2711.537901] binder_alloc: 23912: binder_alloc_buf, no vma
[ 2711.544045] autofs4:pid:23919:autofs_fill_super: called with bogus options
02:39:00 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:00 executing program 1:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

02:39:00 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1f00004487fe3beec43e01e549ff78c21c384d8dcda59273324cfbd1476b699a6d2361a66d48cf8fb80930db0bb61a8fdecc607ca1c0a3f4"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={<r4=>0x0, r3, 0x0, 0xd, &(0x7f0000000040)='/dev/binder#\x00'}, 0x30)
r5 = getuid()
write$9p(r3, &(0x7f00000001c0)="496ca5048ea7ed61139ea5d467ef063354521ef5e5ccfe45804238a0bcac36839fcc8e4d", 0x24)
ioctl$DRM_IOCTL_GET_CLIENT(r3, 0xc0286405, &(0x7f0000000180)={0x9, 0x10000, r4, 0xfc0000, r5, 0x618, 0x9})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2711.625996] autofs4:pid:23929:autofs_fill_super: called with bogus options
[ 2711.647071] binder: 23921:23928 got reply transaction with no transaction stack
[ 2711.670406] autofs4:pid:23940:autofs_fill_super: called with bogus options
[ 2711.724555] binder: 23947:23949 unknown command 1140850719
[ 2711.736906] autofs4:pid:23950:autofs_fill_super: called with bogus options
[ 2711.739097] binder: 23947:23949 ioctl c0306201 20000440 returned -22
[ 2711.779371] autofs4:pid:23953:autofs_fill_super: called with bogus options
[ 2711.823066] binder: 23947:23956 got reply transaction with no transaction stack
[ 2712.210750] binder_alloc: binder_alloc_mmap_handler: 23921 20001000-20004000 already mapped failed -16
[ 2712.220651] binder: BINDER_SET_CONTEXT_MGR already set
[ 2712.226496] binder: 23921:23928 ioctl 40046207 0 returned -16
[ 2712.233234] binder: release 23921:23957 transaction 8073 out, still active
[ 2712.241642] binder: BINDER_SET_CONTEXT_MGR already set
[ 2712.247333] binder: 23921:23928 got reply transaction with no transaction stack
[ 2712.254387] binder: undelivered TRANSACTION_COMPLETE
[ 2712.254970] binder: 23947:23949 ioctl 40046207 0 returned -16
02:39:01 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x68, &(0x7f0000000500)})

02:39:01 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:01 executing program 1:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000))
sync()

02:39:01 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='%utofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:01 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs8', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2712.331326] binder: release 23947:23949 transaction 8073 in, still active
[ 2712.338471] binder: send failed reply for transaction 8073, target dead
02:39:01 executing program 1:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000))
sync()

[ 2712.382008] vhci_hcd: default hub control req: 0000 v0000 i0000 l0
02:39:01 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01030000001d83443e5b2c6c00000000000000000000000000000000f0946cbd000025f10000000000000000000000000000000003000000003d0a91c49a9ee50000", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

[ 2712.474280] autofs4:pid:23968:autofs_fill_super: called with bogus options
[ 2712.486053] binder_alloc: 23973: binder_alloc_buf, no vma
[ 2712.491727] binder: release 23973:23975 transaction 8077 out, still active
[ 2712.505972] binder: undelivered TRANSACTION_COMPLETE
[ 2712.516899] binder: send failed reply for transaction 8077, target dead
02:39:01 executing program 1:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000))
sync()

[ 2712.537758] binder: BINDER_SET_CONTEXT_MGR already set
[ 2712.555029] vhci_hcd: default hub control req: 0000 v0000 i0000 l0
[ 2712.570593] binder: 23980:23981 ioctl 40046207 0 returned -16
02:39:01 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:01 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2712.580715] binder_alloc: binder_alloc_mmap_handler: 23973 20001000-20004000 already mapped failed -16
[ 2712.606966] binder_alloc: 23973: binder_alloc_buf, no vma
02:39:01 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2712.650002] binder: BINDER_SET_CONTEXT_MGR already set
[ 2712.658896] binder: 23980:23981 unknown command 769
[ 2712.681067] binder: 23980:23981 ioctl c0306201 20000600 returned -22
[ 2712.685930] binder: 23973:23975 ioctl 40046207 0 returned -16
02:39:01 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x6000000, 0x0, &(0x7f0000000500)})

[ 2712.707178] autofs4:pid:23998:autofs_fill_super: called with bogus options
[ 2712.715261] vhci_hcd: default hub control req: 0000 v0000 i0000 l0
[ 2712.737347] binder_alloc: 23973: binder_alloc_buf, no vma
[ 2712.780884] binder_alloc: 23980: binder_alloc_buf, no vma
[ 2712.815401] autofs4:pid:24012:autofs_fill_super: called with bogus options
[ 2712.832582] binder: release 24007:24008 transaction 8085 out, still active
[ 2712.840452] binder: send failed reply for transaction 8085, target dead
[ 2712.847608] binder: undelivered TRANSACTION_COMPLETE
02:39:01 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x4000000, &(0x7f0000000500)})

02:39:01 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='a%tofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:01 executing program 1:
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x1fffff, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fsetxattr$security_evm(0xffffffffffffffff, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100), 0x1, 0x0)
connect(0xffffffffffffffff, &(0x7f0000000040)=@un=@abs, 0x80)
socket$inet6(0xa, 0x0, 0x0)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)

02:39:01 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6, 0x1c050, r1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
madvise(&(0x7f0000002000/0x1000)=nil, 0x1000, 0xa)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000f1af8e2ce860b225ec572b38bc4ae2ffff7d4b88a4502df8961476c31408613ebbf7b1d7fae561eb99325200ccc0bad06bd724f9b5962b63e30db36b7cd36616e96ee9c252ddf464598f99a745474d57b53f404153ac49c69afd1cd2cd"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2712.875625] autofs4:pid:24013:autofs_fill_super: called with bogus options
02:39:01 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2712.983296] binder: BINDER_SET_CONTEXT_MGR already set
[ 2713.015221] binder: BINDER_SET_CONTEXT_MGR already set
[ 2713.020655] binder: 24022:24028 ioctl 40046207 0 returned -16
02:39:01 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:01 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2713.033576] binder: 24020:24021 ioctl 40046207 0 returned -16
[ 2713.063068] binder: 24022:24024 unknown command 0
[ 2713.086482] binder_alloc: binder_alloc_mmap_handler: 24020 20001000-20004000 already mapped failed -16
[ 2713.089153] autofs4:pid:24030:autofs_fill_super: called with bogus options
[ 2713.117410] binder: 24022:24024 ioctl c0306201 20000140 returned -22
02:39:02 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2713.144122] autofs4:pid:24030:autofs_fill_super: called with bogus options
[ 2713.183449] autofs4:pid:24035:autofs_fill_super: called with bogus options
[ 2713.201999] binder: BINDER_SET_CONTEXT_MGR already set
02:39:02 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='au%ofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:02 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x3f00, &(0x7f0000000500)})

02:39:02 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2713.253581] binder: 24022:24028 unknown command 0
[ 2713.282597] autofs4:pid:24053:autofs_fill_super: called with bogus options
[ 2713.289701] binder: 24022:24028 ioctl c0306201 20000140 returned -22
[ 2713.297411] binder: 24022:24045 ioctl 40046207 0 returned -16
02:39:02 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x200000000, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\fc@\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2713.351839] binder: release 24057:24058 transaction 8097 out, still active
[ 2713.370296] binder: send failed reply for transaction 8097, target dead
[ 2713.377541] binder: undelivered TRANSACTION_COMPLETE
02:39:02 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb-\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:02 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb+\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2713.410170] autofs4:pid:24060:autofs_fill_super: called with bogus options
[ 2713.437174] binder_alloc: binder_alloc_mmap_handler: 24057 20001000-20004000 already mapped failed -16
[ 2713.480394] binder: BINDER_SET_CONTEXT_MGR already set
[ 2713.491555] binder: 24063:24064 ioctl 40046207 0 returned -16
[ 2713.497946] binder: BINDER_SET_CONTEXT_MGR already set
[ 2713.504802] autofs4:pid:24072:autofs_fill_super: called with bogus options
[ 2713.506699] binder: 24057:24058 ioctl 40046207 0 returned -16
[ 2713.538295] autofs4:pid:24070:autofs_fill_super: called with bogus options
[ 2713.547451] binder: 24063:24064 unknown command 4219660
[ 2713.555743] autofs4:pid:24071:autofs_fill_super: called with bogus options
02:39:02 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb#\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:02 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nul%b0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:02 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x4c00, &(0x7f0000000500)})

02:39:02 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2713.595040] binder: 24063:24064 ioctl c0306201 20000140 returned -22
[ 2713.633384] binder: 24063:24080 unknown command 4219660
[ 2713.685087] binder: 24063:24080 ioctl c0306201 20000140 returned -22
[ 2713.725875] autofs4:pid:24086:autofs_fill_super: called with bogus options
[ 2713.757280] autofs4:pid:24091:autofs_fill_super: called with bogus options
[ 2713.764410] autofs4:pid:24094:autofs_fill_super: called with bogus options
[ 2713.795290] binder: BINDER_SET_CONTEXT_MGR already set
02:39:02 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='aut%fs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:02 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nu.lb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2713.821068] binder: 24088:24096 ioctl 40046207 0 returned -16
[ 2713.835031] autofs4:pid:24098:autofs_fill_super: called with bogus options
[ 2713.856353] binder_alloc: 24063: binder_alloc_buf failed to map pages in userspace, no vma
02:39:02 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2713.896471] binder_transaction: 29 callbacks suppressed
[ 2713.896489] binder: 24088:24101 transaction failed 29189/-3, size 0-0 line 2970
02:39:02 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/npllb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:02 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2713.949149] binder_transaction: 9 callbacks suppressed
[ 2713.949158] binder: 24088:24101 got reply transaction with no transaction stack
[ 2713.967386] binder: 24088:24101 transaction failed 29201/-71, size 0-0 line 2762
[ 2713.975203] binder: release 24104:24106 transaction 8109 out, still active
[ 2713.975213] binder: undelivered TRANSACTION_COMPLETE
[ 2713.982411] binder: 24104:24106 transaction failed 29189/0, size 0-0 line 2787
[ 2714.018924] autofs4:pid:24108:autofs_fill_super: called with bogus options
[ 2714.024464] binder: send failed reply for transaction 8109, target dead
[ 2714.066700] autofs4:pid:24113:autofs_fill_super: called with bogus options
[ 2714.076647] autofs4:pid:24112:autofs_fill_super: called with bogus options
[ 2714.098160] binder: BINDER_SET_CONTEXT_MGR already set
[ 2714.123898] autofs4:pid:24122:autofs_fill_super: called with bogus options
[ 2714.128531] binder: 24104:24121 ioctl 40046207 0 returned -16
[ 2714.145759] binder_alloc_new_buf_locked: 2 callbacks suppressed
[ 2714.145769] binder_alloc: 24104: binder_alloc_buf, no vma
02:39:03 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:03 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofsH', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:03 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/ncllb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2714.224917] binder: 24104:24106 transaction failed 29189/-3, size 0-0 line 2970
[ 2714.226626] binder: 24104:24129 got reply transaction with no transaction stack
[ 2714.240121] binder_release_work: 29 callbacks suppressed
[ 2714.240128] binder: undelivered TRANSACTION_ERROR: 29189
[ 2714.285085] binder: undelivered TRANSACTION_ERROR: 29190
[ 2714.291522] binder: 24104:24129 transaction failed 29201/-71, size 0-0 line 2762
02:39:03 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/-ev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2714.351593] autofs4:pid:24133:autofs_fill_super: called with bogus options
[ 2714.372295] autofs4:pid:24139:autofs_fill_super: called with bogus options
02:39:03 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r3 = syz_open_dev$sndpcmc(&(0x7f0000000600)='/dev/snd/pcmC#D#c\x00', 0xffff, 0x101000)
openat$cgroup_subtree(r3, &(0x7f00000006c0)='cgroup.subtree_control\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r4 = dup2(r0, r1)
r5 = mmap$binder(&(0x7f0000003000/0x3000)=nil, 0x3000, 0xa, 0x1010, r4, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000800)={<r6=>r5})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000300)={<r7=>0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000340)={0xd0, 0x0, &(0x7f0000000500)=[@exit_looper, @register_looper, @reply_sg={0x40486312, {{0x2, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x28, 0x18, &(0x7f0000000040)=[@ptr={0x70742a85, 0x1, &(0x7f0000000000), 0x1, 0x3, 0x33}], &(0x7f00000000c0)=[0x40, 0x18, 0x48]}, 0x40}}, @enter_looper, @clear_death={0x400c630f, 0x4}, @reply={0x40406301, {0x1, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x30, 0x30, &(0x7f00000001c0)=[@flat={0x77622a85, 0xa, r5}, @flat={0x77622a85, 0x101, r6, 0x3}], &(0x7f00000002c0)=[0x38, 0x70, 0x38, 0x18, 0x28, 0x28]}}, @clear_death, @increfs={0x40046304, 0x2}, @free_buffer={0x40086303, r7}], 0x80, 0x0, &(0x7f0000000640)="1713e724001b4389fd67ca489c5a492914afa5b48c932d6d691c4af465b547d49ea3f2a671725471fda1c4efbff0b2e5ca49bc8ad428475a00e672001d914fc545287948b614be77d8ba9178e33f0bfce7ca042b1045c56f4dd690bf37d0ce1a07b1250f3639ff713a2472be71170911deeb4cb05318010699f784ff34172068"})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000400)={0x2b, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0xffffffffffffff6e, 0x0, &(0x7f0000000500)})

[ 2714.424373] binder: undelivered TRANSACTION_ERROR: 29201
[ 2714.503368] binder: 24147:24148 got transaction to context manager from process owning it
[ 2714.532439] binder: 24147:24148 transaction failed 29201/-22, size 0-0 line 2846
[ 2714.538474] autofs4:pid:24149:autofs_fill_super: called with bogus options
[ 2714.548213] binder_alloc: binder_alloc_mmap_handler: 24088 20001000-20004000 already mapped failed -16
[ 2714.574997] binder: BINDER_SET_CONTEXT_MGR already set
[ 2714.580642] binder: 24088:24101 ioctl 40046207 0 returned -16
[ 2714.588290] binder: undelivered TRANSACTION_ERROR: 29201
[ 2714.588468] binder: 24147:24148 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER
[ 2714.614471] binder: 24088:24151 transaction failed 29189/-22, size 0-0 line 2855
[ 2714.623133] binder: undelivered TRANSACTION_ERROR: 29189
[ 2714.629371] binder: 24088:24101 got reply transaction with no transaction stack
[ 2714.629540] binder: undelivered TRANSACTION_ERROR: 29201
[ 2714.642443] binder: 24088:24101 transaction failed 29201/-71, size 0-0 line 2762
[ 2714.650728] binder: 24147:24148 got reply transaction with no transaction stack
[ 2714.658735] binder: 24147:24148 transaction failed 29201/-71, size 40-24 line 2762
[ 2714.667401] binder: 24147:24154 got reply transaction with no transaction stack
[ 2714.675205] binder: 24147:24154 transaction failed 29201/-71, size 0-0 line 2762
[ 2714.708045] binder: undelivered TRANSACTION_ERROR: 29201
02:39:03 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x7a, &(0x7f0000000500)})

02:39:03 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:03 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='auto%s\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:03 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:03 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/-ev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2714.722308] binder: 24147:24148 got transaction to context manager from process owning it
[ 2714.739923] binder: undelivered TRANSACTION_ERROR: 29201
[ 2714.768706] binder: 24147:24154 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER
[ 2714.801227] binder: 24147:24155 got reply transaction with no transaction stack
[ 2714.823250] autofs4:pid:24163:autofs_fill_super: called with bogus options
[ 2714.832934] autofs4:pid:24161:autofs_fill_super: called with bogus options
[ 2714.843742] binder: release 24165:24166 transaction 8123 out, still active
[ 2714.851273] binder: send failed reply for transaction 8123, target dead
[ 2714.858515] binder: undelivered TRANSACTION_COMPLETE
[ 2714.866186] binder: 24147:24154 got reply transaction with no transaction stack
[ 2714.879920] binder_alloc: binder_alloc_mmap_handler: 24165 20001000-20004000 already mapped failed -16
[ 2714.905437] binder: BINDER_SET_CONTEXT_MGR already set
[ 2714.911364] binder_alloc: 24165: binder_alloc_buf, no vma
02:39:03 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/-ev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:03 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
add_key(&(0x7f0000000000)='.dead\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000002c0)="3514568327b47a93ba16212c78c8787d644f122df6fc48c549b7041efe93a531143c579fccff5327ecf24759c66d28184764e4ba941b0bb17c1f3985f9a82439e0683ad095a8ca405d6651543d9dcbcb8daaf7776ecb8e0aa8aded965b98610f515bc621b21cf5837aac3c5a597aecf1e21554928941a5365952770984ea580c9de79e864ba4fc104616b200ff7f7a4dde4471ac33580dffa9fbbe77d2a8511d1e0b2f6fa8c35dbedc62ada54110921db51595cd68", 0xb5, 0xffffffffffffffff)
r2 = add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffa)
r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0)
ioctl$GIO_UNISCRNMAP(r3, 0x4b69, &(0x7f0000000380)=""/118)
keyctl$negate(0xd, r2, 0xfffffffffffffffc, r2)
r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="02000040"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0c630000f8ea89dc608a1500b931f26023980f888c2d1d2bcf0b2a5dd173372ea74015e8415854641a7f5422decd371af07aabb4aeaada7fdd113bb21b911dfefdcb2729062479313915973d6abdd880acf20cf3ed2b73fb4a49fb"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0163404000000000040000000000004000000000000000000000000000000000000000000000000000080020000000000000000065a4011e1462e141109fb620b2b12d60eb711bdb74ccc06200989a1a5bf816b1ed7c9843a5f9a5b2ca021d3d5fbec1102c1d02c7a67240f8142282188491916add9022e828634b89c37112d3c8fbcc01d18e88c287abaeb6581e92d8a8132b65a0b4f0461caec66ffeb250bc1a183c2f70d5628b97a734e40700000000000000d5a9ec2cf0d6c17fc9545c4f11", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

[ 2714.947149] autofs4:pid:24170:autofs_fill_super: called with bogus options
[ 2714.953071] binder: 24165:24166 ioctl 40046207 0 returned -16
[ 2714.968341] binder: undelivered TRANSACTION_ERROR: 29189
[ 2714.985110] binder: undelivered TRANSACTION_ERROR: 29190
[ 2714.992409] binder: 24165:24169 got reply transaction with no transaction stack
[ 2715.004161] autofs4:pid:24157:autofs_fill_super: called with bogus options
02:39:03 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2715.077635] binder: 24180:24188 unknown command 1073741826
[ 2715.088582] autofs4:pid:24181:autofs_fill_super: called with bogus options
[ 2715.099242] binder: 24180:24188 ioctl c0306201 20000440 returned -22
[ 2715.116655] binder: 24180:24183 got reply transaction with no transaction stack
02:39:04 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x300000000000000, &(0x7f0000000500)})

[ 2715.145516] binder_alloc: binder_alloc_mmap_handler: 24180 20001000-20004000 already mapped failed -16
[ 2715.182575] binder: BINDER_SET_CONTEXT_MGR already set
[ 2715.211134] binder: 24180:24188 unknown command 1073741826
02:39:04 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='auto.s\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:04 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x8001, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000040)={0x8, <r4=>0x0, 0x10001, 0x2d7})
ioctl$DRM_IOCTL_AGP_FREE(r3, 0x40206435, &(0x7f00000000c0)={0x3, r4, 0x10001, 0x1f})
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2715.260710] binder: 24180:24183 ioctl 40046207 0 returned -16
[ 2715.267926] binder: 24180:24188 ioctl c0306201 20000440 returned -22
[ 2715.296709] binder: release 24194:24195 transaction 8131 out, still active
[ 2715.303777] binder: undelivered TRANSACTION_COMPLETE
02:39:04 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2715.304229] binder: send failed reply for transaction 8131, target dead
[ 2715.329668] binder: BINDER_SET_CONTEXT_MGR already set
[ 2715.336373] autofs4:pid:24197:autofs_fill_super: called with bogus options
02:39:04 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2715.355893] binder: 24196:24198 ioctl 40046207 0 returned -16
[ 2715.398499] binder_alloc: binder_alloc_mmap_handler: 24194 20001000-20004000 already mapped failed -16
[ 2715.432099] binder: release 24196:24206 transaction 8133 out, still active
[ 2715.439546] binder: 24196:24206 got reply transaction with no transaction stack
02:39:04 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2715.447243] binder: BINDER_SET_CONTEXT_MGR already set
[ 2715.458430] binder: undelivered TRANSACTION_COMPLETE
[ 2715.482224] binder: 24194:24195 ioctl 40046207 0 returned -16
[ 2715.483550] binder_alloc: 24194: binder_alloc_buf, no vma
[ 2715.521718] binder: send failed reply for transaction 8133, target dead
02:39:04 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x68000000, &(0x7f0000000500)})

[ 2715.628594] autofs4:pid:24216:autofs_fill_super: called with bogus options
[ 2715.661911] autofs4:pid:24205:autofs_fill_super: called with bogus options
[ 2715.690155] autofs4:pid:24220:autofs_fill_super: called with bogus options
02:39:04 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2715.742204] autofs4:pid:24209:autofs_fill_super: called with bogus options
[ 2715.781034] binder: release 24224:24225 transaction 8138 out, still active
02:39:04 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='auto/s\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2715.788552] binder: send failed reply for transaction 8138, target dead
[ 2715.802436] binder: undelivered TRANSACTION_COMPLETE
02:39:04 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/#ev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2715.852637] binder_alloc: binder_alloc_mmap_handler: 24224 20001000-20004000 already mapped failed -16
[ 2715.911775] binder: BINDER_SET_CONTEXT_MGR already set
02:39:04 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb="2f6465762f6e756c6c623003", &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2715.938377] autofs4:pid:24229:autofs_fill_super: called with bogus options
[ 2715.938800] autofs4:pid:24232:autofs_fill_super: called with bogus options
[ 2715.953288] binder: 24224:24225 ioctl 40046207 0 returned -16
[ 2715.953328] binder_alloc: 24224: binder_alloc_buf, no vma
[ 2716.009645] autofs4:pid:24235:autofs_fill_super: called with bogus options
02:39:05 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='Ndev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2716.124494] binder: release 24196:24241 transaction 8143 out, still active
[ 2716.135423] binder: send failed reply for transaction 8143, target dead
[ 2716.142231] binder: undelivered TRANSACTION_COMPLETE
02:39:05 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x5, 0x80)
getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f00000000c0)={<r4=>0x0, 0xfffffffffffffffa}, &(0x7f00000002c0)=0x8)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000340)={r4, 0x38, &(0x7f0000000300)=[@in6={0xa, 0x4e22, 0x9, @mcast2, 0x8001}, @in6={0xa, 0x4e24, 0x5, @remote, 0x5}]}, &(0x7f0000000400)=0x10)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:05 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2716.217056] autofs4:pid:24243:autofs_fill_super: called with bogus options
02:39:05 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x20000, 0x0)
ioctl$PPPIOCSMRU(r3, 0x40047452, &(0x7f0000000040)=0x1)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:05 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f6673ff", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:05 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='Ndev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2716.305105] autofs4:pid:24248:autofs_fill_super: called with bogus options
[ 2716.329622] binder: release 24249:24250 transaction 8146 out, still active
[ 2716.341114] binder: send failed reply for transaction 8146, target dead
[ 2716.354593] binder: undelivered TRANSACTION_COMPLETE
[ 2716.381055] binder: BINDER_SET_CONTEXT_MGR already set
[ 2716.404552] binder: BINDER_SET_CONTEXT_MGR already set
[ 2716.410584] binder: 24249:24263 ioctl 40046207 0 returned -16
[ 2716.414093] autofs4:pid:24260:autofs_fill_super: called with bogus options
02:39:05 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f6673eb", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:05 executing program 5 (fault-call:2 fault-nth:0):
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2716.445303] binder: 24255:24256 ioctl 40046207 0 returned -16
[ 2716.451490] binder_alloc: 24249: binder_alloc_buf, no vma
02:39:05 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
r3 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x2, 0x0)
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000500)={<r4=>0x0, 0x1}, &(0x7f0000000400)=0x8)
ioctl$UI_BEGIN_FF_UPLOAD(r3, 0xc06855c8, &(0x7f0000000540)={0x9, 0x5, {0x52, 0x4, 0x8, {0x0, 0xf7cd}, {0x3, 0x100}, @cond=[{0x7, 0x2, 0x2, 0x2, 0x6, 0xfffffffffffffffd}, {0x4, 0x7fff, 0xfffffffffffffff8, 0x5, 0x2e, 0x5}]}, {0x56, 0x6, 0x800, {0x5, 0x2}, {0x20, 0x800}, @period={0x5c, 0x200, 0x1f, 0x8, 0x4, {0x7ff, 0x9, 0x1, 0x8001}, 0x6, &(0x7f00000000c0)=[0x6, 0x9, 0x800, 0x4, 0x0, 0xca8]}}})
getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000300)={r4}, &(0x7f0000000340)=0x8)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0163400000e9ffffff0000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

[ 2716.523801] FAULT_INJECTION: forcing a failure.
[ 2716.523801] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[ 2716.545957] CPU: 0 PID: 24271 Comm: syz-executor5 Not tainted 4.19.0-rc6+ #48
[ 2716.553289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2716.562647] Call Trace:
[ 2716.565257]  dump_stack+0x1c4/0x2b4
[ 2716.568997]  ? dump_stack_print_info.cold.2+0x52/0x52
[ 2716.574207]  ? debug_smp_processor_id+0x1c/0x20
[ 2716.578937]  ? perf_trace_lock_acquire+0x15b/0x800
[ 2716.583884]  should_fail.cold.4+0xa/0x17
[ 2716.587959]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[ 2716.593073]  ? perf_trace_lock_acquire+0x15b/0x800
[ 2716.598030]  ? perf_trace_lock+0x7a0/0x7a0
[ 2716.602278]  ? lock_acquire+0x1ed/0x520
[ 2716.606264]  ? usbdev_do_ioctl+0x28d/0x3b50
[ 2716.610597]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2716.616142]  ? lock_release+0x970/0x970
[ 2716.620128]  ? fs_reclaim_acquire+0x20/0x20
[ 2716.624456]  ? lock_downgrade+0x900/0x900
[ 2716.628618]  ? ___might_sleep+0x1ed/0x300
[ 2716.632770]  ? lock_release+0x970/0x970
[ 2716.636784]  ? arch_local_save_flags+0x40/0x40
[ 2716.641377]  ? __mutex_lock+0x85e/0x1700
[ 2716.645454]  ? __might_sleep+0x95/0x190
[ 2716.649441]  __alloc_pages_nodemask+0x34b/0xde0
[ 2716.654125]  ? __alloc_pages_slowpath+0x2d80/0x2d80
[ 2716.659162]  ? __might_fault+0x12b/0x1e0
[ 2716.663230]  ? lock_downgrade+0x900/0x900
[ 2716.667389]  ? lock_release+0x970/0x970
[ 2716.671368]  ? arch_local_save_flags+0x40/0x40
[ 2716.675954]  ? perf_trace_lock_acquire+0x15b/0x800
[ 2716.680897]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 2716.685920]  ? usbfs_increase_memory_usage+0xf7/0x1d0
[ 2716.691117]  ? usbfs_decrease_memory_usage+0x30/0x30
[ 2716.696232]  ? __sanitizer_cov_trace_const_cmp2+0x18/0x20
[ 2716.701804]  alloc_pages_current+0x10c/0x210
[ 2716.706220]  ? check_ctrlrecip+0xa9/0x320
[ 2716.710377]  __get_free_pages+0xc/0x40
[ 2716.714274]  proc_control+0x227/0xef0
[ 2716.718083]  ? mark_held_locks+0x130/0x130
[ 2716.722326]  ? proc_bulk+0xa70/0xa70
[ 2716.726059]  usbdev_do_ioctl+0x1eb8/0x3b50
[ 2716.730310]  ? processcompl_compat+0x680/0x680
[ 2716.734899]  ? check_preemption_disabled+0x48/0x200
[ 2716.739929]  ? perf_trace_lock_acquire+0x15b/0x800
[ 2716.744865]  ? mark_held_locks+0x130/0x130
[ 2716.749110]  ? perf_trace_lock+0x7a0/0x7a0
[ 2716.753356]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2716.758902]  ? check_preemption_disabled+0x48/0x200
[ 2716.763930]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2716.769474]  ? check_preemption_disabled+0x48/0x200
[ 2716.774505]  ? debug_smp_processor_id+0x1c/0x20
[ 2716.779183]  ? perf_trace_lock_acquire+0x15b/0x800
[ 2716.784127]  ? perf_trace_lock+0x7a0/0x7a0
[ 2716.788374]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[ 2716.793919]  ? _kstrtoull+0x188/0x250
[ 2716.797729]  ? _parse_integer+0x180/0x180
[ 2716.801889]  ? lock_release+0x970/0x970
[ 2716.805880]  ? usercopy_warn+0x110/0x110
[ 2716.809965]  ? __fget+0x4aa/0x740
[ 2716.813439]  ? lock_downgrade+0x900/0x900
[ 2716.817604]  ? rcu_read_unlock_special.part.39+0x11f0/0x11f0
[ 2716.823409]  ? smk_access+0x53b/0x700
[ 2716.827225]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2716.832775]  ? smack_log+0x423/0x590
[ 2716.836498]  ? smk_access_entry+0x310/0x310
[ 2716.840828]  ? __fget+0x4d1/0x740
[ 2716.844301]  ? smk_tskacc+0x3dd/0x520
[ 2716.848131]  usbdev_ioctl+0x25/0x30
[ 2716.851768]  ? usbdev_compat_ioctl+0x30/0x30
[ 2716.856186]  do_vfs_ioctl+0x1de/0x1720
[ 2716.860084]  ? fsnotify_first_mark+0x350/0x350
[ 2716.864673]  ? __fsnotify_parent+0xcc/0x420
[ 2716.869020]  ? ioctl_preallocate+0x300/0x300
[ 2716.873433]  ? smk_curacc+0x7f/0xa0
[ 2716.877076]  ? smack_file_ioctl+0x210/0x3c0
[ 2716.881416]  ? fget_raw+0x20/0x20
[ 2716.884902]  ? smack_file_lock+0x2e0/0x2e0
[ 2716.889153]  ? fput+0x130/0x1a0
[ 2716.892446]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2716.897999]  ? security_file_ioctl+0x94/0xc0
[ 2716.902428]  ksys_ioctl+0xa9/0xd0
[ 2716.905893]  __x64_sys_ioctl+0x73/0xb0
[ 2716.909790]  do_syscall_64+0x1b9/0x820
[ 2716.913682]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[ 2716.919057]  ? syscall_return_slowpath+0x5e0/0x5e0
[ 2716.924001]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 2716.929205]  ? trace_hardirqs_on_caller+0x310/0x310
[ 2716.934230]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[ 2716.939258]  ? prepare_exit_to_usermode+0x291/0x3b0
[ 2716.944288]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 2716.949150]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2716.954344] RIP: 0033:0x457579
[ 2716.957548] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 2716.976890] RSP: 002b:00007fa2a778ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 2716.984606] RAX: ffffffffffffffda RBX: 00007fa2a778ec90 RCX: 0000000000457579
[ 2716.991877] RDX: 0000000020000000 RSI: 00000000c0185500 RDI: 0000000000000003
[ 2716.999151] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[ 2717.006424] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa2a778f6d4
[ 2717.013694] R13: 00000000004bf6c0 R14: 00000000004cf598 R15: 0000000000000004
[ 2717.055712] binder: release 24273:24276 transaction 8153 out, still active
[ 2717.062784] binder: undelivered TRANSACTION_COMPLETE
[ 2717.079155] binder: 24273:24276 unknown command 4219649
[ 2717.109812] binder: 24273:24276 ioctl c0306201 20000600 returned -22
[ 2717.141485] binder: BINDER_SET_CONTEXT_MGR already set
[ 2717.146458] binder_alloc: binder_alloc_mmap_handler: 24273 20001000-20004000 already mapped failed -16
[ 2717.155067] binder: 24255:24286 ioctl 40046207 0 returned -16
[ 2717.175336] binder_alloc: 24273: binder_alloc_buf, no vma
[ 2717.187164] binder: BINDER_SET_CONTEXT_MGR already set
02:39:06 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autoes\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:06 executing program 1 (fault-call:8 fault-nth:0):
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:39:06 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2717.206496] binder: 24273:24278 ioctl 40046207 0 returned -16
[ 2717.214599] binder_alloc: 24273: binder_alloc_buf, no vma
[ 2717.226121] binder: 24273:24276 unknown command 4219649
[ 2717.235054] binder: release 24273:24276 transaction 8153 in, still active
02:39:06 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="e5e4c9ba34"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2717.255109] binder: 24273:24276 ioctl c0306201 20000600 returned -22
[ 2717.262947] binder: send failed reply for transaction 8153, target dead
[ 2717.302091] FAULT_INJECTION: forcing a failure.
[ 2717.302091] name failslab, interval 1, probability 0, space 0, times 0
[ 2717.325768] CPU: 0 PID: 24293 Comm: syz-executor1 Not tainted 4.19.0-rc6+ #48
[ 2717.331013] autofs4:pid:24298:autofs_fill_super: called with bogus options
[ 2717.333074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2717.333082] Call Trace:
[ 2717.333111]  dump_stack+0x1c4/0x2b4
[ 2717.333137]  ? dump_stack_print_info.cold.2+0x52/0x52
[ 2717.360911]  should_fail.cold.4+0xa/0x17
[ 2717.365012]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[ 2717.370137]  ? perf_trace_lock_acquire+0x15b/0x800
[ 2717.375076]  ? debug_smp_processor_id+0x1c/0x20
[ 2717.379809]  ? perf_trace_lock_acquire+0x15b/0x800
[ 2717.384763]  ? perf_trace_lock+0x7a0/0x7a0
[ 2717.389028]  ? perf_trace_lock+0x7a0/0x7a0
[ 2717.393274]  ? mark_held_locks+0x130/0x130
[ 2717.397530]  ? fs_reclaim_acquire+0x20/0x20
[ 2717.401861]  ? lock_downgrade+0x900/0x900
[ 2717.406044]  ? ___might_sleep+0x1ed/0x300
[ 2717.410208]  ? arch_local_save_flags+0x40/0x40
[ 2717.414805]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2717.420356]  ? check_preemption_disabled+0x48/0x200
[ 2717.425384]  ? dput.part.26+0x241/0x790
[ 2717.426815] IPVS: ftp: loaded support on port[0] = 21
[ 2717.429378]  __should_failslab+0x124/0x180
[ 2717.429394]  should_failslab+0x9/0x14
[ 2717.429414]  kmem_cache_alloc+0x2be/0x730
[ 2717.446765]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 2717.452316]  ? may_expand_vm+0x1e3/0x810
[ 2717.456402]  vm_area_dup+0x7a/0x230
[ 2717.456432]  ? vm_area_alloc+0x1d0/0x1d0
[ 2717.456452]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2717.464133]  __split_vma+0xae/0x570
[ 2717.464147]  ? find_vma+0x34/0x190
[ 2717.464168]  do_munmap+0x308/0xf50
[ 2717.473319]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2717.473338]  ? check_preemption_disabled+0x48/0x200
[ 2717.473358]  mmap_region+0x6a4/0x1cd0
[ 2717.480422]  ? __x64_sys_brk+0x7d0/0x7d0
[ 2717.480451]  ? get_pid_task+0xd6/0x1a0
[ 2717.490997]  ? mpx_unmapped_area_check+0xd8/0x108
[ 2717.491027]  ? arch_get_unmapped_area_topdown+0xc2/0x940
[ 2717.491049]  ? rcu_read_unlock_special.part.39+0x11f0/0x11f0
[ 2717.518845]  ? arch_get_unmapped_area+0x750/0x750
[ 2717.523699]  ? lock_acquire+0x1ed/0x520
[ 2717.527680]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 2717.532704]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 2717.532722]  ? can_do_mlock+0x10a/0x160
[ 2717.532742]  ? can_do_mlock.part.11+0x20/0x20
[ 2717.546731]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 2717.552277]  ? get_unmapped_area+0x292/0x3b0
[ 2717.556705]  do_mmap+0xa10/0x1220
[ 2717.560175]  ? mmap_region+0x1cd0/0x1cd0
[ 2717.564246]  ? vm_mmap_pgoff+0x1b5/0x2c0
[ 2717.568319]  ? down_read_killable+0x1f0/0x1f0
[ 2717.572825]  ? security_mmap_file+0x174/0x1b0
[ 2717.577336]  vm_mmap_pgoff+0x213/0x2c0
[ 2717.581237]  ? vma_is_stack_for_current+0xd0/0xd0
[ 2717.581254]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2717.581275]  ? check_preemption_disabled+0x48/0x200
[ 2717.596748]  ksys_mmap_pgoff+0x4da/0x660
[ 2717.600821]  ? find_mergeable_anon_vma+0xd0/0xd0
[ 2717.605588]  ? trace_hardirqs_on+0xbd/0x310
[ 2717.609918]  ? __ia32_sys_read+0xb0/0xb0
[ 2717.614000]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2717.619384]  ? __bpf_trace_preemptirq_template+0x30/0x30
[ 2717.619405]  __x64_sys_mmap+0xe9/0x1b0
[ 2717.619425]  do_syscall_64+0x1b9/0x820
[ 2717.632656]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[ 2717.638034]  ? syscall_return_slowpath+0x5e0/0x5e0
[ 2717.642968]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 2717.647832]  ? trace_hardirqs_on_caller+0x310/0x310
[ 2717.647849]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[ 2717.647867]  ? prepare_exit_to_usermode+0x291/0x3b0
[ 2717.647886]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 2717.667742]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2717.667755] RIP: 0033:0x457579
[ 2717.667773] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 2717.667787] RSP: 002b:00007f07830dcc78 EFLAGS: 00000246
02:39:06 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f66730f", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:06 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2717.676153]  ORIG_RAX: 0000000000000009
[ 2717.676163] RAX: ffffffffffffffda RBX: 00007f07830dcc90 RCX: 0000000000457579
[ 2717.676173] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020007000
[ 2717.676182] RBP: 000000000072bf00 R08: 0000000000000005 R09: 0000000000000000
[ 2717.676196] R10: 0000000000006012 R11: 0000000000000246 R12: 00007f07830dd6d4
[ 2717.711668] R13: 00000000004c284a R14: 00000000004d3bd0 R15: 0000000000000006
[ 2717.750778] binder: 24295:24296 unknown command -1161173787
02:39:06 executing program 4:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040))
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="2b0000008b4390226c09eb321ef47da0ad538b014739b79e1e28721c470bc6188ffe71152f9f5517b8c4599c5d9a57fc82fbec3ea9bab06550ce8f7d24cac24b1e966b0a718026cb7f8920675df82190"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
sched_yield()
dup2(r1, r2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2717.784877] binder: 24295:24296 ioctl c0306201 20000140 returned -22
[ 2717.824537] binder: BINDER_SET_CONTEXT_MGR already set
[ 2717.842933] binder: 24309:24310 ioctl 40046207 0 returned -16
[ 2717.842956] binder: release 24295:24296 transaction 8158 out, still active
[ 2717.848968] binder: BINDER_SET_CONTEXT_MGR already set
[ 2717.857615] binder: undelivered TRANSACTION_COMPLETE
[ 2717.878917] binder: 24295:24308 unknown command -1161173787
[ 2717.891909] binder: 24295:24308 ioctl c0306201 20000140 returned -22
[ 2717.902055] binder: 24295:24311 ioctl 40046207 0 returned -16
[ 2717.902100] binder_alloc: 24295: binder_alloc_buf, no vma
[ 2717.920964] binder: 24309:24310 unknown command 43
[ 2717.931475] binder_alloc: 24295: binder_alloc_buf, no vma
02:39:06 executing program 1 (fault-call:8 fault-nth:1):
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2717.954952] binder: send failed reply for transaction 8158, target dead
[ 2717.964167] binder: 24309:24310 ioctl c0306201 20000140 returned -22
02:39:06 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x800)
setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000040)=@req3={0x2, 0xfff, 0x3ff, 0x7, 0x3, 0x1, 0x53}, 0x1c)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2718.026740] binder_alloc: binder_alloc_mmap_handler: 24309 20001000-20004000 already mapped failed -16
[ 2718.067264] binder_alloc: 24309: binder_alloc_buf, no vma
[ 2718.085432] binder: 24309:24312 unknown command 43
[ 2718.103539] binder: 24309:24312 ioctl c0306201 20000140 returned -22
[ 2718.117241] FAULT_INJECTION: forcing a failure.
[ 2718.117241] name failslab, interval 1, probability 0, space 0, times 0
[ 2718.138858] binder: BINDER_SET_CONTEXT_MGR already set
[ 2718.145916] binder: 24319:24322 ioctl 40046207 0 returned -16
[ 2718.151961] CPU: 1 PID: 24320 Comm: syz-executor1 Not tainted 4.19.0-rc6+ #48
[ 2718.159256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2718.168618] Call Trace:
[ 2718.171223]  dump_stack+0x1c4/0x2b4
[ 2718.174868]  ? dump_stack_print_info.cold.2+0x52/0x52
[ 2718.180083]  ? is_bpf_text_address+0xd3/0x170
[ 2718.184596]  should_fail.cold.4+0xa/0x17
[ 2718.188669]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[ 2718.193786]  ? save_stack+0xa9/0xd0
[ 2718.197419]  ? save_stack+0x43/0xd0
[ 2718.201049]  ? kasan_kmalloc+0xc7/0xe0
[ 2718.204941]  ? kasan_slab_alloc+0x12/0x20
[ 2718.209095]  ? kmem_cache_alloc+0x12e/0x730
[ 2718.213422]  ? vm_area_dup+0x7a/0x230
[ 2718.217227]  ? __split_vma+0xae/0x570
[ 2718.221032]  ? do_munmap+0x308/0xf50
[ 2718.224753]  ? mmap_region+0x6a4/0x1cd0
[ 2718.228736]  ? do_mmap+0xa10/0x1220
[ 2718.232365]  ? vm_mmap_pgoff+0x213/0x2c0
[ 2718.234497] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[ 2718.236426]  ? ksys_mmap_pgoff+0x4da/0x660
[ 2718.236444]  ? __x64_sys_mmap+0xe9/0x1b0
[ 2718.236463]  ? do_syscall_64+0x1b9/0x820
[ 2718.255573]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2718.260944]  ? percpu_ref_put_many+0x11c/0x260
[ 2718.265540]  ? lock_downgrade+0x900/0x900
[ 2718.269696]  ? lock_release+0x970/0x970
[ 2718.273681]  ? mem_cgroup_handle_over_high+0x130/0x130
[ 2718.278965]  ? lock_downgrade+0x900/0x900
[ 2718.283141]  __should_failslab+0x124/0x180
[ 2718.287386]  should_failslab+0x9/0x14
[ 2718.291195]  kmem_cache_alloc+0x47/0x730
[ 2718.295271]  ? kasan_slab_alloc+0x12/0x20
[ 2718.299429]  anon_vma_clone+0x140/0x710
[ 2718.303416]  ? unlink_anon_vmas+0xa60/0xa60
[ 2718.307752]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2718.313299]  __split_vma+0x183/0x570
[ 2718.317025]  ? find_vma+0x34/0x190
[ 2718.320578]  do_munmap+0x308/0xf50
[ 2718.324128]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2718.329675]  ? check_preemption_disabled+0x48/0x200
[ 2718.334707]  mmap_region+0x6a4/0x1cd0
[ 2718.338530]  ? __x64_sys_brk+0x7d0/0x7d0
[ 2718.342634]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2718.348236]  ? check_preemption_disabled+0x48/0x200
[ 2718.353266]  ? mpx_unmapped_area_check+0xd8/0x108
[ 2718.358124]  ? arch_get_unmapped_area_topdown+0xc2/0x940
[ 2718.363583]  ? rcu_read_unlock_special.part.39+0x11f0/0x11f0
[ 2718.369392]  ? arch_get_unmapped_area+0x750/0x750
[ 2718.374244]  ? lock_acquire+0x1ed/0x520
[ 2718.378228]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 2718.383257]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 2718.388802]  ? can_do_mlock+0x10a/0x160
[ 2718.392787]  ? can_do_mlock.part.11+0x20/0x20
[ 2718.397294]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 2718.402838]  ? get_unmapped_area+0x292/0x3b0
[ 2718.407261]  do_mmap+0xa10/0x1220
[ 2718.410745]  ? mmap_region+0x1cd0/0x1cd0
[ 2718.414839]  ? vm_mmap_pgoff+0x1b5/0x2c0
[ 2718.418912]  ? down_read_killable+0x1f0/0x1f0
[ 2718.423421]  ? security_mmap_file+0x174/0x1b0
[ 2718.427928]  vm_mmap_pgoff+0x213/0x2c0
[ 2718.431828]  ? vma_is_stack_for_current+0xd0/0xd0
[ 2718.436677]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2718.442236]  ? check_preemption_disabled+0x48/0x200
[ 2718.447288]  ksys_mmap_pgoff+0x4da/0x660
[ 2718.451363]  ? find_mergeable_anon_vma+0xd0/0xd0
[ 2718.456130]  ? trace_hardirqs_on+0xbd/0x310
[ 2718.460463]  ? __ia32_sys_read+0xb0/0xb0
[ 2718.464537]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2718.469913]  ? __bpf_trace_preemptirq_template+0x30/0x30
[ 2718.475376]  __x64_sys_mmap+0xe9/0x1b0
[ 2718.479280]  do_syscall_64+0x1b9/0x820
[ 2718.483185]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[ 2718.488558]  ? syscall_return_slowpath+0x5e0/0x5e0
[ 2718.493493]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 2718.498349]  ? trace_hardirqs_on_caller+0x310/0x310
[ 2718.503374]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[ 2718.508404]  ? prepare_exit_to_usermode+0x291/0x3b0
[ 2718.513434]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 2718.518294]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2718.523488] RIP: 0033:0x457579
[ 2718.526695] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 2718.545603] RSP: 002b:00007f07830bbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[ 2718.553323] RAX: ffffffffffffffda RBX: 00007f07830bbc90 RCX: 0000000000457579
[ 2718.560596] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020007000
02:39:07 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3})
sync()

[ 2718.567871] RBP: 000000000072bfa0 R08: 0000000000000004 R09: 0000000000000000
[ 2718.575143] R10: 0000000000006012 R11: 0000000000000246 R12: 00007f07830bc6d4
[ 2718.582416] R13: 00000000004c284a R14: 00000000004d3bd0 R15: 0000000000000005
[ 2718.600289] device bridge_slave_1 left promiscuous mode
02:39:07 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_DISALLOCATE(r1, 0x5608)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x8200, 0x0)
getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r3, 0x84, 0x74, &(0x7f0000000500)=""/246, &(0x7f00000002c0)=0xf6)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00')
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2718.624918] ion_mmap: failure mapping buffer to userspace
[ 2718.625039] bridge0: port 2(bridge_slave_1) entered disabled state
02:39:07 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x80045515, &(0x7f0000000000)={0xa3})
sync()

[ 2718.676461] vhci_hcd: invalid port number 0
[ 2718.705838] device bridge_slave_0 left promiscuous mode
[ 2718.711352] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2718.733126] binder: 24331:24334 ioctl 5608 0 returned -22
[ 2718.767060] binder: undelivered TRANSACTION_COMPLETE
[ 2718.772675] binder: send failed reply for transaction 8170, target dead
[ 2718.780588] team0 (unregistering): Port device team_slave_1 removed
[ 2718.798636] binder: 24331:24336 ioctl 5608 0 returned -22
[ 2718.815084] team0 (unregistering): Port device team_slave_0 removed
[ 2718.824438] binder: BINDER_SET_CONTEXT_MGR already set
[ 2718.831022] binder: 24331:24336 ioctl 40046207 0 returned -16
[ 2718.839951] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2718.892519] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2718.941161] binder_transaction: 35 callbacks suppressed
[ 2718.941178] binder: 24319:24339 transaction failed 29189/0, size 0-0 line 2787
[ 2718.986448] bond0 (unregistering): Released all slaves
[ 2719.936738] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2719.943209] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2719.950719] device bridge_slave_0 entered promiscuous mode
[ 2719.987431] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2719.993881] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2720.001158] device bridge_slave_1 entered promiscuous mode
[ 2720.036677] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2720.073321] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2720.179285] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2720.217046] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2720.253479] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[ 2720.260376] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 2720.297825] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 2720.304941] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 2720.422430] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2720.430151] team0: Port device team_slave_0 added
[ 2720.470236] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2720.477606] team0: Port device team_slave_1 added
[ 2720.517334] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2720.560977] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2720.585339] device bridge_slave_1 left promiscuous mode
[ 2720.590867] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2720.645305] device bridge_slave_0 left promiscuous mode
[ 2720.650819] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2720.728161] team0 (unregistering): Port device team_slave_1 removed
[ 2720.738105] team0 (unregistering): Port device team_slave_0 removed
[ 2720.750728] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2720.808089] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2720.892701] bond0 (unregistering): Released all slaves
[ 2720.970577] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 2720.979470] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 2720.995690] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2721.032807] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 2721.040086] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 2721.056300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2721.738295] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2721.744724] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2721.751367] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2721.757765] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2721.767086] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2722.174666] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2723.106590] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2723.234896] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2723.360119] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2723.366831] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2723.375090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2723.504787] 8021q: adding VLAN 0 to HW filter on device team0
02:39:13 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autogs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:13 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185560, &(0x7f0000000000)={0xa3})
sync()

02:39:13 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:39:13 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f00000002c0)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x1d, 0x0, &(0x7f0000000040)="c872dc2ba8ef15af2648e444e92f0baf3545b1e68fb1226875237a2f3b"})

02:39:13 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_mount_image$nfs(&(0x7f0000000000)='nfs\x00', &(0x7f0000000040)='./file0\x00', 0x4, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000500)="c2f849185c478d290cfc66b9b8b50e3b817d8c28690df07565ec63af77ded4d829ca32da4d5464b61bd70918201cc0a5ffe135619dab79bd268edb51b34c176150a373d6c68ef143f7cf78d93969b56653611d9897a9905c02b8b4afdbc06e8450b45267037b7af62e5e08615af9abdf81240ab17c073d6abb756e778e17cbb89d49dba0c98c615832caf0cfd62a2a215c56cf38edff7662a5db9fe1ea76f2c259221899ae3651c8355e473c2b4a7749f6ebe5bc5cf7722baa6bedfcdd7da9217c5606721386c2b8415ae2dabc32c2fec4580f78b55bbcb7320ffed396602bc3", 0xe0, 0x5}], 0x140000, &(0x7f0000000180)='wlan1\x00')
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})
ioctl$TIOCLINUX3(r3, 0x541c, &(0x7f00000001c0))

02:39:13 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs`', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2724.927016] binder_thread_release: 2 callbacks suppressed
[ 2724.927028] binder: release 24595:24597 transaction 8178 out, still active
[ 2724.940325] binder: 24595:24597 transaction failed 29189/0, size 0-0 line 2787
02:39:13 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185503, &(0x7f0000000000)={0xa3})
sync()

[ 2724.972682] binder: BINDER_SET_CONTEXT_MGR already set
[ 2724.973968] ion_mmap: failure mapping buffer to userspace
[ 2724.984163] binder_release_work: 1 callbacks suppressed
[ 2724.984169] binder: undelivered TRANSACTION_COMPLETE
[ 2724.994549] binder_send_failed_reply: 1 callbacks suppressed
[ 2724.994561] binder: send failed reply for transaction 8178, target dead
[ 2725.024396] binder: 24598:24606 ioctl 40046207 0 returned -16
[ 2725.025821] binder_transaction: 11 callbacks suppressed
[ 2725.025829] binder: 24598:24599 got reply transaction with no transaction stack
[ 2725.058671] binder: release 24598:24599 transaction 8180 out, still active
02:39:14 executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x800, 0x0)
write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000100)={0x2, 0x1d4}, 0x2)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r2 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x143)
ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000200)={'team0\x00', <r4=>0x0})
setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000280)={r4, 0x1, 0x6}, 0x10)
set_thread_area(&(0x7f00000002c0)={0x7})
r5 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000000c0)=0x3)
ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r6=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r6, 0x0)

[ 2725.085962] binder_alloc: binder_alloc_mmap_handler: 24595 20001000-20004000 already mapped failed -16
[ 2725.112423] binder: undelivered TRANSACTION_COMPLETE
[ 2725.127134] IPVS: ftp: loaded support on port[0] = 21
[ 2725.135345] binder: 24598:24599 transaction failed 29201/-71, size 0-0 line 2762
[ 2725.149411] binder: BINDER_SET_CONTEXT_MGR already set
[ 2725.158802] binder_alloc_new_buf_locked: 1 callbacks suppressed
[ 2725.158809] binder_alloc: 24595: binder_alloc_buf, no vma
[ 2725.176934] binder: 24595:24597 ioctl 40046207 0 returned -16
[ 2725.196734] binder_alloc: binder_alloc_mmap_handler: 24598 20001000-20004000 already mapped failed -16
[ 2725.213799] binder: 24595:24616 transaction failed 29189/-3, size 0-0 line 2970
[ 2725.222582] binder: BINDER_SET_CONTEXT_MGR already set
[ 2725.236433] ion_mmap: failure mapping buffer to userspace
[ 2725.255020] binder: 24595:24621 got reply transaction with no transaction stack
[ 2725.262520] binder: 24595:24621 transaction failed 29201/-71, size 0-0 line 2762
[ 2725.271654] binder_release_work: 31 callbacks suppressed
[ 2725.271660] binder: undelivered TRANSACTION_ERROR: 29189
[ 2725.271927] binder: 24598:24622 got reply transaction with no transaction stack
[ 2725.277218] binder: undelivered TRANSACTION_ERROR: 29190
[ 2725.295740] binder: 24598:24606 transaction failed 29189/-22, size 0-0 line 2855
02:39:14 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofX\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2725.307869] binder: 24598:24599 ioctl 40046207 0 returned -16
[ 2725.319027] binder: 24598:24622 transaction failed 29201/-71, size 0-0 line 2762
02:39:14 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = accept4(r0, &(0x7f00000000c0)=@generic, &(0x7f0000000180)=0x80, 0x800)
ioctl$sock_bt_hci(r1, 0x800448d4, &(0x7f00000003c0)="366ed541759b7198f4c7e9e07e1ac949e7b04313b583b3544a95ed3f9b4f4172a96be5e5064568ab8ca78dc792b67ee5a22db6ef0c3f4aeb1d8979b11fcde96d112858d528618b5c2ce9702d1353e1c452a9a81c191863f1b3b602fc44e42ad0340e29fd73e658f3c3554dafb8876349957a3af2a8b01c1134d1bc769e29e8379d1e61d4bd2680c3d4b897a11fc700966e0602a51cf8631a261d5c80eb9aaedc692cc55f70b3701f488adcf3afdf11e3d5cb75bedd3d72509c53442660f22cfd5e13eec96294ffe99c6a1b550a7c72fe2c887df1df0038b35d2f3a230687bef95c7899ed706df7d9")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ion\x00', 0xcc00, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x100, 0x11, 0x0, <r3=>0xffffffffffffffff})
openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)
openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/current\x00', 0x2, 0x0)

02:39:14 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
ioctl$DRM_IOCTL_AGP_INFO(r3, 0x80386433, &(0x7f00000002c0)=""/78)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2725.354431] binder: send failed reply for transaction 8180, target dead
[ 2725.378382] binder: undelivered TRANSACTION_ERROR: 29189
[ 2725.395191] binder: undelivered TRANSACTION_ERROR: 29201
02:39:14 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x200000, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x5d, 0x200)
write$P9_RXATTRWALK(r3, &(0x7f00000000c0)={0xf, 0x1f, 0x2, 0x2}, 0xf)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2725.424049] binder: undelivered TRANSACTION_ERROR: 29201
[ 2725.474385] binder: undelivered TRANSACTION_ERROR: 29201
[ 2725.495216] binder: release 24640:24645 transaction 8187 out, still active
[ 2725.502500] binder: 24640:24645 transaction failed 29189/0, size 0-0 line 2787
02:39:14 executing program 3:
socketpair(0x0, 0x8000f, 0xfbd, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f00000002c0)={[0x1, 0x3b, 0x7ff, 0x401, 0x80000000, 0x3, 0x37a0000000000000, 0x8, 0x5, 0x2, 0xfe7, 0x8, 0x9b, 0x80000001, 0x7, 0x2], 0x9fab7081040a1b36, 0x4500})
r2 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000640)={{0x2, 0x4e23, @rand_addr=0x7ff}, {0x306}, 0x28, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1a}}, 'veth1_to_bond\x00'})
r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000040)={0x8, 0x11, 0xe7b10257b957a594, 0x1, 0x9, 0x1, 0x4, 0x80000001, <r5=>0x0}, &(0x7f00000000c0)=0x20)
getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000180)={0x10000, 0x8202, 0x5, 0x80, r5}, &(0x7f00000001c0)=0x10)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
open_by_handle_at(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="8900000002000000efa8dd37723df8cb7769f877b6c0557bab101226b5de9f1069cfc7b063833253d8f9b1f269b35bebd0f82765aeaa9adef09dbd840ea04cdc594b5a384e8b8c5211e86d0a26dd7113db834183913300610a56d24f5047c59a7adbeabd4353f0ae57a543558cebd296c7de4d18af2a511e07195bc5cc6f93f59f1d813f1f42da8f"], 0x0)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r2, r3)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:14 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f00000003c0)={0xca, ""/202})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2725.521582] binder: undelivered TRANSACTION_COMPLETE
[ 2725.534229] binder: send failed reply for transaction 8187, target dead
[ 2725.604943] binder_alloc: binder_alloc_mmap_handler: 24640 20001000-20004000 already mapped failed -16
[ 2725.643338] binder: BINDER_SET_CONTEXT_MGR already set
[ 2725.675532] binder: BINDER_SET_CONTEXT_MGR already set
[ 2725.681034] binder: 24655:24656 ioctl 40046207 0 returned -16
[ 2725.681743] ion_mmap: failure mapping buffer to userspace
[ 2725.695410] binder: 24640:24645 ioctl 40046207 0 returned -16
[ 2725.695423] binder_alloc: 24640: binder_alloc_buf, no vma
[ 2725.695463] binder: 24655:24664 transaction failed 29189/-3, size 0-0 line 2970
02:39:14 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
getrandom(&(0x7f00000003c0)=""/230, 0xe6, 0x2)
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2725.722819] binder_alloc: 24640: binder_alloc_buf, no vma
[ 2725.736022] binder: 24640:24667 got reply transaction with no transaction stack
[ 2725.749544] binder: 24640:24657 transaction failed 29189/-3, size 0-0 line 2970
02:39:14 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofc\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2725.772412] binder: 24640:24667 transaction failed 29201/-71, size 0-0 line 2762
[ 2725.780616] binder: undelivered TRANSACTION_ERROR: 29189
[ 2725.796675] ion_mmap: failure mapping buffer to userspace
[ 2725.818874] binder: undelivered TRANSACTION_ERROR: 29189
[ 2725.824871] binder: undelivered TRANSACTION_ERROR: 29190
[ 2725.835427] binder: 24655:24664 got reply transaction with no transaction stack
02:39:14 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000080)=@filter={'filter\x00', 0xe, 0x1, 0x1e0, [0x0, 0x200003c0, 0x20000540, 0x20000570], 0x0, &(0x7f0000000000), &(0x7f00000003c0)=[{0x0, '\x00', 0x0, 0x4753bc86559007e1, 0x1, [{{{0x3, 0x40, 0x88b5, 'syzkaller0\x00', 'rose0\x00', 'bridge0\x00', '\x00', @broadcast, [0xff, 0x0, 0xff, 0x0, 0x0, 0xff], @remote, [0x0, 0x0, 0xff], 0xb8, 0x100, 0x150, [@ip={'ip\x00', 0x20, {{@loopback, @dev={0xac, 0x14, 0x14, 0x11}, 0xffffffff, 0xffffff00, 0x80, 0x7f, 0x2, 0x4, 0x4e24, 0x4e24, 0x4e23, 0x4e24}}}]}, [@common=@ERROR={'ERROR\x00', 0x20, {"f382eb68cea894cf7c1f02b1d31ebfa152a619abb7ed373642e14d39fe61"}}]}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00', 0x0, 0x4, 0x3}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}]}, 0x258)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

[ 2725.874116] binder: undelivered TRANSACTION_ERROR: 29201
[ 2725.971740] ion_mmap: failure mapping buffer to userspace
[ 2726.377792] device bridge_slave_1 left promiscuous mode
[ 2726.383454] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2726.392502] binder_alloc: binder_alloc_mmap_handler: 24655 20001000-20004000 already mapped failed -16
[ 2726.415048] binder_alloc: 24655: binder_alloc_buf, no vma
[ 2726.435274] device bridge_slave_0 left promiscuous mode
[ 2726.440833] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2726.466188] binder: 24655:24710 got reply transaction with no transaction stack
[ 2726.530530] team0 (unregistering): Port device team_slave_1 removed
[ 2726.548557] team0 (unregistering): Port device team_slave_0 removed
[ 2726.560453] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2726.618086] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2726.702776] bond0 (unregistering): Released all slaves
[ 2726.880514] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2726.887411] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2726.894697] device bridge_slave_0 entered promiscuous mode
[ 2726.931177] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2726.937908] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2726.945192] device bridge_slave_1 entered promiscuous mode
[ 2727.021324] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2727.120290] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2727.392224] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2727.430931] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2727.595094] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2727.602383] team0: Port device team_slave_0 added
[ 2727.637847] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2727.645516] team0: Port device team_slave_1 added
[ 2727.680262] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2727.718237] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2727.757345] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 2727.765337] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 2727.773267] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2727.811029] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 2727.818890] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 2727.834648] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2728.200031] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2728.206459] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2728.213107] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2728.219518] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2728.227138] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2728.954654] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2729.556490] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2729.682693] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2729.809160] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2729.815552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2729.830361] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2729.948780] 8021q: adding VLAN 0 to HW filter on device team0
02:39:19 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:19 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0)
setsockopt$IP_VS_SO_SET_ZERO(r3, 0x0, 0x48f, &(0x7f00000000c0)={0x0, @multicast1, 0x4e24, 0x3, 'ovf\x00', 0x4, 0x5, 0xc}, 0x2c)
r4 = semget(0x0, 0x1, 0x0)
semctl$GETZCNT(r4, 0x2, 0xf, &(0x7f0000000500)=""/252)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="2a0864be"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:19 executing program 1:
r0 = socket$inet6(0xa, 0x1, 0x1001)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0)
ioctl$DRM_IOCTL_GET_CAP(r1, 0xc010640c, &(0x7f0000000080)={0x8, 0x1})
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
timerfd_gettime(r1, &(0x7f00000000c0))
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:39:19 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185504, &(0x7f0000000000)={0xa3})
sync()

02:39:19 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofo\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:19 executing program 3:
r0 = perf_event_open(&(0x7f0000000300)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff51, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x802)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
r3 = fcntl$dupfd(r1, 0x0, r2)
ioctl$KVM_HAS_DEVICE_ATTR(r3, 0x4018aee3, &(0x7f00000002c0)={0x0, 0x5, 0x2, &(0x7f0000000180)=0x80})
mkdirat(r3, &(0x7f00000000c0)='./file0\x00', 0x108)
bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', r3}, 0x10)
r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net\x00')
getsockopt$inet_sctp_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f0000000240), &(0x7f0000000400)=0x4)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:19 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
creat(&(0x7f0000000000)='./file0\x00', 0x28)
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2730.816162] binder_transaction: 3 callbacks suppressed
[ 2730.816179] binder: 24945:24955 transaction failed 29189/-22, size 0-0 line 2855
[ 2730.824861] binder: BINDER_SET_CONTEXT_MGR already set
[ 2730.867373] binder: 24945:24956 ioctl 4018aee3 200002c0 returned -22
[ 2730.887518] binder: 24946:24947 ioctl 40046207 0 returned -16
[ 2730.887748] binder: 24946:24959 unknown command -1100740566
[ 2730.921560] ion_mmap: failure mapping buffer to userspace
[ 2730.927520] binder_alloc: 24946: binder_alloc_buf, no vma
[ 2730.933241] binder: 24945:24955 transaction failed 29189/-3, size 0-0 line 2970
[ 2730.960083] autofs4:pid:24958:autofs_fill_super: called with bogus options
02:39:19 executing program 1:
r0 = openat$vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhci\x00', 0x400000, 0x0)
ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000100)=0x8)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f0000000080)=0x2)
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

[ 2730.966182] binder: send failed reply for transaction 8198 to 24946:24959
[ 2730.992883] binder: undelivered TRANSACTION_COMPLETE
[ 2730.998614] binder_release_work: 3 callbacks suppressed
[ 2730.998620] binder: undelivered TRANSACTION_ERROR: 29189
[ 2731.007879] binder: 24946:24959 ioctl c0306201 20000140 returned -22
[ 2731.010713] binder: BINDER_SET_CONTEXT_MGR already set
[ 2731.035959] binder: 24945:24969 ioctl 40046207 0 returned -16
02:39:20 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/4\x00')
mkdirat$cgroup(r1, &(0x7f00000000c0)='syz1\x00', 0x1ff)
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x40000, 0x0)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

[ 2731.043028] binder: 24945:24955 transaction failed 29189/-22, size 0-0 line 2855
[ 2731.052155] ion_mmap: failure mapping buffer to userspace
[ 2731.058263] binder: 24945:24956 ioctl 4018aee3 200002c0 returned -22
[ 2731.059802] IPVS: ftp: loaded support on port[0] = 21
[ 2731.065164] binder: 24946:24947 got reply transaction with no transaction stack
[ 2731.081495] binder: 24946:24947 transaction failed 29201/-71, size 0-0 line 2762
[ 2731.106045] binder: 24945:24977 got reply transaction with no transaction stack
02:39:20 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofd\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:20 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2731.146319] autofs4:pid:24958:autofs_fill_super: called with bogus options
[ 2731.161921] binder_alloc: 24945: binder_alloc_buf, no vma
[ 2731.178287] binder: BINDER_SET_CONTEXT_MGR already set
[ 2731.187365] ion_mmap: failure mapping buffer to userspace
02:39:20 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)
ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, r1, 0xc0c, 0x48, 0x3, 0x80})

[ 2731.196602] binder: 24945:24977 transaction failed 29201/-71, size 0-0 line 2762
[ 2731.205501] binder: 24946:24959 transaction failed 29189/-3, size 0-0 line 2970
02:39:20 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2731.250731] binder: undelivered TRANSACTION_ERROR: 29190
[ 2731.256974] binder: undelivered TRANSACTION_ERROR: 29189
[ 2731.262512] binder: undelivered TRANSACTION_ERROR: 29189
[ 2731.269683] binder: 24946:24947 ioctl 40046207 0 returned -16
[ 2731.269704] binder: 24946:24991 unknown command -1100740566
[ 2731.291746] ion_mmap: failure mapping buffer to userspace
[ 2731.329313] binder: 24946:24991 ioctl c0306201 20000140 returned -22
[ 2731.335918] binder: undelivered TRANSACTION_ERROR: 29201
[ 2731.344953] binder: undelivered TRANSACTION_ERROR: 29189
[ 2731.363544] binder: undelivered TRANSACTION_ERROR: 29201
02:39:20 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="016340400000000000000000000000000000000000009dda00000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

02:39:20 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
prctl$setmm(0x23, 0x7, &(0x7f0000008000/0x4000)=nil)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
socket$inet_icmp_raw(0x2, 0x3, 0x1)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2731.481153] autofs4:pid:25004:autofs_fill_super: called with bogus options
[ 2731.491190] ion_mmap: failure mapping buffer to userspace
[ 2731.520980] binder: release 25013:25015 transaction 8205 out, still active
[ 2731.534525] binder: 25013:25015 transaction failed 29189/0, size 0-0 line 2787
[ 2731.541959] binder: send failed reply for transaction 8205, target dead
[ 2731.554127] binder: undelivered TRANSACTION_COMPLETE
[ 2731.566307] autofs4:pid:25019:autofs_fill_super: called with bogus options
[ 2731.569129] binder_alloc: binder_alloc_mmap_handler: 25013 20001000-20004000 already mapped failed -16
[ 2731.614537] binder: BINDER_SET_CONTEXT_MGR already set
[ 2731.631210] binder: 25013:25015 ioctl 40046207 0 returned -16
[ 2731.649380] binder_alloc: 25013: binder_alloc_buf, no vma
[ 2731.657416] binder: 25013:25026 transaction failed 29189/-3, size 0-0 line 2970
[ 2731.665316] binder: undelivered TRANSACTION_ERROR: 29189
[ 2731.671211] binder: 25013:25023 got reply transaction with no transaction stack
[ 2731.678900] binder: undelivered TRANSACTION_ERROR: 29190
[ 2731.685749] binder: 25013:25023 transaction failed 29201/-71, size 0-0 line 2762
[ 2731.693398] binder: undelivered TRANSACTION_ERROR: 29201
[ 2732.120726] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2732.127219] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2732.134915] device bridge_slave_0 entered promiscuous mode
[ 2732.169787] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2732.176885] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2732.184055] device bridge_slave_1 entered promiscuous mode
[ 2732.218658] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2732.254147] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2732.358853] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2732.396193] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2732.560525] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2732.568314] team0: Port device team_slave_0 added
[ 2732.602671] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2732.610061] team0: Port device team_slave_1 added
[ 2732.645113] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2732.682129] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2732.720025] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2732.760063] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2733.114180] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2733.121121] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2733.127788] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2733.134158] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2733.145390] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2733.994956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2734.442803] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2734.564964] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2734.686544] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2734.693314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2734.707367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2734.818333] 8021q: adding VLAN 0 to HW filter on device team0
02:39:24 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x8108551b, &(0x7f0000000000)={0xa3})
sync()

02:39:24 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000000)={0x27, 0x36, 0xf, 0x13, 0x1, 0x7dad, 0x3, 0xcc, 0xffffffffffffffff})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:24 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x101040, 0x0)
ioctl$UI_SET_FFBIT(r1, 0x4004556b, 0x4b)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r2 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f00000000c0)=0x2000000000000000)
ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r4=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r4, 0x0)

02:39:24 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofl\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:24 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f6673f6", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:24 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = fcntl$dupfd(r1, 0x406, r0)
ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000040)={0xfffffffffffffff7, 0x100})
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2735.607701] binder: 25278:25280 ioctl 4b68 20000040 returned -22
[ 2735.636213] ion_mmap: failure mapping buffer to userspace
[ 2735.640246] binder: release 25279:25285 transaction 8210 out, still active
[ 2735.645271] binder: BINDER_SET_CONTEXT_MGR already set
02:39:24 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x8008550e, &(0x7f0000000000)={0xa3})
sync()

[ 2735.654442] binder: 25278:25280 ioctl 40046207 0 returned -16
[ 2735.661584] binder: 25279:25285 transaction failed 29189/0, size 0-0 line 2787
[ 2735.663021] ion_mmap: failure mapping buffer to userspace
[ 2735.682842] binder: undelivered TRANSACTION_COMPLETE
[ 2735.726814] binder: send failed reply for transaction 8210, target dead
[ 2735.732764] binder: 25278:25301 got reply transaction with no transaction stack
02:39:24 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
set_mempolicy(0x8000, &(0x7f0000000000)=0x5, 0x7ff)
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:39:24 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x8010550e, &(0x7f0000000000)={0xa3})
sync()

[ 2735.771852] binder: BINDER_SET_CONTEXT_MGR already set
02:39:24 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2735.815664] binder: 25279:25305 ioctl 40046207 0 returned -16
[ 2735.815760] binder_alloc: 25279: binder_alloc_buf, no vma
[ 2735.840769] ion_mmap: failure mapping buffer to userspace
02:39:24 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x0, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000200)={<r3=>0xffffffffffffffff}, 0x13f, 0x2}}, 0x20)
write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000300)={0x1, 0x10, 0xfa00, {&(0x7f00000001c0), r3}}, 0x18)
fcntl$notify(r2, 0x402, 0x2)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
sendmsg$xdp(r2, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000000340)="dcca507d7844bd585789919cb767475ab5fec06d0e2b112fe2237112e3a5bdb87872a3532ed597bb003ac97ffe9ed62dbf2ea7e13d5443c64d190f1e2108728ae96cd5c003535b09ca2b765ba6e9c94480e2f00e265a107585361fdfbaccecc4df831c9ee324ec53bd95ce22ffdc10db9bd05c8b15ebd7c171827f898ae5f8305c576999d275721b077c765494a8bddbd636069808b0c515e957656e2f223ddb72dc90022df08ae50e1c5a57b4a59828b91a16d4fb2e37953228c2f5dd6d5d9982433fbf37480eda1901adf671d8a0a322e45f292b19988d1b3c873918f36669141de6ef0bcd5112f936af435463468dc570b243c1580901dd133422a1ddd7f1acfd3aeac6cb582e0be5d7277cd96a1ef944fe568005bf27473ccf7c2807b67b91d67e87906d21dfd062a874d97f7603dd6c492846ba49598e5aa79ea5953f2d2d6017462f53b62ce120a7ad37e9430a6bd35ea1b88abf02cb01b0ebf0b517f51a35beedb0267120021808d049fd3199c715f0f431a8092c98b34f11c78ded83e18e0a3daf23fb621c154768ba3d61e537525cce3ff90951d12d426c1509fb83ca9ed5e4876011215ea29a9cba830e3e0ca8f00d5ab131ffb07f4719a8efeec26b99771373865ed8c882b546c0e5fc55ddbb7ce4e2a6f4f450e706551f214758851716da5bb1575110d2a52d702078cc889e4ba0e41368e8c693947c2eaac3dc76b566e7dded6aeefea0c7c9acf59f42ecc232bd0eba04ee6c84f22a7396610b864064d051b9cc0fee63e191a3a598f9723cd31e7f2bdfc4f1486971f22c53534e6d7ca352c71bb446803d6316f668fa82864661110305c74ca1dd7e6601ba1fd5bc51d7e675e3178c5c9d6852370fccf3dba3cc19c1565344742aeb7507b5aa0b6b681ecac9640a6662324eaf9dbbadb2886f4892f2ea487b2b3369712dc74a520d1260229b03d47d4788e856de4e7b66bbacfb3f97d596587e825569a648edc12847d3314605ef957fa246f6b9cb8a92c8248cff4b48cf5b480c3f2cb81559ac46544f5a54c1fc71c73b9bfeddfd1e8f8baf1f8b21c640a97541d54fadfbeaa819a178906ef8760420eb4921c6d37df78d89611614839c17c196a4370a8e21852b816a061c941def1a7b6403133984f0e5698fe9ea47e84c769cfa850a0fac16582bdeecd03dd9faa08bbed539b918c401b03efc5cc9f9c87aa2df40ede815f7bd700d2d693110ad23c85958d01fb364d312d2dca69d2a535bd9c67009b2a0a37262333a3aa026b5ece8046aec0b93165493aed81322f2640e01d8e4efcbe80ec9ce9e9c491fcc6823d96b52b537331eb0afcaeae29dced52d33789e6ed468b124a85d22b1b7d8af614ecc529a400f03b11d797c3b739ea2e4906ad4e33cac199d05d3b0faae64e4a2b0c67d8d9d4dab0915944864a69329b33451a5f960c7bc6470367f9c4325e34312fb595deb08939926fb2ac26ea9f64c3a943810893e166ea0fde874ed4b1ecc08568a345f6cdc02106310fa11e505f66f9a854a6cbf9b07c0c541403b58bbf2a30c1afdd6974b62f80ff155b9046d8e1dba69991630ce2ae88e2b664ac79a90444fd4df30d5d72a7b7fc731579e95a04d3befb9dca6f4c8a3648ba8b68b8e35ed7c6c080325dc7690e15f19fe926e1f5edb30be3f590093f8e675f4c86972a27118ce4ce94d6f542bdfa2a2106b6d45a13f6c0dd50cef70879540cdf9292b729586b0ad3bc84354f1c11e7805fb4cda4cc4d407444b7a6bcfe742e045d900d43240078f91ef3488e697c69b422990180c22f344d8ef5abd69382f4c3823dab19c8a2ff375c6826960b0ce54339ba366987ba2a14bad30db6d57412fb103289992304d049b1c063afb9f49304348932a0b340ea08d0cb231516bb7d2f682ac41926e778268fc4b4b264ce60881e4cdfcc7f3b916e87fb0ecdb897deaccbe2558d83e813c160dbd588cfea3af02618930347c596301b5015895819b5c4f47b81004504f293ecd8c5e588d4ed39102012a2f72877bb51a7e08557cb29cf3f833fade3314e9d6035ab1d1f4423eed91e31582b106b662e10be0615848d3b3be8f369ff9108cc039e00142633cddf84d850439068f634ede3aa6872bfbbf9ebae835deb7b0df9b5ba00e1aa8fb65d3aae702ac162fd3789fb8032782e0e567ab4c6a835ed82b78f6a00988541acd1b0e500e2a3bf8035b26eb2bc68261862de2fcf233ea16e2b04f5e4e54e992b4cd54e7b80366148ab0b4ba0c0eac9af79528eb44f188c1aced3815c8c69acf5e652036e0923767d74a2560bc82a5e8292d6527e0f82151a51e7b18d6e7054beb93c20a5fec104e0a7a2c7b5e55757290fa212d9187bfb0b9cfdeb711bca57cad41543d28ab8a9bbce9d9d44d239acd892b4cf5a53649705d13007c771747d16ba1608750b447cc2a1aa42e433ffd5b8c06882128645691368c390c865f2989a071485fdc728eb3ec33b5028465ce0cf26886827281a50e92882b54ca88e645fa520dda46100f75f0399bee99f4909cc4ce454c591a7b631921e7f4e3e3c924f151d5f1eea9f06bad376766279fc82214f64680e694dbe833cb9f7bddece4fb668179bd49b707f25a2e2bbb2e3697cad88ece281af90bf6a579e53da0a3d547dc212541f766e4cd999b47f67f00f5e6088140d2d36bc22add9ecd8ec16c50fa1bc5d1cbc05b9bc29d534e57862e2935fdeebc5b9c8f3a14ea26816777fe9fa5b6d98d4b39c5965f3ec58210097c73787330ee96d096220c04b93425fb9909a24f6ef948bc99f05f58ddc3ed570095319d29c6b85f8f3583e238d8fcba41e3ac5eed90b856a4bdb992eb8d92a108fb85d8e72a59632dc2b8f2bac0135b11b4a19df56ab0b1e50820c4ad0633a9473a8338f38507b97925f84cf4944dbf8e36cf8a55b25ace0a2032c6fb2cc8563b2b9dd7b0e00c90e8ba7d2ce71869a88bdca61b617c4bbaed243e371206460209e8a49a2169ae9b0167e78db5cf39d5d632fd9d8276d1d53128de6f4532e8642284baaf886e8fc4563f1045903b517ed41bc20216d24efc0e63c686048af85444cdd727fec2c3feaa727e73ecb19dac6fc1de0251d6755f03a3c4c59ee08d752398963bdec4d23dc287424d76db4ad6a34cd1de9367cf2807fefa572919f0a7a18133d0b496d941deea967dd4f69ad45d4c81c5603325a570de40fe0fb4365230b473a67f1b21401555778971a39e4e4684a8c62d255204edc87fa1cb8e0d36f5df3dcde9ea10e7fb556633c4297e4bf019a624997ad6bc00465013f122d78cbde9c2d51276dbbe259c57be0007b3277fc5cc0f200fbd7f1f9ca7b0e2e99ccf7798ce0fa2e3eecc5ffbb7c76266d1cee94ee2f7a7fcb0beaa76582128a4682e6573f6cce3cfcfeb509542ff573915cb2e47760c85795c39b5c2ec47adf663f147f62fb94897b8e3d8f79791257f67e4393f3458a1bb0b7a069cccac9ea7e0d3433a996dd17af16e6afa483daadb81314b6b75b7611fbc39218f21de946d5b4acc8a54531f653a3aea32db9924b7db5cf89c9df8a17f5635dca087e9cc2b7cc9fe924a7081bcd0b4df85c8677f762b35f1d56a4d34cb54e7d675943c0b81ac1bc2bff8d8b5c3f5e926facc38d6f18aa640972eacc632a7a9d75aae43f7b2817ee022b7cfea52da65f2842888ebeedd196f6947b065cbcc7f7cdf2f434b92a8bb22059eb3397973ea42d88e6170f544ad831836c4795295d4d47fbf64ce951018096c87d57dafb529e4a3c34cb57564f66434fe4c7e3e9eda0c825b3d2b1f8f51f7cb1e26ed920a45f332efd35f169fefcded1291359451a507162fa9986b8171ccded956c24f570ce2ed29827bd87cb70541d81ce3a24f2396486a8e6f9340a3b6061afd25f0e4127831d5b119e6ec2f668f8c6b256e62499eb0b8e0231d0b1f2acfc39cba657e00a75a13749b6ad7ec8add959c47f61bd458a44a66480dec4fcd881149120708166e19c20b1855575068949e8b4084ecfde72152f552c6982b287468e242a07385946dd8823a9287dfcb62e7180310f74b433282373c22400dcde310c7cb870ce2d5f368a0e6eae1ef3fcacccbd98c7d60b3c1795af07d2c3a8cc1e620ae893a902a3bb3848d4ce10132af912050536bb56f34b7b46f8d0221df270a10c259fcc47664415b44de470f16c3da3e35aa1129e19be2d1bdfce616879bfcb4752460b0a1bedd9110693a6bc0afd58152720e02833b0e5227e307e22afc0dbbebb38ea0b8d947c2c7855f6eea2c12a077822a99d4647983a87dd733269548d502de513a413542de5f8b01455f5f286457c6e0859d7406b21b7b3d1b27244a6616386485cfa1e1f541c93f37ba43407269ce402aa68ff7577873a023dabce7bdf17bbed62fc3ba76ad2d2391c7c66d096298d550251c56a5aeb65c857216d268d4d4c5d7d00b9902ae685732e3383145921f6ee357693074219305a4ae37a3818fcf75a45b7ffa504b7a246dd2bb6dac52563311ead87eab360fcac224ea7e7c732ab95d3998bca2a24da7728b27d770dc8fd979a3a6a78ceeed9a6914b47714b8a89553016ffc53c602a9692fbe6076060af935306122ab27218243d747845230079cf2a64787c4c88bda6c1628488bf98a8d9b22141773e157d6573a0953ff3281c71ecbc338d99a486da42138267e695483585170deda4ae1fcce2339b5eab4afd3c373c7f7828a9832435cff402d08655bfbce392f5189826cf53dd54066634de0b85b7c41113d64a206b266280d2b54c45c87e7a3dd93b94d4e608b62276fe1997daa3990f20f86a3e76207b2195ff0a81d7b1b72e10f9ab725baf481434c9a36ddfc197448ca78e36d394cc3e4057bcc5cc5ae754c16e3a64ce13a9eaf4dc6dcc77fc35ab93ebdee96240b02828c6b76fd90bcd0f9c5e35b74569ceea3f7e871af6d0c468e76d0dcd934e08051a0350948157bc9ecd0f33c362a16de0f00419a2370e4e6b0f70823b5f36868d4a69bbd0c275dfbf752cbacba9321390be5f64e04ff64705b522867ec1b154889a944aba9b9ae94f6d5805ff5401eec9ca3c90525162f02ef44844cbc7df8ba075dc2b156fe81191e66927b5c4069bb2ce1960514d415fcf7d7e9f057224f75b8e88de7b41dd5ffe98f1598c89cfb3b2beb7c8e0692cac5026995feacad88f0b9ee4f6636f1b1ebac6d4da1ca0bac6dc852c37678be5d11b4ab4fd17168fb67ea118cc4dc6df470edbb6a9cbe2a210ab55fc452fb208024237a3a746e124e440048221601e3d66909709a4360acf774d7565142470929be7e611c163fad87e180c366cbc9199e8167217c758a11d8620f2016d965c80fcb1467f5610ef197c23165335385fbef8f1dbfc2cb479f72e4dcfe60f9f7a4e4009e45f93d38e16b91169bbe70f1aba6f05f49ec927ba1932900323f98ac18b6015bf87fe98fb3a194f3a69cfe358739db2a10c6c82404024bea0ff9b5589d8646e2a940fe928588f5b4b66e312829eb89dd4ead412b60754fa739b0acb37856af9a31fcbab900c379a47f6fd5e07771a410e3656421e56373a468c112d9fde83376459f91feca4cda762eadbe44b2edaf9b3617440f46a961ca38f1452059ae05ae515e704e25532e35092420d9e3c35db8dcc888d5f97476b3e2e19fc03b73c8788f1381a6685f10d3c8ff6ebe627b0bce181841d1342eca2e1bf943c8e28ee74be005eaaed7d5bc678bed739f133e5ce2f80d41424890470ff741fbd24856a8cddaae59ef53a2f47147755d89b475ddc581a0", 0x1000}, {&(0x7f0000001340)="d00f88fe0d6edefef134672f25c6c75c21e4ca353c87ad28e2a2d24f34b614a591b0943440bf6f1a6de9d233347bbb8d6dd6f286cd06dcb5997d98ad56fa91b3bf94daab0473318c9947dc06b59a5c40a8fff9ebe55a66610d4c851a91f1fbd7ed5f1c6e8495eb0f7960e8953022e21a9f6bd1671a18115b17069908c0fcd1688578bb0d34c2935aaee48684276f675fbc614a581fa663f6599895c3e9270c4a607e19b2982ab3a3a9c5c64eda74365dea2e640348179171272036c631de8c52d62762973e772d1b7430b61dea8aaacc9b19dbbb", 0xd4}], 0x2, 0x0, 0x0, 0x800}, 0x24008000)
set_thread_area(&(0x7f00000002c0)={0x7})
r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000100)=0xfffffffffffffffc)
ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r5=>0xffffffffffffffff})
r6 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x4, 0x40000)
ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x89e2, &(0x7f00000000c0)={r1})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r5, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x9, 0x208000)

02:39:24 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x4020940d, &(0x7f0000000000)={0xa3})
sync()

[ 2735.880467] binder_transaction: 1 callbacks suppressed
[ 2735.880483] binder: 25279:25285 transaction failed 29189/-3, size 0-0 line 2970
[ 2735.904110] binder: 25279:25305 got reply transaction with no transaction stack
[ 2735.945276] binder: send failed reply for transaction 8212 to 25278:25280
[ 2735.947198] autofs4:pid:25324:autofs_fill_super: called with bogus options
[ 2735.954101] autofs4:pid:25329:autofs_fill_super: called with bogus options
[ 2735.984677] binder: 25279:25305 transaction failed 29201/-71, size 0-0 line 2762
02:39:24 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof0\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2736.010391] ion_mmap: failure mapping buffer to userspace
02:39:24 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
mmap(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x0, 0xa2010, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})
fstat(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
stat(&(0x7f00000000c0)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
lstat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, <r6=>0x0})
getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000640)={{{@in=@rand_addr, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@broadcast}}, &(0x7f0000000400)=0xe8)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x1000000, &(0x7f0000000740)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@allow_other='allow_other'}, {@allow_other='allow_other'}, {@max_read={'max_read', 0x3d, 0xffffffff}}, {@blksize={'blksize', 0x3d, 0x800}}, {@default_permissions='default_permissions'}, {@blksize={'blksize', 0x3d, 0xe00}}, {@allow_other='allow_other'}], [{@obj_type={'obj_type', 0x3d, 'bdev+}mime_typeuser'}}, {@euid_lt={'euid<', r6}}, {@uid_gt={'uid>', r7}}, {@smackfsroot={'smackfsroot', 0x3d, '/dev/binder#\x00'}}, {@audit='audit'}, {@appraise_type='appraise_type=imasig'}]}})

02:39:24 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f6673c0", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:24 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x4004550d, &(0x7f0000000000)={0xa3})
sync()

02:39:24 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x5, 0x40000)
ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r3, 0xc058534b, &(0x7f0000000080)={0x3ff, 0x1570, 0x1, 0x8, 0x80000001, 0x22})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)
r4 = msgget(0x2, 0x24)
msgctl$IPC_RMID(r4, 0x0)

[ 2736.063038] binder_release_work: 2 callbacks suppressed
[ 2736.063046] binder: undelivered TRANSACTION_ERROR: 29201
[ 2736.138218] ion_mmap: failure mapping buffer to userspace
[ 2736.170199] binder_alloc: 25352: binder_alloc_buf, no vma
[ 2736.175901] binder: release 25352:25357 transaction 8217 out, still active
[ 2736.184566] binder: undelivered TRANSACTION_COMPLETE
[ 2736.203659] binder: 25352:25357 transaction failed 29189/-3, size 0-0 line 2970
[ 2736.236827] binder: send failed reply for transaction 8217, target dead
[ 2736.250268] binder: BINDER_SET_CONTEXT_MGR already set
[ 2736.256168] binder_alloc: 25352: binder_alloc_buf, no vma
[ 2736.262314] binder: 25352:25357 ioctl 40046207 0 returned -16
[ 2736.274613] binder: 25352:25367 transaction failed 29189/-3, size 0-0 line 2970
[ 2736.285106] binder: undelivered TRANSACTION_ERROR: 29189
[ 2736.291116] binder: 25352:25367 got reply transaction with no transaction stack
[ 2736.301459] binder: undelivered TRANSACTION_ERROR: 29190
[ 2736.314038] binder: 25352:25367 transaction failed 29201/-71, size 0-0 line 2762
[ 2736.339875] binder: undelivered TRANSACTION_ERROR: 29201
[ 2736.402979] binder: 25278:25301 ioctl 4b68 20000040 returned -22
[ 2736.410286] binder_alloc: binder_alloc_mmap_handler: 25278 20001000-20004000 already mapped failed -16
[ 2736.420298] binder_alloc: 25278: binder_alloc_buf, no vma
[ 2736.426049] binder: 25278:25374 transaction failed 29189/-3, size 0-0 line 2970
[ 2736.433981] binder: undelivered TRANSACTION_COMPLETE
[ 2736.439233] binder: undelivered TRANSACTION_ERROR: 29189
[ 2736.444955] binder: 25278:25374 got reply transaction with no transaction stack
02:39:25 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x802c550a, &(0x7f0000000000)={0xa3})
sync()

02:39:25 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, &(0x7f0000000040)={0x7, 0x7, 0x9, 0x0, 0x80000000})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:25 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x5, 0x0, 0x0, 0x0, 0xfffffffffffffffc})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0xc86, 0x2000)
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>r2})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:39:25 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof+\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:25 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1b5, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
mq_timedreceive(r3, &(0x7f0000000500)=""/196, 0xc4, 0x1, &(0x7f0000000000)={0x0, 0x1c9c380})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:25 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2736.452847] binder: undelivered TRANSACTION_ERROR: 29201
[ 2736.452900] binder: 25278:25374 transaction failed 29201/-71, size 0-0 line 2762
[ 2736.466362] binder: undelivered TRANSACTION_ERROR: 29189
[ 2736.473464] binder: undelivered TRANSACTION_ERROR: 29201
02:39:25 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185506, &(0x7f0000000000)={0xa3})
sync()

02:39:25 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:25 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x101000, 0x0)
getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000180)={<r2=>0x0, 0x1, 0x5, 0x8, 0x1000, 0x5d, 0x1, 0x374, {0x0, @in6={{0xa, 0x4e20, 0x7, @local, 0xfff}}, 0x80000001, 0x8, 0x3ff, 0x400, 0xffffffff}}, &(0x7f00000000c0)=0xb0)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f00000003c0)={r2, 0x1000, "567df13d9fa44276c908407370d2ce7f52722aee2ce9c47865f79b414a31471ee2bf410c572469144ae5e46ccc3292b91563ca3a5cce5388ad5c26bdf254afb68d1ad5ef1709f38b38f377ba58c35a0e1107776558efedcebd22e3904aaf0979209d7cb963ff7f62ad0ccdd53c07f9f4100ce428b68f608e5ed434df6dbf31ba55bf35b878ba18c5364d01144578dcd4890ebdd6a52b19e194bb581048d1f8284f153aa606d4980542ef38e5339e70e985c7bf93e9ce229278dca74f80556a342c052a0d5b82797a152fe074831e73871b84314eda4e9616fa04a2f6b23e277d2b803fa625d22a982d51e9598ad2e9dcd8ff50948e3eca588db577bd727463f589f657c4b62833164ae717ca2c6bff5b751c44401713dba060f76d43bb886340a672a8f1200b76174e8d593280c15e639312765ff6e1ce35af63c19f4ca2e24f0c900680b720e4226a3878529bdbe7cfeeeef1f25d935d8417c883aac89ba203bf7020e08367f5d496376da51a0616bcec13dc5f51431a9a18fedfbc9f138f76736963c8cd6667004d8fd915ee100fefad4dc9fc68bb62c42df863c99c0b323b7e14b853d420464753dd90aa900d7cb9df87d8cc9194b1964a181fd20029bd48667d58882c1b0a11fc210ee0d312c8869895492f127b2715e7f53499e23e3a9872bff5e1ac2e757a7c847f6d1225f4be1f253019ad775485f667801398e7be69c06433845ae00ea707f05072c145931c9b7cc0e842595003da50e5a051a40d23a42fc671f4136e7471ef8f9359dd9cdde643d77e4950b44f449ae36a8802eb792ea37945c2f0b2226314b68f9f4bd241110d5d08a683094c2082ccb99f52a73e4ce02c90979f09268d583cf47c971bf476ea5f4dc947e05bcb3179b7d76225f97c2d1f3483ba576580fc6babee32cca4da3ea3bf9720ee155c734ccb699ec69d09833ce0055b469ab8a5b2bb8df6194343f6791042c2ef036a366eda5a99879c575c413ccb10f75ea317ed5cdafa1ecd544ba60e178ca968e631007ca005cc1d46cd4dc2ea2a415d62e80a7a11be12c3a72f959b0cc6100935d595c73e0b4d44d35acb36ed467d96742f4db3b209d0433180f71c537c738684af40d0c82c7ac022c58a1c6bbbd46632bac469bec52c29a8d67da0bf8a2a687914e541d2805bc85e25eafd5074e8e2a12df46d3d71dfc4797f3708838c493fd7dbd2280303415b3868d21430d99a5434374cf9259fae1d5a912143a4723f6a1efb9bf77ce0d8c1671edc7f59405e2ee82563f97936c5b80cf28d161552f007c9419bb74dd181d835e0be5bdf7b43594ed5c6e7a7516db58bfa76997463e05e633b4f7b572ffad9b463d6fc783897863ad7dc88e1715673af33bb927fe6ab105c82d48c6f69719237b71474757f8cf6f8bf46ef8caff47a6a0fcab57d4cef6e56c6b2a68544fa91d75f826abc520e63e7c68025d5bbc52dcbac265dcb9fdcc7af94024edd6f5137c1890923375d8e70a8928f14e390b312556cf59d9792d1bb5b6754a6a7f85d9ee89eb72ace3505a7edf882f866c63e7bee8f3e9775a4f9df4921418d54fbdba028ac0491e891335130274e946d9620ddd8f951156d81dd74a419d79e9d33c2534d2102165713e7b159ae8ef4d519bebe053f9c25d00d90a3c9cc90ebfc65aff45b86374f07c874531c7fd03b03201392e593e964dfe9c863db1b8e653a4f8fba95b78b0d397e8a6db69f30cc12722470c314b1a044589363b7b38fb3eb066ad2a1cf673f4dd74c2b0cc72dc3bf3b0e4bd0db76ac946495e96a458bb08e524cfdfea7efd011c3e7a71309813f9d9e883d87516fc52dab55789a56a1dabf5c571c890ce8f26ec3fd80de9cf0dc48fc3da682679821b0e1c674a1a90e2f19afaef9dfa32fdfc7d8f034a466e16565babc05cd7e39c3f0de3f3b7c83c0c004b40a12d5bac62cddf23b6e0e96d5f396253f0c2020c9570e5c17b70071f816c0e75642a26316bcd042e7102f68829663c95c6b29cac1c2a0817c60c63fef607431e11de4ef3cec9ab8ef31d0bd3acd5ddb292973938ebadb51084c2eeea7d43e447c4cfbb8a71a3e793dfc9a2814b404e96de94cb7fb307f79e8a8695197acadea338b8f9f940ae0a3867c891bac08e9b1bf76c42ee67d913edf156da87e7b944013442c8f365627d7bde3be312d3201fb07d8f874416433f1224be36384d86f97773ca15d4de7fdc531905076df824c15cf0750459f68d91ad35a02b3295f46ba8f745d96db0ea03dd8be33e8999bdf0e2a1908aa59ac2cb64746fa560c66a9604b946450e9f515fe422701fca8967cc9e1d6befb1792cbbab9ea0210e5b362e85c0096294301b49cccc04a9085dca674faacaf9800ad4fa2fe4377830f2a8ec167440ae0f590f8a628695948375627b3accfac2387b19193973953114b8fc9397c51d67725774b0fa238747d82156a5e2155464ccd159b1cede21672c6b1e7c73cba0a4ecd5243672b4257f7456dc56ba938ca2bc5641771464f481907a96d99a51afdfc7eee460691fb943ee3819ca8d3f9d715f41540f03a98fe4d96678290b69d9084817be2bd5fd8eb132f964b93083b5152fd923f9128e943df2aca88b6e871d7b784ed3f2546df213076e89a5405604fd443707235274203bf9827ed2c0c28c0f87a6a70135e5b4f7c96a904329ed3e5d41516a16b77dc7da2d768f2d3e56be2a6ed8655c93b9887f2ed2dafa08ede682f4af4e27a106e6a58c09e8b546dda4fde77c8863fd7a2a958e875e44bc635c343a4e56f37e1a5ec1a093b0a32c6818a734f65a4cd02a6d02905e1b408459c71a0ce33d363c7a3a96d9342fdc1a1c4b95c099e57832c1c4a99082a7b43326684cc116ed4bfc7f1814658ba9ea7898d2807185f1d06a3170d83e6658597c319ae8bb6593f4e53c0e93b1322c619f5ceb17e2f338e7eecd5c012019b51ef7a02558cb401f4cb66c82982bfdd817f1e97dbe55dde35c60eb104f0e8147b482dad9fbd35162b1e3ab488a0ac0b29ae9831ef852b6a483019e67330f29923f504049c025cad5b925f42bed35505417c6e3f3133bb13dbd3fbc7525c25237ec2db35b0820ec6a028233e4bb05133e83e14eb75443deb32ba39445603f49facb66d7684a98ba47fce86d2f9b6be92d530df2b85ac39bae4b15ee3a195b08504ec08857da1051b205eb804b7b5dc68ca1008dcc6b5a183cf9f2411342f493ab6f76e505db90a594056c7a3a05ac397ebe2883d467a5c0914fd29213ab89d806e4a7736b1afb9aaf3b440f6285812b09e01e89990d3020269e287c73e6b517e81e86e3b1b7e94cb4f7c60034887c4e9628ea9855122dff8681f0dbdc06fef85482bb7e9c3a04974507b1657ca0c9956ae20632aa91dab7b1cbd19cef26c2249b3fca87047e39b6c5b83c917340a98742ada9395891e7d3e6bba6b4a56ee6aa09849b7c0922ec5fba504bc3fa77d27adda6633b2ed356f4eebe708456fc199ec87ed9e63c0b8b4b02159fd3c03ee2be1ccb8de2e6efe13fcb7dd29d64e8f60c3c47303c5ff9bc2db255b8ddc8678fda359ea58eb2b6a285ae55bf740f7a4e38c0858ef710b11aa83fee00e8e6af4cdd58f24d1be2fd482909918f971fc89cfa8e2b2174b80eb5fcb40f6a2153b43f4a7b235cc01a900145d78f55b101f2e3ac6b8e39e5a3a5f06d56530863134d1ae4e3f23ad2798241dec4e7c99ab9c51b13f2c95f42e516290b3b730118e04192a8e2cd2b9e0f0dc00667bf39323dab1711fed713911b66077ebca6f7e030a058fe962a9ca59ef761629eb48588a2a36a5ea63a5dce8213e20720ad28294cc16cbec1fb7e092a5ef0dfbc1b3b5c1309091a2f50813d370234b9b6d259b90e51bccc29b201f8ee9eb23fde03a40716df6884fd7d0bd7b31caac6e8e1720e7a9a494a13f33b335f8bbae9eaf2123e038ac9c7b66341f086d3a31c983089942f048d7cbcb1c4465b549fcdd3e372564925e947a8bfd9a5567ba79015f1feaf227bb1ba5d9c2de9df7baa5447d9fda44abebc9f894baba49a3af1c34bb31fa12c5fc9604d7c1bf6410dbe3d6758a42ba607d0b6545ae740ae1a27d5e42161f390560e89d22b4d23ba8ae6ca5b0e0514b47a19999d9a3086a8fa987f41bbbeabb7bec620f20d60bcae4b862e1ce5137bc6e5b8410d1d0e5e5d8834166a54b4ba111ef1f08780c2a2e0b0036899117904204bc9b1418d7a0a333ef645d77d70a80cdcae640c35833bdf01c9e685987f48efc086580bf4390667284587f80aa52747b066ab3296a66469aae091828fa6176d614442debf7f34564beb654a36c60ca5e605976e299e60d3edd891db08b4d08048a355eb96a80041e6af91d373b742953be406033692b08547ab631df88f53981887ee018dc87dd38ba96ca9f0b7b61bda98e22e3eca6e6b3cb0a018fb271f1b6a8889e5dc732cb75ba5fe1b78318acae2d529a89176ca3df633316763b871cc2d509cb503aff5326087aac9b53f68d8e3b494ccea5a4b26ba406ffea77cc09eab5b31af2be31452aeb8ec81154826b8e1da9c3337ff87d0af66f90e23ff7e8f2c32f4b9d6c3a7c909cb4eebaa3a6955b2f4bc7e6d1b890803456df500afbe5323ee9d4b1fd6ae91d680769d8d78afe948bf1c72a8a9d80dc88ae43c7d9347daa21f0cd5806538785ba2013ebab8e2e8ca20164e4cb89993471b97807592d915aef024f7ff66d56308979f6434b1b3324d14dd07fd8f86af04267da5877ade21fdc0d1831f0e55cd300e94548ff709fdd162abe13cb118098e75945ecc2ecb40d5925f55602f51421e5948d0a29f5623a8d7453bba12ce71472989d18dce8ab0b43a8dd97246dd45e58659236602dafd7de7ae28e2ed7f70ecb4cf74c7697a2785834de0788ee476187d9c230e489910680ba8bdcb22341210dc20352540ee2e99982ef72a889d9208854b2a60278fd49da60510070a8e32bfc4164ce0beeed37f5c8246bef3b48390728719b3ac676d1944d0aabbdc74ea18049d6ba0f94f859189cc2980f7076031eef548f137a456cc92969da83345e88bb44b22b7cee93eb27b7193c846fbd8898cf315012dafb5b412fc6a8b2b35e72cff1d27e37d9183b89520c14103e6aee49c1e784aaeb29e8898f378297377f0bdd19113fa97646b4224315b50711763e4f3bfcb14d8d4a1467d0078f3d1033f2aa0245185831faec6fec2dbd3ba64a510e90cfd98d063b694ba3db47c32dc14e1489441a2b99af3756be92be150c10b1a596ec03c8d7544b077a18caad6fa2136b896975a2d5403a8e1f17520e7d99fc80ee79876b01bd103b340c07de4b693d539ecaed2e1e3ad252a6b18b00c3ceeba5a9ddb8c5987d29804196c910a1a6ec400613e86744b02c85af40c8dc03f23a2f485b2a3d7a221603dcd041908c7a6c73afd19386fb6c099b14c7d614ffc5fa3ca9fe55d11149c236ef9deaf515eff2de78203b4bf70c3a4516e1c3139bd0c67a38caaa08356ea42d517c96b1901bf39d8c88c0b928954ad957e83dd61fbc3a2cf104bdced702e9b58628e13fa045e7f8c74355dfdee83a17b74ffefc9441bd6ba14591338c56cb39406c05b6a5978db9e9e846866f25177763d5cb2c2001c2375ad1448bcb76c56215d25ed096a5f70aea82afef7ce4ae71fcd11ac0c19088a8f994926b040fceaee2dab97ff6920b941d07566f170c01b819cc3074b2a9c2a2e6d42b1bddf6184c3434df62f7d29a379df6534f6811d55e5e481fb858022ec60337f772f94a30e7108cf3ec1d24"}, &(0x7f0000000100)=0x1008)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000000)={'ifb0\x00', 0x1857})
ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r4=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r4, 0x0)

[ 2736.532155] ion_mmap: failure mapping buffer to userspace
[ 2736.589862] binder: BINDER_SET_CONTEXT_MGR already set
[ 2736.596620] binder: 25380:25395 got reply transaction with no transaction stack
[ 2736.617826] binder: 25380:25395 transaction failed 29201/-71, size 0-0 line 2762
[ 2736.621489] binder: 25390:25392 ioctl 40046207 0 returned -16
02:39:25 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc018556c, &(0x7f0000000000)={0xa3})
sync()

[ 2736.641297] ion_mmap: failure mapping buffer to userspace
02:39:25 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/mcfilter\x00')
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000007000/0x3000)=nil, 0x3000})
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:39:25 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2736.683574] binder: 25390:25392 ioctl 801c581f 20000040 returned -22
[ 2736.694244] autofs4:pid:25404:autofs_fill_super: called with bogus options
[ 2736.710793] binder: BINDER_SET_CONTEXT_MGR already set
02:39:25 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0105500, &(0x7f0000000000)={0xa3})
sync()

[ 2736.756174] binder: 25390:25405 got reply transaction with no transaction stack
[ 2736.767169] binder: 25390:25405 transaction failed 29201/-71, size 0-0 line 2762
[ 2736.767372] binder: 25380:25395 ioctl 40046207 0 returned -16
[ 2736.775783] binder: release 25390:25405 transaction 8226 out, still active
[ 2736.788272] binder: undelivered TRANSACTION_COMPLETE
[ 2736.805981] ion_mmap: failure mapping buffer to userspace
[ 2736.812909] autofs4:pid:25420:autofs_fill_super: called with bogus options
[ 2736.864356] binder: 25380:25381 got reply transaction with no transaction stack
[ 2736.888771] binder: release 25380:25381 transaction 8226 in, still active
[ 2736.897106] binder: 25380:25381 transaction failed 29201/-71, size 0-0 line 2762
[ 2736.905912] binder: send failed reply for transaction 8226, target dead
[ 2736.912705] binder: undelivered TRANSACTION_ERROR: 29201
[ 2736.976965] binder: undelivered TRANSACTION_ERROR: 29201
02:39:26 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x4010, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x4000, 0x0)
ioctl$VT_OPENQRY(r3, 0x5600, &(0x7f00000000c0))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:26 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000000)={0xa3})
sync()

02:39:26 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x801, 0x200)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x82203, 0x0)
ioctl$RTC_WKALM_RD(r1, 0x80287010, &(0x7f0000000080))
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:39:26 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:26 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="02634040896fce744592ba5ff4f1842edf036b546f3d69a8494c758f516fc0afd4424b3ec648bcde058dab10529c89d0c191781e62c411930c43c301d78fa1d4ebb920d0d86b107ea8f1cb7a27588cd312fe5a24d97a5a83527d524b4e8db9a345a9b58257cc1e03bf55db7a69b6f12c"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})
setsockopt$inet6_icmp_ICMP_FILTER(r3, 0x1, 0x1, &(0x7f0000000000)={0x80000000}, 0x4)

02:39:26 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofi\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2737.367539] binder_alloc: binder_alloc_mmap_handler: 25390 20001000-20004000 already mapped failed -16
[ 2737.377865] binder_alloc: 25390: binder_alloc_buf, no vma
[ 2737.383609] binder: 25390:25405 ioctl 801c581f 20000040 returned -22
[ 2737.390965] binder: 25390:25439 got reply transaction with no transaction stack
02:39:26 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x40049409, &(0x7f0000000000)={0xa3})
sync()

[ 2737.441671] ion_mmap: failure mapping buffer to userspace
[ 2737.470927] binder: 25450:25453 unknown command 1077961474
02:39:26 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7, 0x20001800, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000, 0x10000000})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f00000003c0)={'broute\x00', 0x0, 0x0, 0x0, [], 0x6, &(0x7f0000000000)=[{}], 0x0, [{}, {}, {}, {}, {}, {}]}, 0xd8)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2737.497887] binder: 25450:25453 ioctl c0306201 20000440 returned -22
[ 2737.505331] binder: BINDER_SET_CONTEXT_MGR already set
[ 2737.515451] autofs4:pid:25452:autofs_fill_super: called with bogus options
[ 2737.526057] binder: 25458:25459 ioctl 40046207 0 returned -16
[ 2737.526194] binder: 25450:25453 got reply transaction with no transaction stack
02:39:26 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc018554c, &(0x7f0000000000)={0xa3})
sync()

[ 2737.575748] autofs4:pid:25463:autofs_fill_super: called with bogus options
[ 2737.603393] binder: release 25458:25459 transaction 8234 out, still active
[ 2737.609217] ion_mmap: failure mapping buffer to userspace
[ 2737.610526] binder: 25458:25473 got reply transaction with no transaction stack
02:39:26 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x6, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, 0x0, 0x800000000000000, 0x0, 0x5})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000000c0))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x0, 0x0)
ioctl$LOOP_SET_BLOCK_SIZE(r3, 0x4c09, 0x7)
signalfd(r3, &(0x7f0000000100)={0xffff}, 0x8)
ioctl$RTC_PIE_ON(r3, 0x7005)
ioctl$DRM_IOCTL_ADD_CTX(r3, 0xc0086420, &(0x7f0000000180)={<r4=>0x0})
ioctl$DRM_IOCTL_NEW_CTX(r3, 0x40086425, &(0x7f00000001c0)={r4, 0x1})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:39:26 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2737.623742] binder: undelivered TRANSACTION_COMPLETE
[ 2737.631406] binder: BINDER_SET_CONTEXT_MGR already set
[ 2737.655072] binder: 25450:25460 ioctl 40046207 0 returned -16
[ 2737.669284] binder: 25450:25453 unknown command 1077961474
[ 2737.686415] binder: 25450:25453 ioctl c0306201 20000440 returned -22
[ 2737.716829] binder: 25450:25484 got reply transaction with no transaction stack
02:39:26 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185507, &(0x7f0000000000)={0xa3})
sync()

[ 2737.737902] ion_mmap: failure mapping buffer to userspace
[ 2737.740836] binder: send failed reply for transaction 8234, target dead
02:39:27 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f00000000c0)='./file0\x00', 0xaa)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})
fchmodat(r3, &(0x7f0000000040)='./file0\x00', 0x34)

02:39:27 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:27 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000002c0)={<r3=>0xffffffffffffffff}, 0x2, 0x7}}, 0x20)
write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000340)={0x10, 0x30, 0xfa00, {&(0x7f00000001c0), 0x0, {0xa, 0x4e24, 0x5, @empty, 0x5}, r3}}, 0x38)
r4 = open(&(0x7f0000000040)='./file0\x00', 0x20b42, 0x20)
getsockopt$inet_mreq(r4, 0x0, 0x23, &(0x7f00000000c0)={@broadcast, @local}, &(0x7f0000000180)=0x8)
dup2(r0, r1)
getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000400)=@assoc_value={<r5=>0x0, 0x8}, &(0x7f00000005c0)=0x8)
setsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000640)={r5, 0x8001}, 0x8)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r4, 0xc0a85320, &(0x7f0000000500)={{0x5, 0x8}, 'port1\x00', 0x10, 0x80041, 0x1f, 0x8, 0x8, 0x8, 0x1ff, 0x0, 0x3, 0x400})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:27 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x8, 0x20000)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000080), &(0x7f00000000c0)=0x4)
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:39:27 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof%\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:27 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x8008551c, &(0x7f0000000000)={0xa3})
sync()

[ 2738.295019] binder_alloc: 25458: binder_alloc_buf, no vma
02:39:27 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x4004551e, &(0x7f0000000000)={0xa3})
sync()

[ 2738.364128] ion_mmap: failure mapping buffer to userspace
[ 2738.379827] autofs4:pid:25500:autofs_fill_super: called with bogus options
02:39:27 executing program 1:
r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/sockcreate\x00', 0x2, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f0000000240)='/dev/vcsa#\x00', 0x4, 0x2800)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000880)='IPVS\x00')
sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f00000009c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000980)={&(0x7f00000008c0)={0xa8, r2, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10}}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x4}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x2f}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2e, 0x28}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x8}}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xaf}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x9}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x1}, 0x0)
lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000003c0)={0x0, <r4=>0x0}, &(0x7f0000000400)=0xc)
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000440)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000480)=0xc)
stat(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0})
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000580)={0x0, 0x0, <r7=>0x0}, &(0x7f00000005c0)=0xc)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600)={0x0, 0x0, <r8=>0x0}, &(0x7f0000000640)=0xc)
r9 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x7, 0x400000)
ioctl$KDGKBDIACR(r9, 0x4b4a, &(0x7f00000001c0)=""/99)
lstat(&(0x7f0000000680)='./file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0})
stat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, <r11=>0x0})
r12 = getgid()
fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000800)={{}, {0x1, 0x2}, [{0x2, 0x5}, {0x2, 0x1, r3}, {0x2, 0x0, r4}], {0x4, 0x2}, [{0x8, 0x5, r5}, {0x8, 0x4, r6}, {0x8, 0x4, r7}, {0x8, 0x3, r8}, {0x8, 0x5, r10}, {0x8, 0x1, r11}, {0x8, 0x0, r12}], {0x10, 0x2}, {0x20, 0x2}}, 0x74, 0x0)
r13 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r13, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2040000, 0x0, 0xfffffffffffffffe, &(0x7f0000000180), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r14 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r14, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r15=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r15, 0x0)

[ 2738.423144] binder: 25504:25516 got reply transaction with no transaction stack
[ 2738.433879] binder: BINDER_SET_CONTEXT_MGR already set
[ 2738.435400] autofs4:pid:25517:autofs_fill_super: called with bogus options
02:39:27 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:27 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x5452, &(0x7f0000000000)={0xa3})
sync()

[ 2738.477952] binder: 25513:25514 ioctl 40046207 0 returned -16
[ 2738.557332] binder: BINDER_SET_CONTEXT_MGR already set
[ 2738.562758] binder: 25504:25516 ioctl 40046207 0 returned -16
[ 2738.593277] binder: release 25513:25528 transaction 8242 out, still active
[ 2738.607102] binder: undelivered TRANSACTION_COMPLETE
[ 2738.621741] autofs4:pid:25532:autofs_fill_super: called with bogus options
02:39:27 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, &(0x7f0000000000)={0x5, 0x6, 0x80000000, 0x40, 'syz1\x00', 0x5})
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x2a, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0c6300005b518cd69a1a4338822ec6ba41f0bf14c913642af35073a3269f74673de079c9b8c0cb75b358"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})
ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f0000000040)={0x1, r3})

[ 2738.649730] binder: release 25504:25507 transaction 8242 in, still active
[ 2738.681704] binder: send failed reply for transaction 8242, target dead
02:39:27 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofu\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2738.697672] autofs4:pid:25542:autofs_fill_super: called with bogus options
[ 2738.733274] binder: 25545:25546 ioctl c0405519 20000000 returned -22
[ 2738.800423] binder: 25545:25546 unknown command -695447205
[ 2738.814427] binder: 25545:25546 ioctl c0306201 20000140 returned -22
[ 2738.829368] binder: release 25545:25546 transaction 8246 out, still active
[ 2738.838742] binder: 25545:25549 ioctl c0405519 20000000 returned -22
[ 2738.845330] binder: undelivered TRANSACTION_COMPLETE
[ 2738.864508] binder: BINDER_SET_CONTEXT_MGR already set
[ 2738.875037] binder: 25545:25546 ioctl 40046207 0 returned -16
[ 2738.875682] binder_alloc: 25545: binder_alloc_buf, no vma
[ 2738.911571] binder: send failed reply for transaction 8246, target dead
02:39:28 executing program 4:
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000002c0)={<r0=>0x0}, &(0x7f0000000300)=0xc)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x6e28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xfffffffffffffffd}, r0, 0x0, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
r4 = creat(&(0x7f0000000040)='./file0\x00', 0x48)
ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f00000000c0)={0x7})
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00634040105b8f90059b1377388f1024e4fb2c5a870d4cf36d66de21cf354e7177a06e100189f62f80967bc2c81446d2c690afa85100826375cf373b1d16537c16dbe8e38933ff5d9c2cbce6fdc136dc74011e101aab07621a6db62150e57d60919f3ce5e4258aa652f413825508939b33409b1cab105f7ddc5e1c91004553c292856e077fb7d09ab6f504521f1bf53c4abe305edc30b9dbe9ce5c67"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="bb99f760"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r1, r2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:28 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof.\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:28 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x40085511, &(0x7f0000000000)={0xa3})
sync()

02:39:28 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000080)=0x4)
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:39:28 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:28 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x100, 0x0)
getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffff9c, 0x84, 0x18, &(0x7f0000000040)={<r3=>0x0, 0x8000}, &(0x7f00000000c0)=0x8)
setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f0000000180)={r3, 0x5, 0xe84a}, 0x8)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r1, r0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2739.193553] binder: release 25513:25528 transaction 8251 out, still active
[ 2739.202040] binder: send failed reply for transaction 8251, target dead
[ 2739.208921] binder: undelivered TRANSACTION_COMPLETE
[ 2739.273330] binder: release 25553:25555 transaction 8254 out, still active
[ 2739.273622] ion_mmap: failure mapping buffer to userspace
[ 2739.286668] binder: send failed reply for transaction 8254, target dead
[ 2739.294476] binder: undelivered TRANSACTION_COMPLETE
[ 2739.319800] autofs4:pid:25558:autofs_fill_super: called with bogus options
[ 2739.325524] binder: BINDER_SET_CONTEXT_MGR already set
[ 2739.332366] binder: 25553:25555 ioctl 40046207 0 returned -16
[ 2739.349251] binder_alloc: 25553: binder_alloc_buf, no vma
[ 2739.349544] binder: BINDER_SET_CONTEXT_MGR already set
02:39:28 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpu.stat\x00', 0x0, 0x0)
ioctl$TIOCLINUX2(r2, 0x541c, &(0x7f0000000100)={0x2, 0xda, 0x1, 0x7ff, 0x200, 0x5})
set_thread_area(&(0x7f00000002c0)={0x7})
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000001c0)={'team0\x00', <r3=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'vcan0\x00', r3})
r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x2040, 0x0)
write$UHID_CREATE(r5, &(0x7f00000003c0)={0x0, 'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000500)=""/132, 0x84, 0x6, 0x1, 0x3, 0x6, 0x7}, 0x120)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000300)={'team0\x00', {0x2, 0x4e22, @multicast1}})
ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r5, 0x40405515, &(0x7f0000000080)={0x6, 0x3, 0x3, 0x100000000, 'syz1\x00', 0x80000000})
fcntl$F_GET_FILE_RW_HINT(r5, 0x40d, &(0x7f0000000340))
ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f0000000280))
ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r6=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r6, 0x0)
ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r5, 0x40045731, &(0x7f0000000180)=0x20)

02:39:28 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x80045503, &(0x7f0000000000)={0xa3})
sync()

[ 2739.385165] binder: 25563:25564 ioctl 40046207 0 returned -16
[ 2739.408368] autofs4:pid:25558:autofs_fill_super: called with bogus options
[ 2739.423310] binder: 25563:25564 got transaction to invalid handle
02:39:28 executing program 3:
socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
write(r0, &(0x7f0000000180)="1e949563390f579f67a757cfe9a8f7304006db7624dde5fc847af05c2c688d0f959be452e4f843b864cd6151f5126512c597564fdb4a4f07cd351a83a6da85404435b9d3c90ce4", 0x47)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x800)
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r1, r2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, &(0x7f0000000500)})

02:39:28 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofsh', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2739.439613] binder: 25563:25564 unknown command 1626839483
[ 2739.459198] binder: 25563:25564 ioctl c0306201 20000140 returned -22
[ 2739.477676] ion_mmap: failure mapping buffer to userspace
[ 2739.495371] device bridge_slave_1 left promiscuous mode
[ 2739.500879] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2739.502762] binder: 25563:25564 got transaction to invalid handle
[ 2739.528124] binder: BINDER_SET_CONTEXT_MGR already set
[ 2739.533475] binder: 25584:25585 ioctl 40046207 0 returned -16
[ 2739.535855] IPVS: ftp: loaded support on port[0] = 21
02:39:28 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x41045508, &(0x7f0000000000)={0xa3})
sync()

02:39:28 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2739.545130] device bridge_slave_0 left promiscuous mode
[ 2739.547541] binder: 25563:25578 unknown command 1626839483
[ 2739.555293] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2739.575192] binder: 25563:25578 ioctl c0306201 20000140 returned -22
[ 2739.629200] binder: release 25584:25591 transaction 8262 out, still active
[ 2739.642587] binder: undelivered TRANSACTION_COMPLETE
[ 2739.655131] team0 (unregistering): Port device team_slave_1 removed
[ 2739.667548] team0 (unregistering): Port device team_slave_0 removed
02:39:28 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b, 0x0, 0x0, 0x4, 0x0, 0x1000000000000000, 0xc000000000000000, 0x0, 0x0, 0x8, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fffffffd, 0x0, @perf_bp, 0x0, 0x0, 0xfff}, 0x0, 0x1000000000, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000040))
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000280)=ANY=[], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0163404000000000000000000000000000f4ffffff000000000000000000000000000000e300000000", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

02:39:28 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000180)={<r1=>0x0, 0xfffffffffffffffd, 0x4, 0x1bc, 0x3f3cd6fc, 0x7}, &(0x7f00000001c0)=0x14)
getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000580)=ANY=[@ANYRES32=r1, @ANYBLOB="e3000000d5128c0d42754dd93a4be3dcd751fb6e3c8115442798dbe90fa96dcb2f54892dd229c9b7b649b64eb6ce2c2583469f3c907a18fecfd372640310df282613e6e9ea0f80436c3b1f8058a4a1640f35af0836aa6f7dc7c33fee09b8b5417eec8e99b356c005fd511f78b2f8927058c5d517f12fb931ce6b0655c6f188334f647cb8e87bc928ae8e804836735a90bc005db5d4ab15d3601132671d7a91028e4a2f908392b5ebf1f6cb390d52a9ca8070c50edb71e477a98c82aa124bef9410b6aa6ec9d21934c209054b70ebfc430f8534fa8af5c288c099ce9b7fdc5b5d00000000000000"], &(0x7f0000000680)=0xeb)
r2 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0)
setsockopt$bt_BT_SECURITY(r4, 0x112, 0x4, &(0x7f00000000c0)={0x5, 0x3}, 0x2)
fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f0000000380)=0xfffffffffffffffc)
getsockopt$inet6_buf(r0, 0x29, 0xff, &(0x7f0000000480)=""/204, &(0x7f0000000100)=0xcc)
ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x1, 0x0, 0x6f641cdc})
r5 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0xff, 0x400)
r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00')
socket$can_bcm(0x1d, 0x2, 0x2)
sendmsg$IPVS_CMD_GET_INFO(r5, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)={0x70, r6, 0x800, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x200}, @IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x400}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'none\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xc, 0x18}}, @IPVS_SVC_ATTR_AF={0x8}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004000)
setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f00000006c0)=0xbeab, 0x4)
write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000940)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000900)={<r7=>0xffffffffffffffff}, 0x111, 0xd}}, 0x20)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r5, &(0x7f0000000980)={0x5, 0x10, 0xfa00, {&(0x7f0000000700), r7, 0x3}}, 0x18)
syncfs(r2)
ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r8=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r8, 0x0)
ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r5, 0x4008af23, &(0x7f0000000000)={0x2, 0xbb})

02:39:28 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2739.673482] binder: send failed reply for transaction 8262, target dead
[ 2739.691759] bond0 (unregistering): Releasing backup interface bond_slave_1
02:39:28 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185574, &(0x7f0000000000)={0xa3})
sync()

[ 2739.720528] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2739.745861] autofs4:pid:25603:autofs_fill_super: called with bogus options
[ 2739.754816] binder: 25604:25606 ioctl 4b3b 20000040 returned -22
02:39:28 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2739.816470] bond0 (unregistering): Released all slaves
[ 2739.831918] autofs4:pid:25603:autofs_fill_super: called with bogus options
[ 2740.319597] binder: BINDER_SET_CONTEXT_MGR already set
[ 2740.326302] binder: 25584:25628 ioctl 40046207 0 returned -16
[ 2740.341247] binder: 25604:25606 ioctl 4b3b 20000040 returned -22
[ 2740.355449] binder: BINDER_SET_CONTEXT_MGR already set
[ 2740.368724] binder: 25604:25611 ioctl 40046207 0 returned -16
[ 2740.386602] binder: release 25584:25591 transaction 8265 out, still active
[ 2740.398387] binder: undelivered TRANSACTION_COMPLETE
[ 2740.428609] binder: send failed reply for transaction 8265, target dead
[ 2741.163943] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2741.170788] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2741.178609] device bridge_slave_0 entered promiscuous mode
[ 2741.214145] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2741.220675] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2741.228300] device bridge_slave_1 entered promiscuous mode
[ 2741.264038] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2741.302116] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2741.414216] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2741.453444] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2741.627294] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2741.635172] team0: Port device team_slave_0 added
[ 2741.654880] device bridge_slave_1 left promiscuous mode
[ 2741.660362] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2741.672474] device bridge_slave_0 left promiscuous mode
[ 2741.679441] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2741.709521] team0 (unregistering): Port device team_slave_1 removed
[ 2741.719548] team0 (unregistering): Port device team_slave_0 removed
[ 2741.730960] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2741.746143] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2741.784115] bond0 (unregistering): Released all slaves
[ 2741.812686] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2741.821608] team0: Port device team_slave_1 added
[ 2741.870792] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2741.941349] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2742.021291] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2742.066860] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 2742.073933] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 2742.088976] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2742.750150] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2742.756590] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2742.763227] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2742.769637] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2742.777892] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2743.064473] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2744.068167] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2744.191465] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2744.313702] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2744.319916] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2744.334814] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2744.452535] 8021q: adding VLAN 0 to HW filter on device team0
02:39:34 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofx\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:34 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000000), &(0x7f0000000080)=0x4)
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:39:34 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x5460, &(0x7f0000000000)={0xa3})
sync()

02:39:34 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
socketpair$inet(0x2, 0x80000, 0x4, &(0x7f0000000000))
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0163404000000000000000000000000000000000d1804f9c9a050000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

02:39:34 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0)
get_thread_area(&(0x7f00000000c0)={0x7, 0x20000800, 0x0, 0x0, 0x0, 0x8, 0x6db, 0x5e, 0x7, 0x9})
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r3, 0xc0bc5351, &(0x7f00000002c0)={0x5, 0x1, 'client1\x00', 0x1, "761adfa3d1da3e7f", "e1872ca47510d43d2588ea943c73722bf13e23ee00ed3374662c8e555d56dcae", 0xffffffff, 0x3f})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="4cbe1335"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:34 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2745.504976] binder: BINDER_SET_CONTEXT_MGR already set
[ 2745.535593] ion_mmap: failure mapping buffer to userspace
[ 2745.546848] binder: 25887:25888 ioctl 40046207 0 returned -16
[ 2745.553889] binder_transaction: 7 callbacks suppressed
[ 2745.553898] binder: 25885:25897 got reply transaction with no transaction stack
[ 2745.567110] binder_thread_release: 1 callbacks suppressed
[ 2745.567121] binder: release 25885:25890 transaction 8268 out, still active
02:39:34 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc020660b, &(0x7f0000000000)={0xa3})
sync()

[ 2745.584979] binder: 25887:25896 unknown command 890486348
[ 2745.617352] binder: undelivered TRANSACTION_COMPLETE
[ 2745.622903] binder_transaction: 22 callbacks suppressed
[ 2745.622919] binder: 25885:25897 transaction failed 29201/-71, size 0-0 line 2762
[ 2745.624191] binder: 25887:25896 ioctl c0306201 20000440 returned -22
02:39:34 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
r2 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_opts(r2, 0x0, 0x4, &(0x7f0000000040)="441f0800000000009727c1c6fe76cef3e26def23000200000811000013", 0x1d)
r3 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x100000000, 0x4000)
ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f00000000c0)={0xc0, 0x0, 0x1, 0x7ff})
r4 = socket$inet6(0xa, 0x1, 0x8010000000000084)
bind$inet6(r4, &(0x7f0000ef8cfd)={0xa, 0x4e23}, 0x1c)
listen(r4, 0x2)
r5 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000080), 0x4)
sendto$inet6(r5, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r6=>0xffffffffffffffff})
read$eventfd(r6, &(0x7f0000000000), 0x8)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r6, 0x0)

[ 2745.668848] binder: BINDER_SET_CONTEXT_MGR already set
[ 2745.695661] binder: 25885:25897 ioctl 40046207 0 returned -16
[ 2745.733932] binder_alloc: 25885: binder_alloc_buf, no vma
02:39:34 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x4008550c, &(0x7f0000000000)={0xa3})
sync()

[ 2745.747422] IPVS: ftp: loaded support on port[0] = 21
[ 2745.763617] binder: 25885:25890 transaction failed 29189/-3, size 0-0 line 2970
[ 2745.774977] binder: 25887:25896 got reply transaction with no transaction stack
02:39:34 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000200)="153f623402000000000000001769610c703bd56099c8623eab744c45006cd6cd")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
ioctl$IOC_PR_PREEMPT(r0, 0x401870cb, &(0x7f0000000080)={0x688, 0xfffffffffffffff7, 0xf618, 0x8})
timerfd_create(0x2, 0x0)
r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ion\x00', 0xffffffffffffffff, 0x0)
r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x80000, 0x0)
mq_getsetattr(r2, &(0x7f0000000100)={0x0, 0x6, 0x1, 0x3, 0xffffffffffff704a, 0xf5, 0x0, 0xff}, &(0x7f0000000180))
listen(r2, 0x2)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00')
sendmsg$IPVS_CMD_SET_SERVICE(r2, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000100}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x24, r4, 0x405, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x400}]}, 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x40040)

[ 2745.795115] binder: 25887:25896 transaction failed 29201/-71, size 0-0 line 2762
[ 2745.797834] binder: release 25885:25890 transaction 8268 in, still active
02:39:34 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
r3 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x90140)
ioctl$KVM_GET_REGS(r3, 0x8090ae81, &(0x7f00000002c0))
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2745.850816] binder: send failed reply for transaction 8268, target dead
[ 2745.876710] binder_release_work: 23 callbacks suppressed
[ 2745.876716] binder: undelivered TRANSACTION_ERROR: 29201
02:39:34 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x8038550a, &(0x7f0000000000)={0xa3})
sync()

[ 2745.909620] binder: undelivered TRANSACTION_ERROR: 29189
[ 2746.001343] binder: release 25929:25930 transaction 8273 out, still active
[ 2746.008776] binder: 25929:25930 transaction failed 29189/0, size 0-0 line 2787
[ 2746.019771] binder: undelivered TRANSACTION_COMPLETE
[ 2746.038857] binder: send failed reply for transaction 8273, target dead
02:39:34 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x1000000, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:39:34 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x5514, &(0x7f0000000000)={0xa3})
sync()

02:39:34 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof#\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2746.070023] binder: BINDER_SET_CONTEXT_MGR already set
02:39:35 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x8004550f, &(0x7f0000000000)={0xa3})
sync()

[ 2746.105802] binder: 25929:25936 ioctl 40046207 0 returned -16
[ 2746.139816] binder_alloc: 25929: binder_alloc_buf, no vma
[ 2746.143004] ion_mmap: failure mapping buffer to userspace
[ 2746.157004] binder: 25929:25930 transaction failed 29189/-3, size 0-0 line 2970
[ 2746.186918] binder: 25929:25953 got reply transaction with no transaction stack
[ 2746.213831] binder: undelivered TRANSACTION_ERROR: 29189
[ 2746.224721] binder: undelivered TRANSACTION_ERROR: 29190
[ 2746.230614] binder: 25929:25953 transaction failed 29201/-71, size 0-0 line 2762
[ 2746.280967] binder_alloc: binder_alloc_mmap_handler: 25887 20001000-20004000 already mapped failed -16
[ 2746.296587] binder: undelivered TRANSACTION_ERROR: 29201
[ 2746.305758] binder: 25887:25896 unknown command 890486348
[ 2746.311354] binder: 25887:25896 ioctl c0306201 20000440 returned -22
02:39:35 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x0, 0x0)
getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f00000000c0), &(0x7f00000002c0)=0x4)
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0c630000d8b98e03d2a3f86c270a71ec06ae624528f6e28cf119ed8e7f031b32d627bd8857cdfd58cc2370b57d36853887e13ce38478"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2746.337926] binder: 25887:25965 got reply transaction with no transaction stack
[ 2746.354940] binder: 25887:25965 transaction failed 29201/-71, size 0-0 line 2762
[ 2746.363228] binder: undelivered TRANSACTION_ERROR: 29201
[ 2746.374818] binder: undelivered TRANSACTION_ERROR: 29201
[ 2746.454148] binder: release 25970:25971 transaction 8280 out, still active
[ 2746.466135] binder: 25970:25971 transaction failed 29189/0, size 0-0 line 2787
[ 2746.474505] binder: undelivered TRANSACTION_COMPLETE
[ 2746.490859] binder: send failed reply for transaction 8280, target dead
[ 2746.508725] binder_alloc: binder_alloc_mmap_handler: 25970 20001000-20004000 already mapped failed -16
[ 2746.528622] binder: BINDER_SET_CONTEXT_MGR already set
[ 2746.534074] binder: 25970:25971 ioctl 40046207 0 returned -16
[ 2746.540899] binder_alloc: 25970: binder_alloc_buf, no vma
[ 2746.546743] binder: 25970:25975 transaction failed 29189/-3, size 0-0 line 2970
[ 2746.554902] binder: undelivered TRANSACTION_ERROR: 29189
[ 2746.560786] binder: 25970:25975 got reply transaction with no transaction stack
[ 2746.569151] binder: undelivered TRANSACTION_ERROR: 29190
[ 2746.576750] binder: 25970:25975 transaction failed 29201/-71, size 0-0 line 2762
[ 2746.584741] binder: undelivered TRANSACTION_ERROR: 29201
[ 2746.990138] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2746.996675] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2747.003870] device bridge_slave_0 entered promiscuous mode
[ 2747.041010] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2747.047810] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2747.055043] device bridge_slave_1 entered promiscuous mode
[ 2747.090345] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2747.125737] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2747.236075] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2747.276228] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2747.439450] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2747.447212] team0: Port device team_slave_0 added
[ 2747.480884] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2747.488580] team0: Port device team_slave_1 added
[ 2747.522898] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2747.560756] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2747.600690] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2747.640576] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2748.009600] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2748.016060] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2748.022691] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2748.029100] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2748.036544] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2748.874602] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2749.399105] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2749.527816] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2749.656338] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2749.662489] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2749.676859] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2749.795826] 8021q: adding VLAN 0 to HW filter on device team0
02:39:39 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:39 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000)=0x10000)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
r2 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x1, 0x0)
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000000c0)={0x200000000056aa, 0x11, 0x0, <r3=>r2})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:39:39 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x4004550c, &(0x7f0000000000)={0xa3})
sync()

02:39:39 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006351c2"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:39 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofp\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:39 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="ee624040"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2750.592074] autofs4:pid:26222:autofs_fill_super: called with bogus options
[ 2750.600154] autofs4:pid:26224:autofs_fill_super: called with bogus options
[ 2750.657718] binder: 26233:26235 unknown command 1077961454
[ 2750.665536] binder: BINDER_SET_CONTEXT_MGR already set
[ 2750.684229] binder: 26227:26238 ioctl 40046207 0 returned -16
[ 2750.696776] binder: 26233:26235 ioctl c0306201 20000440 returned -22
02:39:39 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380)=0x2)
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.stat\x00', 0x0, 0x0)
ioctl$KVM_SET_PIT(r3, 0x8048ae66, &(0x7f0000000080)={[{0xffffffffffffff00, 0x800, 0x9, 0x6803, 0x81, 0xffff, 0x2, 0x1, 0x9, 0x3, 0xd337, 0x1, 0x30000}, {0xf9, 0x8, 0x16, 0x7, 0xfffffffffffff0d1, 0x5, 0x0, 0x0, 0x2, 0x20400, 0x3, 0x7, 0x80}, {0x1, 0x8, 0x2, 0x687, 0xb7, 0x5, 0x10001, 0x9, 0x6, 0x80, 0x400, 0x3, 0x6ed4}], 0xffffffffffffffdf})

[ 2750.715142] binder: 26227:26245 unknown command -1034853632
[ 2750.719220] autofs4:pid:26241:autofs_fill_super: called with bogus options
[ 2750.735868] binder: 26227:26245 ioctl c0306201 20000440 returned -22
[ 2750.745860] binder: 26233:26235 got reply transaction with no transaction stack
[ 2750.805618] autofs4:pid:26241:autofs_fill_super: called with bogus options
[ 2750.815871] binder: 26233:26235 transaction failed 29201/-71, size 0-0 line 2762
02:39:39 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2750.851329] binder: 26227:26245 got reply transaction with no transaction stack
[ 2750.859982] binder_alloc: binder_alloc_mmap_handler: 26233 20001000-20004000 already mapped failed -16
[ 2750.888480] binder: 26227:26245 transaction failed 29201/-71, size 0-0 line 2762
[ 2750.926156] binder: BINDER_SET_CONTEXT_MGR already set
[ 2750.954517] binder: 26233:26244 unknown command 1077961454
[ 2750.984562] binder: 26233:26235 ioctl 40046207 0 returned -16
[ 2750.996930] binder: 26233:26244 ioctl c0306201 20000440 returned -22
[ 2751.027366] binder: undelivered TRANSACTION_ERROR: 29201
[ 2751.033782] binder: 26233:26253 got reply transaction with no transaction stack
[ 2751.059736] autofs4:pid:26259:autofs_fill_super: called with bogus options
02:39:40 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof*\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2751.077559] binder: 26233:26253 transaction failed 29201/-71, size 0-0 line 2762
[ 2751.113926] binder: undelivered TRANSACTION_ERROR: 29201
02:39:40 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={<r4=>0x0, 0xd6}, &(0x7f00000000c0)=0x8)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f00000002c0)=@sack_info={r4, 0x81, 0xffffffff}, &(0x7f0000000300)=0xc)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0xfce7, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2751.145835] autofs4:pid:26263:autofs_fill_super: called with bogus options
02:39:40 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2751.257681] binder: release 26270:26271 transaction 8289 out, still active
[ 2751.265121] binder: 26270:26271 transaction failed 29189/0, size 0-0 line 2787
[ 2751.284739] binder: undelivered TRANSACTION_COMPLETE
[ 2751.311836] binder: send failed reply for transaction 8289, target dead
[ 2751.356950] binder_alloc: binder_alloc_mmap_handler: 26270 20001000-20004000 already mapped failed -16
[ 2751.435555] binder: BINDER_SET_CONTEXT_MGR already set
02:39:40 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autof-\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2751.458940] autofs4:pid:26278:autofs_fill_super: called with bogus options
[ 2751.475106] binder: BINDER_SET_CONTEXT_MGR already set
[ 2751.480430] binder: 26227:26284 ioctl 40046207 0 returned -16
[ 2751.486643] binder_alloc: 26270: binder_alloc_buf, no vma
[ 2751.492253] binder: 26270:26271 transaction failed 29189/-3, size 0-0 line 2970
02:39:40 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x80045510, &(0x7f0000000000)={0xa3})
sync()

[ 2751.518429] binder: 26227:26245 unknown command -1034853632
[ 2751.524289] binder: 26227:26245 ioctl c0306201 20000440 returned -22
[ 2751.562408] binder: 26270:26275 ioctl 40046207 0 returned -16
[ 2751.571640] autofs4:pid:26287:autofs_fill_super: called with bogus options
[ 2751.580191] binder: 26227:26296 got reply transaction with no transaction stack
[ 2751.594466] binder: 26270:26291 got reply transaction with no transaction stack
[ 2751.620837] binder: undelivered TRANSACTION_ERROR: 29190
[ 2751.627186] binder: 26270:26291 transaction failed 29201/-71, size 0-0 line 2762
[ 2751.634975] binder: undelivered TRANSACTION_ERROR: 29189
[ 2751.643385] binder: 26227:26296 transaction failed 29201/-71, size 0-0 line 2762
[ 2751.685240] binder: undelivered TRANSACTION_ERROR: 29201
[ 2751.704960] binder: undelivered TRANSACTION_ERROR: 29201
02:39:40 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:40 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)=ANY=[], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:40 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000000)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:40 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x5451, &(0x7f0000000000)={0xa3})
sync()

[ 2751.781602] binder: undelivered TRANSACTION_ERROR: 29201
02:39:40 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0189436, &(0x7f0000000000)={0xa3})
sync()

[ 2751.858833] autofs4:pid:26315:autofs_fill_super: called with bogus options
[ 2751.869753] binder: BINDER_SET_CONTEXT_MGR already set
[ 2751.889403] binder: 26317:26318 ioctl 40046207 0 returned -16
[ 2751.895746] binder: 26305:26321 got reply transaction with no transaction stack
[ 2751.903221] binder: 26305:26321 transaction failed 29201/-71, size 0-0 line 2762
[ 2751.911402] binder: release 26305:26313 transaction 8295 out, still active
[ 2751.922464] binder: undelivered TRANSACTION_COMPLETE
[ 2751.954979] autofs4:pid:26322:autofs_fill_super: called with bogus options
[ 2751.994564] binder: release 26317:26323 transaction 8297 out, still active
[ 2751.994743] binder: 26317:26323 got reply transaction with no transaction stack
[ 2752.001620] binder: undelivered TRANSACTION_COMPLETE
[ 2752.048902] binder: 26317:26323 transaction failed 29201/-71, size 0-0 line 2762
02:39:41 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f667305", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:41 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:41 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x5421, &(0x7f0000000000)={0xa3})
sync()

02:39:41 executing program 1:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
fcntl$getown(r0, 0x9)
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dsp\x00', 0x101000, 0x0)
ioctl$KVM_IRQ_LINE(r2, 0x4008ae61, &(0x7f0000000440)={0x8, 0x9})
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
r3 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x100000001, 0x80)
inotify_add_watch(r3, &(0x7f0000000100)='./file0\x00', 0x80000081)
set_thread_area(&(0x7f00000002c0)={0x4000000000000007, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffc, 0x4, 0x800000})
r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r5=>0xffffffffffffffff})
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000180)={<r6=>0x0, 0xf770}, &(0x7f00000001c0)=0x8)
getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000200)={r6, 0x8000}, &(0x7f0000000280)=0x8)
write$P9_RSTATFS(r0, &(0x7f00000003c0)={0x43, 0x9, 0x1, {0x40, 0xf2c, 0x9, 0x0, 0x4, 0xd8e3, 0x86, 0x1, 0x4d7b}}, 0x43)
getsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x6)
ioctl$int_in(r5, 0x5473, &(0x7f0000000300)=0x59538f5e)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r5, 0x0)

02:39:41 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x550b, &(0x7f0000000000)={0xa3})
sync()

[ 2752.388612] autofs4:pid:26335:autofs_fill_super: called with bogus options
[ 2752.423263] autofs4:pid:26343:autofs_fill_super: called with bogus options
02:39:41 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f667303", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:41 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x5450, &(0x7f0000000000)={0xa3})
sync()

02:39:41 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185548, &(0x7f0000000000)={0xa3})
sync()

[ 2752.581754] IPVS: ftp: loaded support on port[0] = 21
[ 2752.620923] binder_alloc: binder_alloc_mmap_handler: 26305 20001000-20004000 already mapped failed -16
[ 2752.646080] binder: BINDER_SET_CONTEXT_MGR already set
[ 2752.688863] binder: 26317:26323 ioctl 40046207 0 returned -16
[ 2752.695589] binder: BINDER_SET_CONTEXT_MGR already set
[ 2752.701194] binder: 26305:26374 got reply transaction with no transaction stack
[ 2752.709410] binder: 26317:26376 got reply transaction with no transaction stack
[ 2752.725457] binder_alloc: 26305: binder_alloc_buf, no vma
[ 2752.743882] binder: undelivered TRANSACTION_ERROR: 29201
[ 2752.750139] binder: send failed reply for transaction 8295, target dead
[ 2752.757066] device bridge_slave_1 left promiscuous mode
[ 2752.762594] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2752.772203] binder: 26317:26376 transaction failed 29201/-71, size 0-0 line 2762
[ 2752.779970] binder: send failed reply for transaction 8297, target dead
[ 2752.786954] binder: 26305:26321 ioctl 40046207 0 returned -16
[ 2752.798999] binder_alloc: 26305: binder_alloc_buf, no vma
[ 2752.805218] binder: undelivered TRANSACTION_ERROR: 29189
[ 2752.819270] binder: undelivered TRANSACTION_ERROR: 29189
02:39:41 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_pts(0xffffffffffffff9c, 0x42000)
r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x40, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r3, 0xc0a85352, &(0x7f0000000500)={{0xc7, 0x3}, 'port0\x00', 0x10, 0x20400, 0x6, 0xfffffffffffffffc, 0xff, 0x7, 0x274, 0x0, 0x2, 0x7})
ioctl$PIO_FONT(r2, 0x4b61, &(0x7f00000002c0)="67a07f5f1b8c2df7b699e429cc38d749912bdff3d1f44447a30a1843edcf3a7fdfe8a76473f0250b836353eff0b37da6745b7a21f08a4d728af626933c1325d2ae15f779f0a8263aba5afcd03f9fbff462d1dedce56d2b96d75d36a65d294a50c1ad835f978107c057bf842b9e720725b694908598586069fec0e0a9e8b742674908ab8b125465af0d2c56025e9b7bf7f337903a147373")
r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00001f00"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r5 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})
ioctl$VHOST_VSOCK_SET_GUEST_CID(r5, 0x4008af60, &(0x7f0000000040)={@hyper})

[ 2752.846240] device bridge_slave_0 left promiscuous mode
[ 2752.851708] bridge0: port 1(bridge_slave_0) entered disabled state
02:39:41 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = mmap$binder(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x2000000, 0x110, r2, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000340)={0x44, 0x0, &(0x7f00000002c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x10, &(0x7f0000000180)=[@ptr={0x70742a85, 0x1, &(0x7f0000000000), 0x1, 0x2, 0x3d}, @flat={0x0, 0x10a, r3}, @fd={0x66642a85, 0x0, r2, 0x0, 0x3}], &(0x7f0000000040)=[0x0, 0x20]}}], 0x2a, 0x0, &(0x7f00000000c0)="dfd812eb37cfa0c044a3f4c3797d75e8734bc2622d3d53abb87e020912d13ab50db3cddc7cb337fc6cf5"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:41 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:41 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185508, &(0x7f0000000000)={0xa3})
sync()

02:39:41 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2752.910619] binder: 26385:26386 unknown command 2031616
[ 2752.961726] binder: 26385:26386 ioctl c0306201 20000440 returned -22
[ 2752.977467] autofs4:pid:26393:autofs_fill_super: called with bogus options
[ 2752.996007] binder: BINDER_SET_CONTEXT_MGR already set
02:39:41 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x8004551a, &(0x7f0000000000)={0xa3})
sync()

[ 2753.011835] binder: 26385:26386 got reply transaction with no transaction stack
[ 2753.026006] team0 (unregistering): Port device team_slave_1 removed
[ 2753.029539] binder: 26396:26399 ioctl 40046207 0 returned -16
02:39:42 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f667306", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2753.057361] autofs4:pid:26393:autofs_fill_super: called with bogus options
[ 2753.064727] binder_alloc: binder_alloc_mmap_handler: 26385 20001000-20004000 already mapped failed -16
[ 2753.064833] team0 (unregistering): Port device team_slave_0 removed
[ 2753.081266] binder: BINDER_SET_CONTEXT_MGR already set
[ 2753.091448] binder: 26385:26398 unknown command 2031616
[ 2753.116086] binder: 26385:26398 ioctl c0306201 20000440 returned -22
[ 2753.117184] autofs4:pid:26397:autofs_fill_super: called with bogus options
[ 2753.153450] binder: 26385:26386 ioctl 40046207 0 returned -16
[ 2753.153860] binder_alloc: 26385: binder_alloc_buf, no vma
[ 2753.172381] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2753.218672] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2753.227635] autofs4:pid:26419:autofs_fill_super: called with bogus options
[ 2753.303283] bond0 (unregistering): Released all slaves
[ 2753.773422] binder_alloc: 26396: binder_alloc_buf, no vma
[ 2754.224461] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2754.230900] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2754.238126] device bridge_slave_0 entered promiscuous mode
[ 2754.274785] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2754.281211] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2754.288506] device bridge_slave_1 entered promiscuous mode
[ 2754.323397] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2754.360032] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2754.464740] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2754.502576] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2754.667817] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2754.675171] team0: Port device team_slave_0 added
[ 2754.710198] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2754.717829] team0: Port device team_slave_1 added
[ 2754.752780] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2754.789521] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2754.825400] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 2754.832488] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 2754.847928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2754.878138] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 2754.885558] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 2754.900717] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2755.254134] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2755.260553] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2755.267197] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2755.273566] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2755.281501] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2755.394420] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2756.605770] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2756.730466] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2756.860603] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2756.867204] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2756.881837] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2757.005959] 8021q: adding VLAN 0 to HW filter on device team0
02:39:46 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7, 0x0, 0x0, 0x40000000, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x80000000})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:39:46 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x80045505, &(0x7f0000000000)={0xa3})
sync()

02:39:46 executing program 4:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = dup(r0)
ioctl$KVM_GET_LAPIC(r1, 0x8400ae8e, &(0x7f0000000640)={"434f255f50f884310913f6ce9b233944daf296e850756a3f06bb3377fcdc4022325b93ada516882e8732e79509dac20a23fad45ab65381f22a9493c7283db38285efed08aa4d8b6d1bb312a7df2055de3611cd481128c7445cf4b4150bb2ab67a9bcce08f8fecfc778680e07924e9d3057421501a4467390b40e43d34ef5dbe2b02c719850e94176c9c3a42dcda5de9cb2cbe0dbcf7a36a29a79feac5843b7954f59e6edd3a847ac7f9370a0b90f8b13467fa8fa254f06188e825e23819ed9e0e14216eba93b0f96cea33c909b4fa7d4a498ce8240cc2616c18303e3d36730b5bb4586c9384a0ed79d6c5d675272958859f2fecd00e4a563a0b6a4bbf81c82f671b04e4f45975f44efd8c996733cf06080364afe6a86ac2ed04c28973be97def903a3a9c3e1cb78e8089a0bc76d103640bf62ddee87a554114765b3df6a676c74fbb6174d9156f0d20224b2cab5209ec59cf8119e89e1e80b163571cc0220e2518b6f1b6f0759bb86a67781768fba25fe54f312a831aef5914eaf2052e268bb15529f12bf91e371bb6efc89dd01e357ba2a48e43772dceafa15f9b0263740307e6028d8d5f2f11b7aa5bd1bd3184e2299c74107b7e59419f0de992318162f74256adc8b0a5b1625a7d3e8f8a7a83fd755bd9364e7be44f8209683f941a2ad639f3904525aa08988779d8b0955cd5f8ff966ef1ec9533a099e95b1df506c00db1635382c48c898440f13df5e5a4d6469ce6417645150fb54680376f65dd5948cabb4e6e6ece594951f15d1fbd3cc269adcc9a24d86f9241c5d630c0027dfbf7b2692f9d83a1d3292634792c1c23300309f691c4ddbf85b41c627a2268495e654c3c7e2fd1116cd02893a731f340f966e817af9f412b5ab5a2739edf74f4a81ed4bb79fdd7400b49768cfb80fcdff031afab2984a77e7a1061b04ab6f0db83a1bb6a90ad3990029aea63b4077a23b8533919b44b9eb627746dab5e70dd70ddec8be66b7d09794d20b9081cf024801e934f856caf6cf718411668c112dd7f5566aea2cd718637bd5a1946ae950d3af9c68904d36c159fe0ab3301788408d9146b47597c5bc494dcdf1f2c5afcd60492d453300c4da81393a213c24f6176847db628defd2c208125a683eabdc80ab4852eec638ad1af3af46f0bd4f441f2246c7825f252635d237e69de3233981374128350a468fd9e674737c9ddd9342439a62774ba45e009751fcaa3f52b1196a439bee583877d9a57be9ba175bb3e6cdcbde9f723524bdd5de2e9352b145b5546f70d29cbe857e552954d5dece83976a255b8816a0d9e5ebcee883183fc766242e570fa8beba995d8af824b4dbad1c79d31de6cef0a6a3c1352dfdfd52376d9d8133cd1da1795002468a635a4fa211f4b0bcfe8797697a88b2e34f806315fe2fcb5d008523010e8b3066cfc79e2b1f9823d00ac"})
r2 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040)={0x3, 0x9, 0x80000001, 0x2, 0x169c, 0x4, 0x0, 0x37, 0x1, 0x3, 0x8}, 0xb)
r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffff9c, 0x84, 0x1d, &(0x7f00000000c0)={0x5, [0x0, 0x0, 0x0, 0x0, <r5=>0x0]}, &(0x7f0000000280)=0x18)
getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000002c0)={r5, 0x2cd4450c, 0x8, 0x1}, &(0x7f0000000300)=0x10)
setsockopt$inet_tcp_buf(r1, 0x6, 0x0, &(0x7f0000000500)="709fa8bf66ec17d8513da97659696bf9b97bbc82d619045ca7a65eaf122feb5de3700beaaba564c0c0a832ac79babcbb02a9d716f37ead11c10319f61b8e4b9696c9f4537db4986a82f6e8f74ad8eed60c6ddf333124f600107cbb7b12fd1d16229b8fe542bd213a669d703a99006aa1eb4ef0cfb0805cd4b2d6771a61d82f17f3b91e44b3feb0a69379462474387271263e8f8408f9e30c9bcc4b5a97b066b30b9b8c56e1642f5931613095df739b82655eeaee5e82378cdcfb15", 0xbb)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000280)=ANY=[], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r2, r3)
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:46 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\n', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:46 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:46 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1734fb89cc6cf2819669d6e0439e6988c4291f9f744e4ba29c42c56d0a162c2c757c6e61816224d8eba021851d3890c668c24ccbad9fb19a55fca7957e4f6a678a5aa9e38a9953c34c6e8c2fce933879e9afca5ff524a32067611cb0efb2af194b3cc67d1105193bea3a03e0d2f8b8d29ca8c7da57bd146e2d4e5d01e0a1cb45e9033f2ee447fba7b0a2927264cfaea49e843f56"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ccc5aab84b5257e4e99b95bbfa7501e29a0962643cdf8b67ee477d097c79991bc5f9ee1b435bf83c02366d55d15d8d992af839a42dd6f00fdb266c617d7eabe0438a898985cfa359212f35b314ce453ff4defbcd040bac79d3f1a1a63da323c21098f7412f45bafaeb4ce5964d7edfd204472dbf26bb8dee71", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

[ 2757.745159] ion_mmap: failure mapping buffer to userspace
[ 2757.772182] usb usb9: usbfs: interface 0 claimed by hub while 'syz-executor5' sets config #163
[ 2757.805105] binder: 26680:26683 unknown command 0
[ 2757.806286] binder: BINDER_SET_CONTEXT_MGR already set
[ 2757.829971] binder: 26685:26687 ioctl 40046207 0 returned -16
[ 2757.844417] ion_mmap: failure mapping buffer to userspace
02:39:46 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

[ 2757.850426] binder: 26680:26683 ioctl c0306201 20000140 returned -22
[ 2757.882644] binder_transaction: 4 callbacks suppressed
[ 2757.882653] binder: 26680:26683 got reply transaction with no transaction stack
[ 2757.917241] binder: 26685:26695 got reply transaction with no transaction stack
02:39:46 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185505, &(0x7f0000000000)={0xa3})
sync()

02:39:46 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2757.942450] autofs4:pid:26689:autofs_fill_super: called with bogus options
[ 2757.953941] binder_transaction: 10 callbacks suppressed
[ 2757.953959] binder: 26680:26683 transaction failed 29201/-71, size 0-0 line 2762
[ 2757.957047] binder: 26685:26695 transaction failed 29201/-71, size 0-0 line 2762
[ 2757.965316] ion_mmap: failure mapping buffer to userspace
02:39:46 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
setsockopt$inet6_buf(r0, 0x29, 0x1c, &(0x7f0000000180)="6d65415a7af10eb24e74faf8c74db3b65c5c67b38f3d17c58880435fc3b2015269273ed4a4d059eed67a083d4979f29780508b4abf93b83ddc040cfc6668a1d5c17d7abf8f42432c3cac936072a5", 0x4e)
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x13f, 0xb}}, 0x20)
write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f00000000c0)={0x7, 0x8, 0xfa00, {r2, 0x2}}, 0x10)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r4=>0xffffffffffffffff})
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x80, 0x0)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r4, 0x0)

[ 2757.995745] binder: BINDER_SET_CONTEXT_MGR already set
[ 2758.008788] autofs4:pid:26710:autofs_fill_super: called with bogus options
[ 2758.027379] binder: 26680:26700 ioctl 40046207 0 returned -16
[ 2758.050647] binder: 26680:26683 unknown command 0
[ 2758.068206] binder: 26680:26683 ioctl c0306201 20000140 returned -22
[ 2758.070769] autofs4:pid:26717:autofs_fill_super: called with bogus options
[ 2758.084717] ion_mmap: failure mapping buffer to userspace
[ 2758.103380] binder_release_work: 10 callbacks suppressed
[ 2758.103387] binder: undelivered TRANSACTION_ERROR: 29201
[ 2758.104423] binder: 26680:26718 got reply transaction with no transaction stack
[ 2758.123378] ion_mmap: failure mapping buffer to userspace
[ 2758.142743] autofs4:pid:26717:autofs_fill_super: called with bogus options
02:39:47 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f667304", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:47 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0105512, &(0x7f0000000000)={0xa3})
sync()

02:39:47 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2758.156684] binder: 26680:26718 transaction failed 29201/-71, size 0-0 line 2762
02:39:47 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f0000000000)=0x1)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:39:47 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:47 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})
ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r3, 0x4008240b, &(0x7f00000002c0)={0x2, 0x70, 0x2bd, 0x1, 0x5, 0x0, 0x0, 0x1, 0x48001, 0x8, 0x0, 0x20, 0x2, 0x1, 0x6, 0xb7, 0x6, 0x9, 0x1, 0x7, 0x100000001, 0x200, 0x1ff, 0x8001, 0x3e2, 0x1, 0x4, 0x1, 0x3f, 0x3, 0x1, 0x100000000, 0x9, 0x6, 0x2, 0x3, 0x9, 0x3f, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000040)}, 0x1100, 0x7fffffff, 0x40000, 0x0, 0x10, 0x6, 0x3})
ioctl$IOC_PR_RELEASE(r3, 0x401070ca, &(0x7f00000000c0)={0x5, 0x5})

02:39:47 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x8008551d, &(0x7f0000000000)={0xa3})
sync()

[ 2758.283272] ion_mmap: failure mapping buffer to userspace
[ 2758.300471] binder: undelivered TRANSACTION_ERROR: 29201
[ 2758.348377] binder: release 26750:26751 transaction 8317 out, still active
[ 2758.355695] binder: 26750:26751 transaction failed 29189/0, size 0-0 line 2787
[ 2758.364559] binder: send failed reply for transaction 8317, target dead
[ 2758.376016] binder: undelivered TRANSACTION_COMPLETE
[ 2758.392817] binder_alloc: binder_alloc_mmap_handler: 26750 20001000-20004000 already mapped failed -16
[ 2758.401844] autofs4:pid:26754:autofs_fill_super: called with bogus options
[ 2758.424143] autofs4:pid:26756:autofs_fill_super: called with bogus options
[ 2758.425064] autofs4:pid:26762:autofs_fill_super: called with bogus options
[ 2758.438426] binder: BINDER_SET_CONTEXT_MGR already set
[ 2758.455386] binder: 26750:26751 ioctl 40046207 0 returned -16
[ 2758.477779] binder_alloc: 26750: binder_alloc_buf, no vma
[ 2758.492982] binder: 26750:26759 transaction failed 29189/-3, size 0-0 line 2970
[ 2758.511820] binder: 26750:26751 got reply transaction with no transaction stack
[ 2758.531144] binder: undelivered TRANSACTION_ERROR: 29190
[ 2758.540611] binder: 26750:26751 transaction failed 29201/-71, size 0-0 line 2762
[ 2758.563585] binder: undelivered TRANSACTION_ERROR: 29189
[ 2758.594531] binder: undelivered TRANSACTION_ERROR: 29201
[ 2758.600838] binder_alloc: binder_alloc_mmap_handler: 26685 20001000-20004000 already mapped failed -16
[ 2758.669926] binder: undelivered TRANSACTION_ERROR: 29201
[ 2758.676192] binder: 26685:26695 got reply transaction with no transaction stack
02:39:47 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x400101, 0x0)
ioctl$TIOCSBRK(r3, 0x5427)
r4 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})
write$P9_RWALK(r4, &(0x7f00000002c0)={0x8b, 0x6f, 0x1, {0xa, [{0x5, 0x4}, {0x20, 0x0, 0x8}, {0x1, 0x2, 0x5}, {0x4, 0x4, 0x7}, {0x0, 0x2}, {0x22, 0x3, 0x7}, {0x64, 0x0, 0x8}, {0x8, 0x4a, 0x1}, {0x90, 0x1, 0x4}, {0x0, 0x2, 0x7}]}}, 0x8b)

02:39:47 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000000080)={{0xa, 0x4e23, 0xffffffffffff8000, @ipv4={[], [], @loopback}, 0x4}, {0xa, 0x4e22, 0x7, @ipv4={[], [], @remote}, 0x20}, 0x6, [0xfffffffffffffeff, 0x7, 0x4d29, 0x5, 0xdd, 0x5, 0x1, 0x7]}, 0x5c)
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x114fff, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
r3 = getpid()
r4 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x5, 0x0)
exit(0x8)
getsockopt$llc_int(r4, 0x10c, 0x5, &(0x7f0000000300), &(0x7f0000000280)=0x4)
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x1, 0x5, 0x7f, 0x0, 0x5018000, 0x8000, 0x1, 0x40, 0x7c, 0x7, 0x510, 0x1, 0x400, 0x2e, 0x9189, 0x400, 0xfffffffffffffffe, 0x100000000, 0x63, 0x0, 0x7, 0x81, 0xfe77, 0x800000000000000, 0x8000000000, 0x3, 0x1, 0x401, 0x5, 0xab, 0x1, 0xb52, 0xb4, 0x85a, 0x101, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x2}, 0x10200, 0x3, 0xff, 0x7, 0x4a879900, 0x5, 0x200}, r3, 0xf, r4, 0x2)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:39:47 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f66737f", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:47 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x551f, &(0x7f0000000000)={0xa3})
sync()

02:39:47 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x4)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:47 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2758.724442] binder: 26685:26695 transaction failed 29201/-71, size 0-0 line 2762
[ 2758.764391] binder: undelivered TRANSACTION_ERROR: 29201
02:39:47 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x1, 0x0)
ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000002440)={0x1, 0x0, 0x2080, {0x1f000, 0x3000, 0x2}, [], "d0b8aa66e8c61cf822df712e94b2104975db306b9aaf1fde5d00aff0b77e0b36895a08e7213db72b09f21d799d7fcd6b4642cd84400363cf6d3dcee9dd6abfeb9e6fc5f8ed7fe38c7f32f00b8e6ca03cb6c721e233a999f391adda8b0d2543924b4fdecac69d3b1307f3e0d4eb97889bf048282663adfbd0acbba0b2aae25a2c4ce2ded75104f4d77541837f26ea49ee055aeb6d14ef3269cf6ec43f4cd0f81e751cb06a5c46989275ec85ae7dddc46ffb5f4150cfb37a90d5460a3234d3722042cde24e71be0ef9cb0b2a161280243f9f541e43a891a6e62e20875a63e80552661cfec71ea4aad3e10636642355ee09f38ccd1c102efb5f80d9d37b80bba22279c5d3791d15d4ca9fee30207ae45b0bb62b7cfb5a4cd0b66578d21381b5b3e491c81d52cb1bd4e4f6c7229a5423d150116bd3f20306f18fb7b06b9d1625a56b0d7deb3c433afc4cb4a5588f8d542c62a1b7ea26d38b27d1effb772e21df192eb86b05739a5e765c8bbcdcd853e4eceb98e107f4431d025ed792b9e49919945177dd08dbfee85ba5e759bc0665991a6150700fe1401ef4e4855493428c022e6a2bd5a5d14ad64275e12c52798778757630c9ba9e0fbacfca45ef8eb0c49aebc8f19c86807c860a246cd0076c1a8faf3804bc6a3c98c7ca2a0539aefeb34b997aab1ff8b0f5b4b364e2a914237ff1cd1542e126c70f3b9c1f4891b49ea53a83070e2fa5ebdfa43af63115bbde94d253491ef3e68d73950487e29ad20d9b0c8e50dea453fc6552efcff40618f3f36da0d80d4f528ebb494c658cecc36879ef753af5ee1094eda58aa510e54f4233983a336a2890bae2b0ee0068b1be038c9026fd1a4b1ed3ecef8449b0602a0be032298e0ae9d7a022b93cd35c3aad93565e1a7546a0c82832fa480c50f50b57646784db94446149de61b8c9e3b5429a712584b9d01669fc6124ab7416755f21ae2c3fe5324cb8d87be3c9d423bbb75f9eca0bc0c60e94803b4acdd7be25c379474c36dc111ac3ea2e7857b7df0d82b24e75bbfc1ae394bc408c9f406c88b8d5e8fc3a9fd4978c0d9f281e83d2a6e961f3780f4332f34b830da8cd110bcd40317b69aa7f664f7f749e5934103c3c47f0b107f296170042584c818fcf930db0e48ec04c2ea5fce8fc8e0c381df07c607bdbf8c007f50c177032651d2e6bc350e6be67f868c7c30a20c2e8040a7ee460cffdd6bab3f93ea1aed0b77b8eef98d138e8e89bdc289647781fbda6e9c28373abc19416bb57283ca2bbf79d329b7ed501b628af2ce11993cb2f238a00bdbc93227c09d292598081a583dbae6c6e3b45cfee9e872570bb3c3c8888f69a6f8da48101c85bf85137c05337f23f5591ff930a438ab6a4a1cd03d89d3ea9a569770a5c92dc9eadb91af5c1d3891e3e109c13e84c68d70b6c2ac4d4da35702494ffcb45d8166765747968d7e3e19effb0251f70da68ef3f0ced915a3edd7312009a7d04cc66329b1bedd0fcfaa97da1e044a9627f613ff752823dda2016ac9408420b6330273af84d9daddeb142711bc7059fe06ca80e03e81cd326accf8565bf1f61f621426e06976caee9c4fdde361f3ac2f5a15120d8a7dfcb1443d43f5d28c1a66d45763879817c93adca0f8d9bf0da766618626c240aa9b6f7eb075c2a1f5ee74ef12b62a41af1ad8071b9c89be60cfec6bab73d3dbae93b645572dc171d2c3fd160159ba1718e8e292c0dd2a7fb999985b32a5765e128d8e20c73c69c903e92ea685e00fc456af535d2e64afa9a75ce6ec317b832f21b63d4238b5301f35337850dd022a722d62625f985a98799f321797117fc99b22d52e4baadb6c1ba6785be3be629b54ea06dcca50cb43138c413c550024244b6ded8fe7452605dae63f6f7d83a5d5adbe73e7e67bf57181cc117f3606bc70e90daaa4c06cfc644c1b06793597cec40f634a0e0cf79e090320051dc60ccc1d55617e14d43f90d1a72672a74fd94e737d9e9381796d2a3d26bd9a6342d92a5de76697822b9032d7d175155525fd8696230211ae95d0935c8ed7045a6b5ea94296824116f6975c4477f46dbfc9d746a367b5b980b1bd000cbb0ef6528b9fbf1c438b806aee6d3f6942a6e455b19c9e5ae8d1dcb93d9aaa6611b65404912188ae115d83524585de707b62e974b7896a911b373c0e7b0d1f8c13d3923252395f692635e13afaeef2019143e742242cc0f4dd0728089d6fa0347c04e71c849f28acb8252780b0b4fb11ea94321a6a2eeb0fc5faca0ab88929071fac24b4260af46ca84a0bb18b3d8e3eb18e706ef0ac7d03b88f9b28e2ea5cf7669e12141fc48bcf82d878fdebd428ce12ab0041e439368ddc22713dbf7c19aed5f1bcaaad63d8c3ab916c4582e4267ac14773cd65c678af37b23472a642a1ef483b631c2fb6ddc517e0448c6b8e26ef5e84f6667e823f02c96170ed66c47ace381423b7c4dbd4d12154770dce05a2e288c565caa9ef2757340cc66d1bd746ee76ea1d55ebd85edf0584415b79b36d5c5c003b3317474bca5d3c259a7de21f9cd14b5f45102b6d364fbeed815598ce816ee7c0a833abe366821f18840bc80971bb3aec3284d9932f176a9548dfd9c9793855339da2749eed03678874bf255494c9377b2e4be5a21a317c380c337db9384c431475913825768a0abc6b59e5c5f7ddf3a61780706608269dadd6c3be5668addeea05d2826fd0a999b5434ea7273c4a63e75552185d71ebc9a25872e571e49505613a2e433976721f8942b17855a836e2b6b9c4123761bcd26704efa2b6fe0a5ea4a8b3ee7aed2861fe4173f9973a1f5392bc733aaf84743776551d079621f4bacb7391035f526fc4e5f06af842c9902328b8a3d44d0ecddb8ee1fd4eaf18538c4f3343727e81e12722e72c0d1fec33606a9691b099e25cae432c21da2687814efb192c66dec4fc093faf3e65957980653a4c47f2c826f21279f6e13b315c18af809dcf23348c00e413d2e37a4fdb3f9c59c4bf2b22b04a96c9de0a9da5dff7a2ac32a7b686bd416d8aa3195309dd0bde8566aee0915bac6b45b75a5be7674bb535ca345175431f5ea64b3673f2c27d84fb7e94fb2f2805d12a75f839c901c08c7e51744d18236ca5c45ae1abec9180b9c9973512afe1c08dd104803fa71736b751b7563125ffe1480b49ff3c9a2d8c1c62c47d3fbe0dc5915fea25acc7b9e51fa576f5a9b87bb6e56535c126a67c13a15578d769d6faf3cc0a68d48163141113e09e8f1c7374c1024e3534af3df753c6a86eea2137867225a39e7552fc7e6129d6d928c0c35343dd9bb9e0ac985eabb506cff50138002963170da4e1482e4ef62fe43b7f5a0c33b87f95de2829a83635f56c762df23a00523f8d8650d6abdb6adf711c0af58fec702137b01a2a872b46f7cc6e04ecc67c2efed03bd7e468b4dc86b9129257236ab4ef417f63cda29227e7caa3d7808cada4a77624fffd2b17a1229de333d8328f9e45e99b5cde92394baaba372657499f94b207d8aad428e4952f5acf6a8939fc8ce92afa4637850adcded227cc495c9d9f1ecf0845a5380c76223546dd1067978ad49e814ce9121ddc74f79f431ba445594de81b431b3b7174eb73bc10e0491a7d1ecbd13a39a9f6c7cdb4b0c68e205738173dd7fb9d3845f87f5c5d651e5fe8607727981c9d0bd203e64a13c855478aba22a8b186de8d19773897d34453a7c50f5371f5f7bae84177bed3b8888e17d7c2aa7ce47d408d34756948dee4afe35133396b9aa63d0a0c36016121a5fd522e3f9c5301d691bbc6166014333cd9d8dfabde2d45d14174cdef28cebbeac94935e4bbd08cb0bfe64222c5b6edd8638160c1778af064db2cc77175d1c915f412c9496c4077413cc644e58e5270cdd3a8b71a47cb5ad277eff76a0bce4b60c625a532444376e1ad733a40a713339d1f58ab33ea45430b1812ccf7e4b73076052638c1f0dcd85a5eb99e8c2df934a776884a09b42f83f7d49bf54b0c20966c02a0c6eb719f0b88417061488f23f5d6c66f785282167a62192954b8bcec8c0b62d3e1384a9cc45fc6722b778adbe3dc340c2cffefe3cf67f2f23e6ee01ff1aa4f4773df683803690bcbfc32063df03bfd4f1a25f7df1c1274a453dce4537a067b120904d1bebe87149e23d31f2a21f4f9312fb9f98cff9a353d70cce655157b3cf34be6b9731e8e0f906afdd3644e05e6fd01a57a8a08a668e61c378f3bd4e00263d3904f0debc700a68796e281ecbe95e082ea712c5aa1c8581d3cb1ec575d944fd7a5fa73934f4b2ccc7e232e60a28420ea9473c3a744844fab220b4aeab419ccfd42aa0f4530262fc3ef95d7fb08a884b47eab9c29a6ec98053946651f9bf1062d0c118cda6810b93114a5db8b1fa5ff3db0167be5330d4c5d302aa6f03f33540e87218a6c1f9a159f86fe03c9ac730a5ec5d6dbe9bd61e44ea06f1a2f0f7079657ad7fb36daa3747719e2ac30d1e359b4829b49724d130293c9f6c7047e6c44772153cfdab95aca9cc32931b888666382702c79cb5b92e6920a1d22e2873c83fb4262ab03ce174eb4a964b9a9791302029f68bf7ac976410829c18beccc1dbebfac125f0759339d6b75806e2084c363a71d0be9a418c10cec88f81437da00c4102f4d72f2fc5d9e6e7d50e529313663fba5d33044e4b4091be54cdf0929fbba15a664f074572ac66270d8e9134e458a8e74ddaa64105cfd9139c15eedef2b61de20cf12dd567d217d838bb732f334b82064c76c5f425818234ce2f13c51454b3171f39d5d92b6479cf4436e441f97ee97e8dc64857432670d843e2e79cec2abcc5f92bf26386700607ca9a3b19597ca8319aa6bf30b7698bf833a79183382ba35362196c1b3bd745b12fdecaddaedd4a6f937de21e3e2bf7359bfb54d1b6c57abcd1cf0c991ddbe6e1ce600ff26835973eb36321306c045bd94b96653e8c086d16ac76c18869562831e67b1c7da1b37d4a78b3e718bfd876a5fd90a749ba6cc6878cbca60c8b6f4dffbb32a09211b207e19ac4d0d3839ce6b54c276605624725ab528e1ce44752f06ef499ae4e016fd6f90307da6dd4d370df1bcadc925b2292add72b96174c6e48483cbae1d83cfbe5c4f4d29b4a5ae8a6e2f6fe314c7430c6e2ae86abbaa6f1496466b4393c0823fdfa545aad1d1d26169984f3e226ddc852141f811a4bb93f646a36c39371253872a67ebbc6612c06c39b6e1c94fb2abb4c694a674c413c4b7ad655ec598be32c07a4bb216d9cf000aa485b9fe2bd13eec6bc88393fdcbf98236615d8951b015cb1d82a906be3b762c6edd2705007faff8d45be66d1cb68b376fa030fa38473275197ca449a92b89293c79d56c30342e8259387755f7cc469a5a83918182db0f294c94e29715f3af490efd2e95a135a51672e0c4b01b2486ee77c00e7bef73682711b36493bb34958d48d87b2656f2aec69971ff47d6da6ab8bc9e6fdd228c99694626b726d23271a37d7c97f3882e47efdda9c2401612341d07bf1489244b3b4eb2316b3d5f6fb38b09e325646d8f8a97d644a5b9f20ca844d23271628c77e85b0a0eec6c31f1b9353008025a18528421a7e98ac912d3444defc57e14bc746adc299e0105b72c2be7f490569b16edf964427dd90fb990069d0ef7e40e0db3bfc6d5383d190830230706749fc758146be21ab031df4f153be6990870e8aa983a23027eb7d978834f3aba9a29492dcb0177bb4b13760d569fe43c2a5673371e08c58b91169939da8bb9e41a38deacff22aaf65995bc28e3b20d65e4fe2dbc349f28f", "7c6db7a447331266254a00a3991e92f7d1a40a718aba09a3300622a737e24a060c3d461c5089598d478d958f1e211e117ef8927519f20a6a124935ec5f989e6df885fd09f61da3574ef48cd8603db232981d48eba6a437e0a54847cea2816c24c974f33a6368ee04a984ea103387cc85dd0f8e63dc8fba62fdde810e070f5134f6eb16db27d5fb882dc0f80c8f701f8bca02630c23e6fd3ea6b991dc9198818bae19bf170354e36166bda48e108cd59d1d4ac2679aa72adc6e9ab9b8649f67ca7e20f71759d7ac1b0ab465d00c7a8e38bed3d4afc90096fb1f7608b8bc36d61fd451d614469f6188254660a748e0f350465335cb22b31939a9ec2ba402d9f6043f79f0010da9cf9fe9d5c2d6374d8162f9e4202d9f4b42b6ea9872523b64622c8a8a379d392711cca672ef483bbe57aa83d0a6ebc589a272bbf87f29596d4a9071b8ed2264ebdb647d6c9b9d1a6ce49f1f41f3e585f604624f8477fdf49687eee6e1751d782d579c50cf34b166c175e9926f1f7f034966c12c721a7e739efa39a80429c63ba50ff3e4e25c7fe8a3345395192ce657181e8dcde175e430a623f582c53a14aa553d44169e630f40dbf421ab789d0c3a2a6b0b28e543542eff5298bd38de16671bcccb6297ddd437fc4bf8f7b365d614b0b9f8e350612769ed8ae9aa819254f8cf6a476afe0c4ce09ac7d1b8d4bba604c5df42636043cdfbcbb283d34983a6326bb08fbaefab4c5006f6eaf592375a9195b859496d78f3fd22ca18eb2dd7cbd741dfd5929bb0ee07ec9bc202f4887a60df8f453d87ff47014c28ea472b8c452c69178d41ae222f8ff3c80c1eacd9c481b3cdb728c75e2ab7ab99600cd7e53a18985c29ad5028111b868e5893f053ffd882d188a372776b93b1c88226d88c6f095dd7ae4ec202389f91b078323a7a43b8450f213d1acebc1886102dd893222203fa706d8259b9d521e3d9bb12cbb0e1b8e235e28c5e6d0591ac00bd959fb30175282f148f13f676dcfb8430a84b9bbaa6227dc9aae3a5e4e4883142e30e8e8cac1039e7b9dc5df198897954ec0e8db53af60d1001fcdb9de4612575ea77ecbefbe72646ff07ee545ad069cfce96b11e4d5c481f2974a80fecb7d0750bedaa91323db1c20eaf3d856d8b5a89ebbfdda1cc6d3dff4b9a536c24dd0b6f13d909ce19c267b48b9d2e4828f49d6e3e7df6aff846a2c07a6d53250885f708850fade76e5053b78dea9d9678380e92442c0484865a4e47c21fa264757eb318e3ca8e8c27e94e78fb92bbb22aea5b4b52cdc452f8abcf93a6cdeb5ba5ea2122311f5dde2f94a98d8ed8b7e928fc25306ecb78a819085cbff2fa57ae6ca8d1bf9d87e8290e107f85b2c110d3c70696932db41fb74bdbe95c87aa916915d6352c34d111d760b51662ab07638e8718dcc65b10f5e5a5ca9e06c82ec08e98bb7ffb192622380a783a24af640b1c79d883d0ee888326e967f34f2b425c1d53ad692608acac19391928aab60748df0c38afc82970c3bf42eb35941370d7a773f875050a7d13d67036b5a7fe57e73306ebafc444ce7f0d94f905ca15cf6b2a14db7870b8c123291aa9d55db025baa32cff6fed9abd693e7d26aa9d2406dd9bb84350f9c01cf8dbc5652fe0e2720eaa511140b50d6b45ef6cb62e8c00fadabcff52d5a277df12f0bc0f381141c9fd7b4f6ef640ce0be3df92fd4cd154ed036f94c25c32075306904076310a0f1a0c7334fa0165b0f187c0abe09822f8292da3848f88bd6bba242814228a371e89e231fbc64e6767ae15ca1c6fd7537c7ac37b149846b45a7e33f9e0163721608204e271717791c7ca07db1b405ac7831c6a9cc97996186fa289f94f187b826222b93919d7dd1172a367533bb6e3d28e5ceb2d683d7a93d7b8fd70cf7bd2ef7171626f31ed4d621398334ecc7e47b6a3daf5cb952b619a3b308c7bf5bb3f04d20323c5fa7daa460769df718662c9ffd15934a65afc757adb454e9c7c2ee9b94c628c4b2713cc3cb89ebec44803657b7b36df32885d81548e163a5eb2d36bba2a2f4202b19cc1131f6d8e0b365fd0b27e94ee050147767c4f7cf2512fe5b4dabcf2837ba8a255a15e0bd88ceb8ebdf429b27f82f1e813e42f3f7eaeaafa5993b5b3dc578edfdbdb8a2f0d1cd3e3b630050ae5881b1de88086c58d445fc6fd652b3463ec773ac8b480d2264d013dd5291bb830708a43311418aff416eb9ac60d8893ef32a35f0dc3cd8e59d4d53874022cf48ccf104e0412e3837bc70951188fd9f1ea73464504d6a4cc9ea23a6e829a1d31fffa2bb0e9668836d03dc607a3f61baff66ea419fc5022bf5776e2e80b6b472f21767364a3b3f3b482188aaf0d7f061a3841df0ac59eeb9f049187b2c3fc29230a00439d19d7bacc742ffbfeaa64d2626ae51e3721c5220e24cf58b79e808a955956dd2a0c79d54397a9b50cbc81d738381a0570341139b9ba7078da83d9e09a8d3cbff99b15bd57e79ef21b6fa066375dd093329d2050742eea65d986598e8f70dba9648252ba9d20c92c0cf5f7f9028534f7125eb78b6aa41f42ab9851532ea4f8afd46ccf08876366c33347e544282c656a8ca8e105a070a0f784bdbe37b53773c22c1d787df1b76ef75f70928c0f2687955eb56cc1f94e9736e0a595099d6cff0b8cfa5e54d7c57eb8728fe31c2213716ca242b0319011ec7e21cf2612864cbfe83a316cf2acb8a68e5e6a6d8e01683a4e507615565a07becf6e829bdcf248a17e5a9e9c56e80fd40d5aa1346e8b933bed90ff2d6fed1b41ad43b44d3ec82dff1180d15cf6af89198a98bb7184ad5b54d3887113e3b5b41d0c7e0b8eda0cdf93177aeb10578855379e6293cf3b6de5b54f8b3654b47b1c30a15896ead6456ae52d14862c368ad3e0bdd094b089d19222776b78a2c049a85728fcbe738ce808867b6d8ead337dbcd405f6855444d6aa4c9a0476cbdbe0144ff581277198c3aa1d4d7e70d821834e1a9a51187272130dc6539d07a7a88b0e8a52ad90769c719842a57ede3c314e3dad5d3446d0ca6d8ae439d4407a317a24c7bb8e9cab9c4d929eb49db75a5f25a7fd86442f57ba02b8ef1ff5fefffb4c818ddf036197621ad0788953635a99d2211010e7fe5b8dc7668ee683304369f48b4a438ff5bf666d86bfecd6f78863402be2485039d0fd3436d2180dd0f41b4d256b01950303a0a624ceb8773b64c866ce3fcd19fe11a9124dbf9edd19d6af5c19dde9625ebdf3466d29526863f02128aa172e4bbc694c412b891d4edaa83b5a592c985c511e46e227704c84e54ee557f25d63e57d96acc5030ef7b07fc867eeee35ae88d066eed2136946361a3322c27e076a64228da9f6933e4feb9ec04d4f6eb3f421aaa702e3efb72bd5f0c244c9543b9747a5897922a58f5403356aa7d66e7f59f58599ff6e6539b9a6a3480295e1e8fa0274e1d3c8b2fd2a5d7fbdfbd0c59f824402660df1757b1b3c6e7cf1b2ba78ed4f96eda788a265d73fbf2453e76958f1b57d07f9fac6721ae0e1841a2e7344bcd27312e179def2622e862919752ca90418764c5649f41f0d4a7ac3a0d4f3b4ca6c03910409e1731f2f8d92bfcf259dad4fb5da04f1b4cc193c7970bfbf3126388b96cc4887815aba5195d2de3d69585be399fa317a403d09efaad158c573e4c454cdd5cba137fbf9be98c8039975fedb6e7457a38c581a88e2c0d650bd258d9742580cd4d48762f57c8bceaf3ef21f5f004ff8d313dbc152d617d54b21302b8488d1347895056622a478b00bed207d3856ba327281a821fde3b169e764aa7476df4aca70aabb003e2f717f2916e4d76a21730da57ee6ff7b9b36a04149eb60f09bb775791bb8c91823e41707003d0c267dc5335e3fca47e4b67cf1739195c68c3786487584df00465b5b13ff3ff52ed3597e0f5f741893901989e64ec173b3ee336f314e0f3914150c4a750f2162d2b72b0365acd4826ac682892664e1e03585abab42a16a809b4f497fe3654a0974b62e4afc3acf466e31b1d9f9130a1fb2a894b3962f684d594bdae4c61e7e317579c8576e7bf070ef733522602fd1d94318da801d6af14bf6f8a2b970336a9b0feff6ff4b5241fddacb586dadf75a56216b1b699c39ff9cf90f2d7f532fa54dc888d5a61717a00652ea07f25d08fe4a8462b5ed67f7758fa0d17cab1857d69959fc4645389c8314013759639341a81d4f3b8caf1c0339bc36ea1a5c83f0affddf819b42b95868d2e39f09e529e05c3bd453cc073e5504ce1e4b1a2024c7e111eebc12d186b7dabe98a6eaa45ea8e028f031473a52d7117242f010d784b71460f6f7f1997d22c48a545183883b28c99a4f224e18abee4e3a5aaa85a6dd0ece3ad1eb02b3a43c68dd9b7c31cd9a11d88ec5462a402b7619c1a89db8daf36e3fb424ca1fe00ae024875aa4c59d849a1232fbe17c5a5c775d63901f00c8e230546e8692cdb4850f1fbd64337212782f6491d39b86c348d3d49cb72c612b4bea60b2b10405169b177a3ca6e9b9ffd718a38a121d55ab72b94e9bff1082d0f5f77efd26f2d60d90f34f9018829153fcd67d63319b5552190d24e60a7ec32712d234c77d508b848230dffa0f0c02efa7a521db826853cfba4f5ecff58717baf11600d9732a0efe7ac0fe25cc02fc830888715687cd06dd413072dbfcc81769ce758db79211a555dfd0be11eedd26b119cea2755191ae661399db8da378359a903b65d5c0cde88177eab8961e1026761a6ea395c709724b28291b6823f6d844cdda0707621fc539a0a08eac52c2269f29b4e2f2a2573a502f1a19399c66ee3aaca6fde5ea26e5e20630f9c72912a9272dc3108af3323d0f56f08fba0daeb35577c238d84801e583fd171942ce69065b3e550a135b46b89b460364d48780cd801d554a1903da74c327622a3e0f3433e3ffc6d0c1150173f478813e4688ba3b018667718d52279aa1a45b0afeb263eb701e6d28553399ba27be81cdd8093c8b551f4df3e963570f6ae75a55b0bafc7975c2f061843c291775f5ef509ef648ad15dade22ca52ce133f79c5447412552babab7693ddf31ec0c258188cf4fb0839aaa1c9cb82f6ecd468bf7c6bbe2dac5d5f7bec773a298dd527d67bb9d7e139314a3dfb7f9251d9daf80203e7b40e0e9b36edad02f738aa591711b212d19d629aab563e14d8ea93f1b873f3a46d8b20ef2a6275404c08383e90d0546b5371afb98635fbfee275f6e6e24cbecd2a363e7c4e664f51fe1f724211fa16d9c2df8644f9c97e0a2ede7b26c27c6b8abf784c1d511a308845fa8034d13b84c5ba5d0ffd161353355753e3b5f804973fa37afacdb431eaf84528d9eae27478f8c22a148e365b7f20da5a38b0553e39bd74c2c33b626ec2d70507b903812435f655c13dcc6f6c41ed88771337a86845806820889ca9ec58425365a8212c4c9eac4ef3d57d3e7edf3e102d7ea343f338129b00fdf7e150c2a44dea49bc8eb71d4c604645674f757cc5ea64378b4fe7d4a185d9ddbc3ad3af51075f58b71c2874dee47c267769ac7b649509deff38e7cfc300aec314b379f9b3656998fa05514e8148e6c0ba7f66c84b011af0b9b57b88eb8a649825d3f4d990c5ece7410f0b6727f1210f8249286e57b31de4ace2b188c22b8406256eadac71ac8518cc56dc95a427266787caf81816726bdf623a01354ceecd06362ada24dd298a91f30ce894524c522e5045776ac241470d5ce8fa8dbbc62b306fcd8c65937b2012d4f658a30e44f48f4359b8b8dcdbdf7c7d2ae34f73068af520cc35"})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2758.843298] binder: release 26774:26775 transaction 8324 out, still active
[ 2758.850861] binder: 26774:26775 transaction failed 29189/0, size 0-0 line 2787
[ 2758.856786] binder: BINDER_SET_CONTEXT_MGR already set
[ 2758.863742] binder: 26776:26786 ioctl 40046207 0 returned -16
[ 2758.869561] binder: undelivered TRANSACTION_COMPLETE
02:39:47 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2758.912381] binder: send failed reply for transaction 8324, target dead
[ 2758.931639] binder: 26776:26795 got reply transaction with no transaction stack
[ 2758.939499] binder: release 26776:26786 transaction 8326 out, still active
[ 2758.954652] binder: undelivered TRANSACTION_COMPLETE
02:39:47 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc018557a, &(0x7f0000000000)={0xa3})
sync()

[ 2758.967678] ion_mmap: failure mapping buffer to userspace
[ 2758.976732] binder_alloc: binder_alloc_mmap_handler: 26774 20001000-20004000 already mapped failed -16
[ 2758.995109] binder: 26776:26795 transaction failed 29201/-71, size 0-0 line 2762
[ 2759.015176] ion_mmap: failure mapping buffer to userspace
02:39:48 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc00c5512, &(0x7f0000000000)={0xa3})
sync()

[ 2759.051901] autofs4:pid:26808:autofs_fill_super: called with bogus options
[ 2759.052342] binder_alloc: 26774: binder_alloc_buf, no vma
[ 2759.059142] binder: BINDER_SET_CONTEXT_MGR already set
02:39:48 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
ioctl$FICLONE(r1, 0x40049409, r1)
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

[ 2759.112364] binder: 26774:26812 transaction failed 29189/-3, size 0-0 line 2970
[ 2759.138111] binder: 26774:26775 ioctl 40046207 0 returned -16
[ 2759.145369] autofs4:pid:26818:autofs_fill_super: called with bogus options
02:39:48 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2759.173581] autofs4:pid:26815:autofs_fill_super: called with bogus options
[ 2759.184508] binder: 26774:26801 got reply transaction with no transaction stack
[ 2759.199960] autofs4:pid:26808:autofs_fill_super: called with bogus options
[ 2759.209092] binder: undelivered TRANSACTION_ERROR: 29190
[ 2759.215308] binder: send failed reply for transaction 8326, target dead
[ 2759.263397] ion_mmap: failure mapping buffer to userspace
[ 2759.274861] binder: undelivered TRANSACTION_ERROR: 29189
[ 2759.354593] binder: undelivered TRANSACTION_ERROR: 29201
[ 2759.638477] binder: release 26776:26795 transaction 8331 out, still active
[ 2759.645698] binder: send failed reply for transaction 8331, target dead
[ 2759.652505] binder: undelivered TRANSACTION_COMPLETE
02:39:48 executing program 3:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x101000, 0x0)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, r0, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r1, r2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:48 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f6673ff", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:48 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x2, &(0x7f0000000000)={0xa3})
sync()

02:39:48 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00000b001c9dd40eafbc32760ce12fbfc91a4b6d1be339bd44dcd14980ea528be3f9ef65a8ab2bf5fdf9c2a7294247b6892a49e04aad1bd03a608c857322dd492240650d7fb15b1c0c067a1c4b9b77bc28dca0e520c6413fb4781055730e404a0f9678b84579e00c528312b6e3fe99ec27848dbc3793"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0c630000c795fa2be04504b801a558752a28abd3e6c8c2ef467c8d7125d550a97bacca803c"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, &(0x7f0000000500)})

02:39:48 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x20, 0x1000009, 0x2009, 0x6, 0x3})
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x20800, 0x0)
fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:39:48 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:48 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\a', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2759.786195] ion_mmap: failure mapping buffer to userspace
[ 2759.817682] binder: 26835:26845 unknown command 720896
02:39:48 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:48 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x80045519, &(0x7f0000000000)={0xa3})
sync()

02:39:48 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
sendfile(r3, r1, &(0x7f0000000000), 0x9)

[ 2759.831660] binder_alloc: 26848: binder_alloc_buf, no vma
[ 2759.843367] binder: send failed reply for transaction 8335 to 26848:26849
[ 2759.848559] binder: 26835:26845 ioctl c0306201 20000440 returned -22
[ 2759.868855] binder_alloc: binder_alloc_mmap_handler: 26848 20001000-20004000 already mapped failed -16
02:39:48 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc018550a, &(0x7f0000000000)={0xa3})
sync()

[ 2759.908316] binder: BINDER_SET_CONTEXT_MGR already set
[ 2759.911973] binder_alloc: binder_alloc_mmap_handler: 26835 20001000-20004000 already mapped failed -16
[ 2759.924063] binder: 26848:26849 ioctl 40046207 0 returned -16
[ 2759.942836] binder_alloc: 26848: binder_alloc_buf, no vma
02:39:48 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2759.964708] binder: BINDER_SET_CONTEXT_MGR already set
[ 2759.967720] binder: undelivered TRANSACTION_COMPLETE
[ 2760.009938] binder: 26835:26859 unknown command 720896
02:39:48 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, <r3=>0x0})
socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000040))
ptrace$setopts(0x4200, r3, 0x5, 0x10003e)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:48 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
setsockopt$inet_mreqsrc(r1, 0x0, 0x2d, &(0x7f0000000000)={@empty, @local, @multicast2}, 0xc)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x161001, 0x0)
ioctl$ASHMEM_GET_NAME(r4, 0x81007702, &(0x7f00000000c0)=""/57)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:39:48 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2760.034749] binder: 26835:26845 ioctl 40046207 0 returned -16
[ 2760.074424] binder: 26835:26859 ioctl c0306201 20000440 returned -22
[ 2760.125912] binder: release 26885:26886 transaction 8339 out, still active
[ 2760.132967] binder: undelivered TRANSACTION_COMPLETE
[ 2760.138784] binder: send failed reply for transaction 8339, target dead
02:39:49 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffff9c, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = msgget(0x0, 0x400)
msgsnd(r3, &(0x7f0000000040)={0x0, "6b93003eb1956515b058a2f3ef0539d665e5e5474f2b74606b885464efc54362cbb6ccac75a5f6dea31cd0d9f0b3c8b3ce1eb2e762a0e6f5"}, 0x40, 0x800)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="016340400000000000ed0a0000e7b3998c061100000000010000000000fffffffffffffff7000000000000000000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[], @ANYPTR=&(0x7f0000000040)=ANY=[]], 0x0, 0x0, &(0x7f0000000500)})

02:39:49 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185568, &(0x7f0000000000)={0xa3})
sync()

02:39:49 executing program 1:
r0 = socket$inet6(0xa, 0x80e, 0xfffffffffffffffc)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102021ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)
r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x100, 0x0)
ioctl$UI_SET_MSCBIT(r3, 0x40045568, 0x1f)

[ 2760.181282] autofs4:pid:26890:autofs_fill_super: called with bogus options
[ 2760.189105] ion_mmap: failure mapping buffer to userspace
[ 2760.210187] binder_alloc: 26885: binder_alloc_buf, no vma
[ 2760.212958] binder: BINDER_SET_CONTEXT_MGR already set
[ 2760.247191] ion_mmap: failure mapping buffer to userspace
[ 2760.285620] binder: 26885:26886 ioctl 40046207 0 returned -16
[ 2760.289961] binder: BINDER_SET_CONTEXT_MGR already set
[ 2760.345172] ion_mmap: failure mapping buffer to userspace
[ 2760.354495] binder_alloc: 26885: binder_alloc_buf, no vma
[ 2760.364404] binder: 26897:26898 ioctl 40046207 0 returned -16
02:39:49 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:49 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = dup2(r0, r1)
write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000000)={<r4=>0xffffffffffffffff}, 0x13f, 0xb}}, 0x20)
write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r3, &(0x7f00000000c0)={0xb, 0x10, 0xfa00, {&(0x7f00000002c0), r4, 0x7}}, 0x18)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:49 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7, 0x100000000, 0x0, 0x0, 0x6, 0x0, 0x0, 0xffffffffffffffff})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2760.419684] binder: 26897:26902 got reply transaction with no transaction stack
[ 2760.515809] binder_alloc: binder_alloc_mmap_handler: 26897 20001000-20004000 already mapped failed -16
[ 2760.528580] binder: release 26908:26909 transaction 8345 out, still active
[ 2760.544389] binder: undelivered TRANSACTION_COMPLETE
[ 2760.550758] binder: send failed reply for transaction 8345, target dead
[ 2760.575056] ion_mmap: failure mapping buffer to userspace
[ 2760.585951] binder: BINDER_SET_CONTEXT_MGR already set
[ 2760.591266] binder: 26908:26914 ioctl 40046207 0 returned -16
[ 2760.591270] binder: BINDER_SET_CONTEXT_MGR already set
[ 2760.591290] binder: 26897:26898 ioctl 40046207 0 returned -16
[ 2760.628048] ion_mmap: failure mapping buffer to userspace
02:39:49 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070dcc7b8e750021d4f85d7570d9390630ec4bc00c9be78219366f40fccb7d6cd1e54f35c9395b231c867ad1a3f0065d3ba3aaa7fd0b512217ccb3a56e309b8f2d7985c7626f2eb5bc1706e5dafe28d57c50823a2d22a756027edf33a7c238fcac9e9f00295f8b28c3a7f0f6560ebbc7af7ee56c35b8145b59df33b617f7fa7f2a7e0980d18a525ec7c86c65f6cd1e0c2ffd4a072ded7e5bc43198ac49db1e6070a88ee18dcd976a1b369b6be4e4e")
r1 = socket$inet(0x2, 0x6000000000000003, 0x7)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
r3 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x20041)
bind$bt_rfcomm(r3, &(0x7f00000001c0)={0x1f, {0xffff, 0x6, 0x4, 0x5, 0x7fffffff, 0x7f}, 0x3}, 0xa)
getsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f0000000180), 0x2)
r4 = getegid()
fchown(r2, 0x0, r4)
ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000200)=0x1)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x5eae, 0x13, 0x0, <r5=>0xffffffffffffffff})
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000300)={{0x7, @remote, 0x4e24, 0x2, 'sed\x00', 0x18, 0x6aa, 0x7c}, {@local, 0x4e21, 0x10003, 0xffffffff, 0x7d5e, 0xffffffff}}, 0x44)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r5, 0x0)

[ 2760.677154] binder: 26908:26910 got reply transaction with no transaction stack
[ 2760.691458] binder_alloc: 26908: binder_alloc_buf, no vma
[ 2760.744509] binder: 26897:26902 got reply transaction with no transaction stack
[ 2760.781077] IPVS: set_ctl: invalid protocol: 7 172.20.20.187:20004
02:39:49 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x4, 0x10003)
setsockopt$inet6_int(r1, 0x29, 0x5, &(0x7f00000000c0)=0x4d, 0x4)
r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x80080, 0x0)
ioctl$LOOP_CHANGE_FD(r4, 0x4c06, r0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
write(r0, &(0x7f0000000500)="0dae6f2c6a656b7b5f2ba8fd97d53a523c89e1ae9d1c1f3470d2477e357fc9895e592a0d084c20fd424e4713a36f052b823bcf8313ac831c8229f6979cc77d6286e7cbfd3299eef472f6d5200823b995d01980011d9e167e5f4a9454bfe6f0a1d5854393d8220329ed20b1ad4baeaa7fb2325ef417f8169ba2f01be88fcf21f60f37caefa6dd876d24d3cfee5a5210f9296154219ecbb8e13164b3028170613a55908aab7e17816f4dc10ea0b0f6a3ba844553098e3733f4db0dbfc6290657b002ca4718cdaf896a545011f795f51228385e", 0xd2)
write$P9_RLERROR(r4, &(0x7f0000000180)={0x16, 0x7, 0x1, {0xd, '/dev/binder#\x00'}}, 0x16)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="00634048bb8783f617fad94631ec9b27b776040dfed3f4d6b16860fa346661ebfd9958e92ee352b22177cc69efff7a07076a8325175a106fbe3ad6d50bbbb21843908e43c6a920c1069df709f288cf8d1995001613201ef9a524e26ac5dca001254c06f23a4610ad5c76fa153265377e7ba8a2ea72b28ba8dde8da73ae67833ccf0a934005ad0f61f47b79d8980c8e686f8664f146cdb255547d96f042506721be4666ec1e86beb9e1db106dc011f9c745f0887a08a21ae53e7c84198d334514d4e515bc3a2d"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2760.804241] x86/PAT: syz-executor1:26922 map pfn RAM range req write-combining for [mem 0x1c3d60000-0x1c3d61fff], got write-back
[ 2760.895988] binder: 26923:26924 unknown command 1212179200
[ 2760.901682] binder: 26923:26924 ioctl c0306201 20000440 returned -22
[ 2760.921092] IPVS: set_ctl: invalid protocol: 7 172.20.20.187:20004
[ 2760.967228] x86/PAT: syz-executor1:26921 map pfn RAM range req write-combining for [mem 0x184420000-0x184421fff], got write-back
[ 2760.984936] binder: BINDER_SET_CONTEXT_MGR already set
[ 2761.024839] binder: 26923:26927 ioctl 40046207 0 returned -16
[ 2761.055343] binder: 26923:26924 unknown command 1212179200
[ 2761.070214] binder: 26923:26924 ioctl c0306201 20000440 returned -22
02:39:50 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x400, 0x0)
ioctl$KVM_PPC_ALLOCATE_HTAB(r1, 0xc004aea7, &(0x7f00000000c0)=0xbc2)
r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xfffffffffffffde8, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c6c1300"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:50 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:39:50 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c630514"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:39:50 executing program 1:
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/dev_snmp6\x00')
sendto$inet6(r0, &(0x7f00000003c0)="8b99691883905b04e632e936519e80021c11dbbf5e1326f1ddbc77ba365f65b9d6bd5f51b48e5c1817825f233f6cb10acb518eb2ff743a224eb09b9593b5221b59399a203fe877d0b277eb31583b4381f7e6788c3d3b7df78308321efc73909717d0f7c51627482942b7085bcbb501679c4ce0e15e2bc153fda9543460afd0af705f78c83a53a863555489755ef93ed2f1fe4ad9ebe2db828c97263516a644d5f1ffcb2b4927096f623dd96c8cf4f27c0644f56b134adeb55753337fabca287f9b2481c88bcc47a246646416d3cfba51d16f03570089f8abcacbfef06d1ac0a6ea339e1caee3ae275b65da56f03a", 0xee, 0x10, &(0x7f0000000080)={0xa, 0x4e22, 0x7f0, @remote, 0x4}, 0x1c)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000005, 0x8)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)
ioctl$KVM_SET_MP_STATE(r0, 0x4004ae99, &(0x7f00000000c0)=0x8)
mq_getsetattr(r0, &(0x7f0000000100)={0xfffffffffffffffc, 0x1, 0x40000000000, 0x6, 0x3f, 0x10000449, 0x6, 0x9}, &(0x7f0000000180))

[ 2761.357812] binder: 26930:26932 unknown command 335897356
[ 2761.363438] binder: 26930:26932 ioctl c0306201 20000140 returned -22
[ 2761.381221] binder: BINDER_SET_CONTEXT_MGR already set
[ 2761.390418] binder: 26935:26937 ioctl 40046207 0 returned -16
02:39:50 executing program 1:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000340)='/dev/hwrng\x00', 0x20000, 0x0)
getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000014c0)={0x244a6d60, 0x7, 0x0, 0x1, 0xfffffffffffffffa, 0x8, 0xffffffff, 0xff, <r1=>0x0}, &(0x7f0000001500)=0x20)
getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000001540)={r1, 0xb, "0102fd1278434da940c852"}, &(0x7f0000001580)=0x13)
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r3 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
ioctl$TIOCGSID(r4, 0x5429, &(0x7f0000000300))
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x48000, 0x0)
accept4$bt_l2cap(r5, &(0x7f0000000080), &(0x7f00000000c0)=0xe, 0x80800)
ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000140)={0xffffffff00000000, 0x0, 0x0, <r6=>0xffffffffffffffff})
pwritev(r3, &(0x7f0000000280)=[{&(0x7f00000003c0)="ba4aa90907f0c341a23ab91fbc77d3b37b35098619f7e7e34a66e3e7b253f7993cb7a93cae706f9f7a051ba193139d667a01087e2c5f33d164188e513e9ac513c6bba31a629b01685c9db4b6ca01ac1f0736f8edaefafd6f2933d88913ed54f83b82ffb20a5f302bbbff388c354e6aaa15caf7ba0632ca9f6eea4920e5ddb024970ca8bba14e8332d0dd9aca9328bc33a8123b7de1a03d323d6289f41f93692e014506076d5c9ff0d413a074352fd359f9f669ee67885d3ad7685b03fb324f6719a40a098a9828ffab114129b7db1b1f9640364dc84f3a8e834e505d16ac5140e603e38956b5d73174ee1b025fcbc6331ead87223944ddf87a854a12b47a302546dbd88f650f3511d0545e9f1e819abc93e50cfd06b044f8a1510b68901bf09ceecedd6cdc6d805c4244a4b6d8b19dd1851f932bc94596a4b62149f09292dec9b0a20a78e16a399f5d580a0a57838f3126119a5871b6ce811327c63351ee8374aad47d9b33125e1342f9ee295a83f1acf8c57bab7cd65d2198d6c0df7668ec8758f8791e156b0d2190a83f385a32502df52aaacc1a2798e0b7eda16a32ffbbb91de0bfdf283afb7f786d2706580c54c13abf52859b1e58721828471829dd7b2e28bd6a7a9bc03bc34ad0234202878da2f42fb3e5c994c268bbf896985a6ea83099f521424fd9feaac489e34a5e2c2906ebea890c3f10374b51e60738faf865a9751a375307b9e5e7efc4aabf02cae046d4364eed59417bdaa2ef40e82b8b1965b9bd60ab9cffa0dd25e30e7e1fb0c30a07a7721b59dc893334c4ab89047f920fdaafd5cfd7a3c3a95f30bef329f2c2925916c562a5986fd7fc95db3fc432b7497bcf1aa24935f870bbcd4682aa25a2fea9b45a97921bf6a97a26e0a17c511d2d63a102291bec75d826b47753f314cf67886176a67e493c71391efa7dd3204617e999450c681c8ff57e6ca36c6cde1ec2f016cd6eda26a925b351f63bf3ac048f443a715de4cb4a137251b57d66948890f91f7870ad665faaad94f10920b3ab25af9ceb55344dc6924555c22ac116a15143d47202e38d0b3b0d4d7e03ddc75b2a4bf2f2f668df000c5ff15a3c67ce515e9fdf089fdb65f3bc504bc7a5f15231f9ebde3fd885824127ece319f7c447abb0a6f00a29fad78d232c7541242a71f1a90dea30c9d1310efe2250c70a55cbb2b1bd62d20f13b49b3e2ea943736e5918096e31a62a71daa93f2c5b34f9c15fee4b2f87cc20528d2d99c2c736d69e9ac291cd87213605137839ed1edcb8531a23a24df7cdcb6fb2912cfa70a509e6d2dd7f0993da5810b8e99ac94329510062516c2884f2b7c3369da31d459ff55bef53c9976db10180383aeb1ea27a51bfe458fc54bfe5ee3342ece3e932312ce5521ce088723e8ddcba87ef53eccd4c3c71e1a1505969067ccc2d7e80e7c0f5297cd0be3102b39b3cdf0d84a93554d60f318996e99d778d15c0521934a60a841ae2fc791c0a59a45f17283e8d738eca2c7ff426299fc4096d48ebfc1f837c73656c7744a6c7325a02f88252ad10bf9f515478dc9497f770d9087d60e52a88c203ba7428cbf4b5dac8f89c8a02d968453d4ea0ed40bc1f006bedb54b2f6c446085dac5a7099032691ff26b537dd045568761a5ca3840a37a138f46acfd99a8e138e529fd5222c6a46f325bf05cb863cefca9643796cef57ff07f90e62fa583ee83b8accd3c42263bedbba7597064c74a1bfeedfd7df105441c77e2b412ff43f7a3dc12bc9e57e801dba91b139760862440b5b9a542ff18bcd7182bc00e4d6aa16d8288ca3a9666d1220cc2abea24532dd4473fc0d4fe718dc2e604c0d59f71478313c1cdd05bfa5b585fd4c46ae9237019a273f699947b070abfc1d5d37e7dae7dd8a4a4c315f4f85634da3052e2ad3d8a06beba1819ca15e70e348fa02c139d67ad7ec3cf868e5f4fda14dc524066f09054191407d494913fbcb4ecd6ca7e5a986f488bcb8095a582ad14a12f496408a7318a6b9714b92c40ad1698c8bff470c7780bb3b5690974ab218e69fcc4a4fdaceb96e7602431d9590a708a99a02cd22815b2d3693cf9665a9abfbc41649f444d7203dc54096379c91a556920a73b66e5de8fbb859e280a5794b0d0d2eeb79611c67f5fb46b2257b36dd515833d6a6cf61d35c3381c582874c0b3f504379f6b04bfefb04f2c4d2a08bfb0dff08a1aae1c2711d62e8600f1c6fcd1236350f1302cdc10168cb64a2e9d4543bdf79b1509c23583fc68d72257c192af14c2a1cbb91f5e79f5fd2d1b71c584b25b1813d7d7ba5bc5efbdccb406f4f492ddc5f40222cef14368614613a320a1f349825cc481d28dce361e6178f4a868fa41606494abda8d96712a908902ed6da93425acbdc9751f763032c96ebc25c2ffc4a8885f46c53f559f4aacd9e37d288273938586a7b8201362dc15fffad2f595736302e66a20c902f28f883c65530fe6ef2986c4241f12190c6d8772836c356dd33966fdc2c78aa8c7fb28193b999e41ad697bd0f07c3bc4d1827b10918a0f5d32cde70c67155b54cb922d9c48a704a6e29a88262323b18c2bf275683ae5af182144b8d535ac0a258ec833ca1c68a9b0e422a647940c3f99ae6d75b825d7b958db1e7dc056bf7cdac6fc8094f970ec52bd612c42383ca729b48b63ff3e7d88309d7f6b40ac1ff91b9aee2e5a77edf8b5677d363b863690be14c45ca26c03f5665e33a5ccdd24468368ca996883b36a3dcec0dd1211837e3159871f88e036c89efc16d2ea47d033da8e4afcde56ca59529ff0bc25c7f343032426d80c29be9204d4b3fa7517fcd2341b3670a63eb686e26b3de15c7ed96854ce73252ebf1268b115388d8e6c56aa7eb12027b3b33082cd36922ed7c53ad33d5d30049cc45d27073e710e787cdb132224f6b354699cfb99f7d2fab9357dc82ebd088b93f6e267c1e84639cd7395278de03555ee31553b1939c87f1fba133bc5aa2df03d22b1187983d2da3d595b8b9e4e1a90cd6c92adcedb1889eab673f43f13e254a809ba23e157f5019846f72b5878e1d98d07fd2e682128991a5dd430cf4920ee202073bf1c18b86e67686347a64aca0e8b40b146b35dfa49af8f13a842eb40ecf12915627e006f8c973270fd742f86a2904e64e923b60feeaaa4a29623985bff03d34b5d361893f3def4b837ac656b397c2dcbb2db8731777b48a4ca08537daf644fa6b1c842cfd18d360b70da7f5efc281b2cbc9cd6c2f557038bccdbb17a8fe3d9762f4776bff1759c048f73880a0ae819ede09a9bc3f8b6309def75fe3af5ad275f326efdfab864d9fe80bbbe4645f0e705c956ea6e0b5eec86af34fb67a8d85a67c30e539fc541e745bc03c0d2462cd7c0f2c6e3fea3cab9951f5d20c92a22577bf0df9cc224f00011c8c0d1407f9d500e61067cdf1b24bbf883574aee491373b7164facdafecfc767f9be977deb0b89ca24a33ebfff0373a7fcf514bf823462f90921d1dbba9f6e0cee6e3f6cd4e661166820e02db2c4d3da99b1ff9285e10ed69587a322509bc99dbe3011c7b576f0cb01c5b44fcf791585764b70c10da67f2231110f2cfd55a08e2733d2ede63317b9e4808920e2e310b53cc9619fe7dd5ee3cbb8b3a8ac3d2837665a25ad59e6ae32c9cf3832e5b869e008b499611733a7abf1b44e95390fb202d20bac6fe13464ae419dacdf56363e42534e2ee37404024fb6df8e77fd77b496056055221b5b08dd35f9a181768a7bba831a33c56f0a8afec83038f1771fa5ccb84454d41e94bf5215e8b1967b5a6dc83f86c95dd4757fb8cf494db5ac8fb9e386648ca0dc7b69afd04f172bf9b8e3022da3eb88bb0dbca243a77619fc595eff464b10a48deec70fc7e53a5ac57013624b02519315dda085f8c016e1c5f9bcff321192d8208ddf3c3eb6b03c3cad6ff96c085100e7d6e9afe81a7d22b637dd5c2bc1167f4c4e57c6d68f0b58db8d6948d11373bfde10497a38e5ef16b714530e296b5004303542480782c8a25250e0be5afeb624b12c320b69e1622b11da70a08c6d1fd3dd44fe598778e5c61181b37d0a25885cd330da1576836d7d6c8d42ae1dd2ad2b0c9031beec8ca184cf00038072b6dbe505f4d23825abb992f7138f0b2d0c243eae89f76a9964f430a8a7bc9442b67e498245f3f1c112e36afa5558ed84fecd0e4dbc7b480eb9b858149916681781cc357837e22cbd24efdd6ce0fe9f06ee7631b492ceae6827a619e3b5ee7e5c67143bc7e46ab8ef63a75f4bc582dc231d42d03066eb028b749f320581f140577cffdcec9444f58cea90ae0c031468b804853c0b70a00e5227d97d252adfda52408198b3af4761e8a76ac6f7499958b6117f47a64027b29a1812a2db8beeecbf29fed6e53e0cd7d0aaa4183d1cee9eef6cc56b9aa2f833d01d3132a5265fe7ecfc2f2d795d67306a96a5e31cb110dbb0dd126f8febe9bf9500a350617c437e787f7195096a74fc779f354dc1f7386adb976435cbb3279b075dde9e4b60f397c0c66d3c715535e91fe7fa2d405aaa8e9fee265f7de6f3348f6df23aa13998ab3cb3e14213500b31279d31b5d0c9301cc86ca3e890811517265ea66667e89b82ba3ab4e53c3e9197dea1181d388982a6c2b03b32cf863780a1a1fa23b9b98ec163ec7a1746b01ebb4cd82a4cc1bf6477a4e31cdc5755431545a3168a67ef06420ba48c404ac713e3b5c840d6d68429252562e40e877bbf0f46230230360bace55a07a5952547c51f72b0fad89b978b20fe52021f63c47b4a8d80e7e1c5ac155ba6406cad428452e14e4e40e76a82828ba8027c7b7bd0243dbf76ee817185f9e2ef239df080d96521a485165b64b48a6deac884a1ca4bb37b7e3f41889ea1b6936892bb1562febe907d6a88f078bc017f05df994a8170aebc6205ae0baef4d7b5b4284af99058fb6ab8fdeb5ec7e3e7b67ee9deedd2440ef7bec92101b6d349a2d2a451a9dc62b93ac3dff19d79f7f4c88edf78626e34a82afcd2d1c1c5f51ec45d41fabd77c377f993840bf57911a612bf30fbc8d3c1f92d7404313ee5d8277bf871189513398101393580836a668f0c3082d541d219757b0a5ce2248cc402868c399eabf2f233ae73ee824ef6b9e7d0039dd8d5fb1149509312e200598cd7e29dfe2eeeb4a8ba08351e2ff3e4da14cd5f2c7c771ee292a40828cb6611495cd4cb299a302bc3320ce52a3ce6cb0bdeb0f36f6b4330a78b003ab627f1e753a14a97e99e69e0d722832623577fa48c40a5ff2efd56b85b328faeae9d2e16d8a3ed7c340d12a7e9a0195307e8cabdbfd08892c698dae47a17916a5c4d4ddb0b625f35ef7ee75846418697f317e3f8ee3d253936d91d5c04fec197a27e3dfe6d8fb48ffb1be9b7a31dc712f600111b6f84beb283a178a46af8066685bead2e12bde2c5a1720e18dff321caa6ba010716f5f0e89c59a9162851a760e09be86b05e84946e467127f63b0541c237a1aad0e6bc536c86b6d322a72d44f6d123c07847a4abc7db41e8619cc9529be5ea4bfbd047cc6bada8644f7bd00ab4ca996e3eb1c2072ec6cc73f31c6486d49fea1ea3a6e8137b03722abead37930e85b73f178f039b79804918af6c6fdb1348ec3897273a09d9909012e5c22b0040d041d2bb9e7e7e56bdb40db0a3c80ddee9507b099634ceff8b088e3cb26608f42895a50b6a2bfab30b718b34a9cbb1781b8b10166784d28b99149320cc2c0c5d97bb585af82a6b7f54c3b1b1b957b2c2092f6f9ffec949429469c5a666080cdc001af06f32438e7fd7d", 0x1000}, {&(0x7f0000000180)="d5b10452e3869016c93bcca48f455227d6b1eaeca770d451b8c7943a45360cd0631487517d15e060ce7628be47d646288ead27eee53f10ccd3c8073186e331a92305595b628c4ead973a7bb74687df8046419a5afd447de739fceedf4feec0c5f9f7352ccf13fc72f84da2482d3ee0b4add1a54f6d8b66edc1fabbd55c2a14de984667b236512cd948f3d6906effa2d3475a109435e8506155119ecb87bdaae9", 0xa0}, {&(0x7f00000013c0)="3301e9f74087471362e3fa226eaf44a9a854a7500d6e2f758a28db4c16d80c8bcb2854652e67952f1773e8bf3e4ad6723f739f04a3b00f37c62372215590e8e31d582042c65481d5b54c04964eab4329c94ea8cf9ced69c9a13bed85fb7fb388b68bbe6ed67bb7ff7fd761ace7313f0e519fbe91f375fe2b4b8ce88b94ad6ea401d0a05f1277f2fe6d57a13a0a92fab6058e7c826f145d7243a8ff7a64f0a1a3270000ae958a864ca8a92a4e2ab08a8a1708919f0b905cdcedc65e66d2a111e8545b055a72d7219847886617116d59", 0xcf}, {&(0x7f0000000100)="3b19e4bb3e320a5aada29109caf51f6a1b9ad1b3f7", 0x15}], 0x4, 0x0)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r6, 0x0)

[ 2761.404410] ion_mmap: failure mapping buffer to userspace
[ 2761.411077] binder: BINDER_SET_CONTEXT_MGR already set
[ 2761.425115] binder: 26935:26937 unknown command 1272844
[ 2761.430943] binder: 26930:26939 ioctl 40046207 0 returned -16
[ 2761.434669] binder: 26935:26937 ioctl c0306201 20000140 returned -22
[ 2761.443378] binder: 26930:26932 unknown command 335897356
[ 2761.449674] binder: 26930:26932 ioctl c0306201 20000140 returned -22
[ 2761.540140] binder_alloc: binder_alloc_mmap_handler: 26935 20001000-20004000 already mapped failed -16
02:39:50 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0105502, &(0x7f0000000000)={0xa3})
sync()

02:39:50 executing program 3:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x0, @dev={[], 0xa}, 'lo\x00'}}, 0x1e)
connect$pppoe(0xffffffffffffffff, &(0x7f0000000100)={0x18, 0x0, {0x0, @empty, 'gretap0\x00'}}, 0x1e)
dup3(r0, r1, 0x0)

[ 2761.583347] IPVS: ftp: loaded support on port[0] = 21
[ 2761.595511] binder: 26935:26937 unknown command 1272844
[ 2761.614942] binder: 26935:26937 ioctl c0306201 20000140 returned -22
02:39:50 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:39:50 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000008000/0x2000)=nil, 0x2000, 0x3000000, 0x6012, r2, 0x0)

02:39:50 executing program 3:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x0, @dev={[], 0xa}, 'lo\x00'}}, 0x1e)
connect$pppoe(0xffffffffffffffff, &(0x7f0000000100)={0x18, 0x0, {0x0, @empty, 'gretap0\x00'}}, 0x1e)
dup3(r0, r1, 0x0)

02:39:50 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r0, 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2761.743263] IPVS: ftp: loaded support on port[0] = 21
[ 2761.759295] device bridge_slave_1 left promiscuous mode
[ 2761.768364] bridge0: port 2(bridge_slave_1) entered disabled state
02:39:50 executing program 3:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x483, &(0x7f0000000000)={0x11, @dev, 0x0, 0x0, 'lblcr\x00'}, 0x2c)

[ 2761.813508] ion_mmap: failure mapping buffer to userspace
[ 2761.820254] device bridge_slave_0 left promiscuous mode
[ 2761.826856] bridge0: port 1(bridge_slave_0) entered disabled state
02:39:50 executing program 3:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200)='/dev/uinput\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
read(r0, &(0x7f00000003c0)=""/41, 0x29)

[ 2761.936715] team0 (unregistering): Port device team_slave_1 removed
[ 2761.961163] team0 (unregistering): Port device team_slave_0 removed
[ 2761.972635] IPVS: ftp: loaded support on port[0] = 21
[ 2761.994260] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2762.049284] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2762.147741] bond0 (unregistering): Released all slaves
[ 2762.211383] ion_mmap: failure mapping buffer to userspace
[ 2762.583358] binder: BINDER_SET_CONTEXT_MGR already set
[ 2762.590326] binder: 26963:26968 ioctl 40046207 0 returned -16
[ 2763.691926] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2763.701640] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2763.715376] device bridge_slave_0 entered promiscuous mode
[ 2763.770642] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2763.794426] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2763.802825] device bridge_slave_0 entered promiscuous mode
[ 2763.812107] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2763.821509] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2763.829420] device bridge_slave_0 entered promiscuous mode
[ 2763.836929] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2763.843298] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2763.865274] device bridge_slave_1 entered promiscuous mode
[ 2763.894688] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2763.914455] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2763.921637] device bridge_slave_1 entered promiscuous mode
[ 2763.941940] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2763.963104] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2763.970816] device bridge_slave_1 entered promiscuous mode
[ 2763.979117] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2764.001871] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2764.036541] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[ 2764.059681] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2764.075580] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2764.119979] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[ 2764.239571] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2764.302765] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2764.343171] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2764.380622] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[ 2764.394793] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 2764.413981] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 2764.450287] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2764.492949] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 2764.509264] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 2764.528591] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 2764.562085] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[ 2764.578738] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 2764.624002] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[ 2764.645174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 2764.656613] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 2764.670532] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 2764.718532] device bridge_slave_1 left promiscuous mode
[ 2764.724055] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2764.785189] device bridge_slave_0 left promiscuous mode
[ 2764.790712] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2764.845527] device bridge_slave_1 left promiscuous mode
[ 2764.851039] bridge0: port 2(bridge_slave_1) entered disabled state
[ 2764.905148] device bridge_slave_0 left promiscuous mode
[ 2764.910644] bridge0: port 1(bridge_slave_0) entered disabled state
[ 2765.009888] team0 (unregistering): Port device team_slave_1 removed
[ 2765.020330] team0 (unregistering): Port device team_slave_0 removed
[ 2765.037443] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2765.088344] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2765.173645] bond0 (unregistering): Released all slaves
[ 2765.248181] team0 (unregistering): Port device team_slave_1 removed
[ 2765.257915] team0 (unregistering): Port device team_slave_0 removed
[ 2765.267711] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 2765.318257] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 2765.403080] bond0 (unregistering): Released all slaves
[ 2765.469309] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[ 2765.480677] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2765.496449] team0: Port device team_slave_0 added
[ 2765.501932] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 2765.585739] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2765.593110] team0: Port device team_slave_1 added
[ 2765.684942] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[ 2765.691828] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 2765.715049] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2765.725546] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2765.744754] team0: Port device team_slave_0 added
[ 2765.751427] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[ 2765.762146] team0: Port device team_slave_0 added
[ 2765.794609] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[ 2765.801932] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 2765.815039] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2765.834985] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2765.855489] team0: Port device team_slave_1 added
[ 2765.862760] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[ 2765.885319] team0: Port device team_slave_1 added
[ 2765.944607] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 2765.952196] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 2765.961783] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2765.989035] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2766.015285] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 2766.030138] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 2766.054803] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 2766.062840] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2766.114607] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2766.127326] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 2766.174659] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 2766.181877] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 2766.192281] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2766.225681] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[ 2766.232800] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 2766.255081] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 2766.278559] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 2766.305143] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 2766.314554] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2766.337929] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[ 2766.355177] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 2766.365335] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 2767.036330] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2767.042729] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2767.049422] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2767.055802] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2767.068586] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2767.238204] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2767.244624] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2767.251247] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2767.257644] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2767.265762] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2767.298110] bridge0: port 2(bridge_slave_1) entered blocking state
[ 2767.304524] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 2767.311222] bridge0: port 1(bridge_slave_0) entered blocking state
[ 2767.317618] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 2767.344212] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[ 2767.515427] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2767.522556] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2767.545177] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 2769.785325] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2769.973978] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2770.114569] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2770.145414] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2770.153972] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2770.164103] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2770.179948] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2770.324083] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2770.438603] 8021q: adding VLAN 0 to HW filter on device team0
[ 2770.456122] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[ 2770.585422] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2770.591571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2770.600527] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2770.675309] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[ 2770.681455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 2770.694826] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 2770.797298] 8021q: adding VLAN 0 to HW filter on device team0
[ 2770.997880] 8021q: adding VLAN 0 to HW filter on device team0
[ 2772.469792] autofs4:pid:27741:autofs_fill_super: called with bogus options
[ 2772.504097] autofs4:pid:27747:autofs_fill_super: called with bogus options
02:40:01 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

02:40:01 executing program 3:
r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x201, 0x8000000100079)
ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000180)=ANY=[@ANYBLOB="2303338408"])
ioctl$KVM_CREATE_VCPU(r0, 0x4008550c, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0106434, &(0x7f0000000040)={0x2})

02:40:01 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000640)='/dev/rtc0\x00', 0x400000, 0x0)
r4 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_ADD(r3, 0x4c80, r4)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00c@@'], 0xffab, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r5 = dup2(r0, r1)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0xfffffffffffffcbb, 0x0, &(0x7f00000002c0)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@fda={0x66646185, 0x2, 0x0, 0x31}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}], &(0x7f00000000c0)=[0x78, 0x48]}}}], 0x0, 0x0, &(0x7f0000000500)})
ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r5, 0x4008240b, &(0x7f00000003c0)={0x1, 0x70, 0x6, 0x1f, 0x7, 0x1ff, 0x0, 0x2, 0x8000, 0xb, 0x8, 0x5, 0xfff, 0xffffffff, 0x4, 0x5, 0x200, 0x1, 0x884a, 0x5, 0x9, 0x0, 0xffffffff, 0x8, 0x8, 0x4, 0x9, 0x6, 0x6, 0x20, 0xfffffffffffffff9, 0x1, 0x6, 0x5, 0x1, 0x8, 0xa1, 0x81, 0x0, 0x1, 0x1, @perf_bp={&(0x7f0000000380), 0x1}, 0x0, 0x1, 0x7f, 0x7, 0x2, 0xfffffffffffffe00, 0x9})
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r5, 0x40045542, &(0x7f0000000280)=0x8)
write$uinput_user_dev(r5, &(0x7f0000000680)={'syz1\x00', {0xff, 0x100000000, 0xffffffffffffffff}, 0x32, [0x400, 0xec, 0x264b, 0x0, 0x1, 0x400, 0x2, 0x10001, 0x9, 0x4, 0x8000, 0x6, 0x8000, 0x3, 0x3, 0x101, 0x0, 0x2, 0x9e9, 0x0, 0x101, 0x100, 0xc32, 0x0, 0x1, 0x7, 0x20, 0x80000001, 0x8, 0x80, 0x9da, 0x484, 0x6, 0x5, 0x80000001, 0x5, 0x2, 0xff, 0x7, 0x2, 0x88, 0x3ff, 0x4, 0x3f, 0x0, 0xef3, 0xf2f3, 0x1, 0x1, 0x8250, 0x1, 0x1, 0x8, 0x5, 0xffff, 0x5, 0x8, 0x101, 0xfff, 0x8, 0x40, 0xffffffffffffeac7, 0x80, 0x3], [0x4, 0x6e, 0xffffffffffffff64, 0x1, 0x7b8, 0x95b0, 0x1f, 0x6fd, 0x8, 0x1, 0xfffffffffffffffe, 0xffffffffffffe268, 0xfff, 0xbf, 0x1, 0x94, 0x2, 0x8000, 0xd203, 0x3, 0x0, 0x0, 0x0, 0x2, 0x3f, 0x1f, 0x9, 0x7, 0x5bc, 0x5, 0x5, 0x4, 0xffff, 0xff, 0x10001, 0x0, 0x7f, 0x4, 0x7, 0x7, 0x4, 0x4, 0x10001, 0xc34, 0xff, 0x2, 0x0, 0x76, 0xfffffffffffffff7, 0x6, 0x8, 0xfffffffffffffffa, 0x6, 0x80, 0x6, 0x3, 0x8, 0x8, 0xffffffffffffffd6, 0x401, 0x10001, 0x3ffc000000000000, 0x100, 0x3f], [0x1, 0x6, 0x9, 0x1, 0x591, 0x2, 0x8, 0x9, 0x81, 0x0, 0x7, 0x3, 0x8, 0xb02, 0x9, 0x80000000000000, 0x1, 0x0, 0x0, 0x96, 0x200, 0x4, 0x10000, 0xec, 0x101, 0x9, 0x5, 0x1ff, 0x70, 0x6, 0x6, 0x4b56, 0x8001, 0x7, 0x1000, 0x2, 0x3, 0x5, 0x3, 0x0, 0x2, 0x1, 0x8, 0x2, 0xc2e, 0x0, 0x9, 0x9, 0x100000000, 0x1cb5, 0x20, 0x0, 0xa2, 0x4, 0x4c5f, 0x8001, 0x2, 0x6, 0x8, 0x1, 0x3, 0x2, 0x100, 0x1], [0xfffffffffffffff9, 0x0, 0x1f00000000, 0x9, 0x6, 0x10000, 0xffff, 0x6, 0x0, 0x7, 0x7ff, 0x8001, 0x5, 0x400, 0x0, 0x7fffffff, 0x334c, 0x2, 0x3, 0x7, 0x4, 0x5, 0x397b, 0x7, 0x1, 0xd9a, 0x1, 0x5, 0x8, 0xedd, 0xfffffffffffffff7, 0x6, 0x42, 0x3d6, 0x1d0, 0x1, 0x8001, 0x925, 0x7fffffff, 0xc51e, 0x6, 0x7, 0x9, 0x8, 0x4, 0x9, 0x5, 0x6, 0x10d9, 0x5, 0x2, 0x0, 0x40, 0x6, 0xfffffffffffffffe, 0x38, 0x3, 0xf4af, 0x1, 0x8, 0x2, 0x5, 0x5, 0x53e]}, 0x45c)
ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000500))
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

02:40:01 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x3)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x88000, 0x0)
r3 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f0000000200)=0xe8)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000280)={@dev, <r5=>0x0}, &(0x7f0000000300)=0x14)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000840)={{{@in=@rand_addr, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in=@multicast1}, 0x0, @in=@loopback}}, &(0x7f0000000940)=0xe8)
getpeername(r1, &(0x7f0000000980)=@xdp={0x2c, 0x0, <r7=>0x0}, &(0x7f0000000a00)=0x80)
getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000b00)={{{@in6=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in=@dev}, 0x0, @in6=@remote}}, &(0x7f0000000c00)=0xe8)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000d00)={{{@in=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000e00)=0xe8)
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00', <r10=>0x0})
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e80)={'vcan0\x00', <r11=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000ec0)={'veth0_to_bond\x00', <r12=>0x0})
accept4(r0, &(0x7f0000001300)=@can={0x1d, <r13=>0x0}, &(0x7f0000001380)=0x80, 0x800)
getsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000001480)={@mcast2, <r14=>0x0}, &(0x7f00000014c0)=0x14)
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000001500)={{{@in=@broadcast, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0}}, {{@in6=@mcast2}, 0x0, @in6=@loopback}}, &(0x7f0000001600)=0xe8)
recvmmsg(r0, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000002d00)=[{&(0x7f0000002ac0)=""/63, 0x3f}, {&(0x7f0000002b00)=""/110, 0x6e}, {&(0x7f0000002b80)=""/109, 0x6d}, {&(0x7f0000002c00)=""/125, 0x7d}, {&(0x7f0000002c80)=""/126, 0x7e}], 0x5, &(0x7f0000002d80)=""/69, 0x45, 0x100}, 0x4}, {{&(0x7f0000002e00)=@hci, 0x80, &(0x7f0000003140)=[{&(0x7f0000002e80)=""/160, 0xa0}, {&(0x7f0000002f40)=""/243, 0xf3}, {&(0x7f0000003040)=""/228, 0xe4}], 0x3, &(0x7f0000003180)=""/216, 0xd8, 0x9}, 0x1}, {{&(0x7f0000003280)=@hci={0x1f, <r16=>0x0}, 0x80, &(0x7f00000038c0)=[{&(0x7f0000003300)=""/50, 0x32}, {&(0x7f0000003340)=""/188, 0xbc}, {&(0x7f0000003400)=""/106, 0x6a}, {&(0x7f0000003480)=""/144, 0x90}, {&(0x7f0000003540)=""/105, 0x69}, {&(0x7f00000035c0)=""/182, 0xb6}, {&(0x7f0000003680)=""/48, 0x30}, {&(0x7f00000036c0)=""/225, 0xe1}, {&(0x7f00000037c0)=""/253, 0xfd}], 0x9, &(0x7f0000003980)=""/138, 0x8a, 0x6}, 0xd0}, {{&(0x7f0000003a40)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000004100)=[{&(0x7f0000003ac0)=""/235, 0xeb}, {&(0x7f0000003bc0)=""/204, 0xcc}, {&(0x7f0000003cc0)=""/162, 0xa2}, {&(0x7f0000003d80)=""/211, 0xd3}, {&(0x7f0000003e80)=""/56, 0x38}, {&(0x7f0000003ec0)=""/36, 0x24}, {&(0x7f0000003f00)=""/206, 0xce}, {&(0x7f0000004000)=""/205, 0xcd}], 0x8, &(0x7f0000004180)=""/98, 0x62, 0xff}, 0x8}, {{&(0x7f0000004200)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, &(0x7f0000004380)=[{&(0x7f0000004280)=""/224, 0xe0}], 0x1, &(0x7f00000043c0)=""/233, 0xe9, 0x1}, 0x4}, {{&(0x7f00000044c0)=@llc, 0x80, &(0x7f0000004640)=[{&(0x7f0000004540)=""/195, 0xc3}], 0x1, &(0x7f0000004680)=""/4096, 0x1000, 0x2}, 0x4}, {{&(0x7f0000005680)=@in, 0x80, &(0x7f0000005b80)=[{&(0x7f0000005700)=""/113, 0x71}, {&(0x7f0000005780)=""/1, 0x1}, {&(0x7f00000057c0)=""/129, 0x81}, {&(0x7f0000005880)=""/209, 0xd1}, {&(0x7f0000005980)=""/50, 0x32}, {&(0x7f00000059c0)=""/64, 0x40}, {&(0x7f0000005a00)}, {&(0x7f0000005a40)=""/15, 0xf}, {&(0x7f0000005a80)=""/183, 0xb7}, {&(0x7f0000005b40)=""/39, 0x27}], 0xa, &(0x7f0000005c40)=""/63, 0x3f, 0x1f}, 0x7f}], 0x7, 0x100, &(0x7f0000005e40)={0x0, 0x1c9c380})
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000005e80)={'team0\x00', <r17=>0x0})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000007880)={'\x00', <r18=>0x0})
accept4$packet(0xffffffffffffff9c, &(0x7f0000007900)={0x11, 0x0, <r19=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000007940)=0x14, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000009d40)={'ip_vti0\x00', <r20=>0x0})
accept$packet(r1, &(0x7f0000009d80)={0x11, 0x0, <r21=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000009dc0)=0x14)
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000009e00)={{{@in=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r22=>0x0}}, {{@in6=@mcast2}, 0x0, @in=@loopback}}, &(0x7f0000009f00)=0xe8)
sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f000000a6c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f000000a680)={&(0x7f0000009f40)={0x708, r3, 0x300, 0x70bd2d, 0x25dfdbfc, {}, [{{0x8, 0x1, r4}, {0xc0, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x1a0, 0x2, [{0x74, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x44, 0x4, [{0x9, 0x6, 0x0, 0x4}, {0x2, 0x1693, 0x6}, {0x8f, 0x5, 0x9, 0x8}, {0x7, 0x8a, 0x9, 0x1f}, {0x3, 0xfffffffffffffffe, 0x200, 0x400}, {0x80000001, 0x10000, 0x400, 0x1}, {0x1, 0xfe8, 0x8, 0x7d9d}, {0x401, 0x8, 0xfff}]}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r9}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x101}}, {0x8, 0x6, r10}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r11}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}]}}, {{0x8, 0x1, r12}, {0x1b0, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r13}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r14}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r15}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x3c26}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xb4}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r17}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}]}}, {{0x8}, {0x2c4, 0x2, [{0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0x8, 0x100, 0x8, 0x7fff}, {0x5, 0x9, 0xfffffffffffffc00, 0x8}, {0x8, 0x81, 0x6, 0xc97e}, {0x200, 0x6, 0x51, 0x400a4506}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r18}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r19}}, {0x8}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x3, 0x24d1, 0x5, 0x8001}, {0x4, 0x5, 0x5, 0x1}, {0x1, 0x2, 0x5, 0x24ba}]}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x800}}, {0x8, 0x6, r20}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x563b}}, {0x8, 0x6, r22}}}, {0x74, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x44, 0x4, [{0xbb, 0x4, 0x1ff, 0x10000}, {0x2, 0x0, 0x100, 0x4901}, {0x3ff, 0x8, 0x3, 0x1}, {0x3f, 0x4, 0x1000, 0x3}, {0xba, 0x6, 0x1, 0x9}, {0x3, 0x8001, 0x0, 0x2bdc}, {0x5, 0x4, 0x3, 0x7}, {0xbbc, 0x3, 0x8, 0x1e0800}]}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}]}}]}, 0x708}, 0x1, 0x0, 0x0, 0x4040000}, 0x20000040)
set_thread_area(&(0x7f00000002c0)={0x7})
r23 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r23, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r24=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r24, 0x0)

02:40:01 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x80045518, &(0x7f0000000000)={0xa3})
sync()

[ 2772.630641] binder: release 27757:27763 transaction 8362 out, still active
[ 2772.644048] binder: 27757:27763 ioctl 660c 0 returned -22
[ 2772.663389] ion_mmap: failure mapping buffer to userspace
02:40:01 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0045878, &(0x7f0000000000)={0xa3})
sync()

[ 2772.687746] binder_alloc: binder_alloc_mmap_handler: 27757 20001000-20004000 already mapped failed -16
[ 2772.721207] binder_alloc: 27757: binder_alloc_buf, no vma
[ 2772.742100] binder_transaction: 19 callbacks suppressed
[ 2772.742118] binder: 27757:27775 transaction failed 29189/-3, size 0-0 line 2970
[ 2772.752212] ion_mmap: failure mapping buffer to userspace
[ 2772.786061] autofs4:pid:27786:autofs_fill_super: called with bogus options
[ 2772.794028] binder: BINDER_SET_CONTEXT_MGR already set
[ 2772.808751] binder: 27757:27788 ioctl 660c 0 returned -22
[ 2772.833287] binder: 27757:27763 ioctl 40046207 0 returned -16
[ 2772.858607] autofs4:pid:27786:autofs_fill_super: called with bogus options
[ 2772.866825] binder: release 27757:27763 transaction 8362 in, still active
[ 2772.873791] binder: send failed reply for transaction 8362, target dead
[ 2772.922424] autofs4:pid:27795:autofs_fill_super: called with bogus options
02:40:01 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f66738c", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:40:01 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>r1})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

02:40:01 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x4008550d, &(0x7f0000000000)={0xa3})
sync()

02:40:01 executing program 4:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000040))
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
dup2(r1, r2)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

[ 2773.014857] autofs4:pid:27795:autofs_fill_super: called with bogus options
02:40:02 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0045878, &(0x7f0000000000)={0xa3})
sync()

[ 2773.081086] ion_mmap: failure mapping buffer to userspace
02:40:02 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r0, 0x50, &(0x7f0000000080)={0x0, <r3=>0x0}}, 0x10)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)=r3, 0x4)

[ 2773.133988] binder: release 27802:27808 transaction 8365 out, still active
[ 2773.147206] binder: 27802:27808 transaction failed 29189/0, size 0-0 line 2787
[ 2773.159213] binder: undelivered TRANSACTION_COMPLETE
02:40:02 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f66739c", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2773.183675] binder: send failed reply for transaction 8365, target dead
[ 2773.213923] binder: BINDER_SET_CONTEXT_MGR already set
[ 2773.220393] binder: 27802:27820 ioctl 40046207 0 returned -16
[ 2773.229919] binder_alloc: 27802: binder_alloc_buf, no vma
[ 2773.232409] ion_mmap: failure mapping buffer to userspace
[ 2773.239022] binder: 27802:27808 transaction failed 29189/-3, size 0-0 line 2970
[ 2773.285184] binder_transaction: 7 callbacks suppressed
[ 2773.285195] binder: 27802:27828 got reply transaction with no transaction stack
[ 2773.285493] binder_release_work: 20 callbacks suppressed
[ 2773.285499] binder: undelivered TRANSACTION_ERROR: 29189
[ 2773.306442] binder: 27802:27828 transaction failed 29201/-71, size 0-0 line 2762
[ 2773.352558] binder: undelivered TRANSACTION_ERROR: 29190
[ 2773.453666] binder: undelivered TRANSACTION_ERROR: 29201
02:40:02 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000b55000)={0x2, 0x2}, 0x10)
ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000580)=0xffffffffffffffff)
sendto$inet(r0, &(0x7f00005c9000), 0x0, 0xb5d8b4ede3aea896, &(0x7f0000000000)={0x2, 0x10000000002, @loopback}, 0x10)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
sendto$inet(r0, &(0x7f0000000300)='U', 0x1, 0x1, 0x0, 0x0)

02:40:02 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
getsockname$inet(r1, &(0x7f0000000080), &(0x7f00000000c0)=0x10)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)
syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x0, 0x101000)

02:40:02 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:40:02 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185502, &(0x7f0000000000)={0xa3})
sync()

02:40:02 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f00000005c0)='/dev/binder#\x00', 0x0, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="7015b9642420e6aef74103005011"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x900, 0x0)
ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000080)={0x7, 0x0, 0xe4b900000000000})
getpeername$packet(0xffffffffffffff9c, &(0x7f00000000c0)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000002c0)=0x14)
clock_gettime(0x0, &(0x7f0000000340)={<r5=>0x0, <r6=>0x0})
sendmsg$can_bcm(r3, &(0x7f0000000580)={&(0x7f0000000300)={0x1d, r4}, 0x10, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="07000000200000000500000000000000", @ANYRES64=r5, @ANYRES64=r6/1000+10000, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000e001000000030000e02f0100009b6cbb15fb57b8de8ac0e9ebbc9626ed1127a0e32287fb6cb67c5d73c561b788e5879fe548b9f85cd5e129afb1213f1e26a07bffb9"], 0x80}}, 0x0)
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:40:02 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2773.693188] ion_mmap: failure mapping buffer to userspace
[ 2773.708127] binder: 27839:27843 transaction failed 29189/-22, size 0-0 line 2855
[ 2773.723530] binder: 27839:27843 unknown command 1689851248
02:40:02 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x111200, 0x0)
socket$inet(0x2, 0x6000000000000003, 0x8001)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0)='nbd\x00')
sendmsg$NBD_CMD_STATUS(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x2c, r2, 0x800, 0x70bd25, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008041}, 0xd0)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r4=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r4, 0x0)

02:40:02 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x18}}, &(0x7f00000000c0)=""/253, 0x1a, 0xfd}, 0x20)

[ 2773.738809] autofs4:pid:27842:autofs_fill_super: called with bogus options
[ 2773.750149] binder: 27839:27843 ioctl c0306201 20000140 returned -22
[ 2773.781497] autofs4:pid:27854:autofs_fill_super: called with bogus options
02:40:02 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa1})
sync()

02:40:02 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2773.805811] binder: undelivered TRANSACTION_ERROR: 29189
[ 2773.811778] binder: 27839:27843 got reply transaction with no transaction stack
[ 2773.832944] ion_mmap: failure mapping buffer to userspace
02:40:02 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2773.855675] binder: 27839:27843 transaction failed 29201/-71, size 0-0 line 2762
[ 2773.870467] autofs4:pid:27845:autofs_fill_super: called with bogus options
[ 2773.889585] usb usb9: usbfs: process 27865 (syz-executor5) did not claim interface 0 before use
[ 2773.895762] binder_alloc: binder_alloc_mmap_handler: 27839 20001000-20004000 already mapped failed -16
02:40:02 executing program 3:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f66738c", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2773.935552] usb usb9: usbfs: process 27873 (syz-executor5) did not claim interface 0 before use
02:40:02 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:40:02 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x800)
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0xfffffffffffffffc, 0x6012, r1, 0x3ffffc)

[ 2773.978167] ion_mmap: failure mapping buffer to userspace
[ 2773.993656] binder: 27839:27859 transaction failed 29189/-22, size 0-0 line 2855
[ 2774.032080] binder: 27839:27871 unknown command 1689851248
[ 2774.036810] binder: BINDER_SET_CONTEXT_MGR already set
[ 2774.041091] autofs4:pid:27874:autofs_fill_super: called with bogus options
[ 2774.055253] binder: 27839:27843 ioctl 40046207 0 returned -16
02:40:02 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3, 0x4800000000000000})
sync()

[ 2774.080291] binder: undelivered TRANSACTION_ERROR: 29189
[ 2774.086777] binder: 27839:27871 ioctl c0306201 20000140 returned -22
[ 2774.111571] binder: 27839:27888 got reply transaction with no transaction stack
02:40:03 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f667303", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2774.136119] binder: undelivered TRANSACTION_ERROR: 29201
[ 2774.141928] binder: 27839:27888 transaction failed 29201/-71, size 0-0 line 2762
[ 2774.153763] autofs4:pid:27889:autofs_fill_super: called with bogus options
[ 2774.154158] autofs4:pid:27898:autofs_fill_super: called with bogus options
[ 2774.171311] vhci_hcd: invalid port number 0
[ 2774.224894] vhci_hcd: invalid port number 0
[ 2774.235114] binder: undelivered TRANSACTION_ERROR: 29201
02:40:03 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = socket$inet(0x2, 0x200000002, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000480)=@broute={'broute\x00', 0x20, 0x2, 0x310, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000080], 0x0, &(0x7f0000000040), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x0, 0x0, 'rose0\x00', 'veth1_to_bridge\x00', 'team_slave_1\x00', 'ip6gre0\x00', @link_local, [], @broadcast, [], 0xd0, 0x100, 0x130, [@pkttype={'pkttype\x00', 0x8}, @m802_3={'802_3\x00', 0x8}]}, [@common=@redirect={'redirect\x00', 0x8, {{0xfffffffffffffffc}}}]}, @common=@redirect={'redirect\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'veth1\x00', 'tunl0\x00', 'veth1_to_team\x00', 'vlan0\x00', @remote, [], @dev, [], 0xf0, 0xf0, 0x120, [@cgroup0={'cgroup\x00', 0x8}, @helper={'helper\x00', 0x28, {{0x0, 'RAS\x00'}}}]}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8}}]}]}, 0x388)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r4 = syz_open_dev$usb(&(0x7f0000000400)='/dev/bus/usb/00#/00#\x00', 0x1, 0x103000)
ioctl$PIO_UNIMAPCLR(r4, 0x4b68, &(0x7f0000000500)={0x0, 0x7fff, 0x3ff})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="006340baa08ee382648ecc66a70fdedc4b318540c996e097c55178032aafa5a4f5585c71f1ca61702b713981e5b5fc50c04973c337d116046b81d724e0cd019389b8b83e55d4724a7f1a9bf0e1e6ae77314acd9d3c6fb596b4795ee3ef0b5820ac324bc17afe78e72b7396ebe5ccdeba6282d1269689e9bfd4fbd7fb9af5038bb87e56ae7d95fa0d7a926427d9c2c8c75f5c"], 0x0, 0x0, &(0x7f0000000040)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000080), 0xffffffffffffffc9, 0x0, &(0x7f0000000640)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045fbd90e95b6c807d9ecc9b2662539500d7df7d1802"})
dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)}}], 0x0, 0x0, &(0x7f0000000500)})

02:40:03 executing program 3:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0x2, &(0x7f0000000000)={0xa3})
sync()

02:40:03 executing program 0:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:40:03 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
r1 = socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)
ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000000)='veth0_to_bond\x00')

02:40:03 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3, 0x100000})
sync()

[ 2774.348456] vhci_hcd: invalid port number 0
[ 2774.358267] vhci_hcd: invalid port number 0
02:40:03 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3, 0x6800})
sync()

[ 2774.394902] ion_mmap: failure mapping buffer to userspace
[ 2774.404054] binder: 27922:27923 unknown command -1170185472
[ 2774.408089] ion_mmap: failure mapping buffer to userspace
[ 2774.418194] autofs4:pid:27913:autofs_fill_super: called with bogus options
02:40:03 executing program 3:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f667304", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

[ 2774.440698] binder: 27922:27923 ioctl c0306201 20000440 returned -22
[ 2774.449756] binder: 27922:27932 got reply transaction with no transaction stack
[ 2774.460364] vhci_hcd: invalid port number 0
02:40:03 executing program 1:
r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x1, 0x100)
ioctl$KVM_S390_UCAS_UNMAP(r0, 0x4018ae51, &(0x7f0000000080)={0xffff, 0x7b})
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r3=>0xffffffffffffffff})
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r3, 0x0)

02:40:03 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='autofs\x00', 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x0, 0x3ff, 0x0, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0xb9)
connect(r2, &(0x7f0000000040)=@un=@abs, 0x80)
setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB], 0x0)

[ 2774.506089] vhci_hcd: invalid port number 0
[ 2774.515883] binder: 27922:27932 transaction failed 29201/-71, size 0-0 line 2762
[ 2774.526806] autofs4:pid:27933:autofs_fill_super: called with bogus options
02:40:03 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000540), 0xffffffffffffffff)
r0 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1)
ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0xa3, 0x4c})
sync()

02:40:03 executing program 3:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)="6175746f667304", 0x0, &(0x7f0000000400))
creat(&(0x7f0000000180)='./file0\x00', 0x0)
perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000343ff8)='./file1\x00', &(0x7f0000000140)='nfs\x00', 0x0, &(0x7f000000a000))
r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000140))
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200), &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000340)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x80, 0x3ff, 0x500000000000, 0x7, 0xffffffffffffffc0}, &(0x7f0000000400)=0x98)
r2 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x0, 0x10101)
ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @dev, 'dummy0\x00'}})
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "9bb1fa"}, 0x4, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xb9)
connect(r3, &(0x7f0000000040)=@un=@abs, 0x80)
r4 = socket$inet6(0xa, 0xfffffffffffffffe, 0x0)
setsockopt$inet6_opts(r4, 0x29, 0x0, &(0x7f00000000c0)=@routing, 0x8)
sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0)
msgget(0xffffffffffffffff, 0x0)
syz_emit_ethernet(0x1, &(0x7f000000a000)=ANY=[@ANYBLOB="ff4bc31a631b00c000006d1da88cb8777725e8e3f69078ac149078"], 0x0)

02:40:03 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070")
socket$inet(0x2, 0x6000000000000003, 0x8001)
clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff)
set_thread_area(&(0x7f00000002c0)={0x7})
r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000380))
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x56aa, 0x11, 0x0, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x3, 0x208040)
ioctl$ASHMEM_GET_SIZE(r3, 0x7704, 0x0)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x6012, r2, 0x0)

[ 2774.552378] binder: BINDER_SET_CONTEXT_MGR already set
[ 2774.567261] ion_mmap: failure mapping buffer to userspace
[ 2774.580220] binder: 27922:27943 unknown command -1170185472
[ 2774.631637] binder: 27922:27923 got reply transaction with no transaction stack
[ 2774.666306] vhci_hcd: invalid port number 76
[ 2774.674459] binder: 27922:27932 ioctl 40046207 0 returned -16
[ 2774.674804] binder: undelivered TRANSACTION_ERROR: 29201
[ 2774.682041] ion_mmap: failure mapping buffer to userspace
[ 2774.709388] ==================================================================
[ 2774.716821] BUG: KASAN: use-after-free in vhci_hub_control+0x1b6d/0x1be0
[ 2774.723680] Read of size 4 at addr ffff8801cd42c3bc by task syz-executor5/27959
[ 2774.723684] 
[ 2774.723703] CPU: 0 PID: 27959 Comm: syz-executor5 Not tainted 4.19.0-rc6+ #48
[ 2774.723714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2774.723719] Call Trace:
[ 2774.723754]  dump_stack+0x1c4/0x2b4
[ 2774.755665]  ? dump_stack_print_info.cold.2+0x52/0x52
[ 2774.760873]  ? printk+0xa7/0xcf
[ 2774.764166]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
[ 2774.768947]  print_address_description.cold.8+0x9/0x1ff
[ 2774.774323]  kasan_report.cold.9+0x242/0x309
[ 2774.778746]  ? vhci_hub_control+0x1b6d/0x1be0
[ 2774.783261]  __asan_report_load4_noabort+0x14/0x20
[ 2774.788202]  vhci_hub_control+0x1b6d/0x1be0
[ 2774.792541]  ? vhci_hcd_probe+0x240/0x240
[ 2774.796701]  ? kasan_unpoison_shadow+0x35/0x50
[ 2774.801296]  ? kasan_kmalloc+0xc7/0xe0
[ 2774.805194]  ? __kmalloc+0x31c/0x760
[ 2774.808916]  ? kasan_check_write+0x14/0x20
[ 2774.813161]  ? do_raw_spin_lock+0xc1/0x200
[ 2774.817403]  ? usb_hcd_submit_urb+0x6fc/0x20a0
[ 2774.822013]  usb_hcd_submit_urb+0x17bb/0x20a0
[ 2774.826524]  ? vhci_hcd_probe+0x240/0x240
[ 2774.830692]  ? usb_create_hcd+0x40/0x40
[ 2774.834681]  ? do_syscall_64+0x1b9/0x820
[ 2774.838755]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2774.844131]  ? __x64_sys_ioctl+0x73/0xb0
[ 2774.848198]  ? do_syscall_64+0x1b9/0x820
[ 2774.852268]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2774.857642]  ? ___might_sleep+0x1ed/0x300
[ 2774.861794]  ? lock_release+0x970/0x970
[ 2774.865792]  ? arch_local_save_flags+0x40/0x40
[ 2774.870398]  ? __mutex_lock+0x85e/0x1700
[ 2774.874494]  ? plist_check_head+0xea/0x150
[ 2774.878740]  ? __lockdep_init_map+0x105/0x590
[ 2774.883244]  ? __lockdep_init_map+0x105/0x590
[ 2774.887754]  usb_submit_urb+0x893/0x14e0
[ 2774.891853]  usb_start_wait_urb+0x13d/0x370
[ 2774.896187]  ? sg_clean+0x240/0x240
[ 2774.899835]  usb_control_msg+0x332/0x4e0
[ 2774.903911]  ? usb_start_wait_urb+0x370/0x370
[ 2774.908415]  ? __sanitizer_cov_trace_const_cmp2+0x18/0x20
[ 2774.913980]  proc_control+0x99b/0xef0
[ 2774.917819]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2774.923371]  ? proc_bulk+0xa70/0xa70
[ 2774.927106]  usbdev_do_ioctl+0x1eb8/0x3b50
[ 2774.931369]  ? processcompl_compat+0x680/0x680
[ 2774.935958]  ? futex_wait+0x5ec/0xa50
[ 2774.939799]  ? mark_held_locks+0x130/0x130
[ 2774.944052]  ? __sanitizer_cov_trace_switch+0x53/0x90
[ 2774.949256]  ? drop_futex_key_refs.isra.15+0x6d/0xe0
[ 2774.954373]  ? futex_wake+0x304/0x760
[ 2774.958189]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2774.963751]  ? check_preemption_disabled+0x48/0x200
[ 2774.968780]  ? debug_smp_processor_id+0x1c/0x20
[ 2774.973466]  ? perf_trace_lock_acquire+0x15b/0x800
[ 2774.978415]  ? perf_trace_lock+0x7a0/0x7a0
[ 2774.982668]  ? mark_held_locks+0x130/0x130
[ 2774.986924]  ? do_futex+0x249/0x26d0
[ 2774.990643]  ? kasan_check_read+0x11/0x20
[ 2774.994814]  ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160
[ 2775.000101]  ? rcu_bh_qs+0xc0/0xc0
[ 2775.003651]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2775.009202]  ? check_preemption_disabled+0x48/0x200
[ 2775.014231]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2775.019784]  ? check_preemption_disabled+0x48/0x200
[ 2775.024821]  ? __fget+0x4aa/0x740
[ 2775.028285]  ? lock_downgrade+0x900/0x900
[ 2775.032451]  ? rcu_read_unlock_special.part.39+0x11f0/0x11f0
[ 2775.038255]  ? smk_access+0x53b/0x700
[ 2775.042071]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2775.047612]  ? smack_log+0x423/0x590
[ 2775.051333]  ? smk_access_entry+0x310/0x310
[ 2775.055682]  ? __fget+0x4d1/0x740
[ 2775.059165]  ? smk_tskacc+0x3dd/0x520
[ 2775.062986]  usbdev_ioctl+0x25/0x30
[ 2775.066656]  ? usbdev_compat_ioctl+0x30/0x30
[ 2775.071074]  do_vfs_ioctl+0x1de/0x1720
[ 2775.074976]  ? ioctl_preallocate+0x300/0x300
[ 2775.079410]  ? smk_curacc+0x7f/0xa0
[ 2775.083055]  ? smack_file_ioctl+0x210/0x3c0
[ 2775.087386]  ? fget_raw+0x20/0x20
[ 2775.090848]  ? smack_file_lock+0x2e0/0x2e0
[ 2775.095105]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2775.100836]  ? security_file_ioctl+0x94/0xc0
[ 2775.105262]  ksys_ioctl+0xa9/0xd0
[ 2775.108733]  __x64_sys_ioctl+0x73/0xb0
[ 2775.112643]  do_syscall_64+0x1b9/0x820
[ 2775.116554]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[ 2775.121924]  ? syscall_return_slowpath+0x5e0/0x5e0
[ 2775.126858]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 2775.131744]  ? trace_hardirqs_on_caller+0x310/0x310
[ 2775.136769]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[ 2775.141796]  ? prepare_exit_to_usermode+0x291/0x3b0
[ 2775.146823]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 2775.151681]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2775.156874] RIP: 0033:0x457579
[ 2775.160076] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 2775.178985] RSP: 002b:00007f830ad40c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 2775.186720] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579
[ 2775.194001] RDX: 0000000020000000 RSI: 00000000c0185500 RDI: 0000000000000003
[ 2775.201281] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[ 2775.208552] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f830ad416d4
[ 2775.215837] R13: 00000000004bf6c0 R14: 00000000004cf598 R15: 00000000ffffffff
[ 2775.223121] 
[ 2775.224746] The buggy address belongs to the page:
[ 2775.229681] page:ffffea0007350b00 count:0 mapcount:-128 mapping:0000000000000000 index:0xffff8801cd42cdc0
[ 2775.239486] flags: 0x2fffc0000000000()
[ 2775.243389] raw: 02fffc0000000000 ffffea000625b308 ffffea0006064e08 0000000000000000
[ 2775.251277] raw: ffff8801cd42cdc0 0000000000000002 00000000ffffff7f 0000000000000000
[ 2775.259156] page dumped because: kasan: bad access detected
[ 2775.264861] 
[ 2775.266484] Memory state around the buggy address:
[ 2775.271417]  ffff8801cd42c280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 2775.278784]  ffff8801cd42c300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 2775.286145] >ffff8801cd42c380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 2775.293499]                                         ^
[ 2775.298691]  ffff8801cd42c400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 2775.306054]  ffff8801cd42c480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 2775.313408] ==================================================================
[ 2775.320771] Kernel panic - not syncing: panic_on_warn set ...
[ 2775.320771] 
[ 2775.328147] CPU: 0 PID: 27959 Comm: syz-executor5 Tainted: G    B             4.19.0-rc6+ #48
[ 2775.336807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2775.346159] Call Trace:
[ 2775.348784]  dump_stack+0x1c4/0x2b4
[ 2775.352426]  ? dump_stack_print_info.cold.2+0x52/0x52
[ 2775.357625]  ? lock_downgrade+0x900/0x900
[ 2775.361788]  panic+0x238/0x4e7
[ 2775.364986]  ? add_taint.cold.5+0x16/0x16
[ 2775.369165]  ? print_shadow_for_address+0xb6/0x116
[ 2775.374103]  ? trace_hardirqs_off+0xaf/0x310
[ 2775.378522]  kasan_end_report+0x47/0x4f
[ 2775.382502]  kasan_report.cold.9+0x76/0x309
[ 2775.386838]  ? vhci_hub_control+0x1b6d/0x1be0
[ 2775.391343]  __asan_report_load4_noabort+0x14/0x20
[ 2775.396283]  vhci_hub_control+0x1b6d/0x1be0
[ 2775.400618]  ? vhci_hcd_probe+0x240/0x240
[ 2775.404776]  ? kasan_unpoison_shadow+0x35/0x50
[ 2775.409363]  ? kasan_kmalloc+0xc7/0xe0
[ 2775.413260]  ? __kmalloc+0x31c/0x760
[ 2775.416981]  ? kasan_check_write+0x14/0x20
[ 2775.421242]  ? do_raw_spin_lock+0xc1/0x200
[ 2775.425673]  ? usb_hcd_submit_urb+0x6fc/0x20a0
[ 2775.430271]  usb_hcd_submit_urb+0x17bb/0x20a0
[ 2775.434776]  ? vhci_hcd_probe+0x240/0x240
[ 2775.438936]  ? usb_create_hcd+0x40/0x40
[ 2775.442918]  ? do_syscall_64+0x1b9/0x820
[ 2775.446988]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2775.452374]  ? __x64_sys_ioctl+0x73/0xb0
[ 2775.456442]  ? do_syscall_64+0x1b9/0x820
[ 2775.460511]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2775.465884]  ? ___might_sleep+0x1ed/0x300
[ 2775.470042]  ? lock_release+0x970/0x970
[ 2775.474041]  ? arch_local_save_flags+0x40/0x40
[ 2775.478635]  ? __mutex_lock+0x85e/0x1700
[ 2775.482702]  ? plist_check_head+0xea/0x150
[ 2775.486946]  ? __lockdep_init_map+0x105/0x590
[ 2775.491451]  ? __lockdep_init_map+0x105/0x590
[ 2775.495962]  usb_submit_urb+0x893/0x14e0
[ 2775.500062]  usb_start_wait_urb+0x13d/0x370
[ 2775.504402]  ? sg_clean+0x240/0x240
[ 2775.508060]  usb_control_msg+0x332/0x4e0
[ 2775.512135]  ? usb_start_wait_urb+0x370/0x370
[ 2775.516638]  ? __sanitizer_cov_trace_const_cmp2+0x18/0x20
[ 2775.522192]  proc_control+0x99b/0xef0
[ 2775.526022]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2775.531574]  ? proc_bulk+0xa70/0xa70
[ 2775.535307]  usbdev_do_ioctl+0x1eb8/0x3b50
[ 2775.539555]  ? processcompl_compat+0x680/0x680
[ 2775.544152]  ? futex_wait+0x5ec/0xa50
[ 2775.547967]  ? mark_held_locks+0x130/0x130
[ 2775.552222]  ? __sanitizer_cov_trace_switch+0x53/0x90
[ 2775.557427]  ? drop_futex_key_refs.isra.15+0x6d/0xe0
[ 2775.562538]  ? futex_wake+0x304/0x760
[ 2775.566349]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2775.571904]  ? check_preemption_disabled+0x48/0x200
[ 2775.576936]  ? debug_smp_processor_id+0x1c/0x20
[ 2775.581610]  ? perf_trace_lock_acquire+0x15b/0x800
[ 2775.586551]  ? perf_trace_lock+0x7a0/0x7a0
[ 2775.590798]  ? mark_held_locks+0x130/0x130
[ 2775.595056]  ? do_futex+0x249/0x26d0
[ 2775.598779]  ? kasan_check_read+0x11/0x20
[ 2775.602937]  ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160
[ 2775.608219]  ? rcu_bh_qs+0xc0/0xc0
[ 2775.611773]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2775.617320]  ? check_preemption_disabled+0x48/0x200
[ 2775.622347]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2775.627894]  ? check_preemption_disabled+0x48/0x200
[ 2775.632950]  ? __fget+0x4aa/0x740
[ 2775.636411]  ? lock_downgrade+0x900/0x900
[ 2775.640573]  ? rcu_read_unlock_special.part.39+0x11f0/0x11f0
[ 2775.646374]  ? smk_access+0x53b/0x700
[ 2775.650189]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2775.655747]  ? smack_log+0x423/0x590
[ 2775.659481]  ? smk_access_entry+0x310/0x310
[ 2775.663810]  ? __fget+0x4d1/0x740
[ 2775.667277]  ? smk_tskacc+0x3dd/0x520
[ 2775.671100]  usbdev_ioctl+0x25/0x30
[ 2775.674737]  ? usbdev_compat_ioctl+0x30/0x30
[ 2775.679156]  do_vfs_ioctl+0x1de/0x1720
[ 2775.683062]  ? ioctl_preallocate+0x300/0x300
[ 2775.687479]  ? smk_curacc+0x7f/0xa0
[ 2775.691147]  ? smack_file_ioctl+0x210/0x3c0
[ 2775.695490]  ? fget_raw+0x20/0x20
[ 2775.698965]  ? smack_file_lock+0x2e0/0x2e0
[ 2775.703251]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 2775.708798]  ? security_file_ioctl+0x94/0xc0
[ 2775.713217]  ksys_ioctl+0xa9/0xd0
[ 2775.716681]  __x64_sys_ioctl+0x73/0xb0
[ 2775.720577]  do_syscall_64+0x1b9/0x820
[ 2775.724492]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[ 2775.729882]  ? syscall_return_slowpath+0x5e0/0x5e0
[ 2775.734817]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 2775.739682]  ? trace_hardirqs_on_caller+0x310/0x310
[ 2775.744708]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[ 2775.749754]  ? prepare_exit_to_usermode+0x291/0x3b0
[ 2775.754809]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 2775.759667]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2775.764867] RIP: 0033:0x457579
[ 2775.768069] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 2775.786971] RSP: 002b:00007f830ad40c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 2775.794703] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579
[ 2775.801978] RDX: 0000000020000000 RSI: 00000000c0185500 RDI: 0000000000000003
[ 2775.809263] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[ 2775.816537] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f830ad416d4
[ 2775.823808] R13: 00000000004bf6c0 R14: 00000000004cf598 R15: 00000000ffffffff
[ 2775.832198] Kernel Offset: disabled
[ 2775.835850] Rebooting in 86400 seconds..