f98a9a35c5bef65149621818d5c2c4430602f5791ac9b84169ebbbfdce317052387e8d758e1731f15ed312ab247d41d5c586bb5457c50f4e4f51d25350a73bb79f500d4ff8f0d37bdabc00b07d51ff747b2d211e4273c9b2a727072a6f0f9493a81ec6e486fb63b580b2432e0a2eb00b45d5e511a8aee502968f6324dc4c1d24946455ed76ac3a9e85abf35f2c6f6fd1c867bb5315b9574c3c0f8ec961b88d372887218badd9014fe8cfcc74990d2aea1ba2458eca811f706a24a8a185c115a64930e4354c6de8051685902836e874caa687969f4d7d4ecbd12a7a5753032fb5edd283ef6bb31e8cec80834eff8f1d3a183a0c81cbd6ac46ce3b51a9ee1304cfb3cd6c058237dd513d06b02aa67cac4ebc9eb261f931dd5c61403f3735235ce6684e7a8ef59503a23209741a88ab2b5857ee7cea68f96f4dd9464abecd793aef70a2a74200ebba50531bd6df768c56e5b3a38908d7eaf26124131c250448447dca4e0e5d33109447aed072176edaaf0b921a2024a5c0bed75f794a8b15180737b69beeb9fd80cbc6a4c6f7c1228ca80ba2cc6f8540539fb003811988237969bc4e65430f3afac97c8dabec9c1041a3de7ecee96485b3e3ce064f57a5bce3a3d51f14b523165ea4608f39bc0e44d28052dce2ec26e786b0c292607aa05d499ba6e5758502ea4b1604040a00e754b9eeb64fb06ccf5d6dac7512000c5891b87f788773a35bb8d30fb62d9bd0c07cadb773427d49c18e17254e0da83be32c35924838826c266f5f9dee2b7cb5ffbe1998c9ebb19a9ec86bd14084f7153a259241a8459e52f8fbfa37dac6bdd6e525308f22d609de22a4555a126601240f6e6f5340604dd94ec7ce4c3bc33c3bf1e7c88b5a70cfb72926fb61fe235ade3048df3ce77a1f8fae3be7c20daa62146ef866fddcbe71e0367efccf1b28872", "e34376bb01c687613df7a6c044186ea12edd4d97f739572f4ad60a394d65b9bb4e55bed45a3605fe9796470597d51c46cfef9bb04266dd20b614aefe25e984a620714b722c062c32215366e85cf970fbd2b641e90c8aabc3187520392d362afe1e1174d714c0a986ead8544de849565bca29b1add027ddcd85379ead63d5681924400a426b2962f662c3bc3adc072dba10038dfcf21b9a3be2b7f08a5c408f2eddf76ac7fa0f641e6f8bdc1084614c932dc59e242101edfa840f6161867c4f829f032f0421f505a81a69729263bda8c0aae1fdf12bfd280951aad8c0273611544bef3a8fb5ebcce3a9d93f7a76556db742784c5e709f8979b35ab43f520e1d823467e8f55b3f122395d12370f66a0d4bf43f7daf4c8e4536884f39d882955cf2e90b812e7dcb6a6074c4c4115ac45264ab077660d6a59311eb0c8ddbad48279db94a59599ce13eeadd21611e7a38114f27da9d126a810c662d218c7781de300696969c951aff3a575be150df03ef3b443b06fe626d5c1ce8c3cb3d49c8431891991c1afd00028dc8148d2a396d4822911e510e3904d9a1cd038beac3e4e1dcc7747e5ae64d20bf4b9b22f79099d28b2e1941f27093efe53ee5c0acddd60d7dd48ab63dd85add8f1df6e6e81e6d8e462bfad32a04a13ad778fcfb44f551958001e52e6924b492f322e73461a3202218abe0e9ab5338a17289f7b129b1ce18af92d2c7d1328eff5e2cf75fc692aea461257561c786d8868467c5bc3235b0ec500380fb445b43380b29f94583fd97a112e4a791187da00f3a208056fa71f45f52463223a96f5bba640f31c6b3af229dce967b8531775d03d10bdb8faad3c301bef5929d969fd8f1e2495ed4e2d190ef805fe4e32e94ce712f842e651a9d44bdaa899afada5998735bb37e0bd1d51fe48ae78134cc5d63dd2243dcc38b5023f2ef42036ac43b3f310cc2216a7346bd54ddae7db6686771f9e4d8c0bb5b25c7c4d0aa408e1807303d76d017390e94262c6848fd3c640e0037aa155494934cf4d6a76b6b0416962d0331393cb93520fc7e4f9005732b5c404ecdd5d9d8bfbee4b051f5a24ab1a5639dc0e115d4c2ad131aacdd5870ecf3337cfae23c59c14c0efe270129a466e97cde2f9fd1374e95f358adfae47eec70596c415dd4d106aa33a9f55dd3e220cd686cf3e4fac0d171c7621695be7f82190ee434176ae60606bd402003fe647b8db76f2766ddfeffa03dd14db334104ce32d1e286b9998ad6566ece16a6b6611ab5f38d2a349f376756197215691115ab1ff2b8446c00ce77f1d46824432da8e683fa2c8ff653ee106883541161da17c2ebc4b983ae4aee1f525ee5b7345194b8267ab5140b9119b5f1402080cb03ff086644d25399b5583d7d83fbe0164183964108dffbfa27ece01941768c5bc793d1b70ced134c5267d1a02d845c40f6059787c009a69f8d169599070df6a3794ba459548dba6a2c1b299bb90ef3693964946d1c399f0c825782fdb552a21d553a9072353562b9a152d9f2b735a93284ea3a1024c8e2992357526cd4b54d6477f35586fdbf6eb9523719f8977f5e85c90b110196d112c763079b5aa1f659564c5ea53143cd7ec220f34b08d8dd4ceae796b901b394721b01c95450679d189fb83e3b2bb9a5952fa44646bd4b4de54793a80b66c633bb60d74bb091cecddfdc96352ec6c10ada38f0f11a508472ad4b4b44055209f94f60fc77f71e4a54e405773ae19f496307fa5d3aee01cbf8ba3068a9889f9c001a3456d2aa2bb62263f3631769d4233d1dc822ecff2f3835a6b3080b57d4c7c91f39e396c3a6fdf87c37a78c7ca7261d85a2554f6301d611a1ff84f9ceb820b19f3e0b155d8c624d9ec73f7a4497e7cd9ee855c726d0582c09626ecead60b558c92e5d036291e7b045f0654aae3efd022670152f459d61e41f620f92498f52fbc0bbf58d184ba36544e584884e58d144f4e86377d88b3d2218e3acbaf663143dba82471a527083b88b84c9be9c4fd5d971bf3b6c6c8effcd6a56b1b514c1fae7e5312cbb52cceea499dd3fb548f9ba07aa59c137a79493cefdb6245f1095b93778aa28eb04f7756fa5fe401976e73480a2e8ebd2ce65ec50fb9a6691f0d52c63a79721c4810783d151cb4613c97b47e07c1b02cec48e83ea65819c59ab53f0a33361a64355827349a780cacaf71c8e4b776a1802e9129ca53ccddc6fb2e76c3a1926cc0b30b32266dca5ee9d50138a745b54863882d1784263d05ac5cb5d67e3b7b6d545d06846d487d1064075aa5dd8952b862ea3902644014c060cc27e389391b396bab84c9b589788bdb3eb9e1d1d65fcc72f18c15a96de8e4a28f55a826041873ff6658dddef4f6e2e3d3d3b9886f76be5111d19b63ceb107ef3ceb118c862a5168dc941444d21e24a174c02715991377846a3ea3c4d2a52d840c6efcaccdf1d515c92598afd154a14c99064532809a9ad73e3edd4b24a9d85092b3a7bb6aba4a2302335f2f4f0a3d8a1bdaa7ac1934bed7871dc456918f573517a8faf03414366b360834c63c70bc6bb106c5edaec2462c0a3d9f51094f2c4c02d0105ddbc63d21f21237770bab3f8be0efc5a64347661aa0d0cabec97455f772cfc1394b8a22720544903ec35c6f7b499ee8a75abdaa3c46518adfd878fec5e153d637d0288b249d59198a27bb8d872b3f89bce45e6f2f9bc8e5e3d582c828c6c0c4fac4b611224ab7b1ee96e0e089eb0dd182158a75e66c6cda9e741ae3ccbade28461a5446f57b2f4ca0c3d505b1d32cbc33f4887c45c1b3b2563bf317483a6af0e420596c49082575f8122beeb16999824cfb5329539d7df7b93e0c2050b3cb4921dba40c40ff477966047044c1158f103fd65e7111ecf22f36d5ba268ed63a8925002b00730456070df3658babc4b2497595d128b0e57f4524a19eb6ad750c9a3d775050f67c81939ab1ed50c4ba75191b8b6984690750d84731b1145f9832b6ff20b663af2b190de0da7dd5918e274ec9fbfbb60ebbee833796dd21093089a81bde7521e0946d862557e525ae36a9388ead71a8b9b6c6246d56048188b6a1022a4f501f233aceee53ae346b9d2aff680aaf0d199950623cd72c9c8c3c3ec28b0cfe82ded3ecf1da221c857eea265fbcb299d2b7312e7e938cb58335d2d9b7b5f64f2df327ca8b693bcfc7ce56021b3bc644eccb5dd61ecee2e1f7cd7d0712c087656f5290ab7b5bebb021eff3246d53b99899f61d119bab48170b6080ad261c976928c64ea501360255f95b9a4efe50223978af6bb2a71adab321e9971ac15f16676be6f1d57d2f177842eb4fb3bb3f1bd712288f3459cdb844893de377623084d6d68d869c678027526e3b303940dfcf34de8eebccef6f9f6f32b2ed39891782dd3267ec17efb4bfa85349d310f67657dd24a22b1d34bf8f748431277e47071354eb929bcced3e2f18969061787c474571b56bbff3058cb7c7032bdd6dec39b394d2801fdee0a1ff339c17d6db276ae6caa8bf242477d0b39a1a4a603efd978cdb24f7548b4808bb47420b601162749a54bf5c8fefb06e3ebd97f09516c716007c550f1615870d65c2c180b98bd894d611da55bffc8519d00694eeaad24db46d0ede8f724d5e3b6e1d1cbd33ac6a5a1020e56d8701575772f56d4295043fe2707ca5c1b89027a02d05a2d353319c0e5a6990be846ecd376e2398939f1afddc1ac0e35227d7aec0d228884b527388a107e247e77979cc9e56e178fd126bc266dffb34519241d3fd6305fadd77a082ffad5406e24c6c5c14565e5e01bedfaa33eda72e1b1eadb1cf707cc549eb9c9763927dd8549aeca43470e12df529942e7c68fcd46496d901e567359d95b904bbb535af4be03b0e611838dd55a5485f8442495beb885491ab9d2898bfc98109778b44fd83dead1aafb55ec0c9cac202138cc3eb73e2975dde031c7229351a947ed1c60e96ee5f79515e3a014ffebf7c16e59259f0ae41b0d7a83555857e150a8e004d40c510bef0e1eaf0f253ee96ea6260a93d130d38136b932639c3c344b14005265d470397d75f098124d31fda66f22373c9bc206affcab9e88f128cb80c6eb774b4b60064c382f7d7de8909f9798f1f0b2fa8968c7aafcef3503d134c10bbe59f57ab9f033a5caeb185ee92f839ff9966193bf8b8ca9c738d9849adb57a1fc60a00d0be50787b6913fabaa8c14ecd1b39680a5ff1026ccb87de1c5d2f6a73fdb0478abf308649a15499e88ace431c3e93671638f72bc320c08b2628b53ed6db206dfe17a688513a11adcae747c8118ae02f901eaa9b59dfcef5512a423e4a59fe785633d69ce996ca209e06a206ce3266988eb6cd401a5192d61926dae6e7fcaf3b1814d2b9818b43509fe5bd13a11adb7137199b06f89c3232feb4fff85ffdb5689aa3fde881aa51bd2958da0bc840827b6c5e191fe4c4cc43a58daab3fbc8344e1f7b1def199ac07c7ebd5e05c0dcc55344284ec2fef015f39bbcb663d49f3ff09d3098e4d222c36192d3178bf22b61451863302bda89b3535842c494475a02f6d7bf6786010a96262ce8c8b2563986ee52f895fe384d929b460d1b49f0d5fd815084d9bea0c3adffdc2ec9f1d052f8e5981c010484aca64f775f2a5143c992994a63a5543f197f1e8ce5086072c3834f881dc55857c1b7d6f6b684df2ca308b9842b0b4fcfc9c0fbea7abe71bab255d3dded0dd88150cb67b5570b5ebc03e1b179cac42e58522ee77b61855e2830589ac46ca67d56a923031a20ef349ee6185e50e5344bbb575dfbfdc0b6138522e8284b3100dbeb9e1d7af244ed59dd8e4e186acbd76b7d1fc61c41640ac1988d2125fc612bf4984ff045fa93c7ed050d1c8b6402192facefe368e232a719c47ddc53fed6430377f85b8724d78457901989a949b03b8f355cae877333a8b6b7ba24bf1742bf3140e99aa9b2e4f5376acbee3defb6bb17f5102b1ba53f86aa69fb05a617ddff898c9413ea12283f84d670aaa3859c565eb2363195e26f982aeba9e2ce92032d41c7ccb1c9cc415f27267dc4540dd99640c26bbb727eb70451fb650c1219762d771b57a8dd5919e4326e6bf9e0930e745679d6e9b3f2849b279c4f6af7ea71f5874f18de551031a05b3a499e56b26af5f7b86857edea62e900bf7f16a87dfb808d2b894cae2640fe006d839a3f5c21cde971b6bebb81954abb8b4327ddce370cf2bc0ff5df421b4af1bd47c93a39ce1aad80dba08f2ab8a76807e07f54a4ff0811ccdf22e11ce22b061679e676f6fbbec4adc9b684dffee34c981295f50763cf2054019f53141ee7a37fec09433a3531d9cc0065196611e9b5132f1f32663d78ba080a04c7d85ba35a49a9eca2d6b0c1d1ab50f5a6bd2ab332b038b6c307b5c831e766898ad7a603df85eda0ba8df9892e4c5ef2ddb195f4b661ad6b164ca2d7ce8d5406017f9901f427f9e75d96f235cd3ac856840c220bb485675092fc9413f902202661131cd6def12fe9b55a8fc535a1ce376a3a1892121fbd98277377c34db96f3e4da46e4115a4c7389bd4884a4f56ec853729e5b1b9b3c256772c69f94f3a3d1e73138df307be6cf5a1a793666445ebf77140c87a732215e28da7e04c7156a3debab01aec464e203fcf39d94bc4692adb20a2d3f6b029fea231a8f7d6aa63ca44a9c8cd57c0dbe72bffc1dfce4c3f1a1de1b71edf7f31a11105a4662aca28bc4560ad2dfeefc32fba84347f6d25a9eb73e6f9807468d826fcea7919b339c906d71a7d4282444b39e100734345fd8e96edfdbe"}) [ 1520.875633] FAULT_INJECTION: forcing a failure. [ 1520.875633] name failslab, interval 1, probability 0, space 0, times 0 [ 1520.887204] CPU: 1 PID: 29389 Comm: syz-executor5 Not tainted 4.20.0-rc7+ #15 [ 1520.895009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1520.897017] Call Trace: [ 1520.897017] dump_stack+0x173/0x1d0 [ 1520.909226] should_fail+0xa19/0xb20 [ 1520.909226] __should_failslab+0x278/0x2a0 [ 1520.909226] should_failslab+0x29/0x70 [ 1520.909226] __kmalloc+0xb3/0x3a0 [ 1520.924845] IPVS: set_ctl: invalid protocol: 47 224.0.0.2:0 [ 1520.909226] ? kvm_io_bus_unregister_dev+0x294/0x4c0 [ 1520.909226] ? kmsan_get_shadow_origin_ptr+0x108/0x3e0 [ 1520.909226] kvm_io_bus_unregister_dev+0x294/0x4c0 [ 1520.909226] kvm_deassign_ioeventfd_idx+0x6bd/0xac0 [ 1520.909226] kvm_ioeventfd+0x4b9/0x6a0 [ 1520.909226] kvm_vm_ioctl+0xca9/0x2c00 [ 1520.909226] ? __msan_poison_alloca+0x1f0/0x2a0 [ 1520.909226] do_vfs_ioctl+0xeeb/0x2c80 [ 1520.968675] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 1520.968675] ? security_file_ioctl+0x92/0x200 [ 1520.968675] __se_sys_ioctl+0x1da/0x270 [ 1520.968675] __x64_sys_ioctl+0x4a/0x70 [ 1520.968675] do_syscall_64+0xbc/0xf0 [ 1520.968675] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1520.993939] IPVS: set_ctl: invalid protocol: 47 224.0.0.2:0 [ 1520.968675] RIP: 0033:0x4579b9 [ 1520.968675] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1520.968675] RSP: 002b:00007f7854240c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1520.968675] RAX: ffffffffffffffda RBX: 00007f7854240c90 RCX: 00000000004579b9 [ 1520.968675] RDX: 00000000200000c0 RSI: 000000004040ae79 RDI: 0000000000000004 [ 1520.968675] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1520.968675] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f78542416d4 [ 1520.968675] R13: 00000000004c0994 R14: 00000000004d21a8 R15: 0000000000000006 [ 1521.069247] kvm: failed to shrink bus, removing it completely 14:47:05 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:05 executing program 0: r0 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x0, 0x2) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) epoll_pwait(r0, &(0x7f0000000080)=[{}, {}, {}], 0x3, 0x2, &(0x7f00000000c0)={0x10001}, 0x8) ioctl$TIOCEXCL(r0, 0x540c) ioctl$VIDIOC_STREAMOFF(r0, 0x40045613, &(0x7f0000000200)=0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, &(0x7f0000000180)=""/112, 0x70, 0x40000020, 0x0, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000240)={0x200}, 0x4) ioctl(r1, 0x1000101, &(0x7f0000000740)="0a5c1f023c12628571907051b8625830553534cf2d94530808b675b81e7293ec0b00be81d0ac781eb2a8832a8e869df479bdff9b1f5fe239d9366b6208a5aaa382008471f7b0442d61e8ea6c53e4599c207ef4b5185b4e494a05f33b4ce05c2b92636f1b8845530231f29fa11aabd4adcf980f21d9422ef9d9ae9ec7eea61510362affda71181d97524615184ac7e7ecbda261df435f557a2c807ad54b7b1f148b099227de9b8a621e51f5144027ec1cce8c65f724cebaa743d40be838c28370956dba854978587fd1a1a58c64d5b925555c2df1f3963483a523c0ff0b7759c3973828b592925375575dd9e2b8bee77d1d855bbd258aa8f383320726cc8f4915b3ffe16aa1a499f3d850dd14f6723cd3fa23070e411e60734524d160544e0635d0575b94d06eda979d85e284ef10fa210fb0169811f2df8f1de4bdedcaf04a97077696047525ac9be58e842ea4dca44ecb75dd4ee986517a993f541ac97f01d1e8f0a481eba78111941d4e8ed08e04abdf0701b6f0358b59bda263939fae00000000") setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000002c0)='irlan0\x00', 0x10) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000280)={0x34, 0x0, &(0x7f0000000300)}) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00'}, 0x2c) 14:47:05 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:05 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000080)={0x0, 0x200}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000100)={r5, 0x7}, &(0x7f0000000180)=0x8) 14:47:05 executing program 5 (fault-call:5 fault-nth:2): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:05 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:05 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, 0xfffffffffffffffe, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:05 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r1, 0xae45, 0x6d16) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) eventfd2(0x7, 0x1) 14:47:05 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:05 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = accept4(r2, &(0x7f0000000080)=@ipx, &(0x7f0000000100)=0x80, 0x800) ioctl$PPPIOCGFLAGS(r3, 0x8004745a, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) 14:47:06 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x84, @empty, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x82, @multicast2, 0x4e20, 0x2, 'wrr\x00', 0x1f, 0x1, 0x7a}, 0xfffffffffffffc6c) 14:47:06 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0xfffffffffffffffd, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:06 executing program 3: r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x100000001, 0x30900) ioctl$TIOCEXCL(r0, 0x540c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @loopback}, @in6={0xa, 0x4e23, 0x7f}, @in6={0xa, 0x4e24, 0x3, @local, 0x8000}], 0x48) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4c, 0x66a0000000000000, r4}) memfd_create(&(0x7f0000000100)='{/vboxnet0\x00', 0x3) 14:47:06 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) connect$unix(r2, &(0x7f0000000080)=@file={0x0, './file0\x00'}, 0x6e) r3 = syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x0, 0x2) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, &(0x7f0000000180)="66b82f2c00000f23d00f21f86635200000050f23f8f7b334bc2e3e0fc72c66b9dc0a000066b8ce61000066ba000000000f30e1000f210c0f01cb0fd17ea73e0fbc870090b8d4000f00d0", 0x4a}], 0x1, 0x19e947ed3f33cc6a, &(0x7f0000000240)=[@cr0={0x0, 0x11}, @dstype3={0x7, 0x4}], 0x2) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) 14:47:06 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:06 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x2, 0x2) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x40, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000001c0)={0x0, &(0x7f0000000140), 0x4, r2, 0xa}) r3 = add_key(&(0x7f0000000240)='big_key\x00', &(0x7f0000000280)={'syz', 0x3}, &(0x7f00000002c0)="755296865a48334470e35e6bc8bba377aa4a574ea167b752cf125eac9661c3a2bfe06165fc799da0258c26a73578af5a180c6a41e931749b008c3448bd9e2d9e2a4838965aeccc6bfce36c08ab7cd57a52011a050e9339ad3da2674186c2a43b5558039169cda563dcd0895a579eccf3c40ea75f522f35b2053192e24dc38dc04731e31493fa5ff3bcf5e74c2ad4eda10a2ff7a32f", 0x95, 0xfffffffffffffffa) r4 = add_key$user(&(0x7f0000000380)='user\x00', &(0x7f00000003c0)={'syz', 0x0}, &(0x7f0000000400)="eef606cf", 0x4, 0xfffffffffffffffa) request_key(&(0x7f0000000440)='encrypted\x00', &(0x7f0000000480)={'syz', 0x2}, &(0x7f00000004c0)='&system#cgroupeth1F{,(Qcpuset}loposix_acl_access\x00', 0xfffffffffffffffa) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000600)={0xf000, &(0x7f00000005c0), 0x9, r2, 0x1}) keyctl$dh_compute(0x17, &(0x7f00000006c0)={r3, r3, r4}, &(0x7f0000000700)=""/101, 0x1f1, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r6}) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f0000000200)={0x4002, 0x0, 0x8, r1}) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f0000000000)={0x0, 0x0, 0x0, r6, 0x3}) 14:47:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) syncfs(r0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00'}, 0x2c) 14:47:06 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_script(r2, &(0x7f0000000200)={'#! ', './file0', [{0x20, 'TIPC\x00'}, {0x20, '/dev/kvm\x00'}, {0x20, ':'}, {0x20, 'trusted[em1posix_acl_access*C]posix_acl_access^posix_acl_access'}, {0x20, 'mime_type/(trusted'}], 0xa, "6a684dc51b867f969952321b464ffaa56d8e9e32177653a53a28777633b3a988822b21306a4e8483fc8a059ae4260f12bd38cf01fb63e0ec6f63bf"}, 0xab) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x440400}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r5, 0x200, 0x70bd2a, 0x25dfdbff, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x14) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) 14:47:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x40, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r4, 0x28, 0x2, &(0x7f0000000280)=0x6, 0x8) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, &(0x7f0000000180)="59f560bc64fd1a83d40c36779ca1fdd6fa2b3cd3dfcc33df26a3f838dda2895db685afa4cf78053a8cb47837cfe2f1a64a0a30a6826df4387b61ad3092f1f6ebd22c7f9ecd81c577fa6316beb760c604012c2284e2e65b12fafd7510e1088602d8419255c254ffb0181df66a05f559e8b4bf6ef82ad39cdb483c33c5239be5d6c585424d86537186c2f958afc6f5b0f20dcb10a4a8892a9ffb7fdfd9a2f031a3d0bd3b67ad14965dd71b9381e557f634951ac4837190e3e96cf1b539f3ebeb60bce7d7aba55bed298081bb268b5adbd2bec510") 14:47:06 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000080)='htcp\x00', 0x5) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00', 0x0, 0x5}, 0x2c) write$binfmt_elf32(r1, &(0x7f0000000180)={{0x7f, 0x45, 0x4c, 0x46, 0x7, 0x80, 0x1, 0x333, 0x0, 0x3, 0x3e, 0x6, 0x198, 0x38, 0x1a5, 0x23, 0x3f, 0x20, 0x2, 0x4, 0xfa, 0x100}, [{0x7474e553, 0x0, 0x100000000, 0x19, 0x81, 0x7, 0xe25, 0x1}], "df10", [[], []]}, 0x25a) 14:47:07 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:07 executing program 5: openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x763080, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) connect$unix(r1, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:47:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:07 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0xfffffffffffffff9, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) semop(0x0, &(0x7f0000000040)=[{0x0, 0x8000}], 0x1) semop(0x0, &(0x7f0000000080)=[{0x1}, {0x0, 0xffffffff}], 0x2) r3 = semget(0x3, 0x1, 0x61a) semop(r3, &(0x7f0000000140)=[{0x0, 0x7, 0x1803}], 0x2aaaaaaaaaaaac0f) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = eventfd(0x0) r5 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x7ff, 0x8800) bind$bt_rfcomm(r5, &(0x7f00000000c0)={0x1f, {0x0, 0x8, 0x5, 0x1, 0x0, 0x5}}, 0xa) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) getsockopt$packet_buf(r1, 0x107, 0x1f, &(0x7f0000000100)=""/12, &(0x7f0000000180)=0xc) 14:47:07 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x100, 0x0) ioctl$TIOCLINUX3(r0, 0x541c, &(0x7f00000000c0)) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={@mcast1, 0x4d, r3}) ioctl(r2, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000040)=0x2) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00'}, 0x2c) 14:47:07 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:07 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x2, 0x80) r1 = eventfd2(0xeda, 0x1) ioctl$KVM_IOEVENTFD(r0, 0x4040ae79, &(0x7f0000000180)={0x3000, &(0x7f0000000140), 0x8, r1, 0x2}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000001c0)=@assoc_value={0x0, 0xffffffff}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={r4, 0xa90a, 0x10}, &(0x7f0000000280)=0xc) r5 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r5}) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r5}) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r5, 0x4}) eventfd2(0xff, 0x80000) 14:47:07 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x141c40, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) eventfd(0x0) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x201, 0x0) ioctl$DRM_IOCTL_RM_MAP(r3, 0x4028641b, &(0x7f0000000100)={&(0x7f0000ffd000/0x2000)=nil, 0x3, 0x5, 0x8, &(0x7f0000ffd000/0x2000)=nil, 0x1}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000080)) 14:47:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") r2 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x100000001, 0x2) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000000c0)={0x7, 0x1, 0x8002}, 0xffffffffffffffba) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00'}, 0x2c) 14:47:08 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) r4 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x0, 0x2) ioctl$EVIOCGBITSW(r4, 0x80404525, &(0x7f0000000100)=""/60) 14:47:08 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x0, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:08 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x6, &(0x7f0000000400)="0a5c1f023c126285719070c82e7e1746e42d5eb4f1fc5870dfc45926dfbe861fad4560256e7434153ef3df60b8baf658b2076db8fae9c8d57528ed352afa109c68e651e9615d0761a7ee24e8a74963edea7fe3c82e22f969844e138a8e28084662bf39810c727ca81966ccd42274c4c4cc0226c170d89213377de31f3a36b9198919b05ea95be676b603fa42e51f26887150c210a4d71e9ef4636abf6bdc0730140ad6e4de881de553d0db2848340d4cbeab3fb5f1407c49d49e53e508a2df0f7cec2ad475cdd8a9210837097b2a49bd478a90b1aa06c3c3b8f250b9326255fbdc629787b031e9c8a3c03120a57c63e7eafe5f1765a1106a9562519202e39909c6e1cf2e43e542b55d916308c1e4e00c91af953cc76ae70f8a2e4c") setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00'}, 0x2c) 14:47:08 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:08 executing program 5: r0 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x5, 0x4000) ioctl$TUNGETFILTER(r0, 0x801054db, &(0x7f0000000140)=""/176) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x7ffffffffffe, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_pts(r0, 0x420000) ioctl$TIOCNOTTY(r2, 0x5422) ioctl$VT_GETMODE(r3, 0x5601, &(0x7f0000000000)) ioctl$TUNSETVNETBE(r0, 0x400454de, &(0x7f0000000200)) ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f0000000280)=0x3) r4 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r4}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r4}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000400)={'vcan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'rose0\x00', r5}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r4, 0x4}) 14:47:08 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x0, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:08 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x80000, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x0) write$P9_ROPEN(r2, &(0x7f00000000c0)={0x18, 0x71, 0x1, {{0x40, 0x1, 0x8}, 0x6}}, 0x18) writev(r2, &(0x7f0000002480)=[{&(0x7f0000000140)="9cbdecd7ae7d0ca43199eb5059047d5161c19e18007ff70131bb6a6393a8aaf4633e71387bdb939f50072ff95104ad7f6dc437b0b8a28bd34331fbaabfe63faaba6af4415a1cd32231e936c96343cdbbff96d54c04614f9e4d458c7475a3ed0e28c47e9a7f93739ec829856ae24c12446ee61b897d53fb90a0ff59c2bfa6d667794c8b82b6d604293b413e3d0a4931d9fe5e51c83f6652da6503547e22e244c1c1091b637db62c087bded28d7ebe95586d82a9ad4002b39bd19ab9f27469f4", 0xbf}, {&(0x7f0000000200)="5438c57cbd5cd4ae84b34f734990dd65d964c9327c7d10909e89ddff4a3d0a959a21131584fe4563245e498d13f37f5da8229f3dc75e6abf4994b031eb9280e78cc2fa4b5e9a8353a32014350bb6f1b434407de9a5841b654d94d8db309f81cb0f239bfc09fc9b16e17a7650e079f65fa15124eb3f53740190b3ea96ef6962aff07ed90d27fcf5af347e8ab0af713a5d1f1151fc3dcf478767f072f591e4b44e4ae52bb2fc04396e54d59a2d75f27a9473c965f95cefeb02dd96312adb75799e1306fbef071135698f559e26fda75c8dbda53933e411b860b89b1e9722d1e5cc6344623257b7d837f5a6", 0xea}, {&(0x7f0000000300)="4667790866cf361ec77a09f2a8f0c7c555619f0c8b1571255cdab8664d3de45c66ba6fe19d8d1a2c32ecea2a4270e6ba8af6b175f61d0347dd6b93b82285c7e80e7fad9ceff715f4", 0x48}, {&(0x7f0000000380)="d371af5a2b5b6e2f1bd4d5de4cc590e8f3130a723c14536c2604528993665ef6c458facb3fb40ba1efeb9cc605f2af4f596cd35afb35c48be3ef703b93aeaefb5fd14754c680bf4510de3371fb77777e7557362f52bb6fa514a28a417534511c1efcfba26f4b2e2735cd8e5da16f6933d7c0f4f046f2a652674a6422b32ebfa4d1e77d4522d930ebcdeea5f898adf71afb2e9bdeaa4939b04fcca887c24b4330134f3cddd0b81151cf18c20c5616faef2a1bdeec522267bb1968a5b2d1a5fd65ac6b4ac1f9710be61487f942d4e6f0ff73d4f4020b333c7d288ade1002c55b347b26f3144cd5b246f19774914467742b27358ca2c0b8e9477ab45d70ddace0bf12da04c989aa189a101aa6231d705a6cfe523044b299dd17dd5bd7897a1e5f4adb687cfecde2ffa8a4ec800fe56815e2aa13cb445c1d1ae406b91d184315824ed8376c1d9705cb5fadf705f53ad912d25aa85f5b4745de6767af1bfbd06536c013258822c2d3a2fc670eeee9dcf988f53d3231065961ff6368b2b634e1bcd4b6c8b09c258fc8beb57602476e1f4f44a11e47385ebe1838d23df2d9e54c0daf87cee6c58b480cf92a2f29d9d084b7fa77ae9effeb4e0b153162201500dc9e9d62df9d1170d10671b2a0441aa2b60a13513a4798bfb374067eb079805632c0e9ce96a4ffd07884d150832479e622372fea8a194cf1bba96370ec2bcb59a2fdc82cc646ccaf73a5854c8cdce7b527b6e4d665e6c54d10f1232000df51c4eb97794c15ee19f59a1439eaa2f2cdfce555d6c697184dd8648751e0463106ad41d2523f251afa85cf52cf8fdb24bc65f5aea93a705efe542c16b2674ea40df971d449e64409038bb6b575f93b3d8e68c0614d29d31d98c536163fc900b99781503bef4c4d38fe71bb6403ef4e0478bc26910b2e239b0a975a5453a2a4e63eda1dcd4ba473669bfedf7e5d49b07063d55cc38b24de04151847b8b20dccb96b4e04d5d41873a9416f377d324afef17eb66f45d17422d48e57637759d8fc0567ced176afe539b78cba99e460d36d5571190429dbe4fd3282aa19b135211c2cac3b3165674339c6f71caacdfa3289ae38226f9dedf348a5321ed1db619fb5318eb95b251b9041b0a8bfbf1cd737a7fa2225abdb97ec2109f12428d69161748102cfc1408952ec8b2c99ae17cd4378bbc34b15b5fd7a75b1bcba3eb899494439949a11d56ebc14752888fe45b1c382f5c82a69cc414838744db62494cd525512c6088720ab2992501b65a735bee3b581c87dea651e9a5f187c5a8ed54909a86c1cbbd1a8e0e4668fb9a29d25b3019aa9dc78b430a0a54dd2c2e344bde5c5f9cc6b343a92849e4a6726d7ebe9b4191cbba248488cca114aa5b09bd137e09afdb5255f7244fb9a25bffa1e20212ccfdb4474861e1618ce2d71164bd2d1b79dc6473bbe26b3b1a9cbc3bdcbb712db644af6fc30f32cdd16e139b24528c0fe5d529eae14c00cffcd9059150324438d01e4cfd445c46f7656d7d96f5c33c69b87b0285055e694aa2e9121da69a9fa261486ed672506f12b136c397de8421288b96e44146549dde1c3c04160305fc40526262ceebc51f5abd3a2dac338792265b2a3d3bab3c2e3195636516ae8ca5d7e7044220eab5d5ee74342df2980edf8160515bc2e0a4f3ca543b4599e4cac5d65242e65d1116a7be3504265e4e5b9508d02a6a7a34d4dfe16e4ae505d7898b9b7210287352c9588bc58bce22c5ded2ab3b4d2b33cf28337d8184948166bffd4262f9f76714cf17d731e353056557374c4d1b6191e915369ba8c35c970f5c9301a680e2a1c9882b2d78fade0db04836920a81db6440006c74451c023a9e9c35a0bfd4ed0541e59928122a21fb1797b7e1b8a074b9ea5bc7354b00e64940940939908dd2242547fc179a76014ccf31bde1b43403229998b6e3464da635627b53d441168a666830337d02969f35f320bc063ba57b5e54ae16d86ed844b99825550590dacc5f9658f59d03a60287692be5bbff3f247f2d0ece7b0d4ce6f79d898bb3c8ec0d80843c04db71af47114dd0546a7aa5ec200e2e7d837f7c66aede32a6b1310f86ed20d198e464f59fc06820d660b0c33c890bc4c41b14fa8d848d492ac0e69369b312758a1d23830c6a3a54149decf9bbb3243f5d161d9aeeed2f37b27755e7b9292d3c2f30f085ef7acb4b2aff51434795e572b075122f7d4b8c6ee37833c64c0fe8c8cd1d98ff670be7a21a4f508b27430c763542ca7e19c3dd19ba84df6ce7bd1bcbbd441812224af67daf731605018e16907306a446a1edf8406f74366393c631dc56885159e8ca87ee7b39a96b017ba2790030461837ef7847598c2478a2cfaa9b958c35dc6f3a7cc49f0d80a36fd1bdff93987615c3a911f8de57046e1596cf8c117fb1c0d4b57bbea2075aad3d53e5221a211785c55a173a10a6cced64c7e51d893acd9d289a36705901db7e3b22294f132e47da1c4e4d1e08cd6502f4274ed1a3484f42ed15836cca8b1232664a68163fee58692cf134f03a66d0c346ccd9cbed822a43e92d48c4409291b061fdfdfd1d8d8bd58bc70456e6ad0f89b6aa5f4e0e75f0d052331a5f1a2ec55f0a0b382c465e923d80cdcbd4f48d3957e24c12144d67362d738f2b0455f7a0310ed0d24257660764a931a7997f55f3f8a6db0631bdfbf1824452363ed26a0611d7e3d69e40ab9453847766cd8f2b1e867043613b91225a68034f873039122ca9229d2b61d0e09d1c25afde760e3f9b52d78529aa172e0e875282dadfea829b1780af3f767f57bd57f63730cf92e31dd5139584189f2cc7a6bbc87ac3404c5c483bc975fbe5f8030256b0cf8b75f9eca7ddd17b2edc16d45a51756a32ca07fc897221360d5cb085363a7a9f0f1093772fc2fa866ce1b19d9f8a6ac1896aa51cbce344fb575f5d0e80e2b75fff75719228ad82df96d172732ba5f3f7dab797703c12b27f235923708e54ef7c352ff0c22f121c80c24969e1aea7bb21d062d176e51b167b6f3a6af2250a92c6dd7bbbef596a2c0d017347fbf6ef747cd288d0a94b9e8c5db6a6c01b7ecdc0b129a706204211b0bca3bbe99b0b6f6c19710cefb635d97cc9968e6b90743bd05931b5088f14663e58e8b5e902bf671c2d8df924349ce0ee159ca0bb74b0754ac33a4410f62eddc27b860ec0b196228e15ac093c5e2f50c60e9458d534ff96341fd45f74b50f07e6550b882bd4724cc3855e8906ad4c898bd11ec7522ca7f3737e3899de66022041ad478d0e7159eba63931166b30a473a81c908df93752f9a1a4d23027927184d86284821cfa272b1927b8f150efdd4ad6c1e2b5294c8f69f301f0982caa74636194226ba8665da3d84c46c0323328797a32b0b091d30e9fdcbb5c4743a4cdb1e4d258e154aeeb42436707601d7c515768291a8f0f2d77cde3cb537f886a5ff5fdca5c3ca7907da1d82fcb487c652a5d59ed03024e172bd92b410e0e36379881eb91170dc489040356e4bf3955498de54880b05ebd5dbbe10ea59ce3fd1cdb77f72fd398a24db902ab79a5a44a32de12b460cc31a314460d995ba4c717c2ce72b1f1afb6b34d483f1d6448e68c2de79c334825fc1547fa221b49938e245974c1a325e84cd5e97f3ade4368cb24e5e6a16fc81caf3a6677811c75cc243440544a07c0abcd459ff32b7474f51e8c7fce3b0ad4587c952f40e7eaa4ada2de08bdaec605adf99973ae04c435dc0884b61c95997ee0d2f0de90d832e75cda4761f622ffd714724e316d795156160154009812bd4c31b5ffe591a2a232ec89023619d426ff0a8d022ad37bb5be82faefc47d126521238fbd25e55d1e1d4fcc1a9b8746de1c267ce3eccee6fafbb3ef752b42aefd4adb71ffe983a6ca34506b28beb3b9e24a03f84ab43d206dd12e7d8d38bb57c5bdc6a3b4110b89c3c520bbc49c448ecf581ca5ccae73a2271a58947d5d9c4b3c48800b47277928984f194165908425f51c0e1efec4af064f9932b7b2c13a52e74fd6a3b1865eca0e089789c153c3b92cf5c6ed50d08905a6c87f087253911a48ac1980f23526273b48c469d39b87a490065c7441076c047d493db4401a92497fd4dcf016316711830ccfba6e86e66e32e0fbef544aca471173fdc81afbe59e3f90651da9a12b1f1e23864d93d595607531ce4ea02700bada5b343d78df80f0a609b423d99184d68db646af955427dea6879ccbf60ac9cd9964ed81ff331501799edcc85ff27c9b924742f78432dd3781563c3020db3bd70dd1a47dd77a061bd30cd90325c27210ebc150b6d7dd2ea92211ea6e3421b2d3b99f1dad20fee9ae7bd25a5accf877aef335189edc15df87ec434654845b3ad00d47887e9af375cca6a56abb7caab5bdbbdc7d2fd48e392172bad878e16a98fa43a3bce1bc9f667819e92769f196ee12515b9f96cb40c6431be862dcce3a74338b743f4087cb37bafcc5f261bc3b29874e10d7520dc4ec356f6811a2d9956c3564ebd7f490553846265f902645dbdbd6bceda832086f35fd6eeb6daaad9cdcaf84034212cd52009044cdbe637de10efb5f780e0246267e570643f35da777a6490c69bedb65b1e9c14d876a8daa86e30cb4f63f24f3e55614e89e012af9bd6bcdf1b848a7081c458a83b31c2c15c28dee19ea5aa6b3f14e2d0add99db2e093e27df7ebc307b44ef93ca55a1a794298ed0f1095b2838a835b7ca924f3e478bdf62aaa7148dba2ec4dcd2c7c5464e17f1f5046db2a12d4ead6816baada56fa9cb139eea59fa688fe5fedf495e8c99ecf45ccf745f717e012e35c0269ef4187549152cb9e00cf4679bf29b9bf3ba0447530c82a4c5a4e11be12cc6fad4f1366b41691080c89a134817c375360bc339385f6a4e0c659948540e553bed4ce106ded182af3be62a8599798e99886c5fefd3b407e8587d15be4506a0a69141ff6ae9f58c348d2c5e2cd87ffe3bd344098f1e992955dc141d624c102ca23976bed864ddf480b2be5a10d98395b54dabaadc24cc89f18805ec7cad8ccacc5201bc43167d58395e27c37634f1e426cf01637ca2dfcbee161e51949323962b572197a26df71845de8b4a6b5da9bf46975a9f20c42771b9edae98b0976656330ef7f62179ff0fd6a8db8a1b236a8074efbdc367e1cab6e4ef9121d797291810c9b792be5cc0bdebdd11707057af9a081a815bec80143c4a3548bc22c3ef8845e1f078053f1760540b13609856e897c231b6419bfc190d459da0ad285c799a8e5dbeed3dc222a31dfaee2238becc184e53573e87f4e132de3ec2b17b5bec9576fc553a9a54174f7c17a904e0f5fff366a902fe3a846133ad1bef3a13191def565d762d9efb53fe152dd0b4729a92368c326fcc8ab44b8ad228e4c6b956c6f27112f85947a8c4508d339ac34e8d3dc1887ab57fad5201dcc047607df9f49bf8381a1cb8eb12fbec259ce184037e54712d85e4cc2e956aac1e85037f3fc162824d57b2545c9c921939f284a6b50621ea094f3b0db8af5808ea215f8f8b5940756e0ecaebcca6099a25a1100c76c73af36db2614bcc3d3dc1b736f55a28a61f6a3c5758c8e7bbf2bee35eb302daf7a0c2400b383e8ff7342bce06bc30af45ceff427fd725fb671fa7e79f98192d0e4b58d3ecea48da321ee2177d7c6c2356f49c4edd577fb3d10a1decbe4bc719075e88316aa65971fd60a9f431bc8a10c212c6ee4b9a39598bed81c475a602823aec93156220bf55fe55a20a8ac7290870ffde23c92376ab6c36eac6c8536a6032d5607aed62d83d0ba", 0x1000}, {&(0x7f0000001380)="a595918452de452ca7a105992ee4669fca58d4669f2c7cb7c23abc7744c51b849ba43c023ab06ba9444bd30fc99fb6eccdf1458c35717cfe9028e89291683913feef15431c0ee3c1b0b8e1435f7915711f4d5c47d4d67346f72378eac61e7b043f2a4af9a5d565a9f4a13a9b3557390328150a7c26565f196f6898d0f3dacac81f7739a314de3c1380159b87f070ac49990c75419c633df00334f07b62df48788b16fb056266c229b8fa895aaeffabf38fdecc3c2f10cb6c03933ffd81d5443257a6e9b089f946a21e2bb98995db4b5079254e10969e4f8948d36357289331f7512ce5efbd57ae0d45f5e7178a173ace8ad0fd7d4994e318b07bb7b8c9f15199979ceb64cc84c6cd0180d3c444b2cc4521f3a4f1838848d65c8b494cad68b625936c896544959154199c2972b72618f88fe2cee626a27392a60df617c877c244383987b2fb5d82ab8424a275d79a3b73c032d7e81f35968e18aa8e02612c7e8b78ffeda5065858151185d5a8a88978491d80622f41b7adc3f6b68b9146f63f893b1c1120a54a2cdb3eb43161f2867af2138ac89bc2b57230c35ca090087e13c14291c20a48f244299ec0ff511505395a7953826eb59941e93d74bd5c37c9731b4831692d33d2d641f9920ffe286f0a3062855663bcadfaf925072b2ccb52bcb6148419aaff8bc54dfca889d452a70c2b78e4fdcaa44b957db2d2990806ac8e11954d066dc70d82b88fabb8c75aa8bd3555092d614c4f9b713399a0a9cfe3f5e80dc200c61df26d017af2230824c9af1085bb90382f76ebb35f0ffc0fccd7cec46a2069dee308df06c910c3ba8674e3477bde3db408030b59d907f45d80a22ae00851b62ac665623d2f1e44bde7c7cc48e44d658cd283101a4fcefd1a6dc40d13ee5a839ddfac61f10fc9c55530fce30c7b80a847912149bc032746c3ca2b9978e228cee5aaa57623e8a59fff0a1ef0320f9ed997e1bc393b4d17abc570900a7985c34d27431a42368b7810f3b470cd9c3052ae8f8492ec45a9926302d9f3382aa89c296a42f9c07a0fc08f1b9d779c56c28ac6b60e3c7bc982ec23ebb39b20984174e95f3066744d773c2d4808b29f1df0618a357e9279864bcfa83a9c9fda14dc3eb9b65a92f2b99cec2236851a346f0d5bd296646d7cb6d4dd494c9b56c0013d6baa4d8fdd8430a94627862606a65994689eb272c6218f8180c98dabd70d7be367430939cfd00dd9accb390f4de84bd4ad433ab30e3cbfc8796af1259dec60b56eb3aa2163d72ab67840b44085bd9df6bd40a93f533e07fe06e18eccf3401b460232a4a414cdcde0a69c1e5d059e5aaaba11ee1b40338fcd77a8012c88aa6931fc44dfef39d14bc122c0534fe8d927fae8f28edff1de39ec160956e9f3fa09b8427353dab06d2af9dbf4558853e64bb57137eb1fb52984d6af51979ab039dee785940ea95366198a813d39f1edf599ebc4e29ef97250b1c1359964127ccde74f5a8fbd0854d473185aced1a9a7d03d9a32a27663558c17c0c718ed8842d049f42706d2212aba785e5eb19bf4a88139e53a364f98245b3603434f2d32b5183ba69bd665c0f47eb03b3a482435680d628411c88f59d44003a67a559a1d0535f50ed473602c2010b6b1ec828fbbd5ae721b45a6e2210c173739b2870d8c0e4a27bd5f9b23b11f590818c2c06702b03abcfa83b73ba7af6da7d4d5031cc188e6a7ac61e4d7547d7e63ae123490c8f9d18eb697881663ff532019be3d2d175dfcc8817d85d23a40e2ed02b26b3a53cc00768961890575246c7152409fbe8022cbc9748456e29096d8122a76af5bb68ae3487dc01c75cae28fb3313547adc9fb667b5c38ec26b93ca8db2ad2294dd5df19fe3afde91350f4997d057b5da7c5e1d279d9c39de47024cf9bd84fe2b665249893d3badd150e9df33c65824a65361440c3adcf9a67b60c72d373308b58e0d1d2099c30d054f83a7aca80e474e5c3107deaa13ec722224b8dddf0c8b0dbb552754351e16bd8cea9d6e593fa391de57cd6ebdec69235c0a53cc17e6039ae133268df905c120eead3aeda88e24f6c3f0f2b1e233d8df00a78bc4753a00f1369a9d4bb54ef9b97e6903c47dd19045a2eb55986fd6a42aa7a3b290a985a737db3d4faf286c126c5267948e1f3e340382d93e84679bc062d1942f14d18ee5ffcc41f7c768385727122c425a589d277dce460f31545c2a00baf9b2d50d6f1889696a32261634fc7cb17977595f134281241d0e8d240ad50c4c4be1f9259f9d1e5faab2d87ea11aebd9999a9a64b2ae67d669f037f1868c9876974b77dbea3bb3b522cad2c87906d93d906be34080c959dd5adb922632ceed9a8ccad93254eb51e8d934d171c43b52a77af634ea409b6381d869b6a6b58b38d028922344345952ec667b6bc2614162a5a1bdc4004ce8e6b632c6e0e7a66c1d3036884ea14d10685d44c72b02febcde6c54a7b63c1a93b2c189f9fe28fc750c8b7f746ee345fa8bf2fdc2875cca34c63b6927263bd2067ff8cfefcb85221e5d8e47f8161a3b44a43e86850e3c930f7addd86e9c6231b0a2084aac628d7675dc6efa028d4b8be6340d5b6efaaaccdd8030b02bc470f131fa0f4936ba3dee822010bfa8577475d6e7bdf41467233cab2c6e8312f71d2f8b75107c674a10b41f33f5371acd31dfa869d0749e7814034de9469f828e8b305518436b9a70a6574b627cf81e1e906315a6b7deeacf41f4d403ece414ab20f82f57b005f0c26daba27254f474a3c9d87bf1b5db5196e24496ec22bf6c687b78daacc42062b638bc07bcc37ccee4f7090266e3d36350b3f4bbbba0d7e3304ce89b7c995513613eff60ef03253286c2b7184f07e8de3f1c4fb9f1e728edcdae86d7c8e3c06c7063b5ed90c09f353f1c3f6ce7b32f4dd8d146530cfab935a0a43f320895214877320572102259acd3d66322f74ca58651b1873ff43572ce705edbc1891f62e3dec14ef77533f350d54a18290d375ee86f16505ad487b53db795b88969c0fc888c02f39f8cc08da7f475f31f57b71843df7267eb21504791736a695d66afdfb5e2d43e1408d2f9749feda3b9ce727581a0a592c3fcebf4417d31d2e449b3b65c0eda2701104fcedd4a4abe067f0262de7f7378977c0bff8ee9666840425ba613532d7eed0d737e274842a72c8fcf8f033b2f4f95455d3f601f75c062dfc1cf75898372d246387ba11585284a7445de3685356a421869f96a1cc75e1aaa2761af84e4a7889a2a794c21f1f7e9b43f5f2c2ed1b52893428e63358bf526132a7a00358f4d63833382f7d6fdc4a78f5d6c5c5b65fee3de74da1fd8fe6a25f47146a3bf5e3683bb73b9e1a1b64957b486d1fa3099061522ee5b198ca7509811dd172a7d8134add91c7fcb47f2ea6cb7f055fab52f126e7d552f2a0a2636a527a2637ad155f8345a2b62c4dcff409d6ab21eca60bfa1ce54c8febdf5811f9dc907b93fcf9f37b2e4ac845bc5f318caa24dd82d8f3b75536fa362c5fa69c62326fb79bcff3382bc8ca316bcb0c90ec210c6fa2e27667b58239d05fcb27897bf7ffb6a0fa9826ab2024d7b5df0729b671aaeac8eb78e5776cf2a5d26c21da48ffa8a46a0a430d7dc970cdead33e5434fd075890891c98b93ab4986e1c7aadc94ade4921564dae971fc1011735a4e8e6c09f68dcab43a4af9045b16b344bf893130e470dd8b4ad6ddf703a750d29006b92ded5f75c00f18387ad4517780389e124b84e3526df68696d5c2239a25cc04484b411afffbb3e441989252207f8724f301e948cd3cca913290c70202f07d592df1dd38b53c5885fc79cce9e323a8b0c9bcdda5fd8bafa726f24829c4081daa2cd517f018561fea0c4a99ea4be17e7c728baec6542072daf213fd4b574bed892dea3f4f493f671eb40cc4449a272a267571e07cecf2657a842b2d1195da56225631f57d0aa54c46679e068ee88fc366e51ad10aab58de9f77c69e079761701423825d58b6242cc843e8869bc8039c3595ab7698dc3600b689172960cf247ec75c643cf7dd34b4602ecf2b7020e92ab16e2dc96c175e371c8131800c3c386cfa0d771f1b0602f58cff37e07dc42820baa0d09f8cd46a6787a252f420737978125241aaa11234131f19e9642559262ae22762b541508f492767751b9a291e342ea4406e3594232bae7fa76ae6daf16a935daf3870e81362ec316033ae9ba96d0075509ec7e68681c4da055d51b67b68a5cbf9ec426d999abdc328ba55323edbdb3472d1997b8332e158573327458d8292b0c04dba109f37ab78df7f99118967c7813780baedaca423df4d29eb0716f9f3fb6deb354c99ed0f2b04225254dba89e0922e30e99e6ce220f1b3953f20137a34b2efc1a57f9a6d954f70f434c81126e465ca594b042a158da261d162337cc3e4747ce3ca15faf66726c3a7970938481dc0cca481395b5bddbbb8ea6ce59ecece487bdcfcf36ead2240c169da1a96b708b2669a81eade5fb22ebe9d5e81e461cc046e3b015ed2d950b29fad77fa7a486fc1df080058aca323bc29bdeded8a7656f98b14bc0df09f995835ebbb97b0823c13afeae30e73bab5715b1ab3ec4378f4bfa33e125ed0d28aa9c38f787727fa0e10d14ec3e218ddc56558aead4c953ceed1dbb9ec6462475722f594627c2e6b0848df902e66915241535c952bcca4a31746edd7e468d43cb261766edf314c126c9135df39b6c73f949c4fe7e43c3582b19a7f9472f0cc1c0360c6680afef9a558d7a6e3549bf085ae6294b996a76a787d036d9829715cd35740737a2f0896a22603cc4d8e1eda6070478fb2309440a69acbd1775a0f2352d8469c316184e7e107f41e073e3ec0f3ebaaa97dea14ddf011bf1bf35de2f546f024c5ca90a56e5a280fd3eb0f4ca5d5c5436aa1bb0aa6902a4b57a07de4c975b63bbded8174bd2a4ec8eb3b74eb66c0931860112d3ea25a90460c7d318a87eddfe4b363524b6d699d0e6ab4625490c27120eb1921da2649703a65e656b7748f55171ffa3f908e8080f4b534fc1f1e4a41ced0634379256345fbd0ee1165955568448e454fc29cabf820326c404d8522dd073791d695bca9d10b555bb9d261a4721f41a30ad1fae8c9dfb4174da61fe1a177923bc1e22724b25db347ed4715a713a55b25d22d23e38bf60f1b72f3b499c729de24ec9fa7d55805b621172ceecd11b26db4ffeb1d2139c9fbba15c6f243448bdcdb5174ff1b93f7b5c386d8ac55435b9fde46fc3bc255db1967f888f783e952f627fe0c6852cfa5f39d0109420dfb89eb02abf452c351f7f0d9d9d83fa7316f2629d31f438b72c9a4e72fe398880054823b2bc4f5ab0df6e08e680fe9391c9d8212e536ac3a6d0b496c13342de07510cd63139b22960a4f42663f035b974b7fd40de8c906e5790c087242edbfb8a276b98bfaf4fb6176f5e6b4fd841f4ac7c45f4131933a916b9c5e45ca11200fcba097b009fd8fcabaa35a183dd1b02709caceefefa00de8baa499a17bb0ed7703960bf5b7ef4d2f6d91ede2ae7f9957fb6f3a87f276d03a2979cef384472f66fb3e98bd5639b114668de5efd7df6b8269619951f1346dcfbbb85e6eabe1e2f6a30af3e6d94a1a58f33adb095f775e5ab8d7153585b174b8c6c37442d9545b4ec35dcd252f94af8f569cf281bbdb6ab3558b3c1b96ec9aec8e236e4ae8fc2b18eecda087aeba004a8091d1e226efd68433a9d26d4f09b4076b29ea3e705d56da5ee16812b85391d44a40f758b8b909f324dfb2896db92c4de162efc04a0978", 0x1000}, {&(0x7f0000002380)="6d5581a5f454ad6548", 0x9}, {&(0x7f00000023c0)="ad52d10387e7ca9d4e8ca78373173e8472ff2f7b27b18c9efcd89fd651c1995ad3912fb7b9b88a304700051f8ab0d0b260063e29c40d7f7d208edd70d996c09afa2f45d3fa4f6edd52932b3e80ff4743d4029c8ab48a498f22c95a5ce50f40096a0c6e32d06e5212e28220bbe89fc23983dea2ab04a422ec1d36af70cfab14cac2846e3645b5c9016fccb5a682c851741f72ff14fde762a89400afd5dfe7358ded2378a281b9c5d7", 0xa8}], 0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000002500)=r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) 14:47:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvmsg$kcm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/216, 0xd8}], 0x1, &(0x7f0000000280)=""/167, 0xa7}, 0x10001) r3 = eventfd(0x3) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:08 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f00000000c0)) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_buf(r1, 0x0, 0x27, &(0x7f0000000040)="c07c50b003e52f676fbc358357b71dce47d839ccb674ec0c0ee39f9fc0bd99c600189d4cce8d1fd4146d4a43aef8176ff936e12cefae386f3a927a3ab7c7ac129d25bf1960d783bcd4dd71e130b30c8c38824269b6228f4d394381ff6d1bd89bef1d58b6afa1cb58aa6cf76d71cd4e83b66b7b8edc92c6f63c3b5ccae7d6", 0x7e) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00'}, 0x2c) 14:47:08 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x0, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:08 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) r3 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x10000, 0x900) ioctl$EVIOCGBITSND(r3, 0x80404532, &(0x7f0000000140)=""/169) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000200)='/dev/cec#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000240)=0x1, 0x4) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = accept(r3, &(0x7f00000000c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x80) setsockopt$inet6_int(r5, 0x29, 0x5f, &(0x7f00000001c0)=0xfffffffffffffffa, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r6 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r6, 0x0, 0x2, r6}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000080)={r6, 0xffffffffffff2f4b, 0xc3da, r6}) 14:47:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") r2 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x1, 0x800) ioctl$KVM_REINJECT_CONTROL(r2, 0xae71, &(0x7f0000000080)={0x6}) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x03\x00{\x00\x00\x00\x00\x00 ', 0x20}, 0x2c) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000001", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000100)=0x28) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000180)={r3, 0xc6}, &(0x7f00000001c0)=0x8) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00'}, 0x2c) 14:47:09 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x0, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:09 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) 14:47:09 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x0, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:09 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x2000000000349, 0x3fffffffffd) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x1, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f0000000140)={0x3, 0x5, 0x800, 0xfff, 0x1, 0x4, 0x3, 0x9, 0x7, 0xfffffffffffffff7}) 14:47:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0xffffffffffff2f4b, 0x2, r2}) 14:47:09 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2000000000000002, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={r1, 0x0, 0x2, r1}) 14:47:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00'}, 0x2c) 14:47:09 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:09 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x0, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) setsockopt$inet6_udp_int(r3, 0x11, 0xb, &(0x7f0000000080)=0x2, 0x4) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f47, 0x2, r3}) 14:47:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000080)={0x0, @dev={0xac, 0x14, 0x14, 0x1d}, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 ', 0x0, 0x6, 0x75}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00'}, 0x2c) 14:47:09 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x1, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) pipe2$9p(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) write$P9_RWALK(r3, &(0x7f00000002c0)={0x16, 0x6f, 0x1, {0x1, [{0x2, 0x1, 0x3}]}}, 0x16) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x6000, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f0000000240)={{0x1, 0xb8370ebc78c79398, 0xb053, 0x3, 0xa2}}) pread64(r2, &(0x7f0000000140)=""/235, 0xeb, 0x0) 14:47:09 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dsp\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCDELDLCI(r3, 0x8981, &(0x7f00000002c0)={'\x00\x00\x00\x000\x9d\xe6\x00', 0x7fff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x0) r6 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x0, 0x2) getsockopt$ARPT_SO_GET_REVISION_TARGET(r6, 0x0, 0x63, &(0x7f0000000100)={'IDLETIMER\x00'}, &(0x7f0000000180)=0x1e) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) 14:47:10 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) [ 1525.988159] IPVS: set_ctl: invalid protocol: 0 172.20.20.29:0 14:47:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) [ 1526.054805] IPVS: set_ctl: invalid protocol: 0 172.20.20.29:0 14:47:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x90000, 0x0) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f0000000100)={{0x101, 0x9}, 0x40}, 0x10) connect$tipc(r2, &(0x7f00000000c0)=@name={0x1e, 0x2, 0x3, {{0x40, 0x1}, 0x2}}, 0x10) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000080)={0x84, @multicast1, 0x0, 0x1105, 'mh\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @dev={0xac, 0x14, 0x14, 0x22}, 0x0, 0x4, 'wrr\x00\x00\x00\x10\x00\x00\x00\x00\x00\xc6\r*\xfb', 0x2}, 0x0) 14:47:10 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x2, 0x4000) ioctl$VIDIOC_ENUMINPUT(r3, 0xc050561a, &(0x7f00000001c0)={0x3ff, "99430e86e6ba3dd0560ef5bef46da9d982d53314f526f945d2aecbf7d45c68e4", 0x1, 0xd45, 0x5, 0x0, 0x2000004, 0xe}) r4 = eventfd(0xb36) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) write$apparmor_current(r1, &(0x7f0000000240)=@hat={'permhat ', 0x1, 0x5e, ['/dev/input/mouse#\x00', '/dev/kvm\x00']}, 0x36) getsockopt$inet_sctp_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f00000002c0)={0x0, 0x6, 0x7, 0x2, 0x6, 0x1}, &(0x7f0000000300)=0x14) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000380)={r5, 0x3c, &(0x7f0000000340)=[@in6={0xa, 0x4e21, 0x5, @local, 0x1}, @in={0x2, 0x4e21, @rand_addr=0x4a9a}, @in={0x2, 0x4e20, @multicast1}]}, &(0x7f00000003c0)=0x10) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) ioctl$DRM_IOCTL_GET_UNIQUE(r1, 0xc0106401, &(0x7f0000000100)={0x8, &(0x7f0000000080)=""/8}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000280)) 14:47:10 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x1ff, 0x3a67267ab11c0c37) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) [ 1526.459794] IPVS: Scheduler module ip_vs_mh not found 14:47:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:10 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) fcntl$setlease(r0, 0x400, 0x1) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1526.565791] IPVS: Scheduler module ip_vs_mh not found 14:47:10 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) r2 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x37, 0x8000) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000300)=ANY=[@ANYRES32=0x0, @ANYBLOB="8200000040b733187f643b1295b3445b39f7dc67586d20a4a980c6ef5c8acdce236f1b9fed492102213f1336eb620480163ee32f589d0a45cb0bfb6b19e193bdfc71dbf2149db18a8066581db6c132f6886e7ccf6bb29f3c6f9ec4f8d2d848be02f16870ba3df5e15d37f07bbef035741c8964c51019ccb55344c567e54dcd27624118fcb1545b9322662c83b3"], &(0x7f0000000180)=0x8a) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={r3, 0x94, &(0x7f00000001c0)=[@in6={0xa, 0x4e20, 0x9, @loopback, 0x4}, @in6={0xa, 0x4e21, 0x10001, @loopback, 0xfffffffffffffffc}, @in={0x2, 0x4e23, @loopback}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1b}}, @in6={0xa, 0x4e24, 0xf5, @mcast2, 0x3}, @in={0x2, 0x4e21, @empty}, @in={0x2, 0x4e21, @rand_addr=0x3}]}, &(0x7f00000002c0)=0x10) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00'}, 0x2c) 14:47:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000240)='/dev/vcsa#\x00', 0x8cc8, 0x400000) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x18}}}, 0x8, 0x4}, &(0x7f0000000340)=0x90) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000380)={r3, 0x2, 0x400, 0x9, 0xffffffff, 0x9}, &(0x7f00000003c0)=0x14) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x102, 0x0) r6 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x10000, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r5, 0x4, 0x81, r6}) r7 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r7, 0x0, 0x2, r7}) getpeername$inet6(r5, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000200)=0x1c) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r7, 0xffffffffffff2f4b, 0x2, r7}) ioctl$DRM_IOCTL_RES_CTX(r5, 0xc0106426, &(0x7f0000000440)={0x6, &(0x7f0000000400)=[{}, {}, {0x0}, {}, {}, {}]}) ioctl$DRM_IOCTL_SWITCH_CTX(r6, 0x40086424, &(0x7f0000000480)={r8, 0x3}) 14:47:10 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x181000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x10b02, 0x0) ioctl$RTC_SET_TIME(r3, 0x4024700a, &(0x7f00000000c0)={0x2, 0x6, 0x12, 0x9, 0x3, 0x1, 0x3, 0x11a, 0x1}) eventfd(0x0) r4 = shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffb000/0x2000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000200)=""/226) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000001c0)={r3, 0x0, 0x59, r3}) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r3, 0x84, 0x74, &(0x7f0000000300)=""/178, &(0x7f0000000000)=0xb2) 14:47:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:11 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:11 executing program 5: r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x7fff, 0x187200) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000000140)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) 14:47:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs\x00') write$FUSE_OPEN(r1, &(0x7f00000000c0)={0x20, 0x0, 0x5, {0x0, 0x2}}, 0x20) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a5c1f023c126285769070") setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000080)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00', 0x8}, 0x2c) 14:47:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x200000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3, 0x2, 0x1ffffffffffffe, r3}) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x200000, 0x0) 14:47:11 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x2000000000008002, 0x80000000, r3}) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f00000000c0)=0x4, 0x4) 14:47:11 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:11 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) [ 1527.592294] irq bypass consumer (token 000000009c5be056) registration fails: -16 14:47:11 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffff9c}) setsockopt$inet_sctp_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000000140)=0x3ff, 0x4) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) 14:47:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) 14:47:11 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$video4linux(&(0x7f00000000c0)='/dev/v4l-subdev#\x00', 0xfffffffffffffffd, 0x42641) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x100, 0x0) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f0000000200)={0x10, 0x6, 0x8}) ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000180)={0x0, 0xe, 0x4, 0x1, {0x77359400}, {0x4, 0xc, 0x6, 0x80, 0xbc, 0x2e2, "f4df7978"}, 0x3bb, 0x3, @userptr=0x3, 0x4}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) getrandom(&(0x7f0000000080)=""/49, 0x31, 0x1) 14:47:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000004c0)=ANY=[@ANYBLOB="0000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000090000008d6f000000000000e77d00000000000003000000000000000600000000000000000000000000000000000000000000000000000000000000f9ffffffea000000010000000000bea34f158af38a3b3069aecb0000080000000000000009000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"]) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:11 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:12 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) 14:47:12 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") r1 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x80, 0x40) flock(r1, 0x2) ioctl$DRM_IOCTL_GET_MAP(r1, 0xc0286404, &(0x7f0000000080)={&(0x7f0000ffd000/0x2000)=nil, 0x0, 0x5, 0x20, &(0x7f0000ffd000/0x1000)=nil, 0x1ff}) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00'}, 0x2c) 14:47:12 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x80000, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000900)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400080}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="980000005a17c68b9e58c8d64dcfb1a1fef0fb7689f92fbddb9b5546a9e3fddb32907527584e551f035e19ac2531efa76672ee056b00a21ce0d6566dbf029d398ed30d090000007ec0ff5af47bc9db3d2b2600d45c2993cf0d4854a8b7afdf339a2dbcbd0fe19dc3bbb10bda60be2d3aa57d604910219971c420bfed6d1cdff323b71bf16a28684c5b90892cb775ab258576fe40c544373f35f0259806bcbdf240463a5b961f43e6e818a40cfe7f960b3cc2d0", @ANYRES16=r4, @ANYBLOB="00082dbd7000fedbdf25070000006000010014000300e0000002000000000000000000000000080005000000000008000b007369700008000100020000000c00070004000000200000001400030000000000000000000000ffff00000007080002003a0000000800050003000000240001000800060073656400080004004e20000008000600736564000800090045000000"], 0x98}, 0x1, 0x0, 0x0, 0x44}, 0x1) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='/dev/rtc0\x00', r3}, 0x10) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000580)={0x1, 0x0, 0x9, r2, 0x4}) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000005c0)={{{@in=@initdev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@mcast2}}, &(0x7f00000000c0)=0xe8) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f00000006c0)={@local, @mcast1, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x2, 0x8000, 0x1, 0x400, 0xd4, 0x80000000, r5}) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000500)={r3, r3}) getsockname$inet6(r3, &(0x7f0000000240)={0xa, 0x0, 0x0, @ipv4={[], [], @empty}}, &(0x7f00000004c0)=0x1c) 14:47:12 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:12 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) 14:47:12 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000480)='/dev/dlm_plock\x00', 0x280080, 0x0) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000004c0)='tls\x00', 0x4) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000100)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f0000000440)={0x13, 0x10, 0xfa00, {&(0x7f0000000200), r4, 0x2}}, 0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = eventfd(0x0) read(r5, &(0x7f0000000180)=""/112, 0x70) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r6, 0x0, 0x2, r6}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r6, 0xffffffffffff2f4b, 0x2, r6}) 14:47:12 executing program 0: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000040)=0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x4, &(0x7f00000000c0)="0a5c1f123c2e62855a9070") setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x2, 'wrr\x00'}, 0x2c) 14:47:12 executing program 2: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4280, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f00000000c0)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x6) 14:47:12 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) 14:47:12 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) 14:47:12 executing program 0 (fault-call:6 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:12 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x2, r3}) 14:47:12 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x8400, 0x0) write$P9_RMKDIR(r4, &(0x7f00000001c0)={0x14, 0x49, 0x1, {0x2, 0x4, 0x1}}, 0x14) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f00000000c0), &(0x7f0000000100)=0x14) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$FS_IOC_SETVERSION(r2, 0x40087602, &(0x7f0000000180)=0x3) 14:47:12 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) 14:47:13 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={0x1, 0x28, &(0x7f0000000140)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000001c0)={r3, 0x1, 0x10}, 0xc) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f0000000000)={0x5f80, 0x101}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1529.103038] irq bypass consumer (token 0000000074342f29) registration fails: -16 14:47:13 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) 14:47:13 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x2, r3}) 14:47:13 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x40, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000180)='trusted.overlay.origin\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x3) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:13 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x0, 0x6240) ioctl$VT_DISALLOCATE(r2, 0x5608) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) 14:47:13 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x2, r2}) 14:47:13 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2, 0x800000000}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:13 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x2, r3}) [ 1529.728130] Unknown ioctl 35090 [ 1529.773447] FAULT_INJECTION: forcing a failure. [ 1529.773447] name fail_futex, interval 1, probability 0, space 0, times 1 [ 1529.785096] CPU: 0 PID: 29836 Comm: syz-executor0 Not tainted 4.20.0-rc7+ #15 [ 1529.792418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1529.794966] Call Trace: [ 1529.794966] dump_stack+0x173/0x1d0 [ 1529.794966] ? get_futex_key+0x2e8/0x1ca0 [ 1529.794966] should_fail+0xa19/0xb20 [ 1529.794966] get_futex_key+0x2e8/0x1ca0 [ 1529.794966] ? __msan_poison_alloca+0x1f0/0x2a0 [ 1529.794966] futex_wake+0x198/0xbf0 [ 1529.794966] ? __free_one_page+0x134e/0x1590 [ 1529.794966] ? __msan_poison_alloca+0x1f0/0x2a0 [ 1529.834826] Unknown ioctl 35090 [ 1529.794966] do_futex+0x9ad/0x68a0 [ 1529.794966] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 1529.794966] ? __msan_poison_alloca+0x1f0/0x2a0 [ 1529.794966] ? uprobe_free_utask+0x60/0xd50 [ 1529.794966] ? mm_release+0x13d/0x6c0 [ 1529.794966] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1529.794966] ? uprobe_free_utask+0x5b6/0xd50 [ 1529.794966] mm_release+0x326/0x6c0 [ 1529.794966] exit_mm+0xaf/0x7b0 [ 1529.794966] do_exit+0xc2a/0x38d0 [ 1529.794966] do_group_exit+0x185/0x320 [ 1529.794966] get_signal+0x6d5/0x2050 [ 1529.794966] ? init_wait_entry+0x190/0x190 [ 1529.794966] ? do_signal+0x1be/0x2cc0 [ 1529.794966] ? prepare_exit_to_usermode+0x245/0x420 [ 1529.794966] do_signal+0x1d5/0x2cc0 [ 1529.794966] ? do_vfs_ioctl+0x184/0x2c80 [ 1529.794966] prepare_exit_to_usermode+0x245/0x420 [ 1529.794966] syscall_return_slowpath+0xb2/0x650 [ 1529.794966] ? __se_sys_ioctl+0x239/0x270 [ 1529.794966] do_syscall_64+0xe2/0xf0 [ 1529.794966] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1529.794966] RIP: 0033:0x4579b9 [ 1529.936885] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1529.936885] RSP: 002b:00007f520f81fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1529.936885] RAX: fffffffffffffe00 RBX: 00007f520f81fc90 RCX: 00000000004579b9 [ 1529.971589] RDX: 0000000020000380 RSI: 00000000c0306201 RDI: 0000000000000004 [ 1529.971589] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1529.971589] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f520f8206d4 [ 1529.971589] R13: 00000000004bf00a R14: 00000000004d03d8 R15: 0000000000000007 [ 1530.002978] binder: release 29835:29836 transaction 262 out, still active [ 1530.009970] binder: undelivered TRANSACTION_COMPLETE 14:47:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f0000000580)={0x378, r3, 0x420, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x158, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x1ff, @loopback, 0xf440}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'ip_vti0\x00'}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x63a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x115c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x2c82, @mcast2}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x0, @ipv4={[], [], @remote}, 0x400}}}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xcb2e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3ff}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2c6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x67}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}]}]}, @TIPC_NLA_MON={0x4c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2db}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000001}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x52}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_BEARER={0xb0, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9c41}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'bridge0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @broadcast}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x0, @remote}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x400}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80000000000000}, @TIPC_NLA_BEARER_NAME={0x18, 0x1, @l2={'eth', 0x3a, 'bond_slave_1\x00'}}]}, @TIPC_NLA_NET={0x40, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xf1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x28d9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x63}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}]}, @TIPC_NLA_SOCK={0x10, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0xc0, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3a2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x54}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xce6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xea15}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x546}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x800}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}]}, 0x378}, 0x1, 0x0, 0x0, 0x48010}, 0x4000810) 14:47:14 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2, 0x8000000000000000}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:14 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x0, r3}) 14:47:14 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x2, r2}) 14:47:14 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r1, &(0x7f0000002780)=[{&(0x7f00000004c0)=""/109, 0x6d}, {&(0x7f0000000540)=""/4096, 0x1000}, {&(0x7f0000001540)=""/172, 0xac}, {&(0x7f0000001600)=""/56, 0x38}, {&(0x7f0000001640)=""/16, 0x10}, {&(0x7f0000001680)=""/4096, 0x1000}, {&(0x7f0000002680)=""/248, 0xf8}], 0x7) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000080)={0x2, [0x0, 0x0]}) io_setup(0x20, &(0x7f0000000100)=0x0) io_submit(r5, 0x3, &(0x7f0000000480)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x3, r2, &(0x7f0000000180)="f3b9561dbc07c2f13d913469d8a95a2af08a1fa4df5d2885963e0e6c96b3e3b8d0d07161d3dd6546f7516a2357f7e9f0c0ae65bd84e16397bb046fc227b5dad31d95f37078306e7c67b353b22e91cb3eda1d97a7bd3a37b5880590ae78f28c05c817357b42650eb386703754aaa18f00d644c4c15f2b", 0x76, 0x0, 0x0, 0x2, r3}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x5, 0x9, r2, &(0x7f0000000240)="00a6e5051787fd50c820326a58d6d6de4b61d9b246042133de25eef6c73268cf7afb889f5818559a7e36262e3f6896932696946d1a4e01cf5ffb35e98c724d2aa455e47104d98e181cadec29e6d12bfeacc2cc71bfc351fb3679891278464a3ed1bb1eb75335740f66a632e63486c0d0007c6cc1ff7db36d27b95ffcc9d56f834a459bb3c065e6a1397a1798a10e72229a07f341eb6dd056a01bd4ecc8d15630db508519ee97b595afeac82a22d90bfffd9ea14af19d61f7aa8ec43f32cb541066decd3235b5b929ba44fb29c742d553d1a9594f316da15ea6a43208a3b1f02743767706f840b09d712ac04ddf9e2ccb3140f38f3d6b9627a27e989d336ea0", 0xff, 0x5, 0x0, 0x2, r4}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x8f06bf6f810728a0, 0x7, r4, &(0x7f0000000380)="62758e2491c04f053304312d564b1c777fd5f5482f82baaf176da8715d809ccdeb57636d77e47e8bb8d14c2f5e296b857c16a2322a216e733f0715e292c455524b78f70f0f7752f05528d2397fc2320a092f11be49dd0345ec18ff74af1ad43a3dd58a0a826d8b0035b529f743500169c093e29da6fd4419bf920446d65d895030720deb08aff6df844da4942a31f860f0818ac5129a0f75e20aee88a04b6ce9169c88ab18505c729a", 0xa9, 0x6, 0x0, 0x1, r4}]) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:47:14 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = eventfd(0x401) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={r1, 0x0, 0x2, r1}) [ 1530.178528] binder: send failed reply for transaction 262, target dead [ 1530.380601] irq bypass consumer (token 000000009c5be056) registration fails: -16 14:47:14 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x2, r2}) 14:47:14 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) 14:47:14 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x0, r3}) 14:47:14 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000140)={0x1, 0x0, 0x1, 0x2}) ioctl$DRM_IOCTL_AGP_BIND(r3, 0x40106436, &(0x7f0000000180)={r4, 0xe4}) ioctl$LOOP_SET_BLOCK_SIZE(r3, 0x4c09, 0x400) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:14 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) r4 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x1, 0x2) accept4$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, &(0x7f0000000180)=0x1c, 0x80800) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) socket$inet6(0xa, 0xe, 0x2f0) 14:47:14 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x0, r3}) 14:47:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="bb1dc6e4fc37fac2"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:15 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x400000, 0x0) syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-monitor\x00', 0x90180, 0x0) perf_event_open(&(0x7f00000001c0)={0x5, 0x70, 0x800, 0xffffffffffff2a04, 0x7, 0x80, 0x0, 0x6, 0x2111, 0x4, 0x1, 0x8, 0x400, 0x56b, 0x9b6e, 0x800, 0x6, 0x40, 0x1, 0x5, 0x1, 0x20, 0x8, 0x101, 0x7ff, 0x2, 0x40, 0x1, 0x0, 0xfffffffffffffffe, 0x4, 0x7, 0x8000, 0x3, 0x7, 0xc, 0x1, 0x3, 0x0, 0x8, 0x1, @perf_config_ext={0x6, 0x8}, 0x400, 0xfffffffffffffff8, 0x7ff, 0x0, 0x10001, 0x9}, 0xffffffffffffffff, 0xd, 0xffffffffffffff9c, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x57f) r3 = eventfd(0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f00000000c0)={'vcan0\x00', {0x2, 0x4e21, @broadcast}}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r3, 0x0, 0x84, r3}) 14:47:15 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x0, r2}) 14:47:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) write$nbd(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="67441f98000000000200000002000000"], 0x10) r3 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x3, 0x2) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000000140)={0x0, 0x1, 0x10000, 0x1, 0x8000, 0xffffffffffff0000, 0x8, 0x4, {0x0, @in6={{0xa, 0x4e20, 0x100000001, @remote, 0xffffffff}}, 0x100, 0x69a2, 0x9, 0x9, 0x2}}, &(0x7f0000000200)=0xb0) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000240)={r4, 0x9d65, 0x10}, 0xc) 14:47:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x82) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) ioctl$KVM_PPC_ALLOCATE_HTAB(r1, 0xc004aea7, &(0x7f0000000180)=0x6) 14:47:15 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2}) [ 1531.180856] binder: send failed reply for transaction 266 to 29895:29902 [ 1531.188249] binder: undelivered TRANSACTION_COMPLETE [ 1531.193611] binder: undelivered TRANSACTION_ERROR: 29189 [ 1531.320788] binder: 29948:29950 unknown command -456778309 [ 1531.326772] binder: 29948:29950 ioctl c0306201 20000380 returned -22 14:47:15 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x0, r2}) 14:47:15 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2}) 14:47:15 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) sendto(r2, &(0x7f0000000080)="cb0bba776ae9e9b74021d9c86765c21e03d89a003f240ee6aff098ebcdd0374b8dbd4e366bf62db3efe75b46af257d61dc0e58be53e0ad910edf85f3be0b045aa64e15b9f80197aa635ef7b9fde1b225f2bc7255b70744d8e05576cd9d635c", 0x5f, 0x4040, 0x0, 0x0) 14:47:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x0, &(0x7f0000000080), 0x0, r2, 0xfffffffffffffffc}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001ec0)='./file0\x00', 0x8) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f0000001f00)=""/4096, &(0x7f0000002f00)=0x1000) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) write$P9_ROPEN(r1, &(0x7f0000000040)={0x18, 0x71, 0x2, {{0x4, 0x4, 0x5}, 0x1}}, 0x18) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@decrefs={0x40046307, 0x3}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x4001fd) ioctl$SCSI_IOCTL_GET_IDLUN(r1, 0x5382, &(0x7f00000000c0)) [ 1531.616364] binder: send failed reply for transaction 270 to 29948:29950 [ 1531.655396] binder: undelivered TRANSACTION_COMPLETE [ 1531.660558] binder: undelivered TRANSACTION_ERROR: 29189 14:47:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r4, 0x0, 0x5, &(0x7f0000000380)=0x4, 0x4) setsockopt$inet_int(r4, 0x0, 0x5, &(0x7f0000001580), 0x0) uname(&(0x7f0000000080)=""/2) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) [ 1531.831059] binder: 29974:29975 DecRefs 0 refcount change on invalid ref 3 ret -22 [ 1531.838972] binder: 29974:29975 ioctl c0306201 20000380 returned -11 14:47:15 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x0, r2}) 14:47:15 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2}) [ 1531.922094] binder_alloc: binder_alloc_mmap_handler: 29974 20001000-20004000 already mapped failed -16 14:47:16 executing program 2: socketpair$unix(0x1, 0x8ffffffffffff, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x8, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000001540)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000001580)=0x24) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$unix(r1, &(0x7f00000015c0)={&(0x7f0000000080)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000014c0)=[{&(0x7f0000000180)="afb99e19f5dc419ebbcfc0d2e8820fc55b401942ebe65000d4957be091024864551e9d422b08c2a916772f3c132bf2b4b90413b9c409c3ea143dda4f2cc00365ed31d8abcba4c89d7abe0934fe6c2ae61615fcc2ee74ba36b5de7fcd05540194c9c3d9f5dcfb989714ffee88fb8c3dc440d25603cd8d8f86f7c6b34942354b223da7609ffaa1532419d9c18f79a9a55734c97ba2c984637038ef64956fe3a450c273528a923dbfbbfa0577cc7b9eeef425765a7754d125cfae859aab05405da38d41f4956115c80c616fc4197365ae501ad68f8e6b193f478653061e7aae58a426c46917815694cdad1db273af2e3662f458059bd8f1687dba352dcf89668586024aa04ffde325cb31f56a0512b1cec1561e27a4028ffee341eb435c7b44e292ce635b4f26e64830f0e85b361a18eceb0e2a8fe6d305a79d589215574f24494232f8dc1e7934ce2803b9bf8fe1126faed56ee655d0cc9ec8bb3add8a45fc68f7e5e509c7719179932b6e046a77f2fff16359e7655ad7455fb892a2d12b8ba0959c9e79d255768344b6c311dc646b11d6dbeaaa0e1e2dbf64282044d0fbc3e78299f67d71542bea1a13479cd61a54a3a441de883256a912749fcad9e217edfc6575f3a988403eb7e615cf30a9f6b02ef9d9da846ce1f08ee39cc03dca00e248f3e67aa19b48e38329303e9427f74315bd6644c842b18296b8dc93cca30c9bfc06993fe5c3ea0f5c5eab6e24152acf16ab036426aea8bc360578c3034a8b0570dac6b0c576babc87007beb4ea1533441c344f35617c17c9d5074c9c9b1ade8b54f482c30137c70ef86aefc2759ec83b14d94ec341dbdcec8ee2122cb64e313f41e687487db32126b59987b0dc50d54c1c337fe27f5aec2924e29a74e966cbf565410019c126e1c815bd7e8ceb6fc1d3f5a9ab0583edc1861978190133d9c68d1fe07b39676b2e6cb39233154423c25a9fe9795b96ce50e62a0f89214a22b1ce96c671bd3652eee4126738e52d56e54b23c38cbf77715cfc4afacc81973de41d26ca13a797e0e3514a7bc5d4fb773a6397cbd611c6b20ac53bc1995d4030a9c93d831b9ce5a80703d90be535f4841fb8f227cf3b639950fdf0be4451929558773a4ecf8f988c470c897753ddd77af39568bb0563f308ffa030e538109c950abd96788ae0ad86e55494b6d273d78dfe44aaaa84dc80904e5eda9bcdcccb0c0710ab497343c3200e399fae38c28de16b2d54b3d9019896a31f6ac44dbd8880aefe68f26924d4edbf6f2823784de68ae59aa657ea0e86f1716bad9eeed3f1eda465f725376cfd172aa4165504020f4500c17a66ced09674251af877400bc9a3fa41c8fe4a15d2afd5fa28d0efcfc8b942a0e4cc64f812d3d734efab9165f7d600fea4edab29d4cee98137a73bea57ddef017ad574b4898acce9a3dc8012d4b7b5b29d2733bd270960ac66603b56cee57ae41d5b6baec240493e4dd5b973576363e610415267cf7774df6f4da15ee0fda84814c7e7065da7852546458b307dd59f82d3d0552f188141323344ce8a8010d666940ac50f1bc5a040e26de3aca4a14dceae3e98d10b21861439818e0f1f67fd71c0e18bde3e4ee37e912bde7d6b3e4868c9bfc0207d346f2317197937c2bbd4bb32b837caa0fca7947664c00358c5064a9f392aeb364e0069d68d615462ba28b93f45e87938ca03b9962871ca50408442b801bf4c93b79adaa470281c6c9ee0068548d0b960bec90aecb355d92694beb7e1e4e6262ef4abecf25e288cc5c9ba06984fe33f07a654f30950b86fb42e6afee1e61edc1fb7f7707bd6e1d4469712459c0682da7b87ff8aabff91858970a401ba8f1891f1a1345b9586bae6ca4cbe87a9acf0c9d92c73cfca2bdf388cc51acf12286f8ef74108dfa11c1a86a7b849275ea9f22bd123567cf3cc920ebb29da13e9bfa7baa712c9895cc793e820c45a4fe67d7a0c7a5c2f76c28de310a477df27c09061146a755b7cf5e509a5e85ed3a113df13b3397ce490184f2a15dcdd797b33bda8e54186513c4b48d897915709b0e51405ab7b849ceb05944a2c5079dac3f2a289aba946f39357ceeaffabbb6dd8f6810347e346c7059ef22da0ad0b9d4908ee7db5a7102df12e54f13c641c2f650fdbf36d279060598be1221a6a6a3fa12bcface046324a7b580d62c7b4b4efe565b0c6a55044c2efe7cbe2bb7830e8db43d61c658a5182186b9bcf5a3ecc2198de1f872b75d8e6140736fca2bcdb3b636554c6d598b2bdbb77060627166bd685a486ecf909b42aacac313eff3e5d6ad65e8267293531cfcced3f2360f4361de76f555e6a0af041175f064afb5b84aa6a8138e54973ff2b8ec473dcc41e4ccff3ffb7a6cecbffaaa1b27115878b87e1a78178fe3c447aaf17d4d6d9aa36a3341d7608ccb4aaf1d733aa2ef57d38ef15b7ff7de510dd01a8d67c83a369945dfbaba57e80b7ea9cb584cf264c563de4143798c6b1808c4269de1f0839f06c71c6c00140b92eb24ea49455ee685a017a56be9e2ab739bb280a36d6fd3594d483236ee70448e5aa49ebd093c9d7b3083907a7e724fd5a6cfb1f67501fd85f4a58476e24149f8d14535c6ecbb174f5fefd84137dc435a61021c5d8722fb3b27c76d1c3a35883ce8bfdb5b70c2f75ca55816ab87bc3630ca0f134a6839e05759650a2f6ece16cd2a124cc7bbc7eb4acd1a847c87677f7400b3f5be6ae09ed15380a0c54078202ce65f7bef5aa93bc5999391bd22c6f369e0fc4cf5bbddd07cd3fd4af30517394df5faaf7a2d476e584d410c72dcd1db373d7747b240b3e171641932efc25698a6f7cfc886b645fa457d16375bc3c1692fb3d4609ab69d8dc24a501953806ac89fb0d60d2822d492e06cdd5ed0a8daa260aa5038aefed3e85f9a10b2b3bd293d632be58031fdb2119961eaf57261170afe23caded33af8ec9736e66120e28fa6cd09133f0ae698dc0755ad7a1505ca1da369d42447ac3ccfdd9022e5293ef61215d46707b41c9944a2e2cac27fd935038d9f0c6690dc46ef72a8f4566d0793268b34163e12c6276497da67f3be6dd0956e724334d28177bd8f379033125d80da37d28e153531d9abca9e0737d61a8de679b8113a3260bb0cad2c56fbeb069095830522a716b8ceccc461aaabb0db2b8acda112f67d4d207d7d9cae20836731b87be64189bca3a4639629aebfdb0351ab30e5ea87b4cef3113c2a491677563e2d55eeae7e7bc2c8f5067ac86b926a104e8ce65ac78b758f6e354ba01f363034a5ed0fc8c47251ed2bbbee8c6b31ab9c7b4a344673e7fa37e9aade40a4afca4a2389a7ef222bc69ebd5076782adaac4ea7af9230b020fb6938e2cf721a7a29115c08c7531d6aa692c26ff4358ece0bea69aec7540b7523eff391eb1501b1ef1dc35e323dca6fcd79c21ff6386ed4df5769cd5ae60db313c4ac583d5fded500b6c866b3a709218e98c61d7e0fd16aeea0da3b39eeec9c582d15d2910b24710ca3c9ce38936caaf55718b105430282a73cc16093186c0f50992626296cd9197ff2f9b5e0eddab144386a4b97202ba8ebe6a6b92fdbfff39d4276b717ca740053237d918f60dae25e09b9abcfbb07383d49a70d513aa339599244c903c5bb71aaa45e438696d5f5d2e4e8bc765712fb070c6be264567b0426325f8fd5207b2e884342721afdcd292df57d66c1169b6871337ad65d0889d9c8546108a08fcbab4574ed57859f58d3f58d49a4c02d42c254cc710758ff021b3d8ff25d7fa7e94bf8494e9593488608283588547ce08762c8fa1ce72810110468ba11f80658585163862572e099f0f34cf0cb0106b774e49f1d59323ad8efb65e5d76573f63380f6101b5aea340a208369ccff89d538bfda70f3068db9e2449f1e4cac0a55bb00916cec8f677d12b3337b530018e1c2b46ea14606bf814c05b2802c7a2dbca328828c51d7848441131cd490c14be4ea18e8d3a9c35a2c9923a9e6ab6e601cba70dc9d3cdac30f9515c082656a673ae76979c3471ff557d1322165061856b97da792cc0875224ee131ea989c9883e95fb7e7f3373275da1b19b1d3e31a7b0d78df2a69e896884db834ca2be5adcd10b2136bb9301d3b24d2ace6363c39544df6373f7fab981cf1c725409694be0e9ead994e7739382db072f803f11e06794219052adeb84c4d64b3cd7a3250a87713033059f0b35b7a391baec5d84d29b7420329ef6fb2621855842954820cd6b8ccd3144f9cbaf7d03aeb5c6f8292eba0d9e047a1b6b6e63a6a50ef2c2b303c1f9143090617f9c22dc84853ff7e30e6e606cf12bfdb37b141202354ff4ef1f46b2ad3520290201576634e0695ee21c9e20e3c0ad325708d5c90f738791b61cbc29034d4f498a3361c59d09a2f52f4c7f124dc8f58a96e951ed2f2e585b819bf9a5963fc560d379b62d24e1b1601f41e053b2954fa1fcc50288378410a5d6e90163b710ca3c4eacdaa32815dddfe6875da28c7dcbda1ad788698743fdb34c1f3aec57da6b7f62dd1ed84a21988668f92000641862d82ae6ad7fa8305d76bd77a27d308a018627c2e1cc6024042c052eab163cdb78798c63ba57fc65af7aa62992c8b7e3876a68027f21887480243b7d4d1276192a8d476043c589b6ddfb817dab9a9500cd7538529673b8aa77acd3ac0a195165941686f27cbccd78d12fc2e51425d551914957e5b6ec02b893ac6a465ea9eabc9721dfb0a497093d16062ddab9f2abe067bd63c0e374ed58646b5c77c217da0d641e1181aa32f0d040572630da9c3e94b309ea01e266ae8b575a232377c4d81f678a7e4bc1fb3f55aefa6d34ff2ef44123893e3167cb1a71227b5bbcebcc0bc4d99e09fbdcd4f5841e03358cfa0c18241a004c192c057daa594d15d18ad1c7d1072c07b4020cec68ca224ff137b5fce398964b52434f31444e9ba765287a0a23319f0f9047bd50acc6c286e1ffb73873970c7b60160881cac8133e3c6e712c2bda8124e9d29c93dc7de9701b6638ec0a019d21ca3c4af50af6efdce812cc2be8aeb8f9fc28e1af904d9db75b1d3a4d56049f4c3e950e77bad556015d59355873478d6f786b0e2f9701b47ad5d32cdb2fb662d15cb3534dcf364035e8e857f626fcd22bc6668983df1b186f1d70d6486a6ee3bb345d2fb72fc723659491478e6a916684ff14e49bfd7f477a69d524faf948698cd5b1f6dba9b491160b55e2efa2747a9114fb773fa203d99717e5ee1a5b0e63d16bc179dd97794d4fb59f47d40daeb0ea9e075c34d505dae90e7621118d31daa5bee226ee9dc9ea633044ea4a4b85945b4eda7bd341e92485a8c8df8ad55f7f4bea336fd22d8bad49e3838b34044eb1e304ca9e4b7f7d14337829c54c98aa3d5f43c21cbd2b63e5e3901ccb514ee22b84cf4ae57b5280b4667e6543562c6ed67bdbc98806b4bc53cb63715a16c6d091030695917327347c7f94261118dfddaf90ef99f382afbc3c31c7e7494605bcfec314223d0a2bcbb7bee0837d58c39c3424c23a1e33fa8cefc47a37c23bdc81f5d538f02ba7895e8a0879ba66981fb3e84b3beb169d2faae98dd913c0e1911a281a306dba34f2afe26cd0fd01c3565fd73b7589e8d0a40e5f51592fc0fc7e7a20e47c9db14a1dee9f7e2a51dedb871799b1cc04b5e78c3029fd60d34e407818b02567b9227c9d98361f625f382c6ed4c4c6c31af4ecf6bc44e17175d4a36373697a28be28f4f131c13a44f09cb04e049acb100a4748a4cc93e5bd4af09654c4b2f26250ae85884db3d71a4519afe9e52e7d", 0x1000}, {&(0x7f0000001180)="29c9ee28198ef8706687cb7d66c2981935cd774234ca1aaacdadd24cf1190e175c3b3a72b8ed05533cf3600199628b2cd000992c5898ffd45447a3dec8005f1748011aa79fd1adae65067c96314da3eaaf8197444ae1b48419407ccd346a4667e57ddf60e862af12d9e0ad2361b6491bae9fe324be6105eeef97f4", 0x7b}, {&(0x7f0000001200)="84ba8a6a33e5ca5427f428c0298b9ea2fe0cc8ecbc7d7cc130782a6b62355442ab55e1114154340f71df486dee9c99c6b1a0b267d3ab92d285cd4889e2a485d75e95cb312faf4175454edba0e966d8c13b5997efcf545cc75f8f30b2c745d43ca29bc06d3f8177da8bc4aa5ffeef39d26d3e1d4e7fb6a15cdf5b7ec82e6a70d5893e4c4e73b0e31b059065347d407c5843f2bd12ee74d1e26e8245c60717679a326b47c07bc126b8564eaf1b5fb650bcb75a96da506debe1b352ebe731c0445b7e495834e67cbd75635022377328", 0xce}, {&(0x7f0000001300)="da6ac9b58126041404dad4ddf871fad5aa9e6bd462a7bc3bcb4aead180d4c9fcba8e1af95ff40f73c8f1b7903d13faaaccca6bdb15eba6aa4bf4ac95b800a70c8ee65522f1c64ed27fb8c4f54d4dd8c1320755db80f8b4846c54ac61376d456e53de409c4aceee750afffc5539d785dc4fd05c516084a593665f62b1fdd5f39193887b139b7f3f7609a43b7824dc61aa0bfea54f20ae8c875c0eaad2acc171edecb9af0dbdabc8b8674cc1f9b0bb3e8755ca4e777c1675ab1fd4977854d22af706dce4849313425431fe39f94404974d30e87a57cfe546b612e6b92f824026c3265d7882b5", 0xe5}, {&(0x7f0000000100)}, {&(0x7f0000001400)="b62bc75a0300fe636d362b36d24aa6b0992423950a04d1a6e7bd97028f13390866f1f0cc8e0fa459f1ce101e757b8ca65143ba0a140a7715ad092cc16708791d36c399e3e058f5c98db24dfa62b0bc52b929a09e277bcc649834adeb7bff93988a5db960be549000fdc1c273fc3786355a269bf1c370b49e9a2661ac389dacd17995a2b4ad54d0bea084ac7d004feaac20b6f021a08beeb3800fc1899482fd544f35cb59ad1cfdbb60deefa7339ec9cdc616c6db", 0xb4}], 0x6, &(0x7f0000001600)=ANY=[@ANYBLOB="20000000000000000100000001000000d2063ff0e420b8ceb49645d6e6c4adff04bee3c184949cf91624d8f99091db93004c4e97ed13ff669b915112d51a0afaacd356524556cbd94a6df448b749e34934bf4b2292cdc2b17ea1bb4293beb9deec0000000000", @ANYRES32=r0, @ANYRES32, @ANYRES32=r1, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32, @ANYRES32], 0x48, 0x4000}, 0x10) r3 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$BLKROSET(r2, 0x125d, &(0x7f0000000040)=0x1f) fcntl$getflags(r1, 0x40a) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r2, 0xc0bc5351, &(0x7f00000016c0)={0x5, 0x9f56b245d854142f, 'client0\x00', 0x6, "6cb66cd5892f930d", "e893711fad272cc126ec63bf1b14ef870d75c8d33b1b80664a595d28a84e6b5c", 0x2c}) [ 1532.020865] binder: BINDER_SET_CONTEXT_MGR already set [ 1532.026488] binder: 29974:29982 ioctl 40046207 0 returned -16 14:47:16 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r3 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x3ff, 0x284040) ioctl$DRM_IOCTL_MODESET_CTL(r3, 0x40086408, &(0x7f0000000140)={0x1f, 0x81}) [ 1532.099665] binder_alloc: 29974: binder_alloc_buf, no vma [ 1532.105582] binder: 29974:29975 transaction failed 29189/-3, size 24-8 line 2973 [ 1532.204525] binder: 29974:29982 DecRefs 0 refcount change on invalid ref 3 ret -22 [ 1532.208580] binder: release 29974:29975 transaction 274 out, still active [ 1532.212546] binder: 29974:29982 ioctl c0306201 20000380 returned -11 [ 1532.226113] binder: unexpected work type, 4, not freed [ 1532.231413] binder: undelivered TRANSACTION_COMPLETE 14:47:16 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000440)='/dev/rtc0\x00', 0x80000000, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000100)={0x1, 0x81, 0x2, 0x81, 0x303, 0x3, 0x9, 0x7, 0x0}, &(0x7f0000000180)=0x20) write$FUSE_NOTIFY_STORE(r3, &(0x7f0000000080)={0x30, 0x4, 0x0, {0x3, 0x200, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x30) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f00000001c0)={r4, 0xb71, 0x4, 0x100000001, 0x720000000, 0x7}, &(0x7f0000000200)=0x14) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000000380)=0x4, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280)='nbd\x00') sendmsg$NBD_CMD_STATUS(r3, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20100}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, r5, 0x108, 0x70bd2a, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000580)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x21000002}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)={0x98, r6, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_LINK={0x58, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x10}, 0x8040) r7 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r7, 0x0, 0x2, r7}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r7, 0xffffffffffff2f4b, 0x2, r7}) [ 1532.253084] binder: undelivered TRANSACTION_ERROR: 29189 [ 1532.258877] binder: send failed reply for transaction 274, target dead 14:47:16 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2}) 14:47:16 executing program 1 (fault-call:6 fault-nth:0): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:16 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x2000, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x80040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl(r1, 0x4, &(0x7f0000000080)="9659c175accf7a33a15aa5c248f928c1604b5f2d85896370c6fa2f843e2966e88b29ed35f2b2b03ad7d86a0e2dcf912e41fc4d7a9664a8c67961b209679088747116fedfa213d3d44da8dcea1789adcada039ae283513cdaa07c62af664af2ff311236938f23b92696707857382475a69df7b105feaedf820e1491423b53047d5da7e7d7367b137788922e034ba6f1a0be") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x28400, 0x0) write$FUSE_NOTIFY_POLL(r4, &(0x7f0000000200)={0x18, 0x1, 0x0, {0x7fff}}, 0x18) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) 14:47:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:16 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f0000000140)) r2 = eventfd2(0x0, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000180)={0x40, {0x401, 0x3, 0xfffffffffffffffe, 0x800, 0x7ff, 0x6}}) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0xff, &(0x7f00000001c0)="3dbcf4f4deb7d2542aefa27162e6b4c6e1dd36b85e75012b9d3a6c76ed45eb4b1bbba317f928f2d4a7e3275b3cb99d29bb7ee6bdf727707155e8361440e14afcb7b1ae625b103cb47b4f9a7d2ea6b749a17a6c3bec1335e64bbcd11371f0a4c70c47e23e109e30564c0b7804f33975e6f9fef766670b0072534f755b", 0x7c) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) sched_getscheduler(r3) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x12000, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1532.594787] FAULT_INJECTION: forcing a failure. [ 1532.594787] name failslab, interval 1, probability 0, space 0, times 0 [ 1532.606358] CPU: 0 PID: 30017 Comm: syz-executor1 Not tainted 4.20.0-rc7+ #15 [ 1532.613669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1532.618908] Call Trace: [ 1532.618908] dump_stack+0x173/0x1d0 [ 1532.618908] should_fail+0xa19/0xb20 [ 1532.618908] __should_failslab+0x278/0x2a0 [ 1532.618908] should_failslab+0x29/0x70 [ 1532.618908] kmem_cache_alloc_trace+0x125/0xb90 [ 1532.618908] ? kvm_irqfd+0x166/0x31f0 [ 1532.618908] kvm_irqfd+0x166/0x31f0 [ 1532.618908] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 1532.618908] ? kstrtoull+0x76e/0x7e0 [ 1532.618908] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 1532.618908] ? _copy_from_user+0x184/0x260 [ 1532.618908] kvm_vm_ioctl+0xb52/0x2c00 [ 1532.618908] ? __msan_poison_alloca+0x1f0/0x2a0 [ 1532.618908] ? do_vfs_ioctl+0x184/0x2c80 [ 1532.618908] do_vfs_ioctl+0xeeb/0x2c80 [ 1532.618908] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 1532.618908] ? security_file_ioctl+0x92/0x200 [ 1532.618908] __se_sys_ioctl+0x1da/0x270 [ 1532.618908] __x64_sys_ioctl+0x4a/0x70 [ 1532.618908] do_syscall_64+0xbc/0xf0 [ 1532.618908] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1532.711783] RIP: 0033:0x4579b9 [ 1532.711783] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 14:47:16 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2}) [ 1532.711783] RSP: 002b:00007fe0ba390c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1532.711783] RAX: ffffffffffffffda RBX: 00007fe0ba390c90 RCX: 00000000004579b9 [ 1532.711783] RDX: 00000000200000c0 RSI: 000000004020ae76 RDI: 0000000000000004 [ 1532.711783] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1532.711783] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe0ba3916d4 [ 1532.711783] R13: 00000000004c09a8 R14: 00000000004d21c0 R15: 0000000000000008 14:47:16 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f0000000100)) r4 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x8, 0x40) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r4, 0x810c5701, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0xa0000, 0x0) setsockopt$inet6_int(r5, 0x29, 0x4c, &(0x7f00000000c0)=0x81, 0x4) r6 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r6, 0x0, 0x2, r6}) 14:47:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0xffffffffffffff81) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0xffffffffffff2f4b, 0x2, r2}) 14:47:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x200000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000080)={'batadv0\x00', {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x27}}}) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) 14:47:17 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2}) 14:47:17 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) 14:47:17 executing program 1 (fault-call:6 fault-nth:1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:17 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x4000000000000000) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:47:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x403}, 0xfffffffffffffee0, &(0x7f0000000280)={&(0x7f00000001c0)={0x14, r2, 0x2, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000001340)={0x3, 0xf9, "422087ff583d933a136a9fcecfe8337e0b203307a0d134e1dd2955107c533af866c95fcc2d37485343e810e71f9eca06b0a15aa8f3608b5102b0d5779fc04d76e3c2e2f814d58e99b88bc1fd9c0919939b97b563945e0d4d0c2fbd98054226c90cbd60f7463a8db707c9100adf8c70f2e678ea17d74c5c3273ca97904969d64602b39b3027fc617a650d27e80db780fe0ce2f25f16d9b2160adf79ac4d92672c24996a11ed328e3f6270ca90c34ab11f4cd73358bb4a5d04c15640117d7b22f801c9ec59b7212ee1560b055dadebc96101226cbc9b97369806fbcb4dbaf334aa2378f12f6c4a1d699ab6c6b5ca590fe8aedb4f7d23ec656096"}) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000340)=""/4096) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = eventfd2(0x0, 0x3) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r4}) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r4}) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000001440)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r4, &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RGETATTR(r1, &(0x7f0000001540)={0xa0, 0x19, 0x1, {0x20, {0x20, 0x4, 0x3}, 0x30, r5, r6, 0x8, 0x0, 0x3a, 0x7, 0x0, 0x200, 0x401, 0x4, 0xa0, 0xffffffffffff8001, 0x1, 0x0, 0x0, 0x0, 0x271}}, 0xa0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r4, 0x4}) 14:47:17 executing program 4 (fault-call:4 fault-nth:0): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) [ 1533.739835] irq bypass consumer (token 00000000f81cfe3c) registration fails: -16 [ 1533.747864] FAULT_INJECTION: forcing a failure. [ 1533.747864] name failslab, interval 1, probability 0, space 0, times 0 [ 1533.759323] CPU: 0 PID: 30071 Comm: syz-executor4 Not tainted 4.20.0-rc7+ #15 [ 1533.766640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1533.769203] Call Trace: [ 1533.769203] dump_stack+0x173/0x1d0 [ 1533.769203] should_fail+0xa19/0xb20 [ 1533.769203] __should_failslab+0x278/0x2a0 [ 1533.769203] should_failslab+0x29/0x70 [ 1533.769203] kmem_cache_alloc_trace+0x125/0xb90 [ 1533.769203] ? kvm_irqfd+0x166/0x31f0 [ 1533.769203] kvm_irqfd+0x166/0x31f0 [ 1533.769203] ? rb_erase_cached+0xde8/0x2c00 [ 1533.769203] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1533.769203] ? __list_add_valid+0xb8/0x430 [ 1533.769203] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 1533.769203] ? _copy_from_user+0x184/0x260 [ 1533.769203] kvm_vm_ioctl+0xb52/0x2c00 [ 1533.831796] ? __msan_poison_alloca+0x1f0/0x2a0 [ 1533.831796] ? do_vfs_ioctl+0x184/0x2c80 [ 1533.831796] do_vfs_ioctl+0xeeb/0x2c80 [ 1533.831796] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 1533.831796] ? security_file_ioctl+0x92/0x200 [ 1533.854792] binder: send failed reply for transaction 279 to 30024:30030 [ 1533.831796] __se_sys_ioctl+0x1da/0x270 [ 1533.831796] __x64_sys_ioctl+0x4a/0x70 [ 1533.831796] do_syscall_64+0xbc/0xf0 [ 1533.831796] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1533.831796] RIP: 0033:0x4579b9 [ 1533.831796] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1533.831796] RSP: 002b:00007ff8c6ca5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1533.831796] RAX: ffffffffffffffda RBX: 00007ff8c6ca5c90 RCX: 00000000004579b9 [ 1533.831796] RDX: 00000000200000c0 RSI: 000000004020ae76 RDI: 0000000000000004 [ 1533.831796] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1533.831796] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff8c6ca66d4 14:47:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000100)) mmap$binder(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x8, 0xc813, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000640)=[@dead_binder_done, @decrefs={0x40046307, 0x1}, @reply_sg={0x40486312, {{0x3, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@fd={0x66642a85, 0x0, r2, 0x0, 0x2}, @fda={0x66646185, 0x7, 0x0, 0x38}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}], &(0x7f0000000440)=[0x18, 0x0, 0x38, 0x0, 0x20, 0x28]}, 0x10000}}], 0xfffffffffffffe58, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:47:18 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000400)='/dev/mixer\x00', 0x100, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000480)={@loopback, @empty, 0x0}, &(0x7f00000004c0)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000500)={{{@in6=@mcast2, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @broadcast}}}}, &(0x7f0000000600)=0xe8) sendmsg$nl_xfrm(r3, &(0x7f0000000700)={&(0x7f0000000440), 0xc, &(0x7f00000006c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="540000002000020129bd7000fbdbdf25000000007f000001000000000000000000000000fe8000000100000000000000000000bb4e2442484e2000000a0020a0bf000000", @ANYRES32=r4, @ANYRES32=r5, @ANYBLOB="08000c0000000100"], 0x54}, 0x1, 0x0, 0x0, 0x48080}, 0x24000050) r6 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x2, 0x0) syz_kvm_setup_cpu$x86(r1, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000380)=[@text16={0x10, &(0x7f0000000300)="0f0059da0f0d1866b8010000000f01c10fc79f0000fcbaf80c66b89238d78766efbafc0cedbaf80c66b8b4d73c8a66efbafc0cb8616cef652e0fc79810100f090f1925", 0x43}], 0x1, 0x1, &(0x7f00000003c0)=[@cstype0={0x4, 0x9}], 0x1) r7 = eventfd(0x0) r8 = add_key(&(0x7f0000000080)='id_legacy\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000180)="7ba59fbaf3af0f6c41b75dc81a3b0ce267e575fe7d614915ea2d6c2def8041e6c54ad0724fd1c510e4f695983b1686d44d9147064e5c55b11361cac97445c13c6eb72aaa3c75106bdb4568ef57be2aa9b958c56dafe4a88793d0a36fe3f26165ebc449be1593a847130005104e8a0727a014d34a16a4dd3a403b8b757c251cea70541f5b8245b3129522998b3f5092004522d4752b83d42dddce949204f56c5753334be1b1c55659e12680ec1e45505b6617ec15e4c9bb21a69e2d90febf28a5efe38b68ba08136ae81247f7d7550a", 0xcf, 0xfffffffffffffffa) keyctl$get_security(0x11, r8, &(0x7f0000000280)=""/106, 0x6a) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r7, 0x0, 0x2, r7}) 14:47:18 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) r4 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r4, 0xc0945662, &(0x7f0000000180)={0x3, 0x0, [], {0x0, @bt={0x5, 0x4, 0x1, 0x0, 0x81, 0x1, 0x6, 0x1, 0x7fff, 0x9, 0x0, 0x4, 0x400, 0x1, 0x11, 0x39}}}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x88, 0x8f4, r3}) [ 1533.831796] R13: 00000000004c09a8 R14: 00000000004d21c0 R15: 0000000000000006 [ 1534.055387] binder: undelivered TRANSACTION_COMPLETE [ 1534.060867] binder: undelivered TRANSACTION_ERROR: 29189 14:47:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$EXT4_IOC_RESIZE_FS(r1, 0x40086610, &(0x7f0000000000)=0x3f) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ppp\x00', 0x420800, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r3, 0x80045500, &(0x7f0000000180)) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0xfffffffffffffffc, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1534.107014] binder: 30082:30083 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:47:18 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x1, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f00000000c0)={0x0, r3, 0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) 14:47:18 executing program 4 (fault-call:4 fault-nth:1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:18 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0xfa, 0x400000) ioctl$EVIOCGREP(r3, 0x80084503, &(0x7f0000000180)=""/147) r4 = eventfd(0x400) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:47:18 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3, 0x0, 0x6, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) open$dir(&(0x7f0000000100)='./file0\x00', 0x20202, 0x20) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x440102, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x2400, 0x2) 14:47:18 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) finit_module(r0, &(0x7f0000000080)='/dev/kvm\x00', 0x1) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:18 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x4000, 0x0) ioctl$VHOST_SET_VRING_ERR(r4, 0x4008af22, &(0x7f00000000c0)={0x3, r3}) 14:47:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0) ioctl$VIDIOC_S_TUNER(r2, 0x4054561e, &(0x7f0000000140)={0x6, "7f720a05709697f9a2d49ddf86ba7fc481bf01faa03b77efb96222a75c8a986c", 0x5, 0x70, 0x3a7, 0x81, 0x16, 0x3, 0x3, 0x1f}) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) 14:47:18 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x4000, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) arch_prctl$ARCH_GET_CPUID(0x1011) [ 1534.760037] irq bypass consumer (token 00000000e120a49b) registration fails: -16 [ 1535.018231] irq bypass consumer (token 00000000af7e34ca) registration fails: -16 14:47:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:19 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000080)={0x0, r0, 0x7, 0x100000000, 0x81, 0x3}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x10000, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000180)='/dev/kvm\x00', 0xffffffffffffffff}, 0x30) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000200)={{{@in=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@initdev}}, &(0x7f0000000300)=0xe8) ioctl$DRM_IOCTL_GET_CLIENT(r4, 0xc0286405, &(0x7f0000000340)={0x9, 0xffff, r5, 0x0, r6, 0x0, 0x8001, 0x9}) 14:47:19 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, &(0x7f0000000080)={0x0, @speck128}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000100)={0xb6df, 0x1, 0x100, 0xfff, 0x7fffffff, 0x4}) 14:47:19 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x101, 0x2) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f00000001c0)={0x115002, &(0x7f0000000140), 0x0, r3}) getsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000080), &(0x7f0000000100)=0x4) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) 14:47:19 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x100000000000000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) [ 1535.065078] binder: send failed reply for transaction 283 to 30082:30083 [ 1535.082441] binder: undelivered TRANSACTION_COMPLETE [ 1535.087618] binder: undelivered TRANSACTION_ERROR: 29189 14:47:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x80000, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x200101, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x80) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:19 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) r3 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x4000000, 0x200000) r4 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) 14:47:19 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) r3 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x7, 0x2) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) bind$unix(r5, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) listen(r5, 0x0) connect$unix(r4, &(0x7f0000000480)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r4, &(0x7f000066fff4)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) accept4$unix(r5, 0x0, 0x0, 0x0) openat$cgroup_int(r3, &(0x7f0000000140)='io.max\x00', 0x2, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000180)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:19 executing program 2: pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mmap$binder(&(0x7f0000ff5000/0xa000)=nil, 0xa000, 0x1, 0x1010, r1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x10000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000000040)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) 14:47:19 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001240)='/dev/kvm\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) pwritev(r2, &(0x7f0000000100)=[{&(0x7f0000000180)="51b0d756349f005e0651df50385fa8dc1739083789f1e27bc2da0034c184e4c2acafa25e1c7ab80b81e2986c52dd85abc5f3117eab67119dd643c4b4eed85ea37b0d1fb1abe0abfbfaf3edb150f821b653b0bb4c84a525a260378d472271b0caa914d5568d950e04642594531f98936d46257a5c27d9cd21eb8cbc9792a850a7d1bda6c574dd10e7353bf012684e3ec8e490e5a64b68", 0x96}, {&(0x7f0000000240)="118a759c8e7d4f945424a061c5352b3e8fc5a12f94dc3d581b29d051a1cc39f06acd3df7e4d379b12835f049d693ecbac37dac6a47af54ca73e26784bde2631f6528da9c246803ed5ee0a3cffd586669350b6da1e658d915b1704aa91aea36398ce456a389f692f2a2f941931bd2d15e1318ff1db27ef78ceaea45e47a0c6a95b27e27b7e5e463032834c9bf17bb03822cf7c54d6decf46235bb2946b2a5efbe964349ee2041dd80832a3b8908b27dfaa6d97cc11d24ebe5ef5eec912590c1bec6396c634a9d761e3e8e4cbfcd5b7a1d40a56b239b7e06f965a700ce091aaa192f6abd4acf510aead3099669626977bc4360544d193ab15e322219398965da0ef6a6979ea5d908a4e6fccaab988138b966ffbc1d70a32e23c8461b1dd84e245a733f3e477451f8d9deb4064308d33aab776e091d8ab0595150d8b4a7550da97fa1afdbf73c567c33a3dd4afbcb35599cc466028a7d8fc5c05791e96c903fe91800108ae5250be73c06bb417ace8fea740c913889c92403e54d8361f4e7283c0f22b5205e4c89d29b91a590021376af98bea44e8c53091a919ccbb09dd511a349bec49eebb5bff1c54981d401882b0fcf8fa022230ed9c0edd8f3837a112f12a60ac0baf21ab4769bbd45928c928397139d1771cc0c27b5af2776183ea1481d541e7567ef085d2ab59bc3c37b86149b8db29bbd9acf7a17fdfc51b5fd7b0040ba80f84f2cacbcb6bf7de3cefae48460cdfba7f690bf5b2cb860328070d13ae16f46ae212ece3b4d43f81fd3b02cddb349eec75fd7dbe2971e543bdbdf1029bec7680e00b16d328217f7164c91b83d42e56fb4182935053b0c184a28b276e5df6a263a029008cc231ae5f7f3aea1bb7d79dea23f1ec162640265d60de347087f544249891c5d42d52c1b3ecc3887d4e3ff8dce20670da053457ef82a4de4769514c1984173f557f67871409badf53c7ad9542c6685438fd5a335942aefebbf649bb3e644ab1aa1cb63e71a869e4ce28e26be0ade6c7011416086022a0d98fd194992c5ce57b06f2adde4f0352ffaa5cb4a4be3c3d4dcfdc06071c50a762176d332d0fb89dddcadfa9a2837dbbdb0f9fae694fcb96c5197a2a51d6a75f38ba6432607680b412d357a6b47adf24dcb4b582215b2d2bdacd434b3eaf9eeddcad6f6e2b4ab112e28e6cc6b27eba53e4988e50227bc5c1aeb1e90b439114fd5f7924b398b0753bd033daa2108e3f5c033ae9e4669e258723436efeb600015ccfcc516f0b81deab470ba3c42b66c1a15b681b4f7c34b6714cdb6942504cfe52245315385ae68c55cbe89d3f723c8f4f5823e125a7ac323be02bb174d0a5aac2becdf557be9de118b902bccdb5e770ef97fd634702dec700ecf1d8619e6490f6dc788f2b0dcde682af542acd20617043d834795d8eee0522261cb01c7a9948d0b419eef8a0fe9cf7994cec209e145c692a1304662d3f31f98b69d9bd38eabb1ededc39f05a74eefd320c7335febb0f6077723b9e13e79341768e2e5a1e15fec9496e9a077977ca1da1bd78acf76ae7475f26663a87e7146e1a840e3c8bddde9203e894365fa76e909d7a2dd0e97070b345a576047e18197121830f50b548953c6fb151ee5f48b1126ad8179e80b34b141a9b00f05b717f4c59608d9917e924b2b3f75481c05c4fdd4464fce8c3c50619d5f8816c339c692fb62f996ec414b7a6ada61a838947c532c8a25d5fd45fe094de76959331d29fdd3eef52d31b26c5a5602ff2a76bab608cd51a54aa258b2819742aa887f7efc4675ca49882aca3064e9b4195b57712f53477a5844720744428348bc7743b6756e13086971f89d0c35b25205ccf949179f3939820082ee144afed07bea5e0f85bb5fe56228ba6216bd8e04916d4ca60dd1e58792c0ca92178fe6396234eb5a5b517ed7db37fb95812595ebc59834a4084f238fa2db0c00989b9a1a3870d862b4e33aa07a47fa780cfb97da9d7e67b0ecc2c448939b3cb846d61f1254373397c649befae23464e2f9127c17a092c4b0c9451dab6273017d23d095b3247870d862dfe9f3d704079e8b265830abc1a2ca8c8496380d1b9ecf370cae1979a8121becef88637a1035fd5bca0513fd5a115107de6e8e2b38e49ecc8111d8b6f6eec221cad584e5ca4e713dd5c7c8963037e8445904ff9e40abf2be26e727c773d51a95ee550292a64ecdb3702e639d376122c800ff3ed445d06fac05b4888676f9e6b9256f57c09ce6cbfd821187c22cc63d77b0b0a292342ed1675441d5996a5b2cf82f32b188596a5f2023d08528ec43d52ad4e64c9ae519415c14c7c531286b28c3a005c12a7669b7b186885eba3d182751880401d4d933aa6e1473ba947fbce1e4032aa72e347d9ca4da6d08b2cbcfb039a1649685b2ab13566e04e27b481035f7abee5d8f2b30de66440e1ef68a73e7c16bb68bd1e59c0faac080b090f3a223629f9dc62e186f2723fe07c4385f9c9e2d139c09dd621c6aaf9c73b62302122946cd747667bcb677eaf7c08721d2fcb2c0f511255272079fd3db344fdf5a69fe7b40bbfd958b82f76d290149d00007526ec1787ad78feb4cd7015798bcd1558b209beef46c06f73cca0308b3b3fc30afee867614a162f4994d94c5bc0f42abc283ed7bfa2abdff5f3551085a31f1db8b803faa8af5fb61aea1a46b8dfd6ca3b8443ddc4fbe928225760e66cd922b7183c8fcda88c1ad647d01af560448184d9ee2b16d66298e3c4968fc180427e025c9b2ca8bbd68f9c7952b8b14d03c9e252a02b8793fce80472c38ec5aca7ab0ec18841b3a91389b2bc979015e478fcfed27cafc0c31d3cb5ea90b419a1e2ef7a38fe627e830626bd0b6fe42105cfb6bf763e7eb0e7f3e4144157c2bb41348e7b3db6e6378d7ea683ad9477faae5ff91ab5e91a9e9e829591092c62b0be0118124f6821179c918345bb9031c427af1e21cf441f624f28b0d8d4717dd1554f3ce235c698e29192d51a4c3bedcdcbea9a2bf517ac40a5cdfefd4326e155d5bed472bf01b87ec193ad6b0be851c79d0cd060b7079d5423c3044c9151fd00809c45f8f6bb9437cb1958e022f2b2b97ec438b112ba937549b24a8796100133619310e55c44e9353009a585fa39da9d2b26e830d1df9e57b1417d258e8b8fc113dbd80734ffee8051324e7c1a341ffb28bf2e6d8b0b98adc6507a253dc50025f1885a8f63eafcefee00a0676ccbd7efc2f9debd9879311ce1664df0775916c4bc227ca1c31044b829331ea549b84810d2f5c591dab875dc108021b46a11d569ea16f72796dc94835bacec669bb5346db9cd3b4a487951fd8a7e1885c7eb80be07ada8d814908de000155a7773ce38a93395705f7692ade0591d6e3c88eba7f63fd91a6547f478be95ccfe68fa70da3653cb55745a630d78582a5bdce1de7866649d0d5587a32f25019cb1c91a0167669c5db1aeab007a738e8b78ccbcc3333de4be9743a00b1204cf5fe1942c6f6c5d0465bdcd1d8b2c98d7ebd9ab794f4a60303a34a0e8d5da46f71107881fa8c24890eaa6039b78ddb38c3a6a70d38b2a7cc44b76369a0ad94129e126b1f558ca606a830d246d8f01d35286e4750dec9d5832310c3b58b521ece360f2c753201a53c88614df51ee97d8b501378178d88de4b88df4972a1c6c1eef9a32ee5c0a27b9d2d715d9a4369d57908862c6f74fced650a9376438bae7e503a13b23f5ac1c868dce6d1f06835165d3f4399bdf468979edb200ae166cda2b5eff911bc0f0e6564638f3c04e628317313b6e07955d3198476bdda4dc8b7a9a09eb60077d23a2a01572cedca9a7157e5db275863a87d2ccb5c93ff77543e31c165395c4f89a80ff288eda8c5b5c4bc7c2be5d24bb1db5321bd8e87ccec609fe3c8556d583cb16d76d10aafbb88639fe0a0b5d98da0cb942e4e6d39cbf2fb098ccd52a8d73963499410d0c88e12d8013037468bcd2068c3c038b68697956b441dcf80cdeaee889c87f2a71de1ae70cd32e50968142d2e12e3f908d49df307ee91af38d51c588c3a693d6eb8f92b2ca227f69bf70b35c2029422d6679c4a1267b6840ffcf92cf3f81d03f56cfed69c7c94b41a1b28d0c70c8b8fa70302f5b3b7a98e299834417575c7fb353db568c38eabb80a40b2da65ac07d4d608a9ce2e5eeb42d9209bcc9caeb5572a6261e3e88f518226127f2fde1aa5dbe4ad36d27872583a839f954733106522628b68a13244c2984902eb0a080c0c832e41270d40ae194c11747a5954408fd614d32dfdc4e5218885238b3fc317b747a76329ed7ab3b9acbc477aa4163459096858e9d29a34f243591d750a6d41947d840bc9403224f62e518852c3e5390a1c14885e495ef9c2db693862df948ca02a3cb6aa3e53e03e425e8a62a151b8208d5a418c2ace3fb23757450dceff597f21a1d859a7c03f403962bb4c97dcc9aac4f51c408c68478f24cb60dbc301761c2dc6aaf850f46ab3a4e18f4d29760494eddd9c22ec723e08bd074025bc1fc1fea744a7df7c2ab2884fe6ef00545603da7831704c12a4a867716e499597ba02b949ce6ded0f6138ca6534656d40f846f68cadd5166ce9d5b19cd44093fddfd2ec862d43f13644e833bca90611f96f6d6f9cc03328503eb4c2d02c8bca4d72d8b74db1619ce5a76584d889fcf5c56ac46fe43472fd9b44608fe00520f0f8d0e291ed09dfac28045c9a2ba0a9a61d1a5fca812549c08dfdaf4fdc019c392d1707f698a3e175bfe842c11748c274144d0b5daad9f83e0edd3380f41ceb2a2e367f068dc7253388345a0c04e02e7f711893694fea30eb31a8f07687c52fdcb45b9c01614b8cb1acd085170ff2b64e64608969c34aa759681e2750bd0df5bc7c3b59fe9cc17a9029db03ee40932498b2f789fe6d603ed30b1f51a82346f125c257ea26b0dfcdbb5e7a5a2c766e68758890d705aeb6cc43898cf6ede4805c36354c84d59d8fb0cac9239364da3408820973a6cd21c4e3abb5c4efa03efc5be077a5774246a46a0156ae29f69cf0c75767fc2830e1b013458475f9e7aaeb082cd3e00fa054926b45750d9d9a127f9a6823083604f3787180df6cc6f4e32e8bb3af2a26e3f9c34d57003c16fc61517bf58e6ea7de0a6cd0de39a509ca473bd301382c0553050d03e5b9c197e03d3b979041628f896ee5b0f8cebd269e66215539ecb2ac11ed5ab3711e559f1ec71017f3c2ed65b815e9a9d510a5936181475496e3f000b4a579f5e6ac495c6aae4770970e355be658de4ea55f688d3b4586a1f2980b77aba046b9e6934a608b0adf9289018b01af1bcc1f5a23a6097ef7d74a2c77ffad04cc58ae1d38f4409bce73ce85ac39e171b33ab19c3d082c516b1a5ac5a2ca724e12c9a35fd6684c3e862efdb0367b80ef73b7f07da6fe159b65e5855f1269b571fe4f9d22a7bd3f5e1b1059482419d69b4d29a8d72e4bbe396e53129847f6f5bc32366aa7c5c7a0829eea3f84231c99c3a32ceb9d96b4ffe628ec1bc9686725f48f6c08b6869e29e2534430986cfc9be988770b9f2a195077e55e2b8f6023f47d924e92d9fc2a58523e0fc873534c7d2e37371b416ecda57b20644a450ac9e4fe5bf75e69bd5267aaa943bc69e3ef4eaa8e9db803c4e0c951879a729ecd8e3be9ad7d12d7d9ba75911c7405120a2c75c795d031ea8e83c1e7503abb47e59e8d63faa87ecb2aa9be1970ae25ae8c0168704e74b2173b5f44fda8c4304bc105377e332dcada7741f76ce48fb30cbd2cc9dfae519caf7e271070847853bf0821a130cf41724f", 0x1000}, {&(0x7f0000000080)="8c09cd5b0df0e96f6427cb9227af9daa24df78468e95a9ef742bfdf472fbc2af996e77d51c0cedc4178015", 0x2b}], 0x3, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x800, 0x0) ioctl$GIO_UNIMAP(r4, 0x4b66, &(0x7f00000012c0)={0x0, &(0x7f0000001280)}) ioctl$TIOCGSID(r4, 0x5429, &(0x7f00000013c0)=0x0) r6 = geteuid() getgroups(0x8, &(0x7f0000001400)=[0xee01, 0xee01, 0xee01, 0xee00, 0xee00, 0xffffffffffffffff, 0xee01, 0x0]) sendmsg$unix(r1, &(0x7f00000014c0)={&(0x7f0000001300)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001380)=[{&(0x7f0000001280)="76f1848f1b7e84c906cc9c5ad8b4b1a7ef6a2cd5980ec71daee57d45f495e94354b8928371c55bc0078d1e2ab4015d", 0x2f}], 0x1, &(0x7f0000001440)=ANY=[@ANYBLOB="30000000000000000100000001000000", @ANYRES32=r3, @ANYRES32=r0, @ANYRES32=r2, @ANYRES32=r3, @ANYRES32=r4, @ANYRES32=r3, @ANYRES32=r2, @ANYBLOB="000000002800000000000400c83d78e77e3cd6e0", @ANYRES32=r1, @ANYRES32=r4, @ANYRES32=r4, @ANYRES32=r2, @ANYRES32=r2, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r7, @ANYBLOB='\x00\x00\x00\x00'], 0x78, 0x40010}, 0x20008004) 14:47:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) ioctl$sock_inet_SIOCGIFPFLAGS(r2, 0x8935, &(0x7f0000000080)={'bond0\x00', 0x5}) 14:47:19 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x7, 0x400002) syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x7f, 0x119103) r2 = dup(r0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0xf) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) 14:47:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000040)='./file0\x00', 0x8000, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000000c0)={{{@in6=@dev, @in=@remote}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000280)=0xe8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:47:20 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={r1, 0x0, 0x2, r1}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={r1, 0x0, 0x2, r1}) 14:47:20 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) r3 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x488000) connect$vsock_stream(r3, &(0x7f0000000100)={0x28, 0x0, 0xffffffff, @reserved}, 0x10) getsockopt$inet6_mreq(r3, 0x29, 0x0, &(0x7f00000001c0)={@ipv4={[], [], @multicast2}, 0x0}, &(0x7f0000000200)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x5, 0x3, &(0x7f0000000000)=@raw=[@alu={0x4, 0x5, 0x0, 0x3, 0xf, 0x6, 0xffffffffffffffff}, @exit, @jmp={0x5, 0x7, 0x0, 0xf, 0x7, 0xc}], &(0x7f0000000180)='syzkaller\x00', 0x237ac03e, 0x0, 0x0, 0x41f00, 0x1, [], r4, 0x7}, 0x48) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000140)={r2, 0xffffffffffffffff, 0x5, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:20 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x40000, 0x0) ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f0000000140)={0x3, 0x9}) [ 1536.146933] binder: send failed reply for transaction 287 to 30142:30143 [ 1536.154954] binder: undelivered TRANSACTION_COMPLETE [ 1536.160237] binder: undelivered TRANSACTION_ERROR: 29189 14:47:20 executing program 3: r0 = syz_open_dev$media(&(0x7f00000001c0)='/dev/media#\x00', 0xff, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000100)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:47:20 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/icmp\x00') ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f00000000c0)=0x7) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) 14:47:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$RTC_WKALM_SET(r2, 0x4028700f, &(0x7f00000000c0)={0x1, 0x0, {0x18, 0x31, 0xe, 0x1a, 0x3, 0x9d8, 0x2, 0xc5, 0xffffffffffffffff}}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000004c0)={0xfffffeb3, 0x0, &(0x7f0000000480), 0xfffffffffffffe7c, 0x0, &(0x7f0000000400)="0eb2842bc8293056590258725f50757b758ee914ecf354603a7f75f8766b7149efc1fe770423a2dc46aac05eac5f1c132a6978cb4c72ea954c9144458629ebc8d7bad35b3918bc2632bd610eef3e0edf5d"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:47:20 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x2) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) [ 1536.418401] binder: send failed reply for transaction 291 to 30193:30198 [ 1536.443922] binder: undelivered TRANSACTION_COMPLETE [ 1536.449077] binder: undelivered TRANSACTION_ERROR: 29189 14:47:20 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0xfffffffffffffffe, r2, 0x5}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1536.577406] binder: 30210:30212 unknown command 0 [ 1536.582727] binder: 30210:30212 ioctl c0306201 200004c0 returned -22 14:47:20 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x8080) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000140)={0x0, 0x100000000}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f00000001c0)={0x5, 0x8001, 0x8000, 0x5, 0x9, 0x3405aef4, 0x7fffffff, 0x300, r4}, 0x20) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$RTC_RD_TIME(r3, 0x80247009, &(0x7f0000000100)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:20 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) perf_event_open(&(0x7f0000000180)={0x3, 0x70, 0x0, 0x1, 0x8f1, 0x8, 0x0, 0x9, 0x4, 0xb, 0x7, 0x8, 0x9, 0x81, 0x1000, 0x7, 0x81, 0x260d50ae, 0x8, 0x2, 0x2, 0x8, 0xfff, 0x9, 0x5, 0x7fffffff, 0xfa, 0x1, 0xc25, 0x2c5e15e0, 0x9, 0x5, 0x6, 0xcf, 0x101db424, 0x7, 0x4, 0x1, 0x0, 0x0, 0x2, @perf_bp={&(0x7f0000000080), 0x1}, 0x40, 0x3, 0xff, 0x8, 0x1000, 0x80, 0x4}, 0xffffffffffffffff, 0x10, r0, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x3ff, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4) eventfd(0x0) 14:47:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)=ANY=[], 0x1, 0x0, &(0x7f0000000540)="fc"}) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0\x00') r2 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x7, 0x100) ioctl$EVIOCGREP(r2, 0x80084503, &(0x7f0000000400)=""/129) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x189001, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0x0, 0xffffffffffffffff, 0x0, 0xd, &(0x7f0000000280)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x7f) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/qat_adf_ctl\x00', 0x100, 0x0) 14:47:20 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) [ 1536.843865] binder: send failed reply for transaction 295 to 30210:30212 [ 1536.868252] binder: undelivered TRANSACTION_COMPLETE [ 1536.873630] binder: undelivered TRANSACTION_ERROR: 29189 14:47:21 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) eventfd(0xfffffffffffffffd) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x80000246080, 0x0) ioctl$VIDIOC_G_EDID(r2, 0xc0285628, &(0x7f0000000180)={0x0, 0x7, 0x7fff, [], &(0x7f00000000c0)=0x8000}) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f00000006c0)=@filter={'filter\x00', 0xe, 0x3, 0x4b0, [0x0, 0x20000200, 0x20000500, 0x20000650], 0x0, &(0x7f00000001c0), &(0x7f0000000d80)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff020000000f00000005000000000273797a6b616c6c65723100000000000074756e6c30000000000000000000000065727370616e3000000000000000000073697430000000000000000000000000aaaaaaaaaa000000ff00ffffffffffffffff00ffffffffff000070000000d001000000020000434c415353494659000000000000000000000000000000000000000000000000080000000000000001000080000000005345434d41524b00000000000000000000000000000000000000000000000000080100000000000001000000d900000073797374656d5f753a6f626a6563745f723a61646a74696d655f743a73300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000072656469726563740000000000000000000000000000000000000000000000000800000000000000feffffff000000001700000040000000883e65727370616e3000000000000000000064756d6d79300000000000000000000065727370616e300000000000000000006e7230000000000000000000000000000180c200000fff0000ff00ffaaaaaaaaaaaaffffff000000000070000000a0000000d000000072656469726563740000000000000000000000000000000000000000000000000800000000000000feffffff0000000041554449540000000000000000000000000000000000000000000000000000000800000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000feffffff0100000005000000200000000019697036677265746170300000000000006970365f767469300000000000000000767863616e310000000000000000000062726964676567736c6176655f310000ffffffffffff00ff0000ffffffffffffffff0000ffffffff000070000000d000000020010000434c41535349465900000000000000000000000000000000000000000000000008000000000000000200000000000000434f4e4e5345434d41524b000000000000000000000000000000000000000000080000000000000001000000000000006c6f670000000000000000000000000000000000000000000000000000000000280000000000000007b4992f5e78733a153b21c4c95bb6c86359fcfb4af140b47c2cb6fface00400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ffffffff000000005e9026f57bebab84dd1139e8d929b3bd5787cb9e8b3592d246a8fae1455f70a40c5e262a3dc546e48146570c08a1698b5b2a91516938da810516642112191709916b0de02a5900188cc029409d2dfc3a1deadcbc5d5cbe1342b79c0281d924bb26ef74dfa6f3efd7fe60e32c5a219cf601a6c1f1740f07222311284e75b50c54f847ad23a859a94456bd94066f6a9ea9a6fccaab1e0bc2823822afd35997c83d450284b483f92ebbdbf9228306d295d96e252202dc66a941f838ebb26e41e7c5f003ad30076a165cb4f5f9a244c1e29be98f0dc014aa0d97dc61d69b905765b9db51050545f4dfcb502114cbf21934985bcf5e20a8bd4e687378ec47002cfcb8cb7d7f61ff9b59238f2b14913c4dea02f00b158f695a9ef24fa68ac4cb0011cfbd64d49f1dbb7f084a27e939ff05e2d23d"]}, 0x659) getitimer(0xfffffffffffffffc, &(0x7f0000000100)) 14:47:21 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) memfd_create(&(0x7f0000000000)='\x00', 0x5) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:21 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhci\x00', 0x80000, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000400)={{{@in6=@local}}, {{@in6=@mcast2}}}, &(0x7f00000003c0)=0xb7) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000280), &(0x7f00000002c0)=0x4) fsync(r3) r4 = eventfd(0x0) r5 = socket$unix(0x1, 0x2, 0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x3, 0x2, r1}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) open_by_handle_at(r5, &(0x7f0000000340)={0x59, 0x937, "8db7b729cebb069a0d6f58ace3b99699b0f8988d788dfc6c3b5752c6b3bcc703550b5ee8f3d96dcb657cbbc73eb41af0d1890286d4740e3caf6fee242b61ece23ec9f8bff9fef44dd079b811737194f8aa"}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000300)) 14:47:21 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) openat$cgroup_ro(r1, &(0x7f00000001c0)='cpuset.effective_mems\x00', 0x0, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000200)='/dev/midi#\x00', 0xec, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x3) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) r4 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x9ff, 0x50000) r5 = getpgrp(0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f00000002c0)={{0x5, 0x7, 0x4, 0x8, 'syz1\x00', 0x2}, 0x6, 0x124, 0xff, r5, 0x9, 0x5d49, 'syz0\x00', &(0x7f0000000240)=['-ppp0\x00', '/dev/midi#\x00', '\xb9\x00', '/dev/midi#\x00', 'ppp1\x00', '\x00', '/dev/admmidi#\x00', '/dev/midi#\x00', '[selfself\x00'], 0x47, [], [0x1, 0xfffffffffffffffb, 0x1f, 0x40]}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='-ppp0\x00', r4}, 0x3ec) 14:47:21 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) read(r1, &(0x7f0000000240)=""/23, 0x17) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000200)={r2, 0x80, 0xe800, r2}) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000080)=0x4, 0x4) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000140)={0x0, 0xfb, 0xb0, 0x5, 0x9, "9a1e78b2040fc7ec35ea53cfb4b75f03", "a1f1d7163de93827e8fc10430033180813d568d2af522b8848fd8e6f503a770924f07650b74ed3e7bc972f6f4d52511dc2e710570dbd6ddec8526dba3f7156d7c5369415a84fbb95c6745f58dee42057239f82ca1241556d4b8f42bf783a8f037f50d5b45782875de9453c519b868401bc143142fdbe5a168c97013069f96a3ffdf4f08eaee8bf83701c4f460771a073043727b0edffd6aed49a07"}, 0xb0, 0x1) 14:47:21 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = semget$private(0x0, 0x7, 0x100200) semctl$SETALL(r1, 0x0, 0x11, &(0x7f00000000c0)=[0x9, 0x1, 0xe4, 0x7ff, 0x5, 0x6, 0x0, 0xd85]) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) r4 = getuid() openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x10000, 0x0) getgroups(0xa, &(0x7f0000000140)=[0xee01, 0xee00, 0xffffffffffffffff, 0x0, 0xee00, 0xee00, 0x0, 0xee00, 0xffffffffffffffff, 0xffffffffffffffff]) fchownat(r2, &(0x7f0000000000)='.\x00', r4, r5, 0x1000) 14:47:21 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) r3 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x7, 0x2) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) bind$unix(r5, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) listen(r5, 0x0) connect$unix(r4, &(0x7f0000000480)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r4, &(0x7f000066fff4)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) accept4$unix(r5, 0x0, 0x0, 0x0) openat$cgroup_int(r3, &(0x7f0000000140)='io.max\x00', 0x2, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000180)={0x0, 0x0, 0x0, r2, 0x4}) [ 1537.641653] irq bypass consumer (token 0000000070124001) registration fails: -16 14:47:21 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:21 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0xffffffffffff2f4b, 0x2, r2}) [ 1537.755159] binder_alloc: binder_alloc_mmap_handler: 30233 20001000-20004000 already mapped failed -16 14:47:21 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x83a, 0x200001) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000000100)) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) [ 1537.808904] binder: BINDER_SET_CONTEXT_MGR already set [ 1537.814392] binder: 30233:30244 ioctl 40046207 0 returned -16 [ 1537.824789] binder_alloc: 30233: binder_alloc_buf, no vma [ 1537.830568] binder: 30233:30280 transaction failed 29189/-3, size 24-8 line 2973 [ 1537.974659] binder: release 30233:30236 transaction 299 out, still active [ 1537.981887] binder: unexpected work type, 4, not freed [ 1537.987207] binder: undelivered TRANSACTION_COMPLETE [ 1538.042448] binder: undelivered TRANSACTION_ERROR: 29189 [ 1538.048136] binder: send failed reply for transaction 299, target dead 14:47:22 executing program 5: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x400000000003, 0x32, 0xffffffffffffffff, 0x0) ioctl$VHOST_GET_FEATURES(r0, 0xc0044dff, &(0x7f0000000100)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x1080000080800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000200)={0x7d92, 0x1, 0x2, 0x0, 0x967d}, 0xc) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f0000000040)) ioctl$KVM_IOEVENTFD(r0, 0x4040ae79, &(0x7f00000001c0)={0xf000, &(0x7f0000000000), 0xa, r0, 0xc}) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000140)=""/126) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) 14:47:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x115, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:22 executing program 2 (fault-call:2 fault-nth:0): getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:22 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) modify_ldt$write(0x1, &(0x7f0000000080)={0x3, 0x100000, 0x4000, 0x3, 0x80, 0xd8, 0xba5, 0x5, 0x0, 0x9}, 0x10) [ 1538.191864] FAULT_INJECTION: forcing a failure. [ 1538.191864] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1538.204018] CPU: 0 PID: 30301 Comm: syz-executor2 Not tainted 4.20.0-rc7+ #15 [ 1538.211341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1538.215670] Call Trace: [ 1538.215670] dump_stack+0x173/0x1d0 [ 1538.215670] ? __alloc_pages_nodemask+0x7b0/0x5f20 [ 1538.215670] should_fail+0xa19/0xb20 [ 1538.215670] __alloc_pages_nodemask+0x7b0/0x5f20 [ 1538.215670] ? update_cfs_rq_load_avg+0x5e1/0xa10 [ 1538.215670] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1538.215670] ? update_load_avg+0x11b5/0x1a90 [ 1538.215670] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1538.215670] ? __list_add_valid+0xb8/0x430 [ 1538.265070] alloc_pages_current+0x69d/0x9b0 [ 1538.265617] pte_alloc_one+0x5a/0x1a0 [ 1538.265617] do_huge_pmd_anonymous_page+0x87e/0x28c0 [ 1538.265617] handle_mm_fault+0x5b3b/0x9ef0 [ 1538.265617] ? __schedule+0x6f3/0x830 [ 1538.265617] __do_page_fault+0xf26/0x1a60 [ 1538.265617] do_page_fault+0xe9/0x5c0 [ 1538.265617] ? kmsan_unpoison_pt_regs+0x13/0x20 [ 1538.265617] ? page_fault+0x2b/0x50 [ 1538.301833] page_fault+0x3d/0x50 [ 1538.301833] RIP: 0010:__get_user_4+0x21/0x30 [ 1538.301833] Code: 50 ff 31 c0 0f 1f 00 c3 90 48 83 c0 03 72 55 65 48 8b 14 25 00 fd 02 00 48 3b 82 58 1a 00 00 73 43 48 19 d2 48 21 d0 0f 1f 00 <8b> 50 fd 31 c0 0f 1f 00 c3 66 0f 1f 44 00 00 48 83 c0 07 72 25 65 [ 1538.301833] RSP: 0018:ffff8881949bfc28 EFLAGS: 00010202 [ 1538.301833] RAX: 000000002026bfef RBX: ffff8881949bfc30 RCX: 0000000000000000 [ 1538.301833] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: ffff8881949bfd60 [ 1538.301833] RBP: ffff8881949bfe68 R08: ffff8881949bfd68 R09: 0000000000000000 [ 1538.301833] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffffff [ 1538.301833] R13: 00000000000002c9 R14: 000000002026bfec R15: ffff8881949bfd60 [ 1538.301833] ? kernel_move_pages+0x9bf/0x2b80 [ 1538.301833] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 1538.301833] ? prepare_exit_to_usermode+0x114/0x420 [ 1538.301833] __se_sys_move_pages+0x111/0x130 [ 1538.301833] __x64_sys_move_pages+0x6e/0x90 [ 1538.301833] do_syscall_64+0xbc/0xf0 [ 1538.301833] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1538.301833] RIP: 0033:0x4579b9 [ 1538.301833] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1538.301833] RSP: 002b:00007fcd51043c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 [ 1538.301833] RAX: ffffffffffffffda RBX: 00007fcd51043c90 RCX: 00000000004579b9 14:47:22 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) fsetxattr$security_smack_transmute(r2, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x2) [ 1538.301833] RDX: 0000000020000000 RSI: 00000000000002c9 RDI: 0000000000000000 [ 1538.301833] RBP: 000000000073bf00 R08: 0000000020002000 R09: 0000000000000000 [ 1538.301833] R10: 000000002026bfec R11: 0000000000000246 R12: 00007fcd510446d4 [ 1538.301833] R13: 00000000004c371e R14: 00000000004d62e8 R15: 0000000000000003 14:47:22 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) [ 1538.565414] binder: 30309:30310 unknown command 0 [ 1538.570595] binder: 30309:30310 ioctl c0306201 20000040 returned -22 [ 1538.627512] binder: 30309:30314 Release 1 refcount change on invalid ref 1 ret -22 14:47:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x80, 0x0) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f00000000c0)=0x100, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) setxattr$trusted_overlay_opaque(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f0000000180)='y\x00', 0x2, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x4e22, 0x1000, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x20}}}, &(0x7f0000000280)=0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000480)={r4, @in6={{0xa, 0x4e20, 0x6d, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0xc}}, 0x3ff}}, 0x2, 0x7, 0xcc, 0x1d, 0x2}, 0x98) 14:47:22 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:22 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x60000) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000180)=""/122) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:47:22 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x0, 0x0) ioctl$BLKRAGET(r0, 0x1263, &(0x7f0000000100)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:23 executing program 2 (fault-call:2 fault-nth:1): getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:23 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x4000002, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) [ 1539.205192] FAULT_INJECTION: forcing a failure. [ 1539.205192] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1539.211802] CPU: 1 PID: 30346 Comm: syz-executor2 Not tainted 4.20.0-rc7+ #15 [ 1539.211802] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1539.211802] Call Trace: [ 1539.211802] dump_stack+0x173/0x1d0 [ 1539.239307] should_fail+0xa19/0xb20 [ 1539.239307] __alloc_pages_nodemask+0x7b0/0x5f20 [ 1539.239307] ? rmqueue+0xa6/0x1240 [ 1539.239307] ? memcg_kmem_charge+0x696/0xce0 [ 1539.239307] kmsan_internal_alloc_meta_for_pages+0x80/0x580 [ 1539.239307] kmsan_alloc_page+0x7e/0x100 [ 1539.239307] __alloc_pages_nodemask+0x1587/0x5f20 [ 1539.239307] ? update_cfs_rq_load_avg+0x5e1/0xa10 [ 1539.239307] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1539.239307] ? update_load_avg+0x11b5/0x1a90 [ 1539.239307] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1539.239307] ? __list_add_valid+0xb8/0x430 [ 1539.239307] alloc_pages_current+0x69d/0x9b0 [ 1539.239307] pte_alloc_one+0x5a/0x1a0 [ 1539.239307] do_huge_pmd_anonymous_page+0x87e/0x28c0 [ 1539.239307] handle_mm_fault+0x5b3b/0x9ef0 [ 1539.239307] ? __schedule+0x6f3/0x830 [ 1539.239307] __do_page_fault+0xf26/0x1a60 [ 1539.239307] do_page_fault+0xe9/0x5c0 [ 1539.239307] ? kmsan_unpoison_pt_regs+0x13/0x20 [ 1539.239307] ? page_fault+0x2b/0x50 [ 1539.239307] page_fault+0x3d/0x50 [ 1539.335133] RIP: 0010:__get_user_4+0x21/0x30 [ 1539.335133] Code: 50 ff 31 c0 0f 1f 00 c3 90 48 83 c0 03 72 55 65 48 8b 14 25 00 fd 02 00 48 3b 82 58 1a 00 00 73 43 48 19 d2 48 21 d0 0f 1f 00 <8b> 50 fd 31 c0 0f 1f 00 c3 66 0f 1f 44 00 00 48 83 c0 07 72 25 65 [ 1539.344233] RSP: 0018:ffff8881926bfc28 EFLAGS: 00010202 [ 1539.344233] RAX: 000000002026bfef RBX: ffff8881926bfc30 RCX: 0000000000000000 [ 1539.344233] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: ffff8881926bfd60 [ 1539.344233] RBP: ffff8881926bfe68 R08: ffff8881926bfd68 R09: 0000000000000000 [ 1539.344233] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffffff [ 1539.344233] R13: 00000000000002c9 R14: 000000002026bfec R15: ffff8881926bfd60 [ 1539.344233] ? kernel_move_pages+0x9bf/0x2b80 [ 1539.403876] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 1539.403876] ? prepare_exit_to_usermode+0x114/0x420 [ 1539.403876] __se_sys_move_pages+0x111/0x130 [ 1539.403876] __x64_sys_move_pages+0x6e/0x90 [ 1539.403876] do_syscall_64+0xbc/0xf0 [ 1539.403876] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1539.403876] RIP: 0033:0x4579b9 14:47:23 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:23 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_DBG_S_REGISTER(r3, 0x4038564f, &(0x7f0000000180)={{0x2, @name="92334b7cba6fe30b2c8548f37cb61593a2128a82f98009cd4ebcf55431fb9908"}, 0x8, 0xfff, 0x3}) ioctl$RTC_SET_TIME(r2, 0x4024700a, &(0x7f0000000080)={0x1c, 0x3b, 0x4, 0x1c, 0xb, 0x1, 0x5, 0x38}) r4 = eventfd(0xffffffffffffff52) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:23 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x2000000000000000, 0x80000) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) r3 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x1, 0x123800) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000140)={{{@in=@local, @in6=@ipv4}}, {{@in=@loopback}, 0x0, @in=@local}}, &(0x7f0000000240)=0xe8) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1539.403876] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1539.403876] RSP: 002b:00007fcd51043c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 [ 1539.403876] RAX: ffffffffffffffda RBX: 00007fcd51043c90 RCX: 00000000004579b9 [ 1539.403876] RDX: 0000000020000000 RSI: 00000000000002c9 RDI: 0000000000000000 [ 1539.403876] RBP: 000000000073bf00 R08: 0000000020002000 R09: 0000000000000000 [ 1539.403876] R10: 000000002026bfec R11: 0000000000000246 R12: 00007fcd510446d4 [ 1539.403876] R13: 00000000004c371e R14: 00000000004d62e8 R15: 0000000000000003 14:47:23 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) io_setup(0x4, &(0x7f0000000080)=0x0) io_cancel(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x3, 0x8, r0, &(0x7f0000000100)="c844ed5fc3b4300768aaa5294f7a387ef18a32282c0f4ab8512aa5898c2a5db19d775357f9f383c3d8362b2d480fa6dfdf8cb1efb67ad5f5d6340fcdbecf3fa5d1080bf22704f94875dddac5242bc8bf5679b5c5462b9eb7be73ccdb38541c320f049f08f70730fdb20bbe4e486a7c3e10f18349d6adcee56c0c30ea1ece62dd7d50b3509e615c49447966e810dafdc8aa59081aae09b621ccf8915e8fbcb62ddd4b526a8902ebf1", 0xa8, 0x3, 0x0, 0x1, r0}, &(0x7f0000000200)) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) write$binfmt_script(r3, &(0x7f0000000240)={'#! ', './file0', [{0x20, '/dev/kvm\x00'}, {0x20, '/dev/kvm\x00'}, {0x20, '/dev/kvm\x00'}, {0x20, 'md5sum'}], 0xa, "c6298effaa97cc616a21932c4cf223abf8c86c7336b0fe366321d76dcde957322fa1386a65f94b3a71dc1819f8b01aefefcc3efafb90c495f984fdb21e366308b6433689eac41c10fa61be15ee98d7cf6f527f4faecc82636bfaf7d8ba9f7016b1e35a7844597730b8b38a3154e2307a1236f1738f0637d3f36ae34b6740d53b02763124f9e9d623c69949"}, 0xbb) 14:47:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xfffffffffffffe9d, 0x0, &(0x7f00000004c0)=[@dead_binder_done={0x40086310, 0x1}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x200000, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{}, {}, {0x0}]}) ioctl$TIOCNOTTY(r3, 0x5422) ioctl$DRM_IOCTL_NEW_CTX(r3, 0x40086425, &(0x7f0000000140)={r4, 0x3}) prctl$PR_SET_ENDIAN(0x14, 0x3) 14:47:23 executing program 2 (fault-call:2 fault-nth:2): getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1539.776120] binder: send failed reply for transaction 305 to 30323:30325 [ 1539.783978] binder: undelivered TRANSACTION_COMPLETE [ 1539.789246] binder: undelivered TRANSACTION_ERROR: 29189 14:47:24 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x44c601, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) r3 = dup(r0) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r3, 0x800455d1, &(0x7f0000000000)) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1539.912450] binder: 30371:30372 Release 1 refcount change on invalid ref 1 ret -22 [ 1539.946749] FAULT_INJECTION: forcing a failure. [ 1539.946749] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1539.956121] CPU: 1 PID: 30377 Comm: syz-executor2 Not tainted 4.20.0-rc7+ #15 [ 1539.962940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1539.962940] Call Trace: [ 1539.976736] dump_stack+0x173/0x1d0 [ 1539.976736] should_fail+0xa19/0xb20 [ 1539.976736] __alloc_pages_nodemask+0x7b0/0x5f20 [ 1539.976736] ? rmqueue+0xa6/0x1240 [ 1539.976736] ? memcg_kmem_charge+0x696/0xce0 [ 1539.976736] kmsan_internal_alloc_meta_for_pages+0xf2/0x580 [ 1540.003279] kmsan_alloc_page+0x7e/0x100 [ 1540.003279] __alloc_pages_nodemask+0x1587/0x5f20 [ 1540.003279] ? update_cfs_rq_load_avg+0x5e1/0xa10 [ 1540.003279] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1540.003279] ? update_load_avg+0x11b5/0x1a90 [ 1540.003279] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1540.003279] ? __list_add_valid+0xb8/0x430 [ 1540.003279] alloc_pages_current+0x69d/0x9b0 [ 1540.003279] pte_alloc_one+0x5a/0x1a0 [ 1540.003279] do_huge_pmd_anonymous_page+0x87e/0x28c0 [ 1540.003279] handle_mm_fault+0x5b3b/0x9ef0 [ 1540.003279] ? __schedule+0x6f3/0x830 [ 1540.003279] __do_page_fault+0xf26/0x1a60 [ 1540.003279] do_page_fault+0xe9/0x5c0 [ 1540.003279] ? kmsan_unpoison_pt_regs+0x13/0x20 [ 1540.003279] ? page_fault+0x2b/0x50 [ 1540.003279] page_fault+0x3d/0x50 [ 1540.003279] RIP: 0010:__get_user_4+0x21/0x30 [ 1540.003279] Code: 50 ff 31 c0 0f 1f 00 c3 90 48 83 c0 03 72 55 65 48 8b 14 25 00 fd 02 00 48 3b 82 58 1a 00 00 73 43 48 19 d2 48 21 d0 0f 1f 00 <8b> 50 fd 31 c0 0f 1f 00 c3 66 0f 1f 44 00 00 48 83 c0 07 72 25 65 [ 1540.003279] RSP: 0018:ffff888192b2fc28 EFLAGS: 00010202 [ 1540.003279] RAX: 000000002026bfef RBX: ffff888192b2fc30 RCX: 0000000000000000 [ 1540.003279] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: ffff888192b2fd60 [ 1540.003279] RBP: ffff888192b2fe68 R08: ffff888192b2fd68 R09: 0000000000000000 [ 1540.003279] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffffff [ 1540.003279] R13: 00000000000002c9 R14: 000000002026bfec R15: ffff888192b2fd60 [ 1540.003279] ? kernel_move_pages+0x9bf/0x2b80 [ 1540.003279] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 1540.003279] ? prepare_exit_to_usermode+0x114/0x420 [ 1540.003279] __se_sys_move_pages+0x111/0x130 [ 1540.003279] __x64_sys_move_pages+0x6e/0x90 [ 1540.003279] do_syscall_64+0xbc/0xf0 [ 1540.003279] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1540.003279] RIP: 0033:0x4579b9 [ 1540.003279] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1540.003279] RSP: 002b:00007fcd51043c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 [ 1540.003279] RAX: ffffffffffffffda RBX: 00007fcd51043c90 RCX: 00000000004579b9 14:47:24 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) statfs(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=""/3) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x200000, 0x0) write$FUSE_LSEEK(r4, &(0x7f0000000100)={0x18, 0x0, 0x5, {0x4}}, 0x18) [ 1540.003279] RDX: 0000000020000000 RSI: 00000000000002c9 RDI: 0000000000000000 [ 1540.003279] RBP: 000000000073bf00 R08: 0000000020002000 R09: 0000000000000000 [ 1540.003279] R10: 000000002026bfec R11: 0000000000000246 R12: 00007fcd510446d4 [ 1540.003279] R13: 00000000004c371e R14: 00000000004d62e8 R15: 0000000000000003 14:47:24 executing program 1: r0 = creat(&(0x7f0000000180)='./file0\x00', 0x9efd813c572caac8) ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f00000001c0)={0x0, 0x4, 0xfffffffffffffff7, 0x2f60, 0x8}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x8100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000080)=0x0) syz_open_procfs$namespace(r3, &(0x7f0000000100)='ns/ipc\x00') prctl$PR_MPX_DISABLE_MANAGEMENT(0x2c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x10000) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r5, 0x0, 0x2, r5}) 14:47:24 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = dup2(r0, r0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x8000, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000100)={0x0, r2, 0x1}) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = eventfd(0x4000002002) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:24 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x1, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r3, 0xc040564b, &(0x7f0000000140)={0x8000, 0x0, 0x1001, 0x3, 0x3, {0x1393, 0x4}, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:24 executing program 2 (fault-call:2 fault-nth:3): getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1540.625147] irq bypass consumer (token 000000007fb3c421) registration fails: -16 14:47:24 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0xfffffffffffffffd, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$bt_hci(r2, 0x0, 0x3, &(0x7f0000000180)=""/188, &(0x7f0000000080)=0xbc) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x3) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000100), &(0x7f0000000240)=0x4) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="2363044001000000"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x4}], 0x89, 0x0, &(0x7f00000000c0)="fdeebbec37ca7ea891a96951b8c2a12651b611a3d4ea2524f79012f18a1c113d13e269dc924ade8ab7ed7875ee226caeeac009e8b7bc60d9fee38ae588a7f935fc9f05f9bb9f12146990f2cebeb571ccecd1eb090c70a278cfd6a94a5527a842cde046e83fc57f20af788d8b80bc464d1cb81b201a6eed16316b3a3b097bf11dce8e2f956345915b10"}) [ 1540.810153] FAULT_INJECTION: forcing a failure. [ 1540.810153] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1540.822359] CPU: 1 PID: 30401 Comm: syz-executor2 Not tainted 4.20.0-rc7+ #15 [ 1540.829684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1540.832133] Call Trace: [ 1540.832133] dump_stack+0x173/0x1d0 [ 1540.832133] ? __alloc_pages_nodemask+0x7b0/0x5f20 [ 1540.832133] should_fail+0xa19/0xb20 [ 1540.832133] __alloc_pages_nodemask+0x7b0/0x5f20 [ 1540.832133] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1540.832133] ? update_load_avg+0x11b5/0x1a90 [ 1540.832133] ? alloc_pages_vma+0x105/0x1960 [ 1540.832133] ? handle_mm_fault+0x5593/0x9ef0 [ 1540.832133] alloc_pages_vma+0xd0d/0x1960 [ 1540.832133] handle_mm_fault+0x5593/0x9ef0 [ 1540.832133] ? __schedule+0x6f3/0x830 [ 1540.887705] binder: 30410:30412 unknown command 1074029347 [ 1540.832133] __do_page_fault+0xf26/0x1a60 [ 1540.832133] do_page_fault+0xe9/0x5c0 [ 1540.832133] ? kmsan_unpoison_pt_regs+0x13/0x20 [ 1540.896395] binder: 30410:30412 ioctl c0306201 20000380 returned -22 [ 1540.832133] ? page_fault+0x2b/0x50 [ 1540.832133] page_fault+0x3d/0x50 [ 1540.832133] RIP: 0010:__put_user_4+0x1c/0x30 [ 1540.832133] Code: 1f 00 c3 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 8b 1c 25 00 fd 02 00 48 8b 9b 58 1a 00 00 48 83 eb 03 48 39 d9 73 3c 0f 1f 00 <89> 01 31 c0 0f 1f 00 c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 [ 1540.944015] binder: 30410:30413 Release 1 refcount change on invalid ref 4 ret -22 [ 1540.832133] RSP: 0018:ffff88819363fc28 EFLAGS: 00010297 [ 1540.832133] RAX: 00000000fffffff2 RBX: 00007fffffffeffd RCX: 0000000020002000 [ 1540.832133] RDX: ffff88819266fd6c RSI: 0000160000000000 RDI: ccccccccccccd000 [ 1540.832133] RBP: ffff88819363fe68 R08: ffff8881c60d1078 R09: 0000000000000000 [ 1540.832133] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffff2 [ 1540.832133] R13: ffff88819363fdb0 R14: 00000000fffffff2 R15: ffff8881af734588 [ 1540.832133] ? kernel_move_pages+0x10cb/0x2b80 [ 1540.832133] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 1540.832133] ? prepare_exit_to_usermode+0x114/0x420 [ 1540.832133] __se_sys_move_pages+0x111/0x130 [ 1540.832133] __x64_sys_move_pages+0x6e/0x90 [ 1541.018185] binder: send failed reply for transaction 310 to 30410:30412 [ 1540.832133] do_syscall_64+0xbc/0xf0 [ 1540.832133] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1540.832133] RIP: 0033:0x4579b9 [ 1540.832133] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 14:47:25 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) [ 1540.832133] RSP: 002b:00007fcd51043c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 [ 1540.832133] RAX: ffffffffffffffda RBX: 00007fcd51043c90 RCX: 00000000004579b9 [ 1540.832133] RDX: 0000000020000000 RSI: 00000000000002c9 RDI: 0000000000000000 [ 1540.832133] RBP: 000000000073bf00 R08: 0000000020002000 R09: 0000000000000000 [ 1540.832133] R10: 000000002026bfec R11: 0000000000000246 R12: 00007fcd510446d4 [ 1540.832133] R13: 00000000004c371e R14: 00000000004d62e8 R15: 0000000000000003 14:47:25 executing program 1: r0 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x200000) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000100)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm_plock\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:25 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x1) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) semget$private(0x0, 0x0, 0x80) fsetxattr$security_smack_entry(r1, &(0x7f0000000080)='security.SMACK64MMAP\x00', &(0x7f0000000100)='/dev/kvm\x00', 0x9, 0x1) r3 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x3, 0x40000) getsockopt$packet_int(r3, 0x107, 0x1f, &(0x7f0000000280), &(0x7f00000002c0)=0x4) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r1, 0x8008ae9d, &(0x7f0000000140)=""/202) [ 1541.279778] binder: undelivered TRANSACTION_COMPLETE [ 1541.285239] binder: undelivered TRANSACTION_ERROR: 29189 14:47:25 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000140)={0x5004, &(0x7f0000000000), 0x1, r0, 0xf}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:25 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r2 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x1, 0x100) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000080)={0x1, 0x0, [{0x9, 0x7, 0x0, 0x0, @msi={0x8, 0x3, 0x200}}]}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x7, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:25 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000100), &(0x7f0000000080)=0x68) r2 = eventfd(0x12) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:25 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f0000000180)={0x150, r2, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xf8c}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1c2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2efe0898}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xda}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85}]}, @TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MEDIA={0x1c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7fff}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NODE={0x48, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x101}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1f}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4540}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x862}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x50, 0x5, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xf9}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}]}]}, 0x150}, 0x1, 0x0, 0x0, 0x10}, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:47:25 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x40000, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, &(0x7f0000000100)="660f72d2190f8ef3efba2100b88f6cef2ef20ff0a7e154d9aaf2af65f30f005a3cd2f40fc79f4f0066b9b108000066b80000000066ba000000000f30640fc75faa", 0x41}], 0x1, 0x0, &(0x7f00000001c0)=[@dstype0={0x6, 0xd}], 0x1) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:25 executing program 2 (fault-call:2 fault-nth:4): getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:25 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x6f, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000140)={0x0, 0x4, 0x55, 0x0, 0x621, 0x9}, &(0x7f0000000180)=0x14) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f00000001c0)={0x40, 0x1, 0x200, 0x8, 0x1, 0x4, 0x5, 0x5, r4}, &(0x7f0000000200)=0x20) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:25 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP_VS_SO_GET_VERSION(r2, 0x0, 0x480, &(0x7f0000000080), &(0x7f0000000100)=0x40) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r5, 0x29, 0x41, &(0x7f0000000180)={'filter\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) r6 = syz_open_dev$vbi(&(0x7f0000000200)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VHOST_SET_VRING_KICK(r6, 0x4008af20, &(0x7f0000000240)={0x2, 0xffffffffffffff9c}) 14:47:26 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x0, 0x0) getpeername$netlink(r3, &(0x7f0000000100), &(0x7f0000000180)=0xc) r4 = eventfd(0x0) bind$netlink(r3, &(0x7f00000001c0)={0x10, 0x0, 0x25dfdbff, 0x800000}, 0xc) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:47:26 executing program 0: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000ac5000)='./file0\x00', 0xa400295c) setxattr$security_smack_transmute(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.SMACK64TRANSMUTE\x00', 0x0, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/vga_arbiter\x00', 0x4024c2, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000001d00)={{{@in=@empty, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@mcast1}}, &(0x7f0000001e00)=0xe8) fstat(r2, &(0x7f0000001e40)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000001ec0)={0x0}, &(0x7f0000001f00)=0xc) sendmsg$nl_netfilter(r3, &(0x7f0000003340)={&(0x7f0000001cc0)={0x10, 0x0, 0x0, 0x1000400}, 0xc, &(0x7f0000003300)={&(0x7f0000001f40)={0x1384, 0xa, 0x7, 0x20, 0x70bd2d, 0x25dfdbfb, {0xa, 0x0, 0x4}, [@nested={0x2cc, 0x44, [@generic="b63ad386bb835a10e6a6d1164f76a48c31e23258b94cf12d3bf84e715a458fd3b8589816baca996c5e1d69a2722042b3b7b9f5ad04251cb8f9bb82bf01f48a66011feaa5b16f46cf9633e2ef2c589b0f269f0e85c7a2033dcf", @typed={0x4, 0x2d}, @typed={0x8, 0x50, @uid=r4}, @generic="f1563466fe0ca434b9ebcf2e4ccdc1b2d921ba8403bd3a82ff2795d12afef5ef9e837153622748e21df66264b499dae359baf076e17f85667ad4e84b84d2a10160e843fcf7b56a75edc6978bd008c9a15eaadb45a49051b3414cd76d43d7188637b6ef64b125405dafaf776bdc97ff512c5c2f9821a4a6fe64cfd6037c860ba1afaea1e4f9f868134eb6d1e89a82cb2867307674f9333fd7e1257d8d1b75ce6b2e", @generic="a9411d71a78a31c7096befa3b2996d8bb5323c40be3c108cdaee726519d41e3472d253bcc806a4c37cb58976abaff83e66ab974b3cd5d0b3d6f31802f5c3fbcacdc40118a7de023df0464fbd1ca1d9e3bcd527791153f5ebec2fc55b705b681873f349f1fb6c98d762c6a86452e5334c5c3d502654697f8a91cf47215fec4be784c72fb9d3f368672e4cae6f7d07d0c6f42bdd1d0c1373f47a8b9c84396e2194be0e886b710ff2150881490a1185f14c87ab8af78f70575420f57b993cd96e6fc02e9420f6d1a22322b17f06ea2edea4b6a712d8c903d3d951e1ae81b6dd928dd744d87bda454fa38bb0", @typed={0x4, 0x8f}, @generic="08d44b5500b293ce897a8c838b620404edf88724ae81809a9558af312ec0b987797b08dee6d0cdc89f52bd52ef151fb95a396fbdf114c9d38e290c26428389ffd3625c5a8cfb259dcb978ecaa4f622c2e011eb677350098b9d851c9a2e61a89caa4e63b95f8fc21b96748e1d27167912a4e6ea481b7150f27e74123396acdcdea6f9f98b547e3ecf5b82dd5fab1b0c83c76189ed97b280bca08983aaaee23b1fa7f1e3", @generic="7cb6dcd797821627dd7c90bd8416e1d07e306b1d20459c2687705714223a6046ebef592bdf", @typed={0xc, 0x81, @u64=0x58c1ff52}]}, @nested={0x50, 0x13, [@generic="ccff892fcf2b6788732bc4073ca753730c5caa534fc391d3752cb1560629d267f214daca49362651abd276a9ffdbf8375edb2ecdcf63d047dc067ebeda9de531c0", @typed={0x8, 0x68, @u32=0x7fff}]}, @typed={0x8, 0x26, @uid=r5}, @nested={0x14, 0x13, [@typed={0x8, 0x62, @u32=0x4}, @typed={0x8, 0x81, @pid=r6}]}, @generic="1d39a6c2c5d130db3a3b6f5894306fa53a4cbda47bf2ce19357ccfe276e0647fb0927c4d81a2a12b88b1202b66f7ae006a2e08398c0350a9d60c13caab5618f4724ae8f123b40e1bb234fee9370079741f9492472ca95134ad62e930746a03074106dee23a5cb48387b0f3d019d0871e255a22766caa1d96434220e2130fb0fe765d3b128295c71c6341d89955be37c3dbf77659137c0c693aa18a4646276bb2836e4bb965f3fb249e7286f2f85b0c68edb9429bd8d2ae7f61b4807d77cdfa8312cda3403345c02b677169a34b3583c2f5dccfa226a87adbf65db775f8cdf48a771ed1f9995d8efbd3f4277135bfd32b9b30afcf0a7bed2584dee8a32d1078d9e62094baca0b25a46278f0fc8d71d43c18e60c35ebd2f8735fc33a43baf18bfca160ea883c0abd7210573eb0f46247d7cfba1d1ad39e3cd08d304dca7ac9b10e8f2c4a9fae1a2177bf4f1eb7b0959f3366c23d676636e8a4c88e13a5e2308bcdf35d64eeca0a09fd4fb9e5b092fd579ab9c2c37f6bbe066366c2d09bc2fd98dc43a210fe4d032c33bd20beb19f972692cef48ea72fa2da6343eab230ae77f99809c7e6d085f2c0efc8d845ad28ee7c26aae0e078b4168744b04040a809997996c46ffa0f9b62017dabc83cf3a93cd5362a6640b09cde980feef945ded0fd8c89ecc844c1b70072c3111daf63476f77f4666f5530d4c72a5d5ea33c0377b47eaec881626fa5c0d9ceccb074071cfa45b3ef4f1001ff1b2d476a7b143061699041cf11a9d92c292dd587cbe7bbe344b516ff107fbb93ac7bad949395775f717cf7ec0a6cead6cb626130b7e255656cdf04daaaa4987263687aaf61a320cefb99bd6c0c850239971222df37e6a7d552d6c51ab002dfe098243e7a1f9c5c90f67c082d361044220de98f1486ee379271fd030b4cdc9c029ead023fd0ea6908b78c99dcb7e6b25c3ebe8c9841d4e93027ec182c9c0f137ad7266d52b109b9172bf6be2d89c31bd5699a0ff5a3115a7890b89ff1e7e566b9b8f845bfcbab5003593b4b936578c24564fafb51c7929a9d07c067816222583dc36aac649c63f58ab321fa62b128bb23d0ecc9d0e595345e841c6c670b1d3a4153403a834c2decd4167d5880928f4446bf4795b8d31e6066e52b861e9eb4d081a60424323f41e089d8cf2c34d10a191821a74ea1bb04cb36339c18279cda7765c3f1e73f185b1066de46c6256f656fa49808cbf39f5e3091a337b2a3794171d4310a71e61a7ba199614f772604393fea9e0b3496b9cf90bed8cd4cc24b50e3e25edd77bf61516901437f8d2f55eb8ab723166c525e889affa7ebf25b191f4de844e2861babe7b61abbf5e076908ad91d83d5762637629bb76fc6af80f0082ed9dccd00d2c63ed357116dfc4201e6336ae6ecb5657e7c4ae82aeb0a40220da86520c83de603f74112969fca2e6832a74afeb33285aa4a8ce407daccdb432addd1ab159c09108e9fced81be1db611ab89d43d1eb03bf3fd629aa4ca7bec1422b22dfcf358efeb2ee5ef26f174e62606cd0f36a1641e1a2884f00cc359c8a01dfe1437f06f1ddbf7c7fb5e16599890c80373e92bd98b420770aab9135153570648ad1df734608d0c09922e406c44d526e9a0206923dced65fe64f774f88a5bfcdeb654ba0c82b302f023bcfba562e3527af45c00e2fa2b7b6d5e0485a38d4ee5eee1f9ec5cef57e5696986457ffe01b58e4fb67c2be0153bc09f0810f9079706b7141c14f96c294f3913378f4e690352b3cc36be286c0fdd145551479481f9ee8d218e92b8650e7840274c3c8c227d469e624ac607fbaec2769feafcc673d7bac7e716b05e48f6462b8dac507559e5eff476bba0a401a6b073086780cc9c1c8d471958990b7af10423064f5e00d378488901cdb21fc21984ff61e5af07a70ba9e303ba0cfb3a4d72d3c71fa2fe7c54525b0cd0c50ec87121d019c214870b6c44ed378791509c6a1f58e880412c8a479b624d1679847646937a5c5a802a5781dd4159f2639d17eae5f37b57cac2093bed8ef93b4ed5cccf667629f53f75731a69aeaa02d00278ab31d941ca76dc99d4392f6f6eb92652d260ffacd4a08d14051f08aef6d4ddc3aa3ec1e5968a814cab85a097d765708665353cb5f7f3a3f367417891a3b2a44d729fe15c5e344cf34a9550ce9853b8a0eebe72ced661fe1e174bdaec9aac80c667106e35edf255df117993053e8913d462a1bd17e8a45f75ecd37db156b8cd07feec2199e82bb0eaff533ba5d4aef0e34f9f86c1c6e36021be0e9a8585ac124f362aae696e98958ad18059ce46e267afd30bc34163dd57212a216d0c56a16617a26e1f61c7efdaa8b6f6192a4647dd5499dca9fdb30c2d30bd09c95f407f596f953c72a14dcf66505e5eec780b5671b7407fe5f04eb183622729f1c6f99a6ca1b49761c4404ed8163b1ddd97c5dc5b54802bdc92651bca23902cd64d66a319a36edbf31ded40e5524afecf29081aa1cb399893c96a8f14dd497a3c0551d3e833995558e9b1ad669745e235d4a286acdfb8effdf5d1f1b18bd939875abae53300865817f91456500fd3a58b8158c69ca5f237bf7656e6f9ecd5d89dbf2a37e54d139bc4f497370d62c8909fb46f7f14dcd5034182d17cbdaac98c74ba489d13ff6b9fc6d30e4305dd784c60d55b9d97b111bcca9956350c7d45a967707e952b5de5fe896f91d9374d111ea828bcfaa30cc8257676f2947be735fe0f71b351b2ce58ccd2f95bb3ef9589360b9701503172f494ae58504566720a41629684f690cf3a143705a33d2dd7c47236d29bf862ddd394a123e8d75a446b185565391678b563d9046cd3819601cf0279fcb6fb196036d9384d9e07a8772f8c48b18ca5329cb12d03eb842c9840cac86367542790b79a0f8f5e29271070f0f48c38a4a50f48018221b86cbe9b95b4f898f603d148156175f4fca9917a651edc448256369a36d4c41d45f0d823a562866065149ace4a724051cce84b2a74b44132336713bc977cc66f9fb72e6ff8402a4b1d0df13e02bdde6ead44fc612d1943290b81dc540ec18ff2a88bbc042de6d8aea5f992798e0fa3167213f15f14108edffed17a02a1f8f9bf5ea2b37f6b3a7193e420a445026def8e99ecbbe59d9413bb9133239f779da2fe1cf0e5d037f2540fa978eca673dafd559ae30a6e4809318e8d83f210154be3067903b380013a7432abad067b02821dd6c76900c2431b8851ba6c005aae9ca98a861d046806d61c0444180e6c830c971d429d079ebf7acc9f6d01b0c9454f0bd3dfad013d5b9ede9c5214f0098f73ee2496d426d22bc29b360f992d74a6e16493d23d9ef3b553edf55cad07f1c3cf688d77d505b56d1fae9bb248fcde57afdb3a036a5ee27056ea25d4ca03f365777abc419178aa4921c78505f24101c45ac5d772f3a4fc34c2a4d481c21e72563670f6499f8598d9f68497c8ddeedf9d29c497bda9116417b4a0334f6df656d7b53a7c90cb505e48e7bf3bec8134a3a09234b29cecf2895dda04f9173edad4b124584c5441fd5315e169d47e3e944a9c62646cf7641a477f66a15a3b78270ed83ab269f91d8f9ab5ff49e5f5fd5fd4c3cf5507227b48964b89272f630aad834f434b01dacb7376624838a2894aa8cd969733acc08fcadf5331a19f2b55748eacd9f03fbca6f7459873e433c5788da56d58884af8187a38a13e3c87fcfaa28dbb8029b231e9e6162341ac9f81f1df94a2e0d35401a46d5670358315efe9d9b478573f29632a8adfe374e322ca89c95c04f7a92328f02d1e5f31cabd98d73a56633a5fb281147e1a1b1107272ac86c55472a43c6f721c33b0b6066e9bc639c3951dd7b818ff8d3961868e6e3aa531a9dc3ae14ca33bf3b589e7332cc49ddcf37518ef0d207894e1fa29103108ae392d9a6312700d800461b49ee800fde10a8224a3f88d670e8b33e580e36903bb57ad8f7c1ea011cac9cead527933e06aa326242b35dfef3de60d63a6f44b85286aa1510f24157f2c0abbb78c647d22b75e11ca893fcce8fcaee12d884b02f131d6589da8fd07943703708701cb68fe0dbe380378b2f4fb3f8eacd54398fe6f40d55512a550aafcf3641ecfc3f45e0a7806e62914a0e25e119332cc13cc4e01790a32ef3742b0ec66467d66eb2014537ca8348cff31c30074fd258d0fa77da46b64be147d7de31f02008236df90663c422ba2014bfa7cb9c0cd7204ab9fc2922a931e3e92d177efbdeeb53ed029ecbadae5680053e6a566bac59748a55f838ce8adf8392176673d5ac8582e2476594e2a965e900272760a05da92001de8658edbce0355c1ed7368f924cdae30831760e320c528e324e7adc7d0ad5d284637fbf4b4de2f47765eaebe667beb04f685bf73d6b5b49793e9599e023b1acd29ac610cfc07d8f0cf0f432aa025d8989eefba74a1c4db48cf9d986c30afd07ba02ac8d40b0b74f8c9251bafc9f26467b58f2e1a180a4946566e57b42bcb42534e1df3b505e0509c4f6cea5bbe8965e62dbe0458c2f5008f3a3e7b5cdaa005a52f5d6bdc57ff0a1483e1458718873870d8264c4e9340761618a001bd6463b650a98986593c76d00e803b96009534765ddcfdc030c5daa4b18567aa976aecec8d025694576fa5b87be61834688cab8b65513811ff8e142cde1d9f78843b6a093e96e905d4efebd0353fe1e926388b48078c832bc79f63212d7a0573f63286543d9ebebd928cfd000930c722a07c599591550ad5d8e729f71f5597d742a060a5fc36fe34f8a17018c608a06a5e00b6da02ce268d6c8e20abd17e371ecf5e85a5bb02a1aa12213040fae9e068613bde024aae81946cfa2f36aad8b86202bd2d9858b33bb799bc69196e5cd59a6170e357a7d070d451c7cf6990693768983dec12b1e91ef0dbb15f9efe96ce757ecd62a2d00d2d6b2a145a78bd087e21d333edcbd16f476622a3a5e5c7c0149466db3326abafb3018c40658b71f0df4c2933614843acde77cb62b511e66172cef015d1d80da156d23d8cfba4ea3ee78c318e19ba32e2f5a376bda391aac13ca1790772499aa5d22c3076f136cbb1f9a2b6993d36e8c91faebfe6ddf6f3a469c361ab71567d295998a3fb8d51e6af9682e737c5fff415e1f282d1204b6e8692f19f9ace841c558429cb5632738a3d12a644f001d4c2685c025c70e4e29844e631439d0db629d36284cbd8491464e196a7380f98074882aa76494a2a77ad088677c97da8328ede72af8d4e7101ac57b5749c9c8ab08054327cd059a0bf399fad6209be1585b0a0a393919f8ca76d9b2e3aa62d9edd43fbd5017635895341e2242eebc5985480609e627e2cedec3c3517c9c0311e8674c8a269066c9002dadddb3a0bb399487501b13639c063444c24dccea8911a76076a0c332a3d961028cb836ea5b9c68a92592f4437b634b9a94bc3fa06dcbdc3f2232b2c68a747ffb70648f937eb0f9b12e6894f749a8a8e7b5b4f012e4e98fe59d3beb00849b30837fee3fe0e93c22a512d27e18197feff690dff162d09a40d1a065a5918b62767b26c2639decf390860459424a1c092115c9eb8dd64c9f24a54e791f510c8d853442c04362492a42a5c5258835e734249cc44dfc9172923a4698d126a50fe6638094cc2147453768d7ea7e29e0bf104713d71bd7cc18e63d087514bb5b4c2df86914e048f75842fe88cc49042fca66b342bfa4526eb195ef107bc18371ee8455b4811d07839a389c657e59df430d5d6206c12467377f7c54a3194f28ce8995e61da1a995a9c0a33", @generic="d6374884b55418a7ed57a2928497f9dac051e8dc9cfb7abedf2ad63a036973a624b76cce32b9f09652722d99345348f05d54b229ac"]}, 0x1384}, 0x1, 0x0, 0x0, 0x4000}, 0x80) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000001c40)=ANY=[@ANYBLOB="0000000000000000448020af08e60b941e2cbdfc769309002c00c4727e50f341d25d21af798d694c54a1c8b5d42a"]], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = syz_open_dev$vbi(&(0x7f0000001bc0)='/dev/vbi#\x00', 0x1, 0x2) setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000240), 0x4) ioctl$SCSI_IOCTL_GET_IDLUN(r9, 0x5382, &(0x7f0000001c00)) sendmmsg(r7, &(0x7f0000000480)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="c086cc59b411d8e3ba03324465833d2a0a4702685898de8cef0a32720113c2564b44d1a647fdb3d09e20e2efc2784fb908d5cff137dbcaafb4ed0dae5a772285096ef8fdc43534a46c0b3eee3eccf3eabc5742c12ff68f93def86d076848e180c92050bb5d52314496a4cf9d4d70f3f62d3987611e19cb8dbb22e141f057d6ce6ab0779821833a809e487cdc81ef2a766b75c2ffd7eec3d90f915c88e271af986d663c6600b02b195164322c4cc862dfab517f40256e52aea6abe4619b1544dbdc942c8b7e149701c44d81bf01b970ce884e3380ff56c5a597fb66d8f96899401a645c6a619132cb92b77556ae43", 0xee}], 0x1, &(0x7f0000000580)=[{0x68, 0x107, 0xffffffffffff7fff, "9021b181d6008b8cdc8a1987d0c9ad078a4341f55900a0eb19baa22f636c86ddea588d0c5ee21ffbab354c2dd69af2a8bdfa8a9c27904b1fb30331796ae4b5c07d913e76b1db91ebdff835449f9d931ae536a59b1b8f"}, {0x88, 0x113, 0x9, "d2eae27077be04c0b7c05e20b790a0238956594048c759b35348ea69f373c4575a7949f54794990352cf21879b2e0c4b097c7c533de47bbae4f04e38cac7a92c59e709c31ed01b59779d5ee762eb0fce0f6901e3dcf38b84e25d6b36c9d07577d13760ddcbb7e8f84405f2d625bb1fe378f68a852431fb"}, {0xa0, 0x88, 0x72, "3c4d4c90316377ff6254e02d78c5fb545ff181048462289a4d32fb589c536309da1fd0775f27d11f98f41aea8b0509ae3d019246d9a895a53aa13eb6c438f67d7cfed5f1beb9a8e93893a9fde2edca79d0a2c29cc96a8f426b8661c0b9dbdfa630c394dfeda82542a232d8f36a43ac9a6eef3bf0fd36ab292305256aeccef70e88561fc26434746a1fc4"}, {0x18, 0x10e, 0xffffffffffffff7f, "d47a16aa64"}, {0x108, 0x13f, 0x0, "3fc365fc332429fee25442f37a75542bf6942cd0813d21e95e7bd2ba87d7db0b900d89d923e87ae8bc8cd784a1581d2708b2a76c2041ad9788ab90d8f4d654996f513193909cc51cffacf9d94f1ad35d879d544167b27628cea00d7d5aaa800d9d4de8001f27644cdfa91913d52797cfbb1d937976266eb055b330d02a8b79f8837a99c1c2b6b880cab5d9fa3c16fb74894675091aa0af014f1406da620574c2f07237c38ebb2314fa3ccab722412a53f70668447efc44635a38f378aeb4cd21aae54e196aa94f00e0eed0c658da960c9d2f848bf42d716f7bc7cd875032f9ecb22df53010ec6889f70adc1fd7a4ce8b4a88"}, {0x1010, 0x116, 0x3, "67520250b19d0c463172bd65b64380ddbb4da60ee6a7ff40f63aa9d6048fcd333b29bf14f2be107962751c59b1092e6cffaf413ab9450f845bc40559f1a7c04c8f440078d5b8a8d631c27a82f65fe15fe421de3f480c34a98c0dda910cb198af4ca871a26e8b93e95dbee406b40c495bf16ea9e34bd5477a42e729eb821cfb0391b1330ef9bbcbeba3e377094aa4e037132e96c143c9f9f26af922938338b2ad1dff2eed2030a82aed00a426d3324b7f86e4042dfeac18a49b4dca0970a52b9f41b684960a8070cc6398deedc567de9a1c13fbe6c87a4638b12344c920783f15a2e5f0cfb1f729358d3a312e03b65470622d8ad438a37665ebad8deb3d7bb5c384090f3777892c75967435bfd2f6bbe1e4a9bd89b17257e825d7a380f996312902fdf0d9e7da1243ec91a99912f48d04df654cc4395cabde7171fe7378736e62e169ce06e59be7e6940c3bd8d49bd8c621095babdc5eef90f66ee873e32016fe8c8823d07f0b7230dcb036d87361f48c2ac1fc9c9803b7646a9bdfcd652fdf04e2c849b473585f209d2a6211a70ef47fa5e9cf5b16ac62370ce5910e92f635b92be9822f3195fa8d8206be3f9230328bfd37d28b75be84ea92a077ccf4743fc8da316512ca4b9519c3c3b217e819bf3e75694d53522714e9428a068f437998aec5a78cf469431308fa67dbc593d6513951b8e06558f76c33502ee9337d17bc2ed268a14dc4aadb3af4a7d1a1e579456ce5c633622f7ef170f493b998190ae9348f9877de3497c07052cf27a360e766f781dd94fd76165e9e3819021915dac11554125f39776752dbef5ed9886a82508e3a853859506d68e34bb01b95c94bf03f18245a0c48e9a42002b3d39fb664fdd14c329609787e4c696b86873b68419530b5e9d5ee5aa87d19da86f490d7939cdeb3230303f982dcbbe4a38353b8685b83c4a662a413bf8293f98767876e74551ada0a29cb3c653e869a5c98caf02be07e346eda411708a7e2a876a62bd93ecf30368414b1e812c5d700edaf3533e31d50f0a877470f1d13b8cdb994513324b0abdc5b68d0bd63357e011dfb5ffd46836f3880a6019501225a33f454bd66c9974313d795a0f9dd4e7688bfb0414710198722695d3de39f4a5509d2817efff7a405478b7f3f587acf72949798481c9ffc08dd72ad45f4a04cecd86a4806cf6a4a2442dee697ddeecc3e897c4916041f46d49749bdb0e27de3ff58806fed8b852dd5e9d6ad0b7fa0d1c9f8a533cc35e78d00cf3c0b7de38ac239fa1520992ff546749502ae0f4b0587ee8bd9fa6d0345f67d48812ae99fe16970c7207b58ef912e7d8d1f513e02024f7802e2fa4ba78472e2a2fedaa8d6ae951b37d1340b2ce5b70a40300a7244ce6d117d87440b5ab842b1f9803888094732630263ff56442763c239c0038ef472541f9e5ec8264768dedc955f8b9a65b8f0b885c05d8d902fd281a70b0b1bc01aebb4faaac14932a591727479ea60ec8ef6123a3ad6995b064f8ff070bdaf65f7898ddf1061c5f897a669acd380e9826c83cada705d2c1e6dd94ec1bdd8053d60d39c1bc29dc61e8c991d8ce42cab42b828c1e55a1e2e90498b2c9bcaabec2ed4eed892111888f775b9bd6e60b4e1a33f102499204894b49cdf0fde633982934229fa53fd2e3573f10a9a87f53b25769de1764c646265f054d3300280db7b5707c4b421e3b545a4e0d047a1e72c9a28a623512cd581b0afa556be1438075227231701a1be0c9d4dc1156df4151f651bc2e8489872171b9ef796f6d5fd83310be603170786b7b8bf9fab28689b64174e76054ea606e6369a9d82b9e6be2ac8ffa43e8a141d8b4db870ae06ef814c222367fc932ba1d69a8801d6c8f6892ad272b266f700e96f097d7856403768b8cdcc78b05646746195e9a84383c515a43d4cb8eb84e8d5cf5b72a1dc12ce67bf6e075fbb0791707f038fb5cfadf421842589912fb180969c653faad1ae95f8078f8b7929f8aa149018809c7a0048ed9f0d5c72b2a5bb32686434b1a4bc828ba82d22e02f02649b04fda0be154d796e8d181343dc6af3967b668436286b79c030bef83b061d3590d041cad1b5ba1d4ff3ab3afa701bf660a2b7983da525fa20b5ebddea5c1216c1583c929335ab6fa2256b6ba2b1732193e01b619574df78ffe722137457ca3783dea649ed1d3848bada67199def0731a0518dbb0c7f25b7c167017695bf755b4929b733707aee36faf391f191797a1a6fad3152cbb3d0482e11341aa515685bff40b331e13b90003bf7ac3f21974eb50f9aa8fdc785d8e251af0af53c70704545635f8a4423831dda827f88f214b6b252b9b2a921274426df8171b480a469eb562ff76b8e39c21f53a76d86140609080cd988b0270627d4c8d6227adf3d8d15195e86d20e00667a5a91e58ef67c4ac40262228a39dba231a519cfd13c04c1c511c40caf1062c43525ac5f92e713992e4e19c8b6848e231ad23097eb4b1e0a3b3ff45753784d848933a2492e07e4af1044f7cb2d9c2ebca1abc79c094c19fed883f8d06f35c57760537a3e2ad82978adedc983861935be207555030e3cef1bddb351013211cb945dbf148f248e97613468e6777849de6f0456600e53dad912ed328b4c28e9c188cecb601d1a1dbc1dee12b7ff53dc09a42c6453452344703e559b46354580806c960c19afae34c6858ed0931cd0394b120469fda6e784853f5788ed41b380e91ece51b1f4231a78a4535b60ac6fc2ce712bd82074e5376b4d7e6aa1c231f3aacb3c780623da65642662e474d128af20cfcd39c8984549fe0eba4406f2d859e7d0c4b6cba36100ed8557617604b681bff8bc3db438d8bce0beadbf679a643184d711bae08d099df0da3ca3a42908f734cf0f3161c52a5d09494b1442978a43e9a72b2ec4dbdfe5b70c9453e97c0698a03e379111737930f55f097e2e93553cd3520e142090fd7e58e67b7f6aea3fd837c5b413abf17980a1ad228ca4790aaef54e112ac1ccb1044efaa5cd4eece19cc93988b5ee749171e8f4a0ccb800ed7015525e07cc6ce3124ca2dea6290142c5a6382dfe0d90456eaa22cfb788c68c4b28820df8fbee3860ffa0af04b9400c6650314de086cb993882d3a4940e928dab52cead22845f967d86205c18139f8ab7cc8c1dec82fc5f4ad6a96bc644ff154b333da950b9508a5900b06073f6af13ff9e0eaf45277f23056ad8dc8758e292f043df4c64aa3b4ddec6e9ca864817c16b5859a0e8dc5a6c472a06f39a2a7737095eaf29a017efbca6a7cd4bae36ccd165e51b4d44fd9517e4a77c1e595f998d685cd564e3f0a45b8dca24ad2347e518e45fee253fab0cdb1b89942670d6bd638c5cc0f9575dd9f95d30b1f11a58d215396b96f9d9c6ca18ca03267e9d9dbe21a613298d03f4184cbbea96e169503e1a232f36c7b40adaa9d32e295530a85b130d5904f7418d311edccfde8ab62f00106bba2cd86e064fc91172ecd33a50e22aceef1efdadfda0e9555670e55b94626e974f7f330068a7a407bbdbbba34e59200b236399369c313026d0647affe21438615e38a7a6f6a0d5109957394eb5aa2ffc1e6c5f61394a9a9baabd333c33c8a561626eb76dd99073b82c44536c497a0b6c3795d1a60bb7c0d06d8deb676b522657d82be8f2385d39bab4611252a00e26b836a9d118e75f95046affde955d161b4d611912191cc9603b4b77e314bdac179cbb71a805ccb5aaccf5c538cb9adfb5975b6cf25b1c873702a77cc634b2e215ffe096c4beb4a6afd0d7977a681aa356c2e54abb9f766e48411af31510fda57bee763e4be844075902b9aaa9bf1be7344ad30e17a23306b2c08af26b2f2f39af05b9cc579a3ab754170c18b92226327ef30878d3eb218e12d149f63d9d5c82d384e9ae86006d4cbaf1a99a82e4a4901ec6435161a6c7e29fda499f1c02c66e6060e36c30a2952e01d4b1485cf38fc211802e6b4ce62cd3831c6e4e5242cec073f7300f913bcc6f0df9d9895c670cd431d8f8548254a26b02967ad9532f66819e5a95817ba142c3b73a6b15d50901b40ec4c7e5eff9980b64ffdc46863777f0075e2cad7dbd5469a7262416fe2c2c7f176ff65c5a855f39fdd5d2e9606242d1e81346850d0a4ad92eded0f32afd018448fb1a2edbc253cb8b574cf5f0d901a70cb397492eab44d2fb1265c7165cf51589dbdd9b7df7f51f23e296e01a807d7e73910bcd65747b2c64e3717c0cc40145731a9bb3a51d645382573d8ab557e048d8921d967bc8036d4afc682a608ddc77a503bbb16290da171fe81bfeca2a40b89d78ca3a93eed8e6be6fb9d4554b03d6d91a8dbbda37f15e4074c18583add5b990019e2b1849871628da8d54aae6a43d57c376640ffae37176c8d5942cabc02ce0553b918b1e86d391d2faf5d935449ee2fc923c28724118d45091a4648ab331b12d312647294433a70fbd1082b9ff1d5169cde41a574dc721d46a788248a638eb4e05c702653d1f096b62bd50cbb56929c03f2f7846678493e340e245cb0c273d7ea5ec47c321e9d0f5562a8b4ef01cf56ecdaa634a74a40d478a49dcd3080db2454c86a049ad9fec19a7ceabb55f3316cffefe2882fcb22f0b5f37b0bea7174454b160715ac414235aeeb7f3cffa370abddcd835f2364caf64f07d3b5e3357661b410699a6983419d992c5bee51275037186e2ddc6f58ba6496125038485b3db93e6e45615ef45764c8c7ba7aadf54ad987972163ad899e872d0cbf1066878c24071fd647d469d6320625779d03bdff323a69c38520025addb7116f89fa4a4ffc668c3dfbea143ed8599ee98f34cc4b1df987e0d74fcc84f155d0f535179731481785e20e7c75ac1fa5dc7df8e1dd810e4a2871ca5d13fb68445b6edb74d53c4be42bbd0bb091ebefef815eb477f1aec046495e5dfce86e9ac3bdc61033ef77b211b4a67b7b31ccb325d897608531f7da8a1a60b0082aa74bf020831ee8648465c550b08735b2a9100ff8a34b142f0125f828c22c5254f6b6f50df91f47707eba2070b8479c5315f152c06d93173bd3243b7befd8ec5bb16b0baad453b6485060e3eec5759f3596e17c56de905c9f8cd77468c02ba68729db3d741d287f2b8e6cb2ef53a1aa82296509d3158ce7e0e7b7df2d38d3f9466867e1e2d82b988d957be5e398b1038bf9466afc661fb767ebf8d8243fbd01de2b7ae0a1d9b6dadddc5500bb1c7948a25a2dd6907f6f88fd1378be5885803593d23968f8972a0bbfd2d4b762da6a2786311b0791eec3256305057fa6a2d12d3dd6f50a35da09f7831471e2bacbf2a127595a7bdbe9561208f61490536a2b47fd5f036abe0d11c403e6e8270a40c481f8c16d77c53d3e657b008868ccd516ff8ee0dd1e2445540d97f6fb84bc94f44aff544c19adb2d82116d76b84c6a55f91ed278e95f08dae13e26027fca5707aa2eb2d4be7f6562a56e7a55050c666e530b2365ce4f762b911c0e4c7fd7b7e6c6cf8bcc8b6bca11cdbefd75c2a364e87166588786cdd88f8c26e52abc838b792573ae401843dc13942f8b4adea03b00809cde08f58bb34ae6ae5111a672d858eb16932f4329b1c77bc15a753fc221eca02e729773a85b0e5f705112a8884a059fa1bc5e85ee085aae7fae20d4e8ae7fa7c8263e82c671be90d755f6b91ad928cf55c063083f3b50ed632910e09c3820bbf2628bf3b7100f0fd53511daa8251e690f41d04efd8a6feef45023110a8c4ade88d5115b8e6a0a213a1b6e4a415d885b8eb6ed06e7ce8bd55bc683d44d31"}, {0x90, 0x102, 0xffffffff, "8d8e9203b4220916e905d673d5112e01bbcfa426d6578a55a271d7c6b054e9edb5d7ab1015d9c97d9d23645884276e812f6dce0bf97d0c163afb1c6afcbf89d4aa9f7dce28deada2c56db38da70903495929e17b811a3fe1895efac68918771a369a88caf794f4da0af6ce6375b814de7cc957327493c05db346"}, {0x48, 0x11f, 0xc0, "a4012a8d6debce047b16899a05273b7cb370c2e387d76c7f0e73bfb8665d8cee49286d340f96e378fd16aa45b10d6f6d25daa9fe"}, {0xc0, 0xa8df71be79f481c, 0xb72, "099fe00cc1f763012977a732d860d7702b2aec229c993eb02fc34199868b7a7a9c60518a7269b56f6f5c38fd079063886e0407a3e4af800c5bbc936040603e335efefadbd694c8a569a2df0720b0b744f2526d6f3d3f49331f77166b7aed2a9a97ab99f63b63796284d1b88b6f06a9aec501eef1e8b9985b3e2c025bfc95f7977fd1f64a62ece82321fc801bafccbc688948294cd8f339822c48f1b548dd60292e87f1703ba7ef394aa0173fd8"}, {0xc8, 0x117, 0x8001, "d196c8f8b7a96ac9081d6ea2ed4a4c900d338d507298a85190f43cfc4846407f59c604f16fd2b50dbb0ef45b966f5318a1940f1c86203c55515501c1d8e050991fed566b5840683c3d7d04fb1c7807e851090c79f0f3b44a4168a0cb3405b8c669321eabd90cf68448be57f7e97f1c4dfc380b74b647448d43de3ec51d9c0646ccb476d12d178380e7a0c84e1f1f53f7714e4234340bb67ebae70e78e3b0551d3b2633e6a3908048cc9411a74d27c7085835"}], 0x1520}, 0x8001}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000003c0)="9156d5348421c772c536ea427908c5a4db9a92d603f95e85dc65a00a2d38e686f222a2ce968a03f8f1fec9900d81eb628d0e8db4121b3dc81b4cbcc902c83e3ba431ca6cfd880490fa079a8d25519c4745aaaf911f9da2562638f2e6cb11675afed9371636d7a99b7923d2aa331d86a6400708723e1e270a5b80045003ce668c3eb68e5aa8ed994f786fcae4165e751fe7d59559a789137ee49d3a7912c7c0dfadacea7b967a", 0xa6}, {&(0x7f0000001ac0)="3060ca03a6f370826b372b16a682468c04f70876be54766d65756a6c1a0b99c041a4ee24f0d28c092b2176b241faa73315e4b44aa9e25f154ea47aed2340f502197fe45eb5abbb102d8e67511f093f29bff8fb575241d4b24182f5950c5c3a72f6eb305ef6109037f5df43388bc4ac21454246fe0d6905051acdf0d4fdd4351aa50b09ad0d3f0636a967942003fa41373b31e80823ed6550b8a92560ac11792c95ae419bbb53ad414de08f6deb79ec499262d8b927ac99dc3d422e6315e805430e5c14e34b2d1727bb41c05f5f24828eb2a6fef324d3ce84a13036fa308f63b14ab94ff11b0d3fd28245952fca1995f0888805466288b5", 0xf7}], 0x10000000000001a9}, 0x4}], 0x2, 0x11) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000500)={0xffffffff, 0x5df7, 0x7, 0x83, 0x4}) munlockall() r10 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r11 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r11, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r12, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f00000008c0)={0x90, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x371, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="06ff0f0000000000"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) [ 1542.162860] binder: send failed reply for transaction 314 to 30420:30422 [ 1542.170641] binder: undelivered TRANSACTION_COMPLETE [ 1542.176118] binder: undelivered TRANSACTION_ERROR: 29189 14:47:26 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:26 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) r3 = getpgrp(0x0) ptrace$peekuser(0x3, r3, 0x2) [ 1542.309862] FAULT_INJECTION: forcing a failure. [ 1542.309862] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1542.311693] CPU: 0 PID: 30473 Comm: syz-executor2 Not tainted 4.20.0-rc7+ #15 [ 1542.311693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1542.311693] Call Trace: [ 1542.311693] dump_stack+0x173/0x1d0 [ 1542.311693] should_fail+0xa19/0xb20 [ 1542.345287] binder: 30475:30477 got transaction with invalid offsets ptr [ 1542.311693] __alloc_pages_nodemask+0x7b0/0x5f20 [ 1542.311693] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 1542.311693] ? rmqueue+0xa6/0x1240 [ 1542.355736] binder: 30475:30477 transaction failed 29201/-14, size 24-8 line 3000 [ 1542.311693] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 1542.376795] ? kernel_poison_pages+0x19d/0x360 [ 1542.376795] kmsan_internal_alloc_meta_for_pages+0x80/0x580 [ 1542.387264] kmsan_alloc_page+0x7e/0x100 [ 1542.387264] __alloc_pages_nodemask+0x1587/0x5f20 [ 1542.387264] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1542.387264] ? update_load_avg+0x11b5/0x1a90 [ 1542.387264] ? alloc_pages_vma+0x105/0x1960 [ 1542.387264] ? handle_mm_fault+0x5593/0x9ef0 [ 1542.387264] alloc_pages_vma+0xd0d/0x1960 [ 1542.387264] handle_mm_fault+0x5593/0x9ef0 [ 1542.387264] ? __schedule+0x6f3/0x830 [ 1542.387264] __do_page_fault+0xf26/0x1a60 [ 1542.387264] do_page_fault+0xe9/0x5c0 [ 1542.387264] ? kmsan_unpoison_pt_regs+0x13/0x20 [ 1542.387264] ? page_fault+0x2b/0x50 [ 1542.387264] page_fault+0x3d/0x50 [ 1542.387264] RIP: 0010:__put_user_4+0x1c/0x30 [ 1542.387264] Code: 1f 00 c3 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 8b 1c 25 00 fd 02 00 48 8b 9b 58 1a 00 00 48 83 eb 03 48 39 d9 73 3c 0f 1f 00 <89> 01 31 c0 0f 1f 00 c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 [ 1542.387264] RSP: 0018:ffff8881926ffc28 EFLAGS: 00010297 [ 1542.387264] RAX: 00000000fffffff2 RBX: 00007fffffffeffd RCX: 0000000020002000 [ 1542.387264] RDX: ffff888192a7fd6c RSI: 0000160000000000 RDI: ccccccccccccd000 [ 1542.387264] RBP: ffff8881926ffe68 R08: ffff8881c60d1078 R09: 0000000000000000 [ 1542.387264] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffff2 [ 1542.387264] R13: ffff8881926ffdb0 R14: 00000000fffffff2 R15: ffff8881af734588 [ 1542.387264] ? kernel_move_pages+0x10cb/0x2b80 [ 1542.387264] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 1542.387264] ? prepare_exit_to_usermode+0x114/0x420 [ 1542.387264] __se_sys_move_pages+0x111/0x130 [ 1542.387264] __x64_sys_move_pages+0x6e/0x90 [ 1542.387264] do_syscall_64+0xbc/0xf0 [ 1542.387264] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1542.387264] RIP: 0033:0x4579b9 [ 1542.387264] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1542.387264] RSP: 002b:00007fcd51022c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 [ 1542.387264] RAX: ffffffffffffffda RBX: 00007fcd51022c90 RCX: 00000000004579b9 [ 1542.387264] RDX: 0000000020000000 RSI: 00000000000002c9 RDI: 0000000000000000 [ 1542.387264] RBP: 000000000073bfa0 R08: 0000000020002000 R09: 0000000000000000 [ 1542.387264] R10: 000000002026bfec R11: 0000000000000246 R12: 00007fcd510236d4 14:47:26 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_timeval(r3, 0x1, 0x14, &(0x7f0000000000), &(0x7f0000000140)=0x10) r4 = syz_open_dev$vbi(&(0x7f0000000180)='/dev/vbi#\x00', 0x2, 0x2) ioctl$VHOST_SET_VRING_BASE(r4, 0x4008af12, &(0x7f00000001c0)={0x0, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1542.387264] R13: 00000000004c371e R14: 00000000004d62e8 R15: 0000000000000003 14:47:26 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f00000002c0)='/dev/media#\x00', 0x0, 0x40) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000300)=@assoc_value={0x0, 0x8}, &(0x7f0000000340)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000380)=@sack_info={r2, 0x6, 0x400}, &(0x7f00000003c0)=0xc) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x8000, 0x101280) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f0000000180)={0x0, 0x8c, "940f0e3c35871a70a3a75edd417600b5ee7c3d42a456d54a73872a20d51ccc5a08d6b8cb7f2ad20399160d7abc8b9e9395d3450bfed075a43a87949ee5e46930201908e5652302fdba40879c2fc89a994105d8f0579dbee185da1c5491b177270c0bd3c5a0154a45fdfc037d0323c420496b0e1346c3ecc553ccb42ed67256cd415ada6beca73ab2dee53086"}, &(0x7f0000000100)=0x94) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r5, 0x84, 0x13, &(0x7f0000000240)={r6, 0x1}, &(0x7f0000000280)=0x8) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0xb9) r7 = eventfd(0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000000)={r7, 0x0, 0x2, r7}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000000c0)={r7, 0xffffffffffff2f4b, 0x2, r7}) [ 1542.706601] binder: 30475:30484 ioctl 401c5820 20000500 returned -22 [ 1542.739049] binder: BINDER_SET_CONTEXT_MGR already set [ 1542.744577] binder: 30475:30484 ioctl 40046207 0 returned -16 [ 1542.776308] binder: 30475:30484 got new transaction with bad transaction stack, transaction 319 has target 30475:0 [ 1542.787189] binder: 30475:30484 transaction failed 29201/-71, size 0-0 line 2884 [ 1542.795046] binder: 30475:30484 ioctl c0306201 200008c0 returned -14 14:47:26 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x24200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1542.852021] binder: 30475:30493 unknown command 1048326 [ 1542.857428] binder: 30475:30493 ioctl c0306201 20000380 returned -22 14:47:27 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) write$input_event(r3, &(0x7f0000000100)={{}, 0x1f, 0x10000, 0x9}, 0x18) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:27 executing program 2 (fault-call:2 fault-nth:5): getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:27 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x7fffffff, r3}) r4 = fcntl$getown(r3, 0x9) syz_open_procfs(r4, &(0x7f0000000080)='status\x00') ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:27 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000000), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x1, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:27 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x50, 0x80) ioctl$VIDIOC_G_PARM(r2, 0xc0cc5615, &(0x7f0000000180)={0xa, @capture={0x1000, 0x1, {0x40, 0x9}, 0x3f, 0x9}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0x0, 0x2, r5}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r6 = dup2(r3, r3) ioctl$VIDIOC_G_CTRL(r6, 0xc008561b, &(0x7f0000000080)={0x9, 0xffffffff}) 14:47:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = request_key(&(0x7f0000000040)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)='/dev/binder#\x00', 0xfffffffffffffff9) keyctl$clear(0x7, r2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0xffffffffffffffff, 0x8010, r1, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) r5 = dup2(r4, r3) ioctl$BLKBSZSET(r5, 0x40081271, &(0x7f0000000180)=0x1) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) [ 1543.282893] binder: release 30475:30484 transaction 319 out, still active [ 1543.290012] binder: undelivered TRANSACTION_COMPLETE [ 1543.295387] binder: undelivered TRANSACTION_ERROR: 29201 [ 1543.344139] binder: undelivered TRANSACTION_ERROR: 29201 [ 1543.349784] binder: send failed reply for transaction 319, target dead [ 1543.359422] FAULT_INJECTION: forcing a failure. [ 1543.359422] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1543.366709] CPU: 1 PID: 30516 Comm: syz-executor2 Not tainted 4.20.0-rc7+ #15 [ 1543.377496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1543.377496] Call Trace: [ 1543.377496] dump_stack+0x173/0x1d0 [ 1543.377496] should_fail+0xa19/0xb20 [ 1543.377496] __alloc_pages_nodemask+0x7b0/0x5f20 [ 1543.377496] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 1543.377496] ? rmqueue+0xa6/0x1240 [ 1543.377496] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 1543.377496] ? kernel_poison_pages+0x19d/0x360 [ 1543.420715] QAT: Invalid ioctl [ 1543.377496] kmsan_internal_alloc_meta_for_pages+0xf2/0x580 [ 1543.377496] kmsan_alloc_page+0x7e/0x100 [ 1543.377496] __alloc_pages_nodemask+0x1587/0x5f20 14:47:27 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x0, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x40000, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x402002, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r2, 0x6, 0x446a, r3}) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f00000000c0)={r5, 0x0, 0x2, r5}) [ 1543.377496] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1543.377496] ? update_load_avg+0x11b5/0x1a90 [ 1543.438827] QAT: Invalid ioctl [ 1543.431578] ? alloc_pages_vma+0x105/0x1960 [ 1543.453297] irq bypass consumer (token 000000009b51d462) registration fails: -16 [ 1543.431578] ? handle_mm_fault+0x5593/0x9ef0 [ 1543.468717] alloc_pages_vma+0xd0d/0x1960 [ 1543.469730] handle_mm_fault+0x5593/0x9ef0 [ 1543.476434] ? __schedule+0x6f3/0x830 [ 1543.476434] __do_page_fault+0xf26/0x1a60 [ 1543.476434] do_page_fault+0xe9/0x5c0 [ 1543.476434] ? kmsan_unpoison_pt_regs+0x13/0x20 [ 1543.476434] ? page_fault+0x2b/0x50 [ 1543.476434] page_fault+0x3d/0x50 [ 1543.476434] RIP: 0010:__put_user_4+0x1c/0x30 [ 1543.476434] Code: 1f 00 c3 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 8b 1c 25 00 fd 02 00 48 8b 9b 58 1a 00 00 48 83 eb 03 48 39 d9 73 3c 0f 1f 00 <89> 01 31 c0 0f 1f 00 c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 [ 1543.511989] RSP: 0018:ffff88819205fc28 EFLAGS: 00010297 [ 1543.511989] RAX: 00000000fffffff2 RBX: 00007fffffffeffd RCX: 0000000020002000 [ 1543.511989] RDX: ffff88819379fd6c RSI: 0000160000000000 RDI: ccccccccccccd000 [ 1543.511989] RBP: ffff88819205fe68 R08: ffff8882152be078 R09: 0000000000000000 [ 1543.511989] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffff2 [ 1543.511989] R13: ffff88819205fdb0 R14: 00000000fffffff2 R15: ffff8881adae4588 [ 1543.511989] ? kernel_move_pages+0x10cb/0x2b80 [ 1543.511989] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 1543.511989] ? prepare_exit_to_usermode+0x114/0x420 [ 1543.511989] __se_sys_move_pages+0x111/0x130 [ 1543.511989] __x64_sys_move_pages+0x6e/0x90 [ 1543.511989] do_syscall_64+0xbc/0xf0 [ 1543.511989] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1543.511989] RIP: 0033:0x4579b9 [ 1543.511989] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1543.620406] RSP: 002b:00007fcd51022c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 [ 1543.620406] RAX: ffffffffffffffda RBX: 00007fcd51022c90 RCX: 00000000004579b9 [ 1543.620406] RDX: 0000000020000000 RSI: 00000000000002c9 RDI: 0000000000000000 [ 1543.640782] binder_alloc: 30528: binder_alloc_buf, no vma [ 1543.620406] RBP: 000000000073bfa0 R08: 0000000020002000 R09: 0000000000000000 [ 1543.620406] R10: 000000002026bfec R11: 0000000000000246 R12: 00007fcd510236d4 [ 1543.620406] R13: 00000000004c371e R14: 00000000004d62e8 R15: 0000000000000003 [ 1543.672799] binder: 30528:30531 transaction failed 29189/-3, size 24-8 line 2973 14:47:27 executing program 2 (fault-call:2 fault-nth:6): getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:27 executing program 1: openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x480000, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) [ 1543.761266] binder: 30528:30531 Release 1 refcount change on invalid ref 1 ret -22 14:47:27 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x101840, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000100)={0x0, 0x38, "c99fc689e99d299694a6abde1aac802a8de363bc770d0b36a9ae297a28f03c6e95243ab901d89d7d496a6de2e2970d594fd083ba6e904582"}, &(0x7f0000000180)=0x40) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f00000001c0)={r5, @in={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, &(0x7f0000000280)=0x84) [ 1543.878368] FAULT_INJECTION: forcing a failure. [ 1543.878368] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1543.890512] CPU: 1 PID: 30539 Comm: syz-executor2 Not tainted 4.20.0-rc7+ #15 [ 1543.898292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1543.900393] Call Trace: [ 1543.900393] dump_stack+0x173/0x1d0 [ 1543.900393] should_fail+0xa19/0xb20 [ 1543.900393] __alloc_pages_nodemask+0x7b0/0x5f20 [ 1543.922204] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1543.922204] ? lru_cache_add_active_or_unevictable+0x40b/0x630 [ 1543.922204] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1543.922204] ? _vm_normal_page+0x151/0x4c0 [ 1543.922204] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1543.922204] alloc_new_node_page+0x1e6/0x400 [ 1543.922204] migrate_pages+0x644/0x4050 [ 1543.922204] ? change_prot_numa+0x150/0x150 [ 1543.922204] kernel_move_pages+0x1177/0x2b80 [ 1543.922204] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 1543.922204] ? prepare_exit_to_usermode+0x114/0x420 [ 1543.922204] __se_sys_move_pages+0x111/0x130 [ 1543.922204] __x64_sys_move_pages+0x6e/0x90 [ 1543.922204] do_syscall_64+0xbc/0xf0 [ 1543.922204] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1543.922204] RIP: 0033:0x4579b9 [ 1543.922204] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1543.922204] RSP: 002b:00007fcd51043c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 14:47:28 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x2000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x6, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:28 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x566, 0x200000) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1543.922204] RAX: ffffffffffffffda RBX: 00007fcd51043c90 RCX: 00000000004579b9 [ 1543.922204] RDX: 0000000020000000 RSI: 00000000000002c9 RDI: 0000000000000000 [ 1543.922204] RBP: 000000000073bf00 R08: 0000000020002000 R09: 0000000000000000 [ 1543.922204] R10: 000000002026bfec R11: 0000000000000246 R12: 00007fcd510446d4 [ 1543.922204] R13: 00000000004c371e R14: 00000000004d62e8 R15: 0000000000000003 [ 1544.166867] irq bypass consumer (token 000000006a4204b1) registration fails: -16 14:47:28 executing program 2 (fault-call:2 fault-nth:7): getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:28 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/null\x00', 0x4000, 0x0) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f0000000400)={0x0, {0x2, 0x4e23, @loopback}, {0x2, 0x4e22, @empty}, {0x2, 0x4e24, @empty}, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000200)='vcan0\x00', 0xb3bd, 0xfff, 0x1}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r5, 0x0, 0x2, r5}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x147040, 0x0) r7 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f00000002c0)={'team0\x00', 0x0}) accept$packet(0xffffffffffffff9c, &(0x7f00000040c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000004100)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000004200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000004240)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000004340)={{{@in=@multicast2, @in6=@ipv4={[], [], @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f0000004440)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000480)={{{@in=@broadcast, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@local}}, &(0x7f0000000240)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000004680)={{{@in6=@initdev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast1}}, &(0x7f0000004780)=0xe8) getpeername$packet(r0, &(0x7f0000004800)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000004840)=0x14) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004880)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000048c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000004940)={'vcan0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000300)={{{@in6=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000004bc0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000004c00)={{{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@dev}}, &(0x7f0000004d00)=0xe8) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004e40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000004e80)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000004ec0)={{{@in=@broadcast, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000004fc0)=0xe8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000005000)={'syz_tun\x00', 0x0}) getpeername$packet(r0, &(0x7f0000005040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000005080)=0x14) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000050c0)={{{@in=@empty, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast1}}, &(0x7f00000051c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000005200)={'vcan0\x00', 0x0}) sendmsg$TEAM_CMD_NOOP(r6, &(0x7f00000059c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000005980)={&(0x7f0000000580)=ANY=[@ANYBLOB=',\a\x00\x00', @ANYRES16=r7, @ANYBLOB="180027bd7000fedbdf250000000008000100", @ANYRES32=r8, @ANYBLOB="6c01020038000100240001006c625f73726566726573685f696e74657276616c000000000000000800030003000000080004000300000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040001000000080007000000000040000100240001006c625f686173685f737461747300000000000000400000000000000000000000080003000b000000080004000004000008000700000000003c00010024000100757365725f6c696e6b75705f656e61626c656400000d00000000000000000000080003000600000004000400080006000000000000bd49cacdb427b366d312c4b501ee2498c3cdf34c859c", @ANYRES32=r9, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r10, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000080003000300000008000400ffffff7f08000100", @ANYRES32=r11, @ANYBLOB="340102003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r12, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000100000008000600", @ANYRES32=r13, @ANYBLOB="40000100350001006c625f74785f686173685f696e67000008000400000000000000000000000000", @ANYRES32=r14, @ANYBLOB="080007000000000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004000500000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b00000008000400ce000000080007000000000008000100", @ANYRES32=r15, @ANYBLOB="2c0102003c000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000000c00040072616e646f6d00003c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000000c000400932fc908000100003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r16, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000080003000300000008000400010000803c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r17, @ANYBLOB="08000100", @ANYRES32=r18, @ANYBLOB="7800020038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400ff0000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r19, @ANYBLOB="08000100", @ANYRES32=r20, @ANYBLOB="ac0102003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r21, @ANYBLOB="40000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b00000008000400fdffffff08000700000000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r22, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004000800000040000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000001000040062726f61646361737400000040000100240001006d6f646500000000000000000000000000000000000000000000000000000000080003000500000010000400726f756e64726f62696e000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004000200000008000100", @ANYRES32=r23, @ANYBLOB="f800020038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004000800000044000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b00000014000400000006050600000003000005fdffffff3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r24, @ANYBLOB="3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r25], 0x72c}, 0x1, 0x0, 0x0, 0x4001}, 0x4000080) [ 1544.490752] FAULT_INJECTION: forcing a failure. [ 1544.490752] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1544.502043] CPU: 0 PID: 30562 Comm: syz-executor2 Not tainted 4.20.0-rc7+ #15 [ 1544.502043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1544.502043] Call Trace: [ 1544.502043] dump_stack+0x173/0x1d0 [ 1544.502043] should_fail+0xa19/0xb20 [ 1544.502043] __alloc_pages_nodemask+0x7b0/0x5f20 [ 1544.502043] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 1544.502043] ? rmqueue+0xa6/0x1240 [ 1544.541697] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 1544.541697] ? kernel_poison_pages+0x19d/0x360 [ 1544.541697] kmsan_internal_alloc_meta_for_pages+0x80/0x580 [ 1544.541697] kmsan_alloc_page+0x7e/0x100 [ 1544.541697] __alloc_pages_nodemask+0x1587/0x5f20 [ 1544.541697] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1544.541697] alloc_new_node_page+0x1e6/0x400 [ 1544.541697] migrate_pages+0x644/0x4050 [ 1544.581822] ? change_prot_numa+0x150/0x150 [ 1544.581822] kernel_move_pages+0x1177/0x2b80 [ 1544.581822] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 1544.581822] ? prepare_exit_to_usermode+0x114/0x420 [ 1544.581822] __se_sys_move_pages+0x111/0x130 [ 1544.604768] __x64_sys_move_pages+0x6e/0x90 [ 1544.604768] do_syscall_64+0xbc/0xf0 [ 1544.604768] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1544.604768] RIP: 0033:0x4579b9 [ 1544.604768] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 14:47:28 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x7077) r2 = socket(0x1b, 0x1, 0xcb) connect$tipc(r2, &(0x7f00000000c0)=@id={0x1e, 0x3, 0xd2c091d9b60d9a27, {0x4e23, 0x3}}, 0x10) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x8000, 0x0) ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x2}) 14:47:28 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x202, 0x0) r1 = socket(0x0, 0x1, 0x1a705206) setsockopt$CAIFSO_REQ_PARAM(r1, 0x116, 0x80, &(0x7f00000001c0)="b51ae7eef0f3f0cb44303a524e0f51903edcbb3566274557da1b302ae5a805055bfcabd767c5d6860dfc5cf416d07b91c44a6289442d58183269089a21ba81423f05d1b900a85bcd4b4d17680da0a2388adaa364f48ba544239a96ee7ea7d37f36c2c9acba4147b3662ded64bbf5671e0a1705e93fc0b4ba9e9f7f9f08c7", 0x7e) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = openat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r3, 0x800455d1, &(0x7f0000000040)) r4 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r4}) setsockopt$TIPC_SRC_DROPPABLE(r3, 0x10f, 0x80, &(0x7f0000000440)=0x7, 0x4) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)={0xd0, r5, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x45bd}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7fff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x100000001}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}]}, @IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ifb0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x20040000}, 0x4) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r4}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r4, 0x4}) [ 1544.604768] RSP: 002b:00007fcd51022c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 [ 1544.604768] RAX: ffffffffffffffda RBX: 00007fcd51022c90 RCX: 00000000004579b9 [ 1544.651772] RDX: 0000000020000000 RSI: 00000000000002c9 RDI: 0000000000000000 [ 1544.651772] RBP: 000000000073bfa0 R08: 0000000020002000 R09: 0000000000000000 [ 1544.666677] R10: 000000002026bfec R11: 0000000000000246 R12: 00007fcd510236d4 [ 1544.673177] R13: 00000000004c371e R14: 00000000004d62e8 R15: 0000000000000003 14:47:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x110, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSTI(r0, 0x5412, 0x1) fstat(r2, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:28 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x40000, 0x0) r1 = getgid() getgroups(0x2, &(0x7f0000000180)=[r1, r1]) setregid(r1, r2) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x8) r5 = eventfd(0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuacct.usage_all\x00', 0x0, 0x0) ioctl$TCSETSF(r6, 0x5404, &(0x7f0000000100)={0x81, 0x7, 0x100000000, 0x8, 0x6, 0x7f, 0x80000001, 0x941, 0x4, 0x4, 0x4, 0x800}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) writev(r0, &(0x7f0000000200)=[{&(0x7f00000001c0)="a8f1f35c6e2a8d5c6bf8139ab5225e999d8b0a47592c847320721c", 0x1b}], 0x1) ioctl$TUNSETFILTEREBPF(r6, 0x800454e1, &(0x7f0000000240)=r6) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000000c0)={r5, 0xffffffffffff2f4b, 0x2, r5}) 14:47:28 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x20000000000000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) [ 1544.703015] binder: undelivered TRANSACTION_ERROR: 29189 [ 1544.848017] binder: 30578:30580 got transaction to context manager from process owning it [ 1544.856830] binder: 30578:30580 transaction failed 29201/-22, size 24-8 line 2825 14:47:29 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = gettid() ioprio_set$pid(0x3, r3, 0x8) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x54000, 0x0) linkat(r1, &(0x7f0000000080)='./file0\x00', r5, &(0x7f0000000180)='./file0\x00', 0x1000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) [ 1544.963392] irq bypass consumer (token 00000000571eaa44) registration fails: -16 [ 1544.986626] binder: 30578:30580 ioctl 5412 1 returned -22 [ 1545.073821] binder: 30578:30580 Release 1 refcount change on invalid ref 1 ret -22 14:47:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) setxattr$security_selinux(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='security.selinux\x00', &(0x7f0000000240)='/usr/sbin/cups-browsed\x00', 0x17, 0x1) r4 = socket$inet6(0xa, 0x4000000003, 0x3) sendto$inet6(r4, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast1}, 0x1c) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000000)=0x9b, 0x4) readv(r4, &(0x7f00000003c0)=[{&(0x7f0000000040)=""/243, 0xf3}], 0x1) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x40100, 0x0) ioctl$KDSKBMETA(r5, 0x4b63, &(0x7f0000000100)=0x5) ioctl$EVIOCGPHYS(r5, 0x80404507, &(0x7f0000000280)=""/186) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:29 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x2000fffffffffc, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000740)='/dev/binder#\x00', 0x0, 0x2) setxattr$security_selinux(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='security.selinux\x00', &(0x7f0000000100)='system_u:object_r:tun_tap_device_t:s0\x00', 0x26, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = shmget(0x0, 0x3000, 0x200, &(0x7f0000000000/0x3000)=nil) shmctl$SHM_INFO(r2, 0xe, &(0x7f0000000640)=""/234) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0x800, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000003c0)={{{@in6=@ipv4, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000280)=r4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r3, 0xc0945662, &(0x7f0000000580)={0x90, 0x0, [], {0x0, @bt={0x40, 0xffffffffffffffff, 0x1, 0x2, 0x200, 0x3f, 0x1, 0x5, 0xb0a9, 0x10001, 0x81, 0x0, 0x39eb, 0xcb, 0x8, 0x2}}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0673044001200000"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 14:47:29 executing program 2 (fault-call:2 fault-nth:8): getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1545.320957] binder: undelivered TRANSACTION_ERROR: 29201 14:47:29 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, &(0x7f0000000100)=0x1c, 0x80800) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@loopback, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000240)=0xe8) setsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000280)={@empty, r2}, 0x14) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:29 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x6f7ea2d2, 0x8000) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000100)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) eventfd(0x101) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000180)={0xf5, 0x0, [0x6, 0xfffffffffffffff8, 0x9, 0x1]}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) r5 = dup(r0) openat$cgroup(r5, &(0x7f0000000200)='syz1\x00', 0x200002, 0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) [ 1545.499436] QAT: Invalid ioctl [ 1545.531781] QAT: Invalid ioctl 14:47:29 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) r3 = accept4$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, &(0x7f0000000140)=0x10, 0x80800) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000180)={0x0, 0x47, "6aaea899d75c0c8d6be1895f7558ca8559df197ed06a03a1f40c3783447f04d1fdf2715f8ed869bf1d8019498072a8255a666546ee42c68ff9b6fee94a69b7825cb04d5667d240"}, &(0x7f0000000200)=0x4f) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f0000000340)=ANY=[@ANYRES32=r4, @ANYBLOB="c2000000a2cbf316378822eafa7e58dd97b7fe1af37c8546ccc7ca0cf93ece94babe33063310e15bf655bba77e82bb586c197070e640e9464ac39da445f2e0f106fea5b199060a6388486f58f6c92a7c1cffb9d1efcf63217db6f56197b9ae5ca3f65fb26a513142606b7a3a122624c208740ad4b318a2f2659cb64e8ffd9f215904eddc5b1cf0db01826421091f72fc658538aa990fcf7c05e2453933f9eab66cf32d98d01cd2311aecf6a1378fef743b10950f7fc4a74af2433831a1c45c4f0baf904b8502"], &(0x7f0000000240)=0xca) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000280)) [ 1545.596789] binder: 30609:30622 unknown command 1074033414 [ 1545.602641] binder: 30609:30622 ioctl c0306201 20000380 returned -22 [ 1545.685004] FAULT_INJECTION: forcing a failure. [ 1545.685004] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1545.691574] CPU: 1 PID: 30628 Comm: syz-executor2 Not tainted 4.20.0-rc7+ #15 [ 1545.691574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1545.691574] Call Trace: [ 1545.691574] dump_stack+0x173/0x1d0 [ 1545.691574] should_fail+0xa19/0xb20 [ 1545.691574] __alloc_pages_nodemask+0x7b0/0x5f20 [ 1545.691574] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 1545.691574] ? rmqueue+0xa6/0x1240 [ 1545.691574] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 1545.691574] ? kernel_poison_pages+0x19d/0x360 [ 1545.691574] kmsan_internal_alloc_meta_for_pages+0xf2/0x580 [ 1545.691574] kmsan_alloc_page+0x7e/0x100 [ 1545.691574] __alloc_pages_nodemask+0x1587/0x5f20 [ 1545.691574] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1545.691574] alloc_new_node_page+0x1e6/0x400 [ 1545.691574] migrate_pages+0x644/0x4050 [ 1545.691574] ? change_prot_numa+0x150/0x150 [ 1545.691574] kernel_move_pages+0x1177/0x2b80 [ 1545.691574] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 1545.691574] ? prepare_exit_to_usermode+0x114/0x420 [ 1545.691574] __se_sys_move_pages+0x111/0x130 [ 1545.691574] __x64_sys_move_pages+0x6e/0x90 [ 1545.691574] do_syscall_64+0xbc/0xf0 [ 1545.691574] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1545.691574] RIP: 0033:0x4579b9 [ 1545.691574] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 14:47:29 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x40000, 0x0) ioctl$PIO_FONT(r3, 0x4b61, &(0x7f00000001c0)="26b953b768710e9d8ab28458d90ce47014ebda2472c15041fd3b6b0c89297d462a7220d40b76bf4427b880952b579a4ff090b548bcb102d108f470a7e32e5f642de7849be9dfe26b346f23d49661114bdf712ade4f74023c7470b0babf5b249d2b628cc75331dc36fc53c79119021a13956feaeed202ac7ebf1ee96852154c6327a35f1e4d65ea9fea648ba23a9a1837230ca34125cfc83e96f2260d844b562f2a3cd97564a77509fb972f7dbc85eea863") ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r4 = fcntl$dupfd(r0, 0x4000000000000000, r1) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffff9c, 0xc008640a, &(0x7f0000000000)={0x0}) r6 = getpid() wait4(r6, &(0x7f0000000280), 0x51f02b571e11b928, 0x0) r7 = fcntl$dupfd(r2, 0x406, r1) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000140)={r5, 0x80000, r7}) 14:47:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4001fe) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000080)={0x4, r3, 0x1}) [ 1545.835481] RSP: 002b:00007fcd51001c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 [ 1545.836759] RAX: ffffffffffffffda RBX: 00007fcd51001c90 RCX: 00000000004579b9 [ 1545.836759] RDX: 0000000020000000 RSI: 00000000000002c9 RDI: 0000000000000000 [ 1545.855746] RBP: 000000000073c040 R08: 0000000020002000 R09: 0000000000000000 [ 1545.855746] R10: 000000002026bfec R11: 0000000000000246 R12: 00007fcd510026d4 [ 1545.855746] R13: 00000000004c371e R14: 00000000004d62e8 R15: 0000000000000003 [ 1545.902775] binder_alloc: binder_alloc_mmap_handler: 30609 20001000-20004000 already mapped failed -16 14:47:30 executing program 2 (fault-call:2 fault-nth:9): getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1545.999737] binder: BINDER_SET_CONTEXT_MGR already set [ 1546.005268] binder: 30609:30636 ioctl 40046207 0 returned -16 [ 1546.006574] QAT: Invalid ioctl 14:47:30 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x20, 0x400000) ioctl$EVIOCSABS0(r3, 0x401845c0, &(0x7f0000000100)={0x5, 0x40, 0xa, 0x3cd8dbc9, 0x7, 0x8}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) [ 1546.072646] binder_alloc: 30609: binder_alloc_buf, no vma [ 1546.078298] binder: 30609:30622 transaction failed 29189/-3, size 24-8 line 2973 14:47:30 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x4000, 0x0) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f0000000200)) r4 = eventfd(0x0) r5 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x0, 0x800) ioctl$VHOST_SET_FEATURES(r5, 0x4008af00, &(0x7f0000000100)) ioctl$DRM_IOCTL_ADD_CTX(r5, 0xc0086420, &(0x7f0000000180)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) [ 1546.163781] QAT: Invalid ioctl [ 1546.211420] binder: release 30609:30616 transaction 326 out, still active [ 1546.218549] binder: unexpected work type, 4, not freed [ 1546.224039] binder: undelivered TRANSACTION_COMPLETE [ 1546.262267] binder: undelivered TRANSACTION_ERROR: 29189 [ 1546.267843] binder: send failed reply for transaction 326, target dead 14:47:30 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0xaa157f2aa2fa62bf, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:30 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = eventfd(0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000100)={r1, 0x0, 0x2, r1}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={r1, 0xffffffffffff2f4b, 0x2, r1}) [ 1546.369561] irq bypass consumer (token 000000008781f67f) registration fails: -16 14:47:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000008000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="cf0a40010ed73d1edd3f4956ea11133d47850f307376491364e6e48415931b2cbe562230c253ebabba0e8e73e4ff00000000ae76d75945d6ec8694856b64d0fa3a4cd4d2dffd35000964af81919900000000000000"], 0x1, 0x0, &(0x7f0000000540)="fc"}) dup2(r0, r0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x10003, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000280)={0x1800000000000000, 0x20, 0x1, r3}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:30 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x600, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={r0, &(0x7f0000000040)="334bfb3e2487c0da4ab506b3afec290297620bf09debcf4bd69817bd918e494424bd0970a662ef00ec906b81ae694595248707b36085d0e8093e98c0191a431c080087d917ffe2d0951e83b9aeb14e0d8968121f41460c5aac56607ba1aae489b04a0bfcf9854798978c2e958fd9a3c11a5c1b48a444da60207eadace8fad34ebb739fb2432db2f66af099850aeff570d9ee7877f9e508e17876d36005f1cc951d00fc", &(0x7f0000000180)=""/99}, 0x18) setxattr$trusted_overlay_nlink(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='trusted.overlay.nlink\x00', &(0x7f0000000300)={'L+', 0x101}, 0x28, 0x1) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1546.542969] binder: 30666:30668 unknown command 20974287 [ 1546.548561] binder: 30666:30668 ioctl c0306201 20000380 returned -22 14:47:30 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x100000000, r2}) 14:47:30 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = open(&(0x7f0000000080)='./file0\x00', 0x200, 0x0) ioctl$VIDIOC_ENUMOUTPUT(r2, 0xc0485630, &(0x7f0000000180)={0x1ff, "8ec2b52f4451c532e6a70ecebfbc521cc0808dfba982817753bf7ece678213e9", 0x3, 0x7ff, 0x7f, 0x50807, 0x6}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:47:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) rt_sigreturn() ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) connect$pptp(r3, &(0x7f00000000c0)={0x18, 0x2, {0x2, @multicast1}}, 0x1e) 14:47:30 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x800100000003) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000440)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x4, [{{0xa, 0x4e21, 0x5933edd7, @remote}}, {{0xa, 0x4e24, 0x4, @mcast2, 0xfe1b}}, {{0xa, 0x4e20, 0x2, @mcast2, 0x1f}}, {{0xa, 0x0, 0x0, @loopback}}]}, 0x290) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast2}}}, 0x108) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) [ 1546.744310] binder: send failed reply for transaction 331 to 30666:30668 [ 1546.753104] binder: undelivered TRANSACTION_COMPLETE [ 1546.758490] binder: undelivered TRANSACTION_ERROR: 29189 14:47:30 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) eventfd(0x7d7) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:30 executing program 2: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0x14, 0x0, &(0x7f0000000080)=0x103aea1) close(r0) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x7, 0x200203) ioctl$SIOCGETNODEID(r1, 0x89e1, &(0x7f00000000c0)={0x3}) r2 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$KDGKBMODE(r2, 0x4b44, &(0x7f0000000000)) 14:47:31 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x1, 0x2) ioctl$DRM_IOCTL_GET_MAP(r2, 0xc0286404, &(0x7f0000000100)={0x0, 0x2, 0x5, 0x30, &(0x7f0000ffc000/0x1000)=nil, 0x3612}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x1, 0x0, &(0x7f0000000540)="fc"}) lsetxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.origin\x00', &(0x7f0000000100)='y\x00', 0x2, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0x46000, 0x0) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') getsockname$packet(0xffffffffffffff9c, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000400)=0x14) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000500)={'veth0_to_bridge\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000600)={{{@in=@local, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}}}, &(0x7f0000000700)=0xe8) getpeername$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000780)=0x14) accept$packet(0xffffffffffffff9c, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000800)=0x14) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000880)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000008c0)=0x14) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000002100)={@remote, @broadcast, 0x0}, &(0x7f0000002140)=0xc) getsockname$packet(r3, &(0x7f0000002180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000021c0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000022c0)={{{@in6=@mcast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f00000023c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000002400)={'ipddp0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000002440)={'team0\x00', 0x0}) accept4$packet(0xffffffffffffff9c, &(0x7f0000002f40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000002f80)=0x14, 0x80800) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000002fc0)={{{@in6=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@empty}}, &(0x7f00000030c0)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000003100)={0x0, @broadcast, @local}, &(0x7f0000003140)=0xc) accept4$packet(0xffffffffffffffff, &(0x7f0000003180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000031c0)=0x14, 0x800) getsockname$packet(r1, &(0x7f0000003280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000032c0)=0x14) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000003340)={@remote, @multicast2, 0x0}, &(0x7f0000003380)=0xc) getpeername$packet(r0, &(0x7f00000033c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000003400)=0x14) accept$packet(0xffffffffffffffff, &(0x7f0000003540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000003580)=0x14) getsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000004900)={@broadcast, @initdev, 0x0}, &(0x7f0000004940)=0xc) getsockname$packet(0xffffffffffffff9c, &(0x7f0000004980)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000049c0)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000005280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100044}, 0xc, &(0x7f0000005240)={&(0x7f0000004a00)={0x814, r5, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [{{0x8, 0x1, r6}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x800}}}]}}, {{0x8, 0x1, r7}, {0x44, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r8}}}]}}, {{0x8, 0x1, r9}, {0x198, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7d6d}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r11}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xbe84}}}]}}, {{0x8, 0x1, r12}, {0x74, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r13}, {0x188, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r14}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r15}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x2180000}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r17}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r18}, {0x23c, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r19}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r20}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x82e}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xfffffffeffffffff}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r21}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r22}, {0xb8, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r23}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r24}}, {0x8}}}]}}, {{0x8, 0x1, r25}, {0xb8, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x43}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r26}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}]}, 0x814}, 0x1, 0x0, 0x0, 0x4040804}, 0x40000) [ 1547.105858] binder: send failed reply for transaction 335 to 30680:30682 [ 1547.121300] binder: undelivered TRANSACTION_COMPLETE [ 1547.126794] binder: undelivered TRANSACTION_ERROR: 29189 [ 1547.144048] irq bypass consumer (token 00000000bcae226d) registration fails: -16 14:47:31 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000000)=0x101, 0x8) [ 1547.265654] binder: 30705:30706 unknown command 0 [ 1547.270567] binder: 30705:30706 ioctl c0306201 20000380 returned -22 14:47:31 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) fcntl$getflags(r0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x40, 0x0) ioctl$SG_GET_VERSION_NUM(r1, 0x2282, &(0x7f0000000140)) munlockall() r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) 14:47:31 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_GET_CLOCK(r1, 0x8030ae7c, &(0x7f0000000080)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:31 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) signalfd(r2, &(0x7f0000000240)={0x8}, 0x8) r5 = dup3(r0, r0, 0x80000) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_PORTS(r5, &(0x7f0000000200)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r6, 0x2, 0x70bd28, 0x25dfdbfc, {}, [""]}, 0x1c}}, 0x44000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) [ 1547.372175] irq bypass consumer (token 000000004a5ec5fb) registration fails: -16 14:47:31 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) fstat(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)=0x0) write$FUSE_CREATE_OPEN(r0, &(0x7f0000000280)={0xa0, 0xffffffffffffffff, 0x1, {{0x2, 0x0, 0x8, 0x100000000, 0xe26, 0x7, {0x2, 0x200, 0x4, 0xfffffffffffffffa, 0x7, 0x61, 0x8a2d, 0x176, 0x9, 0xffffffffffffffff, 0x0, r1, r2, 0x1, 0x3}}, {0x0, 0x1}}}, 0xa0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-monitor\x00', 0x200000, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x10001, 0x0, 0x2, 0x100000001}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000040)={0x0, r4}) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(r3, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000004}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r5, 0x400, 0x70bd2b, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008000}, 0x40001) 14:47:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000280)='/dev/dsp#\x00', 0x9, 0x20401) ioctl$KVM_NMI(r2, 0xae9a) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) preadv(r0, &(0x7f0000002740)=[{&(0x7f00000000c0)=""/69, 0x45}, {&(0x7f00000003c0)=""/197, 0xc5}, {&(0x7f0000000580)=""/164, 0xa4}, {&(0x7f0000000140)=""/106, 0x6a}, {&(0x7f0000000640)=""/4096, 0x1000}, {&(0x7f0000001640)=""/4096, 0x1000}, {&(0x7f0000002640)=""/247, 0xf7}, {&(0x7f0000000040)=""/16, 0x10}, {&(0x7f00000004c0)=""/92, 0x5c}, {&(0x7f0000000280)}], 0xa, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000002800)=ANY=[@ANYBLOB="ef02981e21eba05a30e61337513491cf7c4fa94d37e725ce0b1019f7a40dafe937abe78ecc87c3921c2315ea86be8b9559b4274386a5acbb9fc33ce16f5e13d39539c72effa449bda2e151ac619362d03fc2c708ef65789ceb25c705a795beac2123eb53f31bdaf7d925490a933e25c3822c4b386f113042fd48f2c624b0a8c6320e3266b5a2b67d58f24ff410d15c0de3cbb08e820b98f48ffa995d9742864b3388896eddd818e3f01ebd7389a221ec431c7520bf263c309e416d2d3f9a1d1f188530609f69d1d1b8a4986f0404750cc4ef3ecadbb3da664a74b0305ff1b800000000000000000000000000"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:47:31 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) [ 1547.636235] binder: send failed reply for transaction 339 to 30705:30706 [ 1547.644874] binder: undelivered TRANSACTION_COMPLETE [ 1547.650125] binder: undelivered TRANSACTION_ERROR: 29189 [ 1547.665115] irq bypass consumer (token 000000001e701a39) registration fails: -16 14:47:31 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000180)='/dev/vbi#\x00', 0x3, 0x2) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f00000001c0)='syz0\x00') ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$TIOCCBRK(r1, 0x5428) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000080), &(0x7f0000000100)=0x4) ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f0000000200)=0x400) [ 1547.850712] binder: 30737:30738 ioctl c0306201 20000380 returned -14 14:47:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = add_key(&(0x7f0000000080)='rxrpc_s\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000180)="f1fe62756db2d70e961fcef61414a602934685fcdeb22dcc762b089e86d60f6bb8a457999ad5b9c2d1abea76ab9d964a227d5ecb7af7831a0682c29945f099d21e88cc1e73c9fb2d66ebc4b825387729b78a028fc173fc01a36aecf13e7a03a09acc5646372cc60099c0ea7d493df2cd9073bfd36783a2162585c2605a45ab77e4ef39e8f65711b2b58b41568baf7862b08ee0b5c199e4fab503adba8dd66a9aaf2898a79ccb1e50fce5139afa4cb6d13cd7b483d6ddeacc649c", 0xba, 0xfffffffffffffffb) r4 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$search(0xa, r4, &(0x7f00000003c0)='trusted\x00', &(0x7f0000000400)={'syz', 0x0}, r4) keyctl$instantiate(0xc, r3, &(0x7f0000000240)=@encrypted_load={'load ', 'default', 0x20, 'trusted:', '/dev/kvm\x00', 0x20, 0x1, 0x20, [0x77]}, 0x36, r4) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000300)='/dev/dlm-control\x00', 0x4000, 0x0) ioctl$VIDIOC_G_EDID(r6, 0xc0285628, &(0x7f0000000380)={0x0, 0x3f, 0x6, [], &(0x7f0000000340)=0xfff}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0xffffffffffff2f4b, 0x2, r5}) 14:47:32 executing program 2: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x3, 0x1e, [], 0x20e, &(0x7f0000000000), &(0x7f0000000000)=""/30}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000080)={0x0, 0x80000, r0}) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f00000000c0)={r2}) 14:47:32 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x800000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$kcm(0x29, 0x5, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x21) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, &(0x7f0000000140)="c744240005000000c7442402f4ffffffc7442406000000000f0114240f95b30000000066b840000f00d0c4e3794c81020000000cda76070f21d2c4c331216800ae660f38827cedf50f01b5408b0000c4e315386f25ab", 0x56}], 0x1, 0x8, &(0x7f0000000200)=[@cr0={0x0, 0x18}, @dstype3={0x7, 0x9}], 0x2) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) socket$kcm(0x29, 0x2, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) prctl$PR_SET_TIMERSLACK(0x1d, 0x9) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) 14:47:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="7f00000000000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0663044001009de4"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1548.023744] binder: send failed reply for transaction 343 to 30737:30738 [ 1548.040204] binder: undelivered TRANSACTION_COMPLETE [ 1548.045610] binder: undelivered TRANSACTION_ERROR: 29189 14:47:32 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x8, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000180)={{0xa, 0x4e20, 0x9, @ipv4={[], [], @rand_addr=0x429}, 0x36992c9}, {0xa, 0x4e20, 0x401, @loopback}, 0x2, [0x8, 0x8001, 0x6, 0x1f, 0x80, 0x8, 0xfffffffffffffffa, 0x80000000]}, 0x5c) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f0000000100)={0xda, 0x33, 0x1, 0x13, 0x0, 0x100000000, 0x5, 0x6e, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) r5 = getpid() fcntl$setownex(r2, 0xf, &(0x7f0000000200)={0x1, r5}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) [ 1548.150328] binder: 30752:30757 got transaction with invalid offset (0, min 0 max 24) or object. [ 1548.159591] binder: 30752:30757 transaction failed 29201/-22, size 24-8 line 3035 14:47:32 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x4, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:32 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) eventfd(0xfffffffffffffffe) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x4, 0x2, r2}) [ 1548.315513] binder: 30752:30765 Release 1 refcount change on invalid ref -459472895 ret -22 14:47:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f0000000100)=""/42, &(0x7f0000000240)=0x2a) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x0) r6 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x2, 0x2) ioctl$sock_bt_bnep_BNEPCONNADD(r6, 0x400442c8, &(0x7f0000000180)={r3, 0x3, 0x0, "cd6c955858c98655b120bdb2a7a131cb50ad3eae82b37e5b17769a106cc412d3faac2a275c802880a289a57d85061f5bd93348c63c07667b764f4338f0de714fe64a5d60d32b93fd9e0114af28da5ce6ac2ea7c43d0d4d36588882e982a6f402f8a4a02c3564fce59df4851a791c0537e3034ea48f8996658a1ec53ccd1bc2cebd515a0226f0ecd916b42242ec92bbea6f4ce4dee6a5"}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r5, 0xffffffffffff2f4b, 0x2, r5}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) dup(r7) [ 1548.416423] binder_alloc: binder_alloc_mmap_handler: 30752 20001000-20004000 already mapped failed -16 [ 1548.458953] binder: BINDER_SET_CONTEXT_MGR already set [ 1548.464469] binder: 30752:30757 ioctl 40046207 0 returned -16 [ 1548.504387] binder_alloc: 30752: binder_alloc_buf, no vma [ 1548.510061] binder: 30752:30765 transaction failed 29189/-3, size 24-8 line 2973 14:47:32 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x2000, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r3, 0x80e85411, &(0x7f0000000140)=""/23) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) mq_getsetattr(r3, &(0x7f0000000180)={0xfff, 0x9, 0x3, 0x9, 0x2, 0xfffffffffffffffb, 0x10001, 0x2}, &(0x7f00000001c0)) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1548.589935] binder: 30752:30757 Release 1 refcount change on invalid ref -459472895 ret -22 14:47:32 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:32 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x100, 0x8) ioctl$sock_proto_private(r2, 0x89e0, &(0x7f0000000180)="1bd02a04a5f2d351d8ee2dd022160ab71f83bdd58260810d23b32a45ba70be5502c8e2bada549ee53f4121de88a3fe3ff9a688b340dbd235402763936f9c19eeb2c63073b6ac8e4c5d42d4241f94f73501b8578ad75a3691ab157490ebbedc45469e8aafcaaf8584da9e398cfa3e52a58cfc40f39e94969b5ee6a408e0bdec82c8e472d9d6417247b02a2ce7778cb2") r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) [ 1548.704961] binder: undelivered TRANSACTION_ERROR: 29201 [ 1548.715511] binder: undelivered TRANSACTION_ERROR: 29189 14:47:32 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) prctl$PR_CAPBSET_DROP(0x18, 0x11) 14:47:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x0, 0x2) mknodat(r3, &(0x7f00000000c0)='./file0\x00', 0x10, 0x7) 14:47:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = open(&(0x7f0000000080)='./file0\x00', 0x20c200, 0x150) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r3, 0xc0a85322, &(0x7f00000003c0)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r4, 0x80845663, &(0x7f0000000180)) r5 = eventfd(0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r4, 0xc0505510, &(0x7f0000000340)={0x8ad, 0x4, 0x5, 0x6, &(0x7f0000000240)=[{}, {}, {}, {}]}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0xffffffffffff2f4b, 0x2, r5}) 14:47:33 executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000200)='/dev/snd/pcmC#D#c\x00', 0x401, 0x60000) socket$l2tp(0x18, 0x1, 0x1) r1 = eventfd(0x3) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000040)={0x1, r1}) ioctl$TIOCMSET(r0, 0x5418, &(0x7f00000000c0)=0x401) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) eventfd(0x0) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000180)={0x0, {0x2, 0x4e20, @multicast1}, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x16}}, {0x2, 0x4e24, @multicast2}, 0x81, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000080)='syzkaller1\x00', 0x2, 0x6, 0x7}) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000000)={'sit0\x00', {0x2, 0x4e22, @loopback}}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:33 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x7f, 0x2, r3}) 14:47:33 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) getsockname(0xffffffffffffff9c, &(0x7f00000001c0)=@can={0x1d, 0x0}, &(0x7f0000000240)=0x80) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000003c0)={{{@in6=@dev={0xfe, 0x80, [], 0xf}, @in6=@mcast1, 0x4e20, 0x0, 0x4e20, 0x0, 0x2, 0x20, 0x80, 0x3f, r4, r5}, {0x6, 0x0, 0x6, 0xffffffffffffff00, 0xb2, 0x3f, 0x3, 0x8000}, {0x6, 0xfd, 0x7ff, 0xff}, 0x2, 0x6e6bb6, 0x1, 0x0, 0x2, 0x2}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d2, 0x33}, 0xa, @in=@loopback, 0x0, 0x4, 0x0, 0x61, 0x3f, 0x80, 0x8}}, 0xe8) 14:47:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="b25b014efdef8aeeee1bd1bc25d829ca29ed12ef3f4148d816ffffff7f00000000"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) ioctl$TIOCMGET(r3, 0x5415, &(0x7f0000000280)) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f00000000c0)=@assoc_value={0x0, 0x9}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000140)={r4, 0xcc4}, &(0x7f0000000180)=0x8) ioctl$EVIOCGABS2F(r3, 0x8018456f, &(0x7f0000000400)=""/116) 14:47:33 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0xfffffffffffffffe, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x4bb2, 0x80) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000000100)={{0x6c, 0x40}, 'port1\x00', 0x10, 0x86c2c9b147bab7d0, 0x40, 0x8, 0x8001, 0x10001, 0x5, 0x0, 0x4, 0x8}) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={r1, 0x0, 0x2, r1}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={r1, 0x0, 0x2, r1}) [ 1549.288789] binder: send failed reply for transaction 350 to 30802:30804 [ 1549.305011] binder: undelivered TRANSACTION_COMPLETE [ 1549.310184] binder: undelivered TRANSACTION_ERROR: 29189 14:47:33 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r0, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {r1, 0xf}}, 0x10) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) setsockopt$RDS_RECVERR(r0, 0x114, 0x5, &(0x7f0000000000)=0x1, 0x4) 14:47:33 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000400)='/proc/self/net/pfkey\x00', 0x200, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000440)={0xffffffffffffffff}, 0x13f, 0x341c9e75818fee79}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f00000004c0)={0x14, 0x88, 0xfa00, {r3, 0x10, 0x0, @in6={0xa, 0x4e23, 0x7, @mcast2, 0x54e1}}}, 0x90) r4 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x200000010000, 0x100) ioctl$RTC_VL_READ(r4, 0x80047013, &(0x7f0000000100)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r6, 0x0, 0x2, r6}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r6, 0xffffffffffff2f4b, 0x2, r6}) getdents(r4, &(0x7f0000000180)=""/198, 0xc6) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) rt_sigtimedwait(&(0x7f0000000280)={0x9}, &(0x7f00000002c0), &(0x7f0000000380)={r7, r8+10000000}, 0x8) r9 = msgget(0x1, 0x100) msgrcv(r9, &(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e771aa1400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0xc9, 0x0, 0x3000) write$UHID_DESTROY(r0, &(0x7f00000003c0), 0x4) [ 1549.433863] binder: 30823:30825 unknown command 1308711858 [ 1549.439564] binder: 30823:30825 ioctl c0306201 20000380 returned -22 14:47:33 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x64, 0x0, &(0x7f00000001c0)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x40, 0x8, &(0x7f0000000140)=[@ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x0, 0x16}, @fd={0x66642a85, 0x0, r2, 0x0, 0x3}], &(0x7f0000000180)=[0x78]}, 0x1}}, @request_death={0x400c630e, 0x1, 0x4}, @decrefs={0x40046307, 0x3}], 0x57, 0x0, &(0x7f0000000240)="1103f9e2966ea996831327f7f68a81786aa44330d93b7ce200f32cb5d1cbb0e33ab7bda8c52fb161aa242cf819d5d480b1d1fe7d08d9bf819e774ffbb12b06dffa0769b69a3aae014c8e8959d8620738bb4fca17921dc9"}) 14:47:33 executing program 1: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x1, 0x2) ioctl$VIDIOC_S_FREQUENCY(r0, 0x402c5639, &(0x7f0000000100)={0x101, 0x4, 0x1}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) prctl$PR_CAP_AMBIENT(0x2f, 0x0, 0x4) ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f0000000180)="1291de499710eb63ba5ecaa6a8e3ef96e53915e4e0c9cd8bb86960a6d4f231c3a939b2244ad74b4dbec5f5b16fdbbfe14ffb35ac290a1f6a405c2f23ef14a95e4dec0f648c57fd4f614b5e9d67af4bb482719e09954f296876c50b37756827ea2a4701aa56e56aa3b688cdee7ccc128baeca7b87677f2273e8dab7e2a9fc1ab6d65e313e1c3631d3f58a152e4e358b23cb1c1cacf01054148df6768f89ddf5b9c4c95d54d29a42834340c700bbc4") ioctl$RTC_WIE_OFF(r0, 0x7010) 14:47:33 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7ba, 0x2) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x7, &(0x7f0000000080)=[&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil], &(0x7f000026bfec), &(0x7f0000002000), 0x2) syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0xffffffff80000001, 0x402283) 14:47:33 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x200000, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0xd142, 0x400000) ioctl$TCSETS(r2, 0x5402, &(0x7f00000000c0)={0x1ff, 0x5, 0x7ff, 0x9, 0x8, 0x85d, 0xffffffffffffff80, 0x7, 0x1, 0x9, 0x9ad, 0x80000001}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 1549.761807] binder: send failed reply for transaction 354 to 30823:30825 [ 1549.794829] binder: undelivered TRANSACTION_COMPLETE [ 1549.800069] binder: undelivered TRANSACTION_ERROR: 29189 14:47:34 executing program 2: r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x90) r1 = socket$bt_hidp(0x1f, 0x3, 0x6) sendmmsg(r0, &(0x7f0000000c00)=[{{&(0x7f0000000180)=@generic={0xb, "46983c79813a59a346353da44809862128b5919f6f47a778229d170447e1812f544c8c4ca4965d21ec99f54bf89af2bf2df3d0b8b422ba850912d8c600e86029ae98e645b2697ff2f8f6ca75321b2cb5b196b78dda480fe489ff9675166d73ecf82d01bf4877c7dfdc7fbdc98e9cea3a10aa7842e1b6b409f4db06c53059"}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000280)="b26b19c304f590c6086181d25953170673747affc2d43c8ca98c9af5b699df4a0324b994ee9b7aaaa909c9bad8a0dcef56622374ca9fb668ed3328154e4005f0afb2d1d88ecaf77e7f1255e31fc7adb7e1dcbb5053862183b35b6366e3af1ed4e9363a38", 0x64}, {&(0x7f0000000200)="c713269fb747b04fec3a8fc2f5e813fc3385052cc64e29d2d31c8b9bb3421f0d0bf33d22ab7e855fbc", 0x29}, {&(0x7f0000000300)="e6a1f3c3090f65ec42e7b26e9bc7c1ad58c1ff3a65060da92cad0a2aea954f2eeb9667b955bd2930952ca6316a561c647902163f26e8fdad9079cf020b4165903a1faea450052c2e76e8a641", 0x4c}], 0x3, &(0x7f00000003c0)=[{0x80, 0x107, 0x4, "fff2730f41897f41b933554e97fb923497a2f2fa19545da2275e9c3e730ef1311c3d1b0aa84d681becaaff94ed66e35931c4db2b12edd3db2d18567cf0212d5ff08526f23c238d8526c6cbe2ace9f822048d0b16b243620d29df635fb33f863fbfcea02279ab517f01e7"}, {0x88, 0x10a, 0x3f, "3952f36d96dec1944937865eedf89311d6258a5e98c20047c1e37911be57aef61fc5b62ee7166376ab0641fb49f18c591e67ae154e683f4c3634b4377fcd6093a285efdda920b8831c36d01523cdfe52d0053022dca603e92abcba6bb89ed437ddc6ea55b7b8c6e5c253ca9a782c61b8cd373f8175587d"}], 0x108}, 0x6}, {{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000500)="7bbf348055ec49980eb2509f9d38e1380841b41a1043a2ada7369a543fff5ce620dc62a5cc4b99909684f3c496c3b2cd7618283170750474f7525acbd6024f5bb6e70ee5a0c90a2082100ee25b92b9ed35e3bfb718ecf1068fa14ce9b228b1859b5464034688ab3b85e35c1438835893f917171dbb6a25e399217fb52104d5e5c41484f677700be739474a4567", 0x8d}, {&(0x7f00000005c0)="b352b542d26b6b20e32c3cf8cd42963590ba79f9126ca9518b9d52b19b460459433a80ce9d7f51aad41c8f3b4ee23b0bef403cdf46e6be5e8b18d3ff2d8442705dd64263caa46cde7f9db3c542a1e7880b3e58de066d1710ca74021b088a0ec79fbbd268b3ec4ceaee1a18c44b007d4468eb82a083637140a5583e6e36ce54feda626128445ffcaf85519a020d3800a2e56102b354764aaf57d3e4a57f2a94ab140b73ca5e2208c2c02bb199f50019cf32ef1a3e70965d022188cb2acde144b5ecf007bc8af0ce364ef9f8b524235352292e56eb547eb1a7718e93bff9f4b131c65488ba51de833e6f1d864f", 0xec}], 0x2, &(0x7f0000000700)=[{0xb0, 0x11b, 0x6, "c0ca513d01b1be838b65d7ef416b0c257079b92dc7e16b0cbec38c9880d4b163ea096623bab78144dcbf56a273902b5dc84d8a67666c19e32d50bed8ea93eb2f5ec88d8d8af128e6e3cc9f344f7d6899e6a5bd9563cb6c21255feda365dd8aac5853780d1369d61ade4e2ffa89db3359c9feaad47dcea3e9cc2a97532be9630a50a41ee5f27e39ebe0cf99a6f4ddd80ccfca71daedb70b81e1c77b"}], 0xb0}, 0x40}, {{&(0x7f00000007c0)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e23, @broadcast}, 0x3, 0x3, 0x3, 0x4}}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000840)="36496ebf7420705ca9d489dde89f9895ed055b5c94dd48662ff62c59dd0ce3d3be55dad10d28fa5505eb6e19c262e11c12c21f4ece5e53e52860a270696f80369d0f2608240f975f4c958559ff4f4d68b82966ef11879883f8b0ca1b3accbd648b9c8e01781fbac8cc88fbdc86d0a463e121e1837e7d89d44d533457fa69490d3433ad52a20fe79f56efb4d97c99c2cf65409171e7190d3f8c9080d1cfa2d557efef8909c78c63e98788a0ba97dc8dcea0ce58ed0efd9c40691ed56b70bb25b2ec8baf0e262f5d7fd19f2e25bec8dc0591123aceb02f1bd6264da6fad033", 0xde}, {&(0x7f0000000940)="e7e815442be64416cd", 0x9}, {&(0x7f0000000980)="6dde940c887ea71668d27618de2fd376a51ff0df78f2363c9154e8d62eb4bf64017896ac8a474922d649b5bca5830e2f82a1a6ceeea841bd96919ddc79a5842cc1b162fd5301efdc81f359770ead2e4574fcd71d2c91513ee99dc37c8662c4f935994e17e1c412f82ccc21501bccd452f704728b0c7c8f1d6772ec", 0x7b}], 0x3, &(0x7f0000000a40)=[{0x10, 0x113, 0x400}, {0x30, 0x107, 0x4, "b3b5b8d817a5f331e503c66b490d5a0409d78670ae04609273052ddef54489bf"}, {0x28, 0x11c, 0x3, "2900a58105c061551344c049d03fa8dd2b144ac23a561b2a"}, {0x110, 0x103, 0xb6, "5beb837a79193a004e16414c71d37da32661c2aa4ea79d991d50403513f00bd75be0b90a81f5fb7e1b45c59345c7d847afc6a893b75dfb76b9529fa0af315bbddaaf6f94fd5de5b4767c34b870d4a99c3c0e47601d6434002d582a7c37d803aaa4eaa206d7f47b49fb3f48db7d801047b8432b1905ae97589ead849d5b6a3a8ae952f686eb7e9f05a45c5937969225cd5913cf9786a13932698975f5daf9b574eb8df277e769106d66cea2e22e0334488ea14a0c340ddb7d5055dff7146989cddb293375d507a776f8d95a46a637d4b88d90a219fd8e95be9bc0df098b87dd4592f1785daf0f7fe0ebd61e7ccd3463cd63e6905def578b637b119dc7a3bab1"}, {0x30, 0x112, 0x720bb3b2, "c580f129496820b628ccbb49e7ee6c30014b501766f5c7033cc08fb7a75d"}], 0x1a8}, 0x100000000}], 0x3, 0x4000010) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r2 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000040)={&(0x7f0000000000)=[0xff, 0x4d, 0x4], 0x3, 0x9, 0x101, 0x200, 0x10000, 0x1, {0x2, 0xfffffffffffff843, 0x1000, 0x8, 0xffffffffffffff15, 0x95, 0x8, 0x10001, 0x1, 0x4, 0x4, 0x0, 0x7fffffff, 0x5, "d44fdb33e63d6c90c27ec4bf12266b29e1e54be4353e6f7584e404afc5b6adc1"}}) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:34 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x100000000003, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400240) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0xf}}, 0x20) r6 = fcntl$dupfd(r2, 0x0, r3) write$RDMA_USER_CM_CMD_MIGRATE_ID(r4, &(0x7f00000001c0)={0x12, 0x10, 0xfa00, {&(0x7f0000000080), r5, r6}}, 0x18) 14:47:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x2040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:34 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x8) write$P9_RREAD(r1, &(0x7f0000000100)={0xcf, 0x75, 0x2, {0xc4, "d9cd37a4e5fe37c95f08c90a51703cae599d084298324c2ff515fd3e33fbaa90b4fbb0534edb9615ce1fc49834e3cd48e905aeff57e2318e749304777177347ca9a045e440c6d89e6f5cfb97d22655f5f28f8e2625376391a0013f762d002041ffda58c322acb46820c7ea2eeebdbc945ce1bb24db2b8d5cc40acfddfc73947396b8a496f47206d6d1173758c1498a4f8cb2f0c4ad33fc4ea1507eb0866a485886132b01990cf66032ce26b83f71c9fdf7a4cdfdec5c6fe08d195abd864a65b759e91656"}}, 0xcf) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x6, r3}) 14:47:34 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000000)={0x1, 0x4, [@remote, @remote, @random="16e28c9cfb44", @random="f64ed4e69692"]}) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000040)=0x8, 0x4) 14:47:34 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) lsetxattr$security_smack_entry(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='security.SMACK64\x00', &(0x7f0000000180)='/dev/kvm\x00', 0x9, 0x2) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x3) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xed, 0x2, r3}) 14:47:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x7, r3}) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000080)={0x10001, 0x1, 0x2, 0x5, 0xfffffffffffffe01}, 0xc) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:34 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x7, 0xffffffffffffffff, 0x1}) r1 = memfd_create(&(0x7f0000000040)='nat\x00', 0x7) r2 = fcntl$dupfd(r0, 0x180ea3626fa2c5e1, r1) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f, 0x100b}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000080)=0x10001, r3, 0x0, 0x0, 0x1}}, 0x20) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:34 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000140)={0x100000001, 0x8}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0a5c1f023c126285719070") r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r3, 0x8937, &(0x7f0000000100)={'veth0\x00', @ifru_settings={0x10001, 0x0, @fr=0x0}}) setsockopt$inet_mtu(r3, 0x0, 0x8, &(0x7f0000000200)=0x8800, 0x4) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) r5 = syz_open_dev$vbi(&(0x7f0000000180)='/dev/vbi#\x00', 0x2, 0x2) ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000240)={0x7, 0xe, 0x4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:35 executing program 5: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f0000000200)="84877a616ec23aa1984b9bf3bc1f99a8d927627ec8204a99e037b6fff2cac5cf161af7b75aebdef8a9648a7dc007f4c64f5595020c0f0c38e6686fe2d9fe24f44d5da7e432a17b72e027b931d15fc1bf2a26bf0800ae1ad54fdaa17cfb693daa6133df4297a4b0faf9f904ea226676dabff9c7ade6091b80d66192672e2e1e4ed628eb40db473a5ee7a59922b00ed795c80c") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/mixer\x00', 0x200, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000140)={0x0, @multicast1}, &(0x7f0000000180)=0xc) setsockopt$inet6_mreq(r4, 0x29, 0x1c, &(0x7f00000001c0)={@empty, r5}, 0x14) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000340)={{0x200, 0x1f}, {0x67b, 0x1000}, 0x2, 0x0, 0x6}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) 14:47:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xfffffffffffffea8, 0x0, &(0x7f00000000c0)=ANY=[], 0x46, 0x0, 0x0}) r2 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x1000, 0x181) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x23, &(0x7f0000000500)={@multicast2, @broadcast, 0x0}, &(0x7f0000000800)=0xc) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000840)={@loopback, 0x31, r3}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0663c954015c650037f518311d28f966386fd3c97af350f1e63f34c7512e08a335f95ce215e303d922214b46e150129fc498ee340b907fcba4904831903de9e88c63d84a7684c4514b1fde322320ab784c30a64458e981a60756054a9544be773242873b715c3dde38c96a6888c4396e9305000000e00dcb8b6b1b434c7d1068c3045343d5e2e2bce6c166749534fd047b46be7fcdb264148e70500f130ad9bdf1e4cfa9fff2a098c38f05f35b8f5875f6deacfe96e16809d5729d22b851d7bc850866fda4bee63469703a5a916ea52c7c3d025bd234b4110398b9f73cf34d3d188fb9ee441a36c56555880e88006b064b351304b06408d136713454f1c918005bd9b489501666275c979bb7b70ff5788c0f83b047f166dea8ce3c6a7f824129e677e89421d903d0ec19b502645fee944b2e5b6f227e03ba830e02ea0b469b318567852ad4b50952d6ecdfc9a7ffc13d1080a5931c7f22aa8ac00fd8195e5f7f"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) r5 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x1, 0x1) setsockopt$netlink_NETLINK_CAP_ACK(r5, 0x10e, 0xa, &(0x7f00000000c0)=0x6a, 0x4) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r5, 0xc10c5541, &(0x7f0000000200)={0x2, 0x4, 0x5, 0x0, 0x0, [], [], [], 0x5, 0x3}) [ 1551.019607] binder: send failed reply for transaction 358 to 30860:30861 [ 1551.045541] irq bypass consumer (token 0000000012bee418) registration fails: -16 [ 1551.052742] binder: undelivered TRANSACTION_COMPLETE [ 1551.058249] binder: undelivered TRANSACTION_ERROR: 29189 14:47:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000180)='./file0\x00', 0x20000, 0x4) setsockopt$inet_dccp_int(r1, 0x21, 0x5, &(0x7f00000001c0)=0x2, 0x4) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x0) write$binfmt_elf32(r3, &(0x7f0000000d00)=ANY=[@ANYBLOB="7f454c4600000303090000000000000003000000000000003701000038000000be030000020000000000200001000700000107000000000002000000200000008100000070020000008000009fdc000000040000050000003a34faebf4cf186481564a5c557703b0305ab3b3a1b0e4e8923ab71c58d6ced8d050ed9870fbc418f01a133bb25081ab0adb450376cf76a8518a9c24283e8097f9b7584ac988856c58881803be6709149fbe44a5bd928fe8d3bc87d98b8c72f954a4b0845b9fc000539c7b7a6c510e40f88c7d4f887becd450637923d06f301f19c6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000401000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000038000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba7bb8ac93f2c85d2b597ec8fee6955f3501a0f62ce753b0eab98c621d6e25979aa07b44b93efd1f2a688cab893bc73afd64a55cb76477c509d5f8a115c48e6ee0731d89ad799303a2adb2101d1e0d283cd99239fe4dea6e2b3674f206e834712f1ac5e8af29d56c37e30c3f49683abfb387da3c31e646d91148e30fed222cca320514962c529be79deb958af57bf563c4d01b07d27fb8c1b3d52aa0cd98c041e7386cc0d0b6c45ced02121efda9f32ef36f9713e550b516c34c668aea5f70caabd7eb4c00eef466289664add5b1f274145be753639f1040409a6ee5fa0ef3184844483834c8219f0d254c9d4b5ea8019733662c8ff0ea777ac341dede95846844cb61cb8c3b4250e64fe54ff5173f58ec9163f60f89963cda1532bb02637d2c7e9686b2b96247d07d4474b1c516a4706a9cd620914715da5aeb2303f5f75897665bad9fe4496f0e45bdca65d5e37837e6b54f003f4220542caea14c8272ffe5184ede202e974f601cd767221cfef29db14004c027a9e08be76224af6be1b13a3edec86763057af5cd56ea1589693f3804a68491026d5d245a9c351599524c71c999ea"], 0x9da) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r5, 0xffffffffffff2f49, 0x2, r5}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ioctl$EVIOCGEFFECTS(r6, 0x80044584, &(0x7f0000000100)=""/22) 14:47:35 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r3, 0x8, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:35 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@local, 0x8, 0x2, 0x0, 0x2, 0x10001, 0x5f2d}, &(0x7f0000000040)=0x20) 14:47:35 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x100, 0x0) getsockopt$EBT_SO_GET_INFO(r3, 0x0, 0x80, &(0x7f0000000100)={'nat\x00'}, &(0x7f0000000180)=0x78) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) [ 1551.299213] binder: 30923:30924 ioctl c0306201 20000000 returned -14 [ 1551.395241] binder: 30923:30924 unknown command 1422484230 [ 1551.400969] binder: 30923:30924 ioctl c0306201 20000380 returned -22 14:47:35 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x8000, 0x0) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040)='nbd\x00') sendmsg$NBD_CMD_STATUS(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x60, r1, 0x500, 0x70bd2d, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}, @NBD_ATTR_SOCKETS={0xc, 0x7, [{0x8, 0x1, r0}]}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x80000001}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0xfffffffffffffffc, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) [ 1551.499830] binder_alloc: binder_alloc_mmap_handler: 30923 20001000-20004000 already mapped failed -16 14:47:35 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x38e04351, 0x100) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x4, 0x4900) sendmsg$nl_netfilter(r3, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x64, 0xd, 0x2, 0x42c, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x4}, [@typed={0x50, 0x65, @binary="1edcba6edd8487db2d2d864cc043c5df6e42ecbe2c369f8fd101dbbf906c499d3e3f3947652b01f96649187e28c2b9430c7db861a8b09ad96fd6c7ec3346dad81144df6b3167cc598c"}]}, 0x64}, 0x1, 0x0, 0x0, 0x20040000}, 0x40041) ioctl$KVM_TPR_ACCESS_REPORTING(r3, 0xc028ae92, &(0x7f0000000180)={0x91, 0x6}) r4 = eventfd(0x0) ioctl$NBD_DISCONNECT(r3, 0xab08) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:35 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x1, 0x208000) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x7fffffff) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) [ 1551.579948] binder: 30923:30924 ioctl c0306201 20000000 returned -14 [ 1551.662939] binder: 30923:30934 unknown command 1422484230 [ 1551.668641] binder: 30923:30934 ioctl c0306201 20000380 returned -22 14:47:35 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) [ 1551.746383] binder: BINDER_SET_CONTEXT_MGR already set [ 1551.751941] binder: 30923:30942 ioctl 40046207 0 returned -16 14:47:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip_vs_stats_percpu\x00') getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=0x0, &(0x7f0000000180)=0x4) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000001c0)={r5, @in6={{0xa, 0x4e24, 0x574, @loopback, 0x3}}, 0x1f, 0x6, 0x4e05, 0x7fffffff, 0x13}, 0x98) setsockopt$inet_MCAST_LEAVE_GROUP(r4, 0x0, 0x2d, &(0x7f0000000280)={0x400, {{0x2, 0x4e23, @remote}}}, 0x88) 14:47:35 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x1, 0x2) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040), 0x4) r1 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom\x00', 0x200000, 0x0) signalfd(r1, &(0x7f0000000080)={0x1}, 0x8) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PIO_CMAP(0xffffffffffffffff, 0x4b71, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4}) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='clear_refs\x00') writev(r3, &(0x7f00000000c0), 0x20000000000003fa) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:36 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x22000, 0x0) ioctl$PPPOEIOCDFWD(r4, 0xb101, 0x0) 14:47:36 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x1, 0x0) move_pages(0x0, 0x0, &(0x7f0000000080)=[&(0x7f0000ffc000/0x2000)=nil], &(0x7f0000000040)=[0x6, 0x100000001, 0x1, 0x0, 0x101, 0x1, 0x4], &(0x7f0000000000), 0x6) 14:47:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0xfffffffffffffffc, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x202900, 0x0) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dlm-control\x00', 0x80, 0x0) ioctl$sock_netdev_private(r3, 0x89f0, &(0x7f00000002c0)="bfa2e66b48f6184cfe6063") ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r4 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhci\x00', 0x80, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r4, 0x2402, 0x10000) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r5, 0x40045566, 0x6) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r5, 0xc0a85320, &(0x7f00000001c0)={{0x1f}, 'port1\x00', 0x0, 0x10, 0x94, 0x20, 0x2de0, 0x800, 0x0, 0x0, 0x1, 0x2}) 14:47:36 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x6, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) sysinfo(&(0x7f0000000100)=""/4096) 14:47:36 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$FITRIM(r3, 0xc0185879, &(0x7f0000000080)={0x80, 0x0, 0x2}) r4 = dup3(r2, r3, 0x80000) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000180)={0x28db, {{0xa, 0x4e20, 0xcf, @loopback}}, 0x0, 0x1, [{{0xa, 0x4e23, 0x100000000, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x1}}]}, 0x110) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:36 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r0, 0xc034564b, &(0x7f0000000000)={0x3c80cf25, 0x34325842, 0xe4f8, 0x1000, 0x1, @stepwise={{0x3, 0x8001}, {0xad, 0x86}, {0x480000000000000, 0x2}}}) socket$alg(0x26, 0x5, 0x0) 14:47:36 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x100, 0x0) ioctl$VHOST_GET_VRING_BASE(r2, 0xc008af12, &(0x7f0000000600)) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) r4 = fcntl$dupfd(r0, 0x406, r1) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e24, @loopback}}, 0x1e2, 0x81, 0x8000, 0xec, 0x28}, &(0x7f0000000080)=0x98) r6 = fcntl$getown(r0, 0x9) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000580)={'vcan0\x00', 0x8000}) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r4, 0xc1105511, &(0x7f0000000440)={{0x2, 0x0, 0x3, 0x7, 'syz1\x00', 0xffffffffffffffff}, 0x3, 0x10, 0x60e3, r6, 0x5, 0x5, 'syz1\x00', &(0x7f0000000400)=['/dev/midi#\x00', '/dev/kvm\x00', '/dev/kvm\x00', 'GPLcgro\x7fp&(\x00', '\x00'], 0x2a, [], [0x7, 0x80000000, 0x3]}) r7 = syz_open_dev$midi(&(0x7f00000002c0)='/dev/midi#\x00', 0x8, 0xbe6c58f4b56abb8) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) ioctl$VIDIOC_S_DV_TIMINGS(r7, 0xc0845657, &(0x7f0000000300)={0x0, @reserved}) ioctl$RTC_VL_READ(r4, 0x80047013, &(0x7f00000003c0)) ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f00000006c0)={0x6, 0x789}) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000001c0)={r5, @in={{0x2, 0x4e21, @loopback}}, 0xfff, 0xfffffffffffffc00, 0x12b22c28, 0x1, 0x8}, 0x98) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:36 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000001600)='net/protocols\x00') r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001700)={&(0x7f0000001780)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="2004adbd7000fedbdf25410000000000000001410800001800170000001f000000096574683a73697430000000008b2c26dca918a28ebe7bf5c2016b5ff05fcda3228a1a8edd0fac30cc7ae15504ce520ba1cba3a494221dde53c2d4262a81c90000000000000000"], 0x34}}, 0x40055) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhci\x00', 0x341d80, 0x0) sendmsg$inet_sctp(r5, &(0x7f00000015c0)={&(0x7f0000000100)=@in6={0xa, 0x4e24, 0x1f}, 0x1c, &(0x7f0000001540)=[{&(0x7f0000000180)="69f98d748c2e3457753b373a0c6f3cf0f16b0588d7467e9c003852ff57c6197f8f794a1ed65b446be06f1bff5ff03238a1e29968f89a6a184e469afe3b50b9fc363b28daa0dd2fb5b60589699e056f9e0ab2eab2054b33a3035ea989b62fce8d37c2d69bfe852d5501f6a8b4edf6169fa566", 0x72}, {&(0x7f0000000200)="e47084896bbf862d11d18e4b5890c5b7dbd60c9272d374da82024eac2a24421f07d244dd410d28ed685b858001e00535c06802b36a72fae21aeb107c632e491de4824037d6396efc2e9470bb21ab8ef814a455bdae0c659d05418a10b2c426eef96a05ce0ff9247595c623066a46b15edb61adc43a30fd62a0b08ffa03fad36e53203582657bd00c4eace23ef127123590666c557cba35c64acec50c687aeeea6b5dbd85a2696de463d634064b5b1ee94da755141bce7e2f0b853cbbffda78f7e1c5ee7de07d47845689ec1874df7e7893b67e0cfe7a37ba", 0xd8}, {&(0x7f0000000300)="2320ddf89e2da79301a4110bb128ce4440e4b4803e12c31181ee5a884fd31f379715fec3fa6f57aa58b81150aef1ced7990039beaba5d50e1df073a9149a572240ac352c178efd572db7457617ec5072e879e18a26ccf3f2957a66d8006b15881f41ea3377895fe17ee9c1e15ec85d0ab0ddf79e08dd5849905466741ef932d72727ed63610fafbf90cb2ce1c70769fda00d1301945df332db1048117fbbd4a8af80e2c8d6e6fa6bdc4289b8b48c48e06bf387022900eaaaec7e63c44c2f2bad5f369ada9ab3e6f15dbc2722c51056c0628875e9718d14be4bc866c4f529a1da17b22f41b24027cdfda73e362a1980f6332210093f902e16d1fca05a2bcdaa10a90a66d90c7d5dc50297c192262b0a5f60b1956a27d3851dce38df1e7bed18c0af466c8bc6bdaec34ad3edb14f6953afb0e134d41f3fdb381a73b77041e0296fb93268325815bd2355b8efaef9ce978d5d6887d5094744b35db721e37b868b5b24d32ce6d55a70f7503e041d08cff94d4bf6dce9b9a5df60d8269eafd77568037021bcd0827961e2b54fdb9486f0887e30b7eca53f381b4131633f0763ca551628c44f320967a1d174e9383679da4155a9908518883ee9add64e3c6bd2a09cc444993da5e7ab41218025ec60f2e19fe7ce0bc493ef3f08a4a06922c428079a667227af64e2db92e2cd45ecdc59bc4ca7445e648e1d13edeb082da5a1d6daa87bfa2ef57e5d5fc6b17c4ccdada9d8b0e902d01c9b6a73e9b241bdcd88ddf4f016c7db9f7fd584900bc038a5c38151211f0b0b6456d86e13c2df18521dbcd4a50faf8a592bb5e52d591897bb3bc7cbcd42e498b0e1c60e94ca22cff0a945ef35bbae3b602502b1db45586ec2d30b49cbcb3fd8536bf8986cf1e6aac653f12706906249bad758104f3719e9774ca0a64d0203a9df677558877fd328f8ef2edd12c82a65e304343c8f49f976da57f4b43c3e8f094f76fffd59364cdac138a18f62609694c3fda1e71f679797309b342faa4da23b37468340f4d175e7990b5a25b8c60ebc6e26a39efe9870cd4beacb91043b74862943c1d60e6ef216566b972d64fc2727263a75177fca2e91e5592d1ebb146f82311e7f470ab230df1119dcd5850f1f9dabb74e5165466f68df929833b5539f3dc5100dea42dcd327fc9aec232b39d23b4d1797003b106a1e4f7c363dcbd931bf9498bce4fbfe55b9f1e60971dc774c4a72bd5e23d49661e36116d4504e966c43a587f888cfaa7d378c3dc0230a7a11ac631a28a75cb6c5d45c16bc44d7b771961dda1634496aabd059b92dca1506346cdc387d337bdd38c2d6f2bdc56b7030b13aec4c78f0ec011b5955de800f6011bcef24d16ff5a97550f7c9079adcad57737d7ca28048f88e354608119c321a6e5e0cbabfe522a920507b20fbe2a3e97efb61ad5ebfdf30fcafd4aeb421a72dffc4b933aa63a882572a4cd046d9820e8cad3faf795ec556196afdb8f9cae3ffadad2818cac0698ad71c4004fb7cbc541ae4309af656f605b0922d089a339a277a4fa1a8eba0cc1021c003565739ca709836c96a2a85eb433d0fbf2556dfb8c607263ef1f88396774b22669bbfb95bde4769e5dc3148d615542e6b3f0bc56716720bc37b0c89938fe222fb0e8fe242158676033c883b6a3ccf18f118eb62538642cbc2d3bf448d6201660c2084fb0cf99fe54ea24711fd9eac286b1ce1f38119ab91d73d9e27bd495bc4ee659fa94c4f396427e8bd3d61db543ba4e8f10e2b3ff7114bd68df2b761e10581e7ae5e9e36c44ec681124765f5d21940aafd0daace4f620095eaee08d8a6d606c963f05f37364e3bb930049af45d1963ee5fa93a19a250abe19799c55ced490631e7a318853be5f3ab59be91de7271289b29b443cb11890bd439f5ef66d2fc7cf8999f6e0eada392637efa0ebf26782c9b84bb36f297bf713e82aa4f19d52369ed4412f328483845bd390235c6575d3c437044c97b7bf320342e968f467e33c10373c0180753371bd0654e6567b7dfbde732ba1c1451d38d9a3cc44bd55a1e942856b63b8545d6647fb8bb43e21bf34d16926072594311a3adc61ba85f810e3f3f6d3089ed5c5119d0c56dd13b80e801af88a9245efb9d7e4f901af426afb052602dc8c59cd514eb610ad65d63323bbeafb1c465d3a3a08643b58e249db7a80bfe70687edb808a4f4c0edbdb0af3002ce549725170f326730c2925ad0f4455e36a893c57918d20cc4d61e0915391345117ce1abd86e4479fb3907b68b22fee91237dcd9dc1c672376a931825eb15a6aa301a41cc6ed267d63dc6267d66ea7348737406cac2a0d76eeb9c47006884d2db63b72711a1d571510f7da28d0ce3986137bf2c99e460ac8e178a249b40d8ac3c5c370de79256f5df0770325f8728ba351521fd2bb44b1a3eb81f280889e51a44eb080f7d42ab83c85c024e328e05828e0ccfee3ebac229eed5f59c31fc8eec4d4a05d446fcf81fcd255a59fcb45d7bf79191cbbfaad4ffd9078afa56c43ea1c93dc3814e076898e8aba598385eca3f5c42aabebd04b9f143ce54b22cd1c623c5edf1f1812a6d58c7ed73cb2436cee265cb8e95c18ad51a0f314a8a01024be83ed479b47b4ea2d8f65a4019417359131b00766d5182d5aac9b2fbf5703bcc70988f31289ced23c60821599cf1ccc21c6f0d21797902bc0d200741601bda7f4d62a81cae206c124bb8058462a3eeb28b04c306cfad4c86c91caace0f81007e0b338beb02f7aa6e6c80c70c7a8a6d3c54a5d5fba51c9536e8585e027ff186ff5456b9d157efc373bd58c0636f42dead4e0789fdfb37c67af141025f38148aeb41c5ff51996ab9ade35d1c6b85e2b0304ff0c00a1ddb993314ef3374c0c0b3931b63294baedf117d629916cbd6cfb1e3d3c920f4fe0694decc17a066e97b54511855efa31c1701165d9e09e9fd12addf0562321d7bdede7b86298d5a4506a41fcf91ee75b2f3bd2753699f4c3fb1b1b39d496b9d3e5151638e3901319d7c74af18c2cdc4db41f4225bee7e40209328e3d86e09f7af041d77721216fd34a6e5ccee01b98072ea6c29301a492def6f602f62b8ece57440ad8ddf991ae516b6352303a3d3dec4569193267cad2537c1b1ee0f2eb15889c4be1da5d613e03266a014e785bf17c713eefc0d261e857fe5dcf948c7cbc09b19909ae2a8f50763d7c7b189b1beb10f9c0c37cb01bea4ed45f8234d79842bea7eca653cfbe84107c5bb5c6cab28cef2b0318f121c6065d347e86ec830842676632b2bbc1ab93ed460b4cb28bfd12f7141b218a6291aee987780d6e02524dee1d6da2a053294a51af9a09a2d5068066477d7fd49ac83e657f96420166023b9355dc8bc015bf499a203ef527dda0dedec45b9e94b39df996afc46b30b5b6c8c82dffbe6652a42316df1594ba8c560fa79d971753f5f86e2216b74c732ba904e42fdbf86386264d32ff1ba496d3731a060c3e285833ada3327890f483f04194030462b3c5dd878a396728d21879f60daf576e78525c72fafd2fe28bd84f5a63990cad0fc1c15677ea05a64295cf0e47ae0082cdc53e82c57ab528952b54db88e5e5b23d65475cfcd26edc30356d864872395ec36e6030862cb74010f0142a7cdea87e71ae7711fdf5759473dc58101dc163ad7e8847c7d2880b20d03d2b1bdcd6637bba459a88852032363c29bdf76be489b84be88229d1988ca29ef8bee5a85e1feabeced7c2043a70a8d80843facd19846da2a561727cb6954e7c31c9dce0bf380248501ec9fc814be4e5e08fafe89a383f658856f1340431bd15faedae3dcd95855f89eccbacbe8c68b445920304342ff2413f0d7aea384e0a45792d9d570f2b22771bf846b78af9c38270b0cc8f4822569872adc199836be56659090960fde12ee5a983cc46456b7ca17be3e751923fcf30117664357ed008ac7e248d659ba8e950c766dce420de1758df5882b7de5f0ef4952029b078fd7dcd3320831ee4be2b2910df9e33ac96b89e895c0596ee1d884f54005f69fc433538f0590429df6a6d4b9907984e1ff476396b59162cc6a736f87a5174d7697fb46b03b200b613c1301c0ba7063a4df4327969bb3bc4c36138dbe094de2f38b907955b109652334c47296440f55fb2b1e1f0f82eecc3f4ca699caaf1cdb384094952e832dd9e0607eaefb8b19142e39e4b5feaf16e14754b1559ea422b311c54de7a1a57cd965a00abc256ee57151a7743221319fc6c2b6ab9c73aa9f1dd574f64f448378984ad47d0bcfb16d0d86898f0afe2bf08b10e850882dba1e1ee5d0ca7ffcd14f8cb716e3832b637b397248a849f8ff14e9371c9d13184650a0f6cc1d29b4910fc95bc4102c4d22caa5317a1df9637292e226653267d7593da9b538f1280edd3cfaea38b2d5a10aa88496f9295daf80ea0a22a5238327a1bcd03033899a19e46d20c1288d49c3fd75e573645bff9d899fa72ff6284ae7c4c2d32e19e05328d84281a6d41d2d742f282d394dd2ce3ed7b2e57c5d0bacf613c237d6ad3821f2c03fbb3377084af273376fdf5ca456300efaeb217be53d371d29339df963d341ed099cc345ff9e431bc4655b1c53cd6be1514e72ac7b34123d95b0daa58e374fbf00abba42da319e5f4a673293c254583f81013ccecad6913ec5ad51a15beeb8d90fcd65683e4827fa74ea07ab5b0ed81c0192cfb73bf67403121fbe52edffdcd1d584dbe9440ed29cb1c95092044535c15a034b802d9856293b63dbf0d08389f309a2c139538dff131da2006d0309e74c53551de72cb3ec074dff729784f03ff85743c4b03a2ff9956fffde11a8178fa20feb05b118d69cc5987c754a402e31a6ba8ef211a8ba57e1a8fc9d9aa3c9e8e932b1627f58126e7a25c7f16da062d3cf1950db2232c53c6f98a3371e11cfd684230c26a7e690f00ac0ae07dba3549251195b28347ca6f7a881ce12e020f96ff5a956d2d6d3bea791fdb8f0ec95a87e74477583361e1279229291dbf8c59dba3d8b40f861dba5e0bb3b82a8c728f1d885186162bb7cc661ab53f3e635575a9ecfba562116bedded49ae85b05492fcb355f66732d97361655a7463c632850f317c98973a8786b7b972ba863d46e149c8ad5aa4d8c98cfd4ac337c1ed6bfacfae7a7f198b11c181471e320372caed00da37d90a6c006b58176841bf481ae17cf053e18e6062c453764a3565cbfb3b5da89f6b6baf16de65f8676bcaf69243a4a1c488e0f325798013958b5e358ec3b2a724e31cea1554fa1d17febcc11aca50e3bdd93cf5fea55a66f93fc8d7c1b82ab344a4e535b3f1aa8d65f0341262da40de31f84952507e636ab97bafe8f33449d2b2764f2aef0447eed0be3705c3bad480315ac3d28fe214253c5a693f141ab75efaf9bfb700acce18182a1ade4c1d5900d27139dd47f8b4e48adef0ec4a099847a76b7e9c21b501f8b1af0aa20322fede05a36814ad0e869efb0a4f09556ad4cf322853da15b8241603d9ec1a009b39884aaf9673a39f1d3b0f718862485ab3a8be47e482c95ae97cbc0839afced9c61ddcc9a9c2a7f7df5b2987ff12361abe4ec5d7bc77a47097f0271386f8d040701e03a3b7ecddaf348f34ca47bbc715cd98aa66491947b2799430378bcb3998aafffa7a010316c841016b167153450b09483a019eed2f2e9fefd6f91dda7fd848ccc32faa974e8a8d7026e2657e53910ce698c0eb5bfa0ad64412b6184a8cbd1c330463d9cf830273c21398afa4a5258ea39a8136e505541f83bde0918750e3f13c82061f679e919c", 0x1000}, {&(0x7f0000001300)="32f581a1b0aa1a2e9a6e59eeef5c6559f1d10d43798df0fe3d5470e05d93f569a0f637aca173257a279e32bf88a8308de647cef324115b7220b5b5ba99df528582b343f273bfa0ab1152f06900c88f0257bebaa2f883631569fb40a647322b42b98e42cb8c1b1344fc8235085d3acf8d4e3297454c3ae75c1243fd5b2909aaae51ccd919081e78a77b8079daf9f8c6f5b8b3b696c44717c4f15adbc8fa97c634aa55b93972e2d805e6026e6ee0a9422b5f8b35c1fb5c2ac86100b182a4e9253cc51915dd81e738", 0xc7}, {&(0x7f0000001400)="75b483f5dbf1d9f7c2f733d06f79b310d47b1e6bcf71eca70d3e654117204dee247d1f8ac1cf59ca6ef6084b7dd677358b5fbb19c386b752407b9735e1673cd258491e02c80cd994d0c27fe1a36380ebecbd58a9d81541e50556152b0440292d59b8ce2d512c6e63b10c2cd3cee84db68147e5c4029accfa6286511f0a1a2a216184d2b20a6c64ced19df24631da89594aa44e8ba780efa2c852eaa0eee1b18ab0429ef9e235e4bcb140a992bf7b58aa91bca659441e96a39d6b157e633b3627fc", 0xc1}, {&(0x7f0000001500)="e397c9516713a252cd0f1b1e20961608694e58000d6a3f828ffb46bab5c445b69f00e3782e7f564fab82c78e", 0x2c}], 0x6, 0x0, 0x0, 0x8800}, 0x80) r6 = eventfd(0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000000)={r6, 0x0, 0x2, r6}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000000c0)={r6, 0xffffffffffff2f4b, 0x2, r6}) 14:47:37 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x1}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r3, 0x114, 0xa, &(0x7f0000000100)={0x1, 'J'}, 0x2) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) r3 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xfffffffffffffff8, 0x44180) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000140)={@in={{0x2, 0x4e21, @loopback}}, 0x0, 0x1000000000000, 0x0, "036e8188a4db8798b7c445002ee62115bec021771364349f3a50d13aa1a791716aa38dc319047e00470e796975500430e9d4f37a3fd8d07dccff2ab509751c6a9279b2e36b6b80a9297aabd004cdcbb9"}, 0xd8) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1553.220601] irq bypass consumer (token 000000005ab1d326) registration fails: -16 [ 1553.244550] irq bypass consumer (token 00000000b1c81dce) registration fails: -16 14:47:37 executing program 2: openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@increfs={0x40046304, 0x4}], 0x1, 0x0, &(0x7f0000000540)="b6"}) r3 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x2, 0x2) setsockopt$bt_BT_SNDMTU(r3, 0x112, 0xc, &(0x7f00000000c0)=0x8, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sysinfo(&(0x7f0000000140)=""/226) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x200000000000005}) 14:47:37 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) 14:47:37 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup2(r1, r1) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r2, 0xc0505405, &(0x7f0000000180)={{0xffffffffffffffff, 0x3, 0x8, 0x0, 0x100000000}, 0x3344, 0x0, 0x9}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000300)={0x0, 0x58, "1c523bd86eb196c957e7cfb3b3d1663130c871bc905a4f9d9ad1669f48fe3f99c56c4868e93fe40b28de3cc895d3da7a9c8303ab3c4789e533d5825543ced121f3550a4dd7e0dda2d992e615f40e3c2e26797cb7d68af311c107080096e03b3fa025a50a30e913ef053b38e3b33890c8cfb90e1db6efaf37af5336f90b7e253ae5c74f2777b0d7e58877175bfcf0405d61c871d5590e16deb3061091ada83a69ca2cbde824229f76fd29dad401ddcb01192e3eced0a9f3b0935101edd3f7231446b11c177d760f685aa4bc92371b16fdd7350190a4366f1bddf15f93b1e8285cc249989e0b252aef24000151c54f651226afeb9793a04ff9bb4555f4c27dec74ffa6d9b0639737dd905d2d44af80967c06d8cbdd745061da706820915d79166a0683602c0b7aed1ee9753e392937568c6d32a65358cc9b93230bf3bf387a69dc788c7e80b9"}, &(0x7f00000004c0)=0xd996f1231be00bff) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f0000000240)={r4, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x29}}}}, &(0x7f0000000100)=0x84) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0x0, 0x2, r5}) 14:47:37 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getpeername$unix(r2, &(0x7f0000000180), &(0x7f0000000200)=0x6e) r3 = eventfd(0x80000000004dfc) ioctl$KVM_ASSIGN_PCI_DEVICE(r1, 0x8040ae69, &(0x7f0000000100)={0x6, 0x3, 0x8, 0x4, 0x7}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:37 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)={0x0, 0x0}) move_pages(r1, 0x4, &(0x7f0000000200)=[&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil], &(0x7f0000000280)=[0x7f, 0x80000001], &(0x7f00000002c0)=[0x0, 0x0], 0x6) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000000)=0x1000, 0x4) move_pages(0x0, 0x20000000000002fa, &(0x7f0000000000), &(0x7f0000000040)=[0x5, 0x9, 0x400, 0x1, 0xe6, 0x6], &(0x7f0000000000), 0x0) ioctl$VIDIOC_SUBDEV_G_FMT(r0, 0xc0585604, &(0x7f0000000080)={0x9eb2efd21cc73c02, 0x0, {0x400, 0x5, 0x7009, 0x2000000000003, 0x2, 0x2, 0x1, 0x1000000000000006}}) poll(&(0x7f0000000180)=[{r0, 0x20}, {r0, 0x120}, {r0}, {r0, 0x100}, {r0, 0x80}, {r0, 0x1000}, {r0, 0x2}], 0x7, 0x3) [ 1553.716514] binder: send failed reply for transaction 363 to 30983:31005 [ 1553.723738] binder: undelivered TRANSACTION_COMPLETE [ 1553.728884] binder: undelivered TRANSACTION_ERROR: 29189 14:47:38 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x1000000003, 0x1e, [], 0x382, &(0x7f0000001680), &(0x7f0000000040)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1553.984684] binder: 31042:31054 IncRefs 0 refcount change on invalid ref 4 ret -22 14:47:38 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0xfd, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x7, 0x400) ioctl$VIDIOC_DV_TIMINGS_CAP(r3, 0xc0905664, &(0x7f0000000240)={0x0, 0x0, [], @raw_data=[0x1, 0xf52f, 0x4, 0x7fff, 0xf0, 0x2cde4cd0, 0x100000000, 0xa06, 0x25, 0x7ff, 0x4, 0x1, 0x5, 0x1, 0x8, 0x2, 0x4, 0x7ff, 0x7fff, 0x8001, 0x0, 0x3, 0x3, 0x8, 0x1, 0x9, 0x200, 0x2, 0x15d8, 0x2, 0x6, 0xffffffffffff7fff]}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) r4 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x9, 0x4400) ioctl$VT_GETSTATE(r4, 0x5603, &(0x7f0000000100)={0x6b6, 0x4, 0x3}) getuid() syz_kvm_setup_cpu$x86(r4, r4, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000140)="b9ad0200000f32b939030000b8bbbf060dba000000000f3066b8a8008ee866440ff64493d866baf80cb8b469cc80ef66bafc0cec450f01d1f30f42630066420f080fc71966b8d6008ee0", 0x4a}], 0x1, 0x8, &(0x7f0000000200), 0x0) 14:47:38 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x8, 0x200000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000300)={r3, 0xfffffffffffffffd, 0x2, r3}) fcntl$getownex(r1, 0x10, &(0x7f0000000380)={0x0, 0x0}) get_robust_list(r4, &(0x7f0000000280)=&(0x7f0000000240)={&(0x7f0000000180)={&(0x7f0000000100)}, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)}}, &(0x7f00000002c0)=0x18) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f00000000c0)={0x40001ffe}) r5 = open(&(0x7f0000000180)='./file0\x00', 0x80000, 0x5) epoll_pwait(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x400, 0x43) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000002340)={{{@in6=@local, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@empty}}, &(0x7f00000002c0)=0xe8) sendmsg$nl_route_sched(r5, &(0x7f0000002ac0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002a80)={&(0x7f0000002440)=@newtfilter={0x630, 0x2c, 0x420, 0x70bd28, 0x25dfdbfb, {0x0, r6, {0xfff7, 0xd}, {0x9, 0xffff}, {0xffff}}, [@TCA_CHAIN={0x8, 0xb, 0x40}, @filter_kind_options=@f_matchall={{0x10, 0x1, 'matchall\x00'}, {0x5f4, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x4}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_ACT={0x5e0, 0x2, @m_police={0x5dc, 0x11, {{0xc, 0x1, 'police\x00'}, {0x53c, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0x7, 0xffffffffffffffff, 0x9, 0x6, 0xac5, {0x3, 0x1, 0x100000000, 0xa4, 0x3, 0x9}, {0x10001, 0x1, 0x7, 0x7db, 0x6, 0x6}, 0xd5, 0x1, 0x1}}, @TCA_POLICE_TBF={0x3c, 0x1, {0x7, 0x20000007, 0x0, 0x6, 0xcc56, {0x7, 0x2, 0xfff, 0x5, 0x20, 0x7fff}, {0x8, 0x2, 0x3, 0x10000, 0x2fea, 0x4}, 0x9, 0xfffffffffffffddd, 0x2}}, @TCA_POLICE_RATE={0x404, 0x2, [0x9, 0x80, 0x4bed3af7, 0x0, 0x9, 0x6, 0xfffffffffffff801, 0xde, 0x3f, 0xdd, 0x86, 0x2, 0x8, 0x29, 0x5, 0x3, 0xaeb, 0xa, 0x1, 0x1, 0x7, 0x6, 0x5, 0x5, 0x6690, 0x20, 0x10000, 0x3f, 0x5, 0x3, 0x9, 0x8000, 0x50f, 0x4, 0x880, 0x10001, 0x4, 0x6, 0x81, 0x9, 0x1, 0xffffffff, 0xfffffffffffffe13, 0x100000000, 0x1, 0x3, 0x80000001, 0x4, 0xa8d, 0x7, 0x400, 0x4e9c, 0x0, 0x9, 0xfff, 0x8, 0x400, 0x7f, 0x1ffc00000000, 0x20, 0x200000000, 0x7, 0x2, 0x8, 0x401, 0x80000000, 0x401, 0x0, 0x1, 0x0, 0x3, 0xffffffff80000000, 0xd527, 0x6, 0x9, 0x7, 0x4, 0x800, 0x6, 0x3, 0x3, 0x8, 0x4, 0x7ff, 0x7, 0x2, 0x5, 0x5, 0x7658dba3, 0x5, 0x9, 0x3, 0x40, 0x2, 0x10001, 0x1000, 0xa1, 0x2, 0x4, 0x4, 0x7, 0xf9f, 0xa2, 0x9d, 0xfffffffffffffffc, 0x80000001, 0x26, 0x2e, 0x3, 0x3, 0x6, 0x48d, 0x7, 0x8000, 0x9, 0x4, 0xffffffffffffff81, 0x2, 0x9b, 0x9, 0x85f, 0x0, 0x6, 0xa9, 0x9, 0x20, 0x79c, 0x6, 0x5, 0x0, 0x5927, 0x7, 0x9, 0x42, 0xa00000000, 0x100, 0x5, 0x2, 0x1, 0x10000, 0x971, 0x99, 0x1, 0x7fff, 0x7f, 0x0, 0xe39, 0x6, 0x1000, 0x800, 0x8, 0x4df, 0x20, 0x2, 0x0, 0x1, 0x3, 0x81, 0x8f18, 0x5, 0x7, 0xffffffff, 0x6e38, 0x7, 0x1f, 0x7, 0xffffffffffffff56, 0x3, 0x75ab, 0x5, 0x10001, 0x7fff, 0x5f2e, 0xed8, 0x6, 0x9, 0x7, 0x7b, 0x6, 0x5, 0x8, 0xfffffffffffffff8, 0x40, 0x1, 0x8, 0xffffffffd96b49b2, 0x0, 0x7f, 0x5, 0x0, 0x0, 0x7, 0x1, 0x400, 0x56, 0x8, 0x952, 0x7, 0x7, 0x28, 0x5, 0xd0d, 0x80, 0xfffffffffffffff8, 0x4, 0x8, 0xfff, 0x800, 0xd6c, 0x8001, 0x3, 0xd690, 0x7, 0x5, 0x180b8000, 0x80, 0x7fffffff, 0xffffffff, 0x5, 0x0, 0xba, 0x3, 0x0, 0x0, 0x4, 0xbc, 0x10000, 0x65, 0xad58, 0x3a43, 0x1000, 0xf6, 0x2, 0x27a, 0x40, 0x7, 0x1, 0x3, 0x7, 0x8616, 0x438f, 0x2, 0x5, 0x1, 0x4, 0x4, 0x3, 0x4, 0x34, 0x1c, 0x1, 0x0, 0xc2, 0x7, 0x100, 0x1]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xcef, 0x0, 0x2, 0x8001, 0x5, {0x80, 0x0, 0x14, 0x80000001, 0x7, 0x4}, {0x80000001, 0x2, 0xa42e, 0x15, 0x6, 0x8001}, 0x51, 0xfffffffffffffff7, 0x3}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x3}, @TCA_POLICE_TBF={0x3c, 0x1, {0xffffffffffffff3c, 0x0, 0x5, 0x6aef, 0x7f, {0x20, 0x1, 0x1, 0x2, 0x4, 0x3}, {0x4, 0x3, 0xffff, 0x8, 0x101, 0x2}, 0x5, 0xfc, 0x80000000}}, @TCA_POLICE_TBF={0x3c, 0x1, {0x7fff, 0x4, 0x2, 0x4, 0x4, {0x4, 0x1, 0x7, 0x401, 0x9, 0x9}, {0x80000001, 0x0, 0x8, 0x6, 0x100, 0x101}, 0x80, 0x7, 0x6}}]}, {0x8c, 0x6, "7e80268a88283af558b7dd42db08b4bb5455ca433c66462483be76ea80a001128d9714c658cb507631947f339795e2bb2820a7bb71ab36034d7fd4e0cf78a33c521c6a6d22ba95c083f9be06113fa22ba0c824d5cb14e4943960b05a3e85b3adeb14546ac34a64dd458278d662865f8112e34d386ec4e4bc872f9934560da20134edcfb00e97"}}}}]}}]}, 0x630}, 0x1, 0x0, 0x0, 0x800}, 0x4000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r5, 0x0, 0x1000, 0x1000, &(0x7f0000000340)="d78bc59064e373edd104ba1e1f048cd9a79e273fed4805fb0646f837be866c22c9f2bed99d2e6971625d465a5e7b2db06e5906b7b18571a3bed025aff64ae2fc6023d2a9e27947498a80871b04674aaf1d10a8387297e6a9dfd739f9a53c921190c0d1e1db77d94b7db4093b4c4939d9d35c2d8c64bc29f17478de3ae3b851e391994b0cc420331f9520ecdd611263910b6821252fbda5fd54827b3f630c3849c5f9dd14391772519ed34d0b207b6f1ad16506b9d40294c59c76646117d181e01f19390eca74bcd40cba5f62bc26bbb8fc425a94417bd61a1af714c04a42979b00090aab47ac3132dfd91973156874855722f359359fee68f0c86df5ad4bd162dcf3dac37fcc0250f570b44e2aead22aa42168b94c20418a2aa8c3e4bcea20f5394c3a4033391bcdf4fb1ad435adf1d801a4d833793ec2db1405fe14dbbe5142b51dee051ae497af5dcd31b51d471853411a2723b5a11b2db5d277a06703c8ae787458571bbd8e550d4e89ac0bec2481f03966035cbd5e8cbbe13627be9c4e2eba635784c041984f5881cd3ee7521d1a2a5f6d8319c78eb4a739fc747518d6a992394f433bed7ec77567e6afde9e5d098367a16e85a4baff15b8d7cb0c6889e88447b50be9bdd68740dc4e34dee4d1ab96288e56795ded6eb87725e00ce5a067880110264d766798f2321774cad1d620efa4ed7c20fd50b1d9495ad09188a06e50570c97b640718f7a14ab46950e1ce2deba165411d4c908475bb7099d88875c464952ac1bebb69ec75ccedeb53ee9ddd90cd2fe1259564d57ad1c136e3b9d0b5eb5cf984b95dabf8b6209d3c2a0b5cb06b5c47d0868390f64f19b8c0d387fefdf07aa8c07298eec326ff196a4f4dc6f4ca0b445a021b8949c06854733780eee73ae130332c52fc1ea023b94a2ec4cbc88c01b080931e456207d31c389ca4e7e3efd094ffc601119352f5500dbc0c8f4b93a72c1da22975d9eaf618ceb71afeec955487ce65eef38b31ff4241546415d45b1d31ac713af4a001e1632ec30c86244e1355376ac7c838fa55487f27076abd0aa273fe3f374bc1b6e727b81021a9c1accb82693924eef8527557a4c00a271d35611e1994a060e05df76c21816ef3cfb18c9e0c9cea9d5c3a7bd732f5841839fa0dd9328f206d195dc1d18214cd9e9e7e3b81aaa448c35267021317ce3c1f42e510f053839feca87f958b71f930292bfe07844490ab92e7f1840c576df62241147c0f6ad48b4b995f554ad81c4ea16bc87e1e77fbceeac90b7dabaf5255110934be28c41f5a144c6e8161753f32e02da76c636eda1e1422351334f0ba11e90986520bff1188ec7ebacd0bd03a36e416812928e7e6878a4ac275b6d7810f2a0272f59a43945ebab19e946b3c06375fcc19c36935b5f6307cccd5dfe840a4af2c2b2644f1a056124bd8b1acaa0c81909e51fed632d61baea23021d5019df0b9e03bb3b3eca4e9164a85df361e3d6e926b88961fb9f70d246ea541354a6e9c18564896e423db63c624ce987ca59cfc0ca85b0c62b0a8f8bf904ad50e7eaf86dc98ed460d917fbf5667f8141b2ba1d51114c3be9c545aac979df3340edc53c76e04cd5358a191213008a3622dd4efd3ca96d63f4dce263e77b1663d409eb6aa2c3238f85f341d509455aadca49f69330afc563e42d221bb42da7cfbcd8b708bf35b89ff4ce9f27b04533bedd40878a91fd9742f127e88004c037dd4275b1e013bbe21c5733af37fd15aa326f8fe687ff654e3b338b6a6906d5ad557ee99f0d20fdbddca540c53fb68384fe91e6c8d38888efcb0261af2c1f9654128cf58a68bcd34457e1c785c5bf5999858e09c1c9cdd4f34c37229dba8645839c8109a824332fd88ca3290f4ebad265018700846e4c05679adce5eeba3acc08a170793bd07b9075acf0a91f7e4ba6677628d2e90494879647fbf46b66ea7a8dd5fc8db35c8f25675e1c83104cb8cf5855f55803b57872f815b5fe58c2e7d6a748aa51369081db494bf71dcfe8347c57337cf555c55489a7dba93037cd0b30b67bde472cb7885e01d4681d6720e53c260087dc6cb99a7e1631e33dd958552f5e7384541fe9aea24558399e709c399ab68b8ac3399bf7d042c304d7ef9de38ecc85ed64b4379793b131c874800baeccbec46cd1dcce10fa74831292e1a682d9d5b74d9c88e66321ed108af3793ef40a4224cf9099f9a925e5d7e56030fe696c81f4f3071ab469f5044cf1716789669f2fc94f426d1d20f4cb0f20ff89725586a0c2ff0c0bcf610eb7cbe9f7ea4fdef858226c104255d960b0630f1d0bda686fa984c641b1f5a39742d185c642fdca92d78137df639d8348aec959bbf3e292a3246ca99c42c53bddfb6758f3b5952534c02e120421f65a078b0f7701ad5ae1392aa81b66edc28fe25e08b4c02b2d338bb1f72d99647dc8d49aeb99aec7319ac46f66ed4c18e39ae7534bbcfc50ed59e0668051d2525b931c053a351b0257174ffe8a94762edc5f1a5fc8b645acf9e33e3b97cee3f8e4e75cf6965fea8f3439559c7b9d24da9c03c8996851b1b991ecb597b2f7d42619e4fb63df3872737eff2be885998171adb48b423d0b95972e13149ef083d98e1919b73037d85bda6d5e13f4aeb2ee4f8e1addd1704fe53f3ff6da8431a9c8df935751daba2d99240ae5330ae418f678fe281eb8922b95e2cb3302f5378e880b7fca96e47af32281c9434d2f598bdf0497cc5cd452f36909adb5f7a4ab6c2e0a8fcaa278d84c46aef0622dd630a84ed49c87d0b37cb99680f90149af537a056b814a25295afc202615a8c160ae85e1f6f4a33033b66eaafa8001f21a64bff102915593fd094a15bf38c4002811d28762d437dc67fc58040337d46f837b7fea3c826607f509f8ee13b8299ab91adffa9a8043e9315fb3c60b75705f55235709de741a1afa7da52b0a0fc04a291c0717bed5bc2a549d7ea90eac18b5b77348d31d687ef74f4714fb337bbce0998b55371126accbe9f8ac586788391dd861808fbd60888e61e302308bc119cb92d1cd32af42b4456164ada6d718152857da75b1f022240df59ef25b944c37b5f6e83ea83c7474cee3d5eb5aabe76972177e9bf8fc248c976bf5517ddb5f3456baa4b777fe6c9d826e61d037968de8ba504340eaa3adfc3733c399c570e969aace76952cfa0e198df6af203f1df1a87f43978ee97e793c52fa8d71618d8c23255ec40001b63d6e51fa55fd00aae46d842f3a15f37dbddbc3ecdefe055ee570ff179ee16dadcc65c40faaca231b4643db92e7b344786354ddd4cb0d7bf8a53ae0c6437070ed785b6e65b679f61863ef27cb7aee597251f1c16589b8810126fc173f4bea77af7d82debf068cc1f416b9f878676e4d1cf882a36148e33c8da0ded59875865a2bc12922f6b295bcc27876b17e8aa6f44c943e18259ad72025d743fdadf15ce65fa4ae674b01338a8aa860d5a57ac2cdc1562ca406bb31c6c80afb5e21ca6deb8617025d08bada91bcd23ab987636d970b56bd773c9bfbf4417cc0f39f683ab9e9cbccb5ca5e597c90a4eb5ee15cffa0abc4a5fe07ead2a209603fd7d9ce7792814ad611a4edf67b0f4284c8d1cbf20b9081dfe729469cabf00d1243b4d789e98f058d8f3fa6757eff5f2e205292a34deef7f18e1e0ccaf139c308a48918c8a9381b938894427508fbf997544486347201420b5877b0cb392edc6417389d02512eaa2d59bebd8ebcb8d6958092bf3627f9158478e7b8f49f791db17312576209cd60e1b402140eeeb1fe0034f8f07f64cf46db23a09cdea0cb83c2a0cd85a264ca08be92b5a443e6cd3e8cfb70f6c4794fdd9cfdae5ffc66064688fa61fbb2d3f36e21159db214984f0228d3c0a15a2a4c0fa563410beb6652d69dcc8b55951cdac09c1edcea42d30c56a517cd141a2adc0dd9c253bcbaedc8c759e24720043b14209288d3f3457d8a72d3575675c673b70de24206f66ad2da43993e6d8943f1772e044d48f97d3238d8c76287f5c22c978c3dc152d86be668680afc96e7be9e5b0884e83e3f4ce8e2e1434c3c18014623746d8e1505a302951e1ff6184588ebaf709306ad75b0761e9b6194524d90800f096d1a38bcc3eda129d5ad1f742ce3f35eda9422b1db10e6bdf9435ac69bdb6c223eb57f0f900793ecdec77769606cdd2ab441d91a92f603baaa8e1bbcdf14b5bbca231c6e25440cca55cc475a6d74f6d1bb5c033b20f07dbf3e0161d049cfcb7611835d80eea2392dd8c14846fc86ec75329c16d7c7addec9871b573149e2b018d9c1b9b40b67aa5053520829fb79cf8a7524c387474595299dff5c09eec59240c5994304b90e8885d0f421c3604d8ab96bebfde08727a414fd20a2da204e4734a641e844eebfaff8cb67cbc1afabf863410720ac55fc8a53c7eb5995876a6200078cd210e2554822b91c1ab3aa8391fa85127b0b80b34519e7f1c10b50196c8f57bd4c4a21a08330df156bdb371f859d98acc0ad3bc24dd049273fc3c11bdbe4edf9a1eda215d4ef62835c2270d4f700aad2f8f5178b012b41234dacdb62aee9832cf1a553c1d368d1e22b1d0e0dbfe31588e1aa2ade1aa24ae88b7d8167897b49a314f8da9a0d2e335158c4d9172fad2a14986c6ea0a03a61d1b1c8abcbccc798d239f4779230a16954a1f99613ea6fab8e66fc9ad8a5374bc449cda34a576b872383bfee4d8b1e23fffb0edce134b456624b579d0910b15990967ceeac5d301dacf6e847dafd41e1887638f7fa0fe353832b2b17fa155410997ce6eb8bb9d12595c4db991dc4e4350e0c5dd19c8af489da7f188d6cc71c790f92e1276190743c8c09e6dd5bf7de58547a04fdc84770dca0b7ca7c5a794b93660b2e07ceacc25eeb852c93a32b57cde00ffd611d2460cc2b39edd585f6173b9e9b5e699448648ec0d89cf8acaa20225a68d5978bd242ef30a1a21b715c34fc2330bc9d1d172cfd4d45a497cb08ef4f695cb76174c564106c54f008c15707728d18f49f46396e63aa242873028d7f02d93a123488f5810872eccceb7b4cdb2f8510810e4ccfb493c7fc8b41a7a3fb03921eb7419a1c12c88b5ea4af6b0dca1f85cf44dea8574637b3e33afad736e872a2d79202da228fcc3483bd9625a3855d39babf1aa813e8a50c373692c24b69a719c3775fbb152ef6e81c0b202f4661e39218fa2363dd508eccde392616f298109bd2f22fb21bfb5f3a6c910e8270f4fffa2f9b5344fceeb1c5e4a58a2c5245b25f27bad9ff32edca7e97da281ef7f24326759768c31e2bec9f3b1b421ea7b034555245e1fb8ece770acb584f3dc69111e366b9ef041a29ff3c7bc2439fa23b4a68ff67dc23bbafd9befb8167e59c51178e2c1ed33c59b35db15af705ddb0b98acfb088c89646e4405b9f3bb3742ecea34f851574e37279adfa17408dbee31ebd5ba21f8fcd2fe53d7471266a5b4aeee38f0fa01ecb1665b5dc84393ebd9a401c7749a95b0d56825acf1f51da9b1198b9246a825dcfa1ba620629fb50c7c60cd9ff3250d30418be760b09d10f38f9962df1e766c1b7269d527aa80a58ab4d6a60dea1f4dc571833b2d9247c4236c84c29a617c19f8ce238a85623b36b0cc4527c7633279662275071ddf0fca09f8163de2e45134693d157838e5a30f8ec022d0150834733f3b8a7056cb8c988093a20bfc6377aa67170cb5a81f1a9b3461c1ee68ce863823675f7cab607f81cbcea36a25596063588e6199a5eea8f25923c6932278c8d3cf79d25de969e2f7cfcf4ec58252d1a1c11fbd5a518", &(0x7f0000001340)=""/4096}, 0x28) 14:47:38 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x10000, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:38 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x42, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x8481, 0x0) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000140)={0x2, &(0x7f0000000100)=[{0x9, 0x2, 0x1, 0x7}, {0xffffffffffffffff, 0x322, 0x7f, 0x20000}]}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x800000000) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="0000000000000000414706558741fdf26a85786750ba702ed529988e79c69eb52d736775193878923bfa8629ae86638d45d6b317cf8a7dcf148cf374caf3a5f94254212db8af9d6105139125776385c61c68ca65a4eb7fedd89156dcf7ccb70c607aa07839f2c9741601a3409792e4aa2cbc1860049e093f55f99c42bd5dd6456e65211cc11ad63fa4b3b496e8b33075d2373ff1d7b3bce2c48760d653baf07981cede1b33abd51506da"]], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) r3 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x3, 0x400000) ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:38 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x2}) 14:47:38 executing program 2: r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x9, 0x8000) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1554.809341] binder: send failed reply for transaction 367 to 31042:31054 [ 1554.817527] binder: undelivered TRANSACTION_COMPLETE [ 1554.822882] binder: undelivered TRANSACTION_ERROR: 29189 14:47:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x10000000000000, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x80002, 0x80) r2 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x6af75de6, 0x40c0) r3 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0xa517, 0xc0082) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000001c0)={r2, 0x80000001, 0x7, r3}) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000100)={0xf000, &(0x7f0000000080), 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r5, 0x4}) 14:47:39 executing program 4: r0 = perf_event_open$cgroup(&(0x7f0000000100)={0x0, 0x70, 0x6, 0x4, 0xa4, 0x7, 0x0, 0x0, 0xc, 0x1, 0x200, 0x8, 0x3, 0x5, 0x9, 0x80, 0x1ff, 0x9, 0x9, 0x4a, 0xd52, 0x6, 0x3, 0x8, 0x400, 0x6, 0x5, 0xcc, 0x5, 0x8d, 0x40, 0x5, 0x80000000, 0x3, 0x100000001, 0x1ff, 0x3b65, 0xfff, 0x0, 0x75a, 0x1, @perf_bp={&(0x7f0000000080)}, 0x40, 0x9, 0x80000001, 0x0, 0x81, 0xdf, 0x1ff}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000180)={0x6, 0x9, 0x81}) r1 = accept(0xffffffffffffffff, &(0x7f0000000200)=@nfc_llcp, &(0x7f0000000280)=0x80) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000300)='nbd\x00') r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000340)='/dev/null\x00', 0x240300, 0x0) r4 = dup2(r0, r0) r5 = syz_open_dev$usb(&(0x7f0000000380)='/dev/bus/usb/00#/00#\x00', 0x5, 0x420800) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000003c0)={0xffffffffffffff9c}) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000400)='/dev/vcs\x00', 0x20000, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000440)={0xffffffffffffff9c}) r9 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vga_arbiter\x00', 0x800, 0x0) r10 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/snapshot\x00', 0x101000, 0x0) r11 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000840)='/dev/vcs\x00', 0xa4000, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000880)={0xffffffffffffff9c}) socketpair(0x5, 0x5, 0x2, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) r14 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000900)='/dev/sequencer\x00', 0x8000, 0x0) r15 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000940)='/dev/rtc0\x00', 0x0, 0x0) r16 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000980)='/dev/rtc0\x00', 0x100, 0x0) r17 = syz_open_dev$vbi(&(0x7f00000009c0)='/dev/vbi#\x00', 0x2, 0x2) r18 = open(&(0x7f0000000a00)='./file0\x00', 0x40, 0x40) r19 = openat$null(0xffffffffffffff9c, &(0x7f0000000a40)='/dev/null\x00', 0x500, 0x0) r20 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/sequencer2\x00', 0x400002, 0x0) accept(0xffffffffffffffff, &(0x7f0000000ac0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000b40)=0x80) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000cc0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8000004}, 0xc, &(0x7f0000000c80)={&(0x7f0000000b80)={0x100, r2, 0xd06, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x929}, @NBD_ATTR_SOCKETS={0x24, 0x7, [{0x8, 0x1, r3}, {0x8, 0x1, r4}, {0x8, 0x1, r0}, {0x8, 0x1, r5}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3638}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x101}, @NBD_ATTR_SOCKETS={0x3c, 0x7, [{0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8, 0x1, r9}, {0x8, 0x1, r10}, {0x8, 0x1, r11}, {0x8, 0x1, r12}]}, @NBD_ATTR_SOCKETS={0x4c, 0x7, [{0x8, 0x1, r13}, {0x8, 0x1, r14}, {0x8, 0x1, r15}, {0x8, 0x1, r16}, {0x8, 0x1, r17}, {0x8, 0x1, r18}, {0x8, 0x1, r19}, {0x8, 0x1, r20}, {0x8, 0x1, r21}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}]}, 0x100}, 0x1, 0x0, 0x0, 0x40}, 0x4) r22 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x8400, 0x0) r23 = ioctl$KVM_CREATE_VM(r22, 0xae01, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f00000001c0)={0x0, @speck128}) r24 = eventfd(0x0) ioctl$KVM_IRQFD(r23, 0x4020ae76, &(0x7f0000000000)={r24, 0x0, 0x2, r24}) ioctl$KVM_IRQFD(r23, 0x4020ae76, &(0x7f00000000c0)={r24, 0x0, 0x2, r24}) 14:47:39 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x40, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000180)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r2, &(0x7f0000000200)={0x16, 0x98, 0xfa00, {&(0x7f0000000100), 0x0, r3, 0x1c, 0x1, @in={0x2, 0x4e23, @remote}}}, 0xa0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x0) write$FUSE_LSEEK(r2, &(0x7f0000000300)={0x18, 0xffffffffffffffda, 0x2, {0x6}}, 0x18) setsockopt$IP_VS_SO_SET_EDIT(r2, 0x0, 0x483, &(0x7f00000002c0)={0x2f, @multicast1, 0x4e21, 0x0, 'fo\x00', 0x7, 0x6, 0x74}, 0x2c) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0xffffffffffff2f4b, 0x2, r5}) 14:47:39 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = open(&(0x7f0000000080)='./file0\x00', 0x2, 0x2) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r1, 0x1fb922f6, 0x5, r3}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:39 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x2e, 0x6, @tid=0xffffffffffffffff}, &(0x7f0000000080)=0x0) timer_getoverrun(r0) r1 = openat$autofs(0xffffffffffffff9c, 0x0, 0x20c00, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f00000000c0)={0x6}) sendmsg$nl_route(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x210000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@setneightbl={0x28, 0x43, 0x1, 0x70bd2b, 0x25dfdbfe, {0x2}, [@NDTA_NAME={0x14, 0x1, '%(em1*cgroup\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x8004}, 0x80) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$KVM_GET_MSRS(r1, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYBLOB="02824a000000000000000000000000000401706d0000000000000000000100000000000000000000"]) 14:47:39 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='syscall\x00') ioctl$VIDIOC_G_DV_TIMINGS(r0, 0xc0845658, &(0x7f0000000140)={0x0, @reserved}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd2(0x8, 0x20000001) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) r4 = syz_open_dev$vcsa(&(0x7f0000000200)='/dev/vcsa#\x00', 0x1000000000005, 0x2) accept4$alg(r4, 0x0, 0x0, 0x80800) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) 14:47:39 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r1, 0x4008ae48, &(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:39 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) 14:47:40 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x40c01, 0x0) ioctl$KVM_DEASSIGN_PCI_DEVICE(r1, 0x4040ae72, &(0x7f0000000080)={0x5, 0x1, 0x4, 0x1, 0x1}) ioctl$DRM_IOCTL_GEM_OPEN(r3, 0xc010640b, &(0x7f00000001c0)={0x0, 0x0, 0x1ff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000200)={0x0, 0x80000, r3}) ioctl$DRM_IOCTL_GEM_OPEN(r3, 0xc010640b, &(0x7f0000000240)={r4, r6, 0x2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$TIOCSBRK(r7, 0x5427) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) r8 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x1, 0x2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r7, 0xc00c642e, &(0x7f0000000280)={r5, 0x80000, r8}) ioctl$BLKSECDISCARD(r8, 0x127d, &(0x7f0000000140)=0xfffffffffffffef4) [ 1556.123708] irq bypass consumer (token 000000001f9c3097) registration fails: -16 [ 1556.195983] binder: send failed reply for transaction 371 to 31100:31104 14:47:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = mmap$binder(&(0x7f0000002000/0x1000)=nil, 0x1000, 0xc, 0x80010, r0, 0x0) r3 = mmap$binder(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x114, 0x0, &(0x7f0000000580)=[@acquire_done={0x40106309, r2, 0x1}, @dead_binder_done={0x40086310, 0x3}, @transaction={0x40406300, {0x4, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x28, 0x20, &(0x7f00000000c0)=[@ptr={0x70742a85, 0x0, &(0x7f0000000040), 0x1, 0x0, 0x37}], &(0x7f0000000100)=[0x48, 0x40, 0x0, 0x18]}}, @dead_binder_done={0x40086310, 0x2}, @reply={0x40406301, {0x3, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x68, 0x18, &(0x7f00000003c0)=[@fd={0x66642a85, 0x0, r1, 0x0, 0x4}, @ptr={0x70742a85, 0x0, &(0x7f0000000140), 0x1, 0x4, 0x17}, @ptr={0x70742a85, 0x0, &(0x7f0000000180), 0x1, 0x3, 0x1d}], &(0x7f0000000280)=[0x78, 0x0, 0x68]}}, @increfs_done={0x40106308, r3, 0x4}, @transaction={0x40406300, {0x2, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x0, 0x40, &(0x7f0000000440), &(0x7f0000000480)=[0x78, 0x0, 0x38, 0x28, 0x38, 0x0, 0x30, 0x28]}}, @increfs={0x40046304, 0x2}], 0x23, 0x0, &(0x7f00000004c0)="cc29cb34288cd707b8862557b4dbe359bf52560f249d582f2daa6835418ecbbb19e1af"}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0663041eaaab9add"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 14:47:40 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, r0, 0x0, 0x2, &(0x7f0000000080)='g\x00', 0xffffffffffffffff}, 0x30) move_pages(r1, 0x0, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000180), 0x4) ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f0000000000)={0x2, 0x6, 0x7fff}) 14:47:40 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) [ 1556.308644] binder: undelivered TRANSACTION_COMPLETE [ 1556.314061] binder: undelivered TRANSACTION_ERROR: 29189 14:47:40 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x10000, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) [ 1556.686839] binder: 31141:31153 BC_ACQUIRE_DONE u0000000000000000 no match [ 1556.694142] binder: 31141:31153 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 1556.701703] binder: 31141:31153 got transaction to invalid handle [ 1556.708017] binder: 31141:31153 transaction failed 29201/-22, size 40-32 line 2834 [ 1556.719304] irq bypass consumer (token 0000000089933b41) registration fails: -16 14:47:40 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000080)=0xfffffffffffffffa) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:40 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x2, 0x482100) ioctl$TIOCNOTTY(r3, 0x5422) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r3, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000484}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, r5, 0x400, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000001c0)={r6, 0x3ff, 0x6, 0xfffffffffffff001}, &(0x7f0000000200)=0x10) ioctl$VIDIOC_TRY_EXT_CTRLS(r0, 0xc0205649, &(0x7f00000002c0)={0xf000000, 0x0, 0xfffffffeffffffff, [], &(0x7f0000000280)={0x9b0978, 0xffffffffffff7fe5, [], @string=&(0x7f0000000240)=0xc65}}) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000480)=[@in={0x2, 0x4e24, @empty}, @in6={0xa, 0x4e23, 0x3, @remote, 0x2}, @in6={0xa, 0x4e21, 0x1ff, @local, 0x40a}, @in6={0xa, 0x4e21, 0x80, @mcast2, 0x3}, @in={0x2, 0x4e20, @broadcast}], 0x74) 14:47:40 executing program 2: openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x90000, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vga_arbiter\x00', 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000080)={'na\x00\x00\x00\x00\x00\x00\x1cv\x00', 0x0, 0x0, 0xfffffffffffffd79, [], 0x10000000000000df, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) close(r0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1556.864509] binder: 31141:31149 unknown command 503603974 [ 1556.870207] binder: 31141:31149 ioctl c0306201 20000380 returned -22 14:47:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000005, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1557.115733] binder: undelivered TRANSACTION_ERROR: 29201 [ 1557.121409] binder: send failed reply for transaction 376 to 31141:31149 14:47:41 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) r0 = shmget(0x3, 0x4000, 0x54000900, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/98) 14:47:41 executing program 4: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000080)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) r3 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x0, 0x40) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000200)={0xffffffffffffffff, 0x10, &(0x7f00000001c0)={&(0x7f0000000180)=""/47, 0x2f, 0x0}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000280)={r3, 0x10, &(0x7f0000000240)={&(0x7f0000000140)=""/17, 0x11, r4}}, 0x10) 14:47:41 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) r3 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$update(0x2, r3, &(0x7f0000000380)="0bd8c165f82786c8301204c4574941", 0xf) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x1000000, 0x0, 0x8, r2, 0x4}) keyctl$instantiate_iov(0x14, r3, &(0x7f0000000340)=[{&(0x7f0000000200)="715b95456514b92c937c0f788fbc1e49d69277b77be4a0631b1919964ea31af9ba1afca3b1ba781a25df1c2c473a6e2cbe90ac30b1dbef01a76ff2a3bef5f23914f6d48dc066325ffb5c83f3a08e79be18c34cde8feea7c351088793daa1b165c30502621d9ec9eec74090b26b62059db432123bd0a7a3d25b72fbff97ba6683dbc744b09b5cf2fa62e781a7e9073f1f9274a8e6f4b2e2957fb40b3cc06fecf85e4710d888aee7a14e2cd8c89fa6fd9bb8599a9a8880898a18d09e71bb792fc3d340efe491525ae7", 0xc8}], 0x1, r3) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, &(0x7f0000000180)={0xa, 0x6, 0x3ff, 0x4, 'syz1\x00', 0xbc4}) syz_open_dev$sndpcmc(&(0x7f00000001c0)='/dev/snd/pcmC#D#c\x00', 0xb7e1, 0x8200) [ 1557.274380] binder: undelivered TRANSACTION_COMPLETE [ 1557.279573] binder: undelivered TRANSACTION_ERROR: 29189 14:47:41 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x7, r3}) 14:47:41 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000002c0)='/dev/snd/pcmC#D#c\x00', 0x7f, 0x10201) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x141800, 0x0) ioctl$UI_END_FF_UPLOAD(r4, 0x406855c9, &(0x7f00000001c0)={0x8, 0x1, {0x55, 0x7, 0x7fffffff, {0x5, 0x10001}, {0xfff}, @rumble={0x40, 0x1}}, {0x52, 0x7e47, 0x40, {0x1, 0x1}, {0x95, 0xdfc9}, @period={0x5f, 0x0, 0xfffffffeffffffff, 0x6, 0x6, {0x4e, 0x80000001, 0x87, 0x8}, 0x7, &(0x7f0000000180)=[0x2, 0x5, 0x7, 0x9, 0x7769b231, 0xb89a, 0x3]}}}) ioctl$VIDIOC_G_CROP(r4, 0xc014563b, &(0x7f0000000280)={0x7, {0x7, 0xffff, 0x5, 0x800}}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40086607, &(0x7f0000000080)=0x80) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0xffffffffffff2f4b, 0x2, r5}) ioctl$LOOP_SET_FD(r5, 0x4c00, r3) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r4, 0xc0145401, &(0x7f0000000240)={0x3, 0x1, 0x2, 0x3, 0x6}) 14:47:41 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) r3 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x1f, 0x30b800) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r4, 0x4, 0x70bd2c, 0x25dfdbfc, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8014}, 0x90) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) write$P9_ROPEN(r3, &(0x7f00000002c0)={0x18, 0x71, 0x1, {{0x80, 0x2, 0x2}, 0x5}}, 0x18) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) write$P9_RRENAME(r3, &(0x7f0000000280)={0x7, 0x15, 0x1}, 0x7) 14:47:41 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000000)) 14:47:41 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f0000000080)={0x4, &(0x7f0000000100)=[{}, {}, {}, {}]}) setsockopt$inet_dccp_buf(r1, 0x21, 0xf, &(0x7f0000000380)="b748a733b4cf7dadacf768e86d1704f11ac0f73fb956462a933afd018c186f80e24b5a196e0a1fde222c5d356bca04ee470354cecb569908f3db31965d266b717ddb47ad1fc9e4dfcae2aba45870edd8bc54a45314679b444fed0a0dd3363408d6aff41d9de5a1aabe7064d74bef1d597a06e3f730bca55595c06f12fc9a14bcdcd29c7f628c90c77e70fbf50329813fcfd7305242790a8e9a24bbe168199d678e5efb2f3c276db5d3ab9eb7472bc95fb732bbdf0cb6995b2f195b59aae282340b5d9563de56954699d1024a7c7e9c92fba58f5052fa6200741479bf1f344e38f7824d4032d98436d3cf0d82a59107f8311467384284573fea29daaea1cf3d1fb4c3e595fe3ae7a809f2916283a8fd742a9aac8887861bba2796a2cbb0d99679449073f1a66a8dffa62bd7890538b0f7c6fea1aa143a4f16368a02c51e6b55e087d058de50e20e704996b9aa090ed550e55ec40ae27f4b0ce0025d5a151030670b8fde7cb9548714674237a39d45cda7bced9bf8e7abb60b409174231ea685acd61be2dc1d09b60af03c76aaae2c2d57a81b4f6f53965b0ad294bebcb86783f0fa5abf4c0e8bd19e2e2a6151665b334e387b995fe39a4e61252d8956b0d28a416c84ddbabad0fff6e562d28e4c3731967b79525c70188c0fe67b611863dea01e5d0b7f2fc551ce1e818b18780c68b6bdf8f6ed652d1fa2c357be16d192bc0ba25124261b46d3d1bd3894313de8a693b882f6c36dc50509f9b3ba5547dee53619457374449aefd2f4e90e1784e77c8e6b3c47a6e929b573b5608ed71ee5b7b1cabe83ed914cb0227ecf2bf27fc9c41a559d96476883857c6c145db106a63cd08d998c9178da602df70448ebca7219024a2802cf97d3ff7f1a4e6443c4bc0cc6aff3160609030789d9389dc6dfed2395ccb02beaad32b611aae622d2d3d11a9eaa33efc96f39377626ed7d39172da6403f449eaed3b3a9d0218b383734889b6309fe2d98364585440cd18a05d446cd2b05474f7b0d77602695b75575ce2961f40e6918f9b5e900df0a80e1706541e51d6ff58d5dc2a9cfe069433c6d8192a9cf451cf425298d9ad4756ef5765dfc5c1cc2d40c0433d1df2f01d693eedc206adb9e151759a1c45a4ba2cab604d2c57a7831bfd5c4c63efdf0460962cd37b835b586ee8a88d8c3aeec47846e107db0edafe2de25bc2f15a3ef0da7a9d9944e07e4cf18822b45a36a2d855fa5c035aea3b1fb28461518fff61a558ea6139ca4089346da9bf3750160ff264526ee49fd6c048cad95c01b43531ec0633a62e54b43041c9c09093a8f40275b409fccdbe2a66a8309f7faabef844456284ad84f275d0d4bcf221b67283bbe3863c3dcd57a55421ff699267fe2fc90849d46ae237bcb7a02202a2c99162d6b17d12dff24fa57b99c2ab9874d4c440ab29f3e9e29ccc5d517cab5da6c4e7a6d0e93a58ed4dcc6f808c0b55408c3dbfbfaa3f84b2630879d8846b1c7bf03d1d61563a8223b13520156186874c9b9506a311d2bcf68b06598d53d3f0489180c1c71d221dbdaa06ef3ae7cdbefb5f7657143069b3fa339bb90000605410202e76028a2d8e7c13be2bf66c5dbf0f14bac63e13fb4ed9e1ae4bdf76e9c8ab008d1ea0463a52afb193374d08e81851d2b74155fb41d44d400ae36c3109b260ccc66d1edeb56b92baa6698a1b3e4718cbf0cad3bb8f1a57218b233040f9a70d40b1d7c499f14154a6829a8364d9ebaee67a7560c9da68798e240053636fda329876cd5c92164269c4710982a2d0ad75f4f28d75139a300d03e9802ec8cf328c185c26af730d855cccf0c051ab678888e151e9bf947cbda166f40cff63558ec998e08e8cd85a8cd92f35c8ce4d8c2bf3e1f2a668e6ad9774c9c08606b6e121d5dc9995bea138e90104dcdd58e629a01ad59f9755fae3fa26e836fb40fa2a1057c50ccdbe0397cf83cff557e640d0b3812e232e837bc90b4072c1681d57e1e7db54b964e2d984486b21892167dcc3363c9adf917f46631dde231ceb9625a175a48cc18bc9acec59bf4c2af9015e9ccca3bb0bb737897c4ea08328e35b124df2a14f7ed920ce178275416caad5b4a24b36fca26720aefb3b0ba53fc7082d14114bb4f66ce9c338bef8405e6cdb2cbf719e77da52c3803844a71df4b2d35333745679f768317f1057fe376a91b0be4879f1845c919934209277d2add57d43dd1e0b1c9d356ffbc23a0546cb260c58f5bd8ce951f8d861333cc485d6e5ead0e045bd56c8a4138bb69fd72a455a48b24f65f69a2d44bfb28b2b75dd522e5a0433d075028c60709043d147f347c7874c5f6a9c8584bc77ed884a229c39ddec516d4ca3be4b9474ce0decbc85a2e6c9a3df3e83606b5c86c5967ac3618b16753bcd1bc7bd6c96bea15420b7d51247d353e4acd52ad3e5bc2350d68d4b052af971a2acfcd2311e415517e8625ebf2f5fa8d14d075c05acfd2c0ce164139d3c11cf7d5d4bc40b52ad6af1aafc9edc8cdff04565f3f2f65c682ba7760ef333caadd4ef104e54d4e93178fbdb0f4d878ece019a5c405744db23c0997789895aaad2ba5545caa35c213b9a7575390a7d213a573f7c0475920e0f4a544bc829571e896c23385603a6ae8afea3acf1459f5998cb7e663abfe43db7adcbc3a3c0ba642317e4db7e42c0ccb7cd37e7e8769da3d9b19cccb1c6ec4c04ed4de5383bf0372adcdb19038d140194c27a51696855081b688d513e9654b47b125572b68d0ba99dbac5a50b2cf62a0dbfaea78f904ed3fcaeebe7e16744c28192ab8b18fed06341fd643c71d1e881e953f2e4a68292fb7bca2523db2ff0b48a0a50586b23b6cc773190ac91c0b0f88671646802fd44f518d4f5a9e81b658a990078dfde098a62b28165e9e2b58ec009448556c239fc45193aa192db5a0c0c72adc79c5e3830d2910bf44b9bbf2065993b530ec8e624305f84f59c327d0a8cc036c5812a78d1755e4e787b210ad27bc138095c9c2696324b38edb1a020566a3ec3335abae5f862acdc4fc4e0322825bcd7f5b9fb1e527b127b81d66fdae45a00e85fbfba864c1af7b6df97d95f0c5c37c727533bf351fc90209a68025575ec72c80f4ee7404e4fd90bbe3ab7f73a683031a23cacfbe7545bdd20bc4f2861b5dc98db2474d1ce98e8207f50ea7dd7c552d563e37e60b657bfa16800c2069e607f719e1580e0508f4cd916c8e216b4658287e71cee0e0a80604660241d0d1d47be2cec37d99e03ba30d5e0cd6754b2143bfd3120a4f0515db6972e4b04c69b3ae36a1b1291d754f5b6cbd7ae650c685d518a8629eb0d57808b72590b97a16c1d81962cc722562235ffccd241604dcfa7e7c1e1c22ff6f5a17593b46c7e27673aa768be084fcfe134172a592c06750987e32a9e42a83264c6744728902c250d5be6564f7f3355b9352577b15c89cbfc1fe4766d98ca37b776622732e41d6b5d1b969c02ff8c9311eb68c358e06ba903f0db1664f08486a9e71b4771f8fa9c34f215fbf555fd57501a7c40b8aeff0ff529830470c39b1285a85a74fd3127d6c9dca2a0caac2f6ea7d1248aba6b8dd6182322e9d3078dd5e87be7ca2a455f46cb2f77d80aada9f9b7984b35fb7b4103272af76cc46bd8186200691ccdd224ac1733b6d7785a1f7553a35b2ad3a01cfd58848ed65ec19534d2c0cfebffa2ce65c0f257b1e2f14da1d9deb22c1efacc5899f29ef60e3fb4675b3b0af576ca6cc5d868b86091bfdbaa59a822eb8da721fce7707f2cbf80324c050a6eb8bd347612818c25aab6fc7ad91505c27882c45f5c9aa68739550865678618ba2b03f3c99448cc46ba078801abad15c4eaa263feefe71e539fe8af1622d55d2446750900c21332b41e712fe67cf946b35b1c622b22c1e1da0bb5f0645fc272860e271889d369f601d2c43b59d72d8d5f3a1cc68034330193da0406af716b3801bef2ccc0f3c28afb2228ca57dc15b1879604d23c99bf0b512a14a799915e13756be24aa3b2c8f3b3d291494da6b15a20e87db85ffc717a192abaf6bad5cd0344c32b95a6ab5dc8062cfbdfa1f5b42f99d6a4d1c972db438a3eded0ff58224a1522402bf7e990581f7b2de7cdc8118c10fbb2de2f1eea0465f98136b02d08104f5126827dcd37dada9a4f51679731cbc646572240de6fd306bbd4a1f9d25990881b742a65cb6a2c4cb3f0776e879d85e59c7c7441894c308e287c277f074d22b98947208b662a8e7711a8386ef756ec777d628b7e1a5a065d425119625b336d9ddbeb4887387eb838198af9562d94f7ea475ab0d485f35e7c6f7b9e63015d9fb4822e2a31dd4fd99da6c98099b16cc3fb5aaf6e75c4e4ada16022ad40f1b32109098f0f7e719bc5075670120ef9abca543e1ae15a98dc4c0824962c5bd34f1bcf1e19958f29c9242ad3d6da6552a6f19e0f2eb97bbede80a1d93489a58a71abf9c42c041894a2432b84ec78caa6e06d7010ad813f2f0497b4e3e705f03fc88aa8dedde78a3652a0dbde43a0bc13c0634b2301337fc641c6b1395bd4963a67f1a7b5f9158801c0b794e9ad2243d3a11bbc971630730fbe09124af3b4deb9c2a87b5c66d93a19f204911fe847c1d8bf700e3730692d72d699bb36a1ea747401c59534a1e8adff967fb1143edbe2876105e620904a9521ef05e19d21f050dc364f12fe4b14552d424a0873e78d3a1017127a66e61d0a28eba3798645dfa37f0e810a7063b02088f7a8bc1280192a3a48668c256bba22405365d0cd56e461c16c31c88b4694c4b49eee2edc6fe0038950ae45ebe499c9c22b6cfe2eda765bc09ab8b090cbefad4e49c9b2da938c55cb3bf941fea668adc7aff37d303c761a18ca65d9626b4143f812b86a563d34acb199f96316973de3fbb07bcb96c50e767927152666c8a7eedd8e47f3ad190dda5a5a01c85c97c29853554af663caac7a761dc64e0cc30e1a1357dd844032c18cf045d3943e2a85f8241e57fe2256a874d9f90ed124b9ae26655db133fa980981a63fc81bfc66e2c71dd2ad3b85c638ae4c17e9215a4b06060f4e2bb9e2148077fe521beb8f628cad916dc062849b66848732c0abc187717324a762b511beb4d70a5b85fe7cfbe1ca7a9f54fb1d2bf2645da7d642776df2f290f89b8f5bc6ad01f6b95679234c2b1ab8030b4d9a6ac2f15119052064062677199bc913b7bf7437b8949613500f31b491ebeb29d587e48e18fc4502d10e24da399ca759fd423b7fb5e32e93e443b5ea10442aed00728907ebcd59178cbc2657ad1fdb4f92612a512d7ac51445103466bd5e30213826ce884c0643c5e460b0573aa670dfd2ec85536ae39de6eb9e022d1eab1cc16b4632f1458aeeb27215b4cc5ac4ea3641c302bc453d3421d2683964783c0eea9fdf3e43e9a7e78e0511eef497d57796e8a80a1c5f57d480379abe05b4086076bda6e34a4a96dd685268ac969fa5fee05adc6d3f33f740f7dc2ab4f459ce62a9570c3338d8dff0caa065a9e160fa407939e91e79d5638e06e2b1f314d1a6da38a14c27893845dc44c43791586d021b8f352794e31873937c1681104f52bd154f699752e34639af0677003fcabc3aa7fdb9eea21ec67f786a6e9b30653daf6d74a0d1b40cebf7bba9ea89187a78fe62f74ce08612688a13450c2675e8731a1dfa2a18ccfafbd62b55e034cd72a087011ac4b48c89c44548426c4d0e78073e23b11c5906ae1dc0bcf0422cd20a4fd70562fe9fe2e48b3efe0549aff9a07cc680810b40498bd35a53aaea7a5706f2c02fabf39da998adeb70341", 0x1000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:41 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0xfffffffffffffffd) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:41 executing program 3: r0 = socket$unix(0x1, 0x7, 0x0) r1 = gettid() fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x1, r1}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000180)=0xe, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = eventfd(0x0) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000000)={r6, 0x0, 0x2, r6}) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f00000000c0)={r6, 0xffffffffffff2f4b, 0x2, r6}) 14:47:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x80) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="6d22fe41bd349b152ce5b7346e00a9639e76926f0afbf6ec03cb48dfaa0d9d24bb66ef21cf8437918985c82305"]], 0x0, 0x0, 0x0}) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x404000, 0x0) ioctl$DRM_IOCTL_SET_MASTER(r2, 0x641e) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 1558.149565] irq bypass consumer (token 00000000061184cc) registration fails: -16 [ 1558.166594] binder: send failed reply for transaction 380 to 31183:31190 [ 1558.174730] binder: undelivered TRANSACTION_COMPLETE [ 1558.180021] binder: undelivered TRANSACTION_ERROR: 29189 14:47:42 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x440000, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_NR(r0, 0x4008ae73, &(0x7f0000000100)={0x6bd692bb, 0x10000}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x0) r4 = getpgid(0xffffffffffffffff) move_pages(r4, 0x1, &(0x7f0000000140)=[&(0x7f0000ffa000/0x4000)=nil], &(0x7f0000000180), &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0], 0x6) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:42 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) r4 = shmget(0x2, 0x4000, 0x208, &(0x7f0000ffc000/0x4000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000180)=""/80) 14:47:42 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0xffffffffffffffff, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x2) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:42 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) r3 = syz_open_dev$dmmidi(&(0x7f0000000380)='/dev/dmmidi#\x00', 0x7, 0x800) mq_getsetattr(r3, &(0x7f00000003c0)={0x1, 0x1a55892a, 0x10, 0x7, 0x400, 0xffffffffffffff00, 0x0, 0x8}, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r4, 0x84, 0xf, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e20, @remote}}, 0x9, 0x4, 0x8000, 0x100000001, 0xf7}, &(0x7f0000000200)=0x98) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={r5}, &(0x7f0000000280)=0xc) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) fcntl$getownex(r2, 0x10, &(0x7f00000002c0)={0x0, 0x0}) fcntl$lock(r0, 0x26, &(0x7f0000000340)={0x1, 0x4, 0x36, 0x9, r6}) 14:47:42 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = accept4(0xffffffffffffffff, &(0x7f0000000180)=@sco, &(0x7f0000000080)=0x80, 0x800) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x4000, 0x0) r3 = syz_open_dev$amidi(&(0x7f0000000200)='/dev/amidi#\x00', 0x6, 0x20000) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f00000002c0)={r2, r3, 0x4, 0x0, &(0x7f0000000240)="bef8f76413c47f62c7b85e8f74bced6071ca16a50a77b110ef33f0717b52c313d89e59a3d0f4dcd61361f345703d10b043aa05f7fce40519b42f0ef9a162c7c02b20be460e624c856ce170e5e23129031e64ecf7d527f398169c4963aa5dcf2448", 0x0, 0xff, 0x8, 0x6, 0x3f, 0xb6, 0x1, "1ea3f5c8082d3d2f769f3b4d5cb83dcb5e9037184ba87995b229af63ac2352bd9e674a0b147c11d1c578a960be0da12c2ba1b645a02bd1ff0814edb307b72e5a01fcd7ef6b09a919b441aca4c6fce58144"}) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = eventfd(0x0) ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f0000000340)={0x0, 0x189b}) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000000)={r6, 0x0, 0x2, r6}) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f00000000c0)={r6, 0xffffffffffff2f4b, 0x2, r6}) [ 1558.861065] binder: 31238:31239 got transaction with invalid offset (1556896083647275629, min 0 max 24) or object. [ 1558.871960] binder: 31238:31239 transaction failed 29201/-22, size 24-8 line 3035 14:47:43 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)=""/176) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) [ 1558.968946] binder: 31238:31256 Release 1 refcount change on invalid ref 1 ret -22 14:47:43 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0xfffffffffffffffe, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) fcntl$setsig(r0, 0xa, 0x4) 14:47:43 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rtc0\x00', 0x301882, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r1, 0xc0605345, &(0x7f00000001c0)={0x401, 0x0, {0x2, 0x0, 0x3ff, 0x0, 0x1}}) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x80, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f0000000140)={0x800100a, 0x401, 0x1}) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r4}) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r4}) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r4, 0x4}) 14:47:43 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$BLKGETSIZE(r0, 0x1260, &(0x7f0000000080)) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:43 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x4000000004, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x4000, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r3, 0x84, 0x21, &(0x7f00000000c0), &(0x7f0000000100)=0x4) [ 1559.440879] binder: undelivered TRANSACTION_ERROR: 29201 14:47:43 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000040)=[0x0, 0x2]) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) personality(0x410000f) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000000)) 14:47:43 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup2(r0, r1) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e22, 0x3, @local, 0x5}}, 0x60000, 0xc3, 0xfffffffffffffff8, 0xa6, 0x7aa6f73a}, &(0x7f0000000080)=0x98) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000100)={r3, 0x48, &(0x7f0000000240)=[@in6={0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, [], 0xb}, 0x100000001}, @in={0x2, 0x4e21, @multicast1}, @in6={0xa, 0x4e22, 0x40, @mcast1, 0x2}]}, &(0x7f00000002c0)=0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = eventfd(0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000300)={0xfffffffffffffcca, 0x202, 0x25b, 0x8, r4}, 0x10) fchdir(r0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r6, 0x0, 0x2, r6}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r6, 0xffffffffffff2f4b, 0x2, r6}) 14:47:43 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x6, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x8, 0x0, 0x6, 0x14, 0x11, "fb6acc1efc8518dd15dc92eb93b5de3bac63270dee615a3d07d844c0d521fd1e73b7dba874b229d9f843c2dd5a9ae40858f81e97b5511f96f6e9ba0e692a9429", "8295081274804be88110357d8cc913c64a143f816f24e6ab405e58797deb1e4567ab16ff7a6c0481622f225a166f6987ea8bb1ee1045532f167d2b225f5aef1b", "62ed4f8cac2aec7e6d88d53c80c816f5572d37c7a52e7e6dc60696e6ec0ad115", [0xecd, 0x81]}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:44 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0x6, 0xfffffffffffffff9, 0x9, 0x8}, {0x7, 0x0, 0x9, 0x8}]}, 0x10) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:44 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$dspn(0x0, 0xb9, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f00000002c0)={0x0, 0x5, 0x1, {0x1, @sliced={0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcd]}}}) r4 = gettid() timer_create(0x0, &(0x7f0000000200)={0x0, 0x20, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) ioctl$VIDIOC_STREAMOFF(r3, 0x40045613, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$VIDIOC_STREAMOFF(r3, 0x40045613, &(0x7f0000000040)) tkill(r4, 0x1104400000016) r5 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r5}) ioctl$KVM_S390_INTERRUPT_CPU(r2, 0x4010ae94, &(0x7f0000000180)={0x9, 0x6, 0x9}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r5}) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000280)=0xd) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x8f) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000001c0)={0x3, 0xb, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r5, 0x4}) 14:47:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0xfffffd91, 0x0, &(0x7f0000000040)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1560.453818] binder: send failed reply for transaction 386 to 31273:31279 [ 1560.472079] binder: undelivered TRANSACTION_COMPLETE [ 1560.477358] binder: undelivered TRANSACTION_ERROR: 29189 14:47:45 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x1, 0x800) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000200)={@loopback, 0x0}, &(0x7f0000000240)=0x14) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={&(0x7f00000001c0), 0xc, &(0x7f0000000380)={&(0x7f0000000280)=@newqdisc={0xd4, 0x24, 0x108, 0x70bd28, 0x25dfdbff, {0x0, r2, {0x1, 0xffe0}, {0xfff1, 0xffff}, {0x8}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x8000}, @TCA_STAB={0x50, 0x8, [@TCA_STAB_DATA={0xc, 0x2, [0x3, 0x6, 0x4, 0x6]}, @TCA_STAB_DATA={0x8, 0x2, [0xa67]}, @TCA_STAB_BASE={0x1c, 0x1, {0xd0c6, 0x5, 0xffffffff00000001, 0x6, 0x0, 0x2, 0xffff, 0x8}}, @TCA_STAB_BASE={0x1c, 0x1, {0x2, 0xae62, 0x1f, 0x7, 0x2, 0x7, 0x33, 0x7}}]}, @qdisc_kind_options=@q_codel={{0xc, 0x1, 'codel\x00'}, {0x4c, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x9187}, @TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x5}, @TCA_CODEL_TARGET={0x8, 0x1, 0x87fc}, @TCA_CODEL_TARGET={0x8, 0x1, 0x3}, @TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x9}, @TCA_CODEL_INTERVAL={0x8, 0x3, 0x7}, @TCA_CODEL_INTERVAL={0x8, 0x3, 0x1}, @TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x3}, @TCA_CODEL_LIMIT={0x8, 0x2, 0xffa}]}}]}, 0xd4}}, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x0) timer_create(0x7, &(0x7f0000000000)={0x0, 0x37, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)=0x0) timer_delete(r6) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000080)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000000c0)={r5, 0xffffffffffff2f4b, 0x2, r5}) 14:47:45 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0xfffffffffffffffd, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = openat(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x402000, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f0000000240)={0x7b, 0x0, [0x7fffffff, 0xff, 0x40, 0x4]}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) getsockopt$bt_hci(r1, 0x0, 0x3, &(0x7f0000000100)=""/200, &(0x7f0000000040)=0xc8) setsockopt$inet_dccp_buf(r3, 0x21, 0x0, &(0x7f00000002c0)="338e2c754b4b45cd65f3a6c629ff0b161f0f66b9a0058c539529127587ab0de32404", 0x22) 14:47:45 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_dev$audion(&(0x7f0000000380)='/dev/audio#\x00', 0x200, 0x20000) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0xfff, 0x1, 0x0, 0x4, 0x0}, &(0x7f0000000400)=0x10) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000440)={0x0, 0x3c, "3c7a9b60c94596b29ed2cedbe0e23fbddca36a6b1d5c35cf159be238dc8e50b29508599b0b5bb44946cdf64fa9a664c5822a0c041599ba2587f51cd3"}, &(0x7f00000004c0)=0x44) getsockopt$inet_sctp6_SCTP_STATUS(r4, 0x84, 0xe, &(0x7f0000000500)={r5, 0x81, 0x9, 0x4, 0x3, 0x9, 0x1, 0x5, {r6, @in6={{0xa, 0x4e21, 0xff, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x1}}, 0x6, 0x9, 0x0, 0x2, 0x100}}, &(0x7f00000005c0)=0xb0) r7 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r7, 0x9, 0x0, r7}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r7, 0x0, 0x2, r7}) r8 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x40012205, 0x0) getsockname(r2, &(0x7f0000000180)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x80) r10 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000280)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r8, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000202}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, r10, 0x800, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}}, 0x48800) setsockopt$inet6_IPV6_PKTINFO(r8, 0x29, 0x32, &(0x7f0000000240)={@local, r9}, 0x14) 14:47:45 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x0, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:45 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x4000, 0x0) ioctl$EVIOCGID(r2, 0x80084502, &(0x7f0000000180)=""/162) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$VHOST_SET_VRING_ENDIAN(r2, 0x4008af13, &(0x7f0000000100)={0x2, 0x9d}) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0xd000) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000140)={0x3, r3, 0x1}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0xffffffffffff2f4b, 0x2, r5}) openat$urandom(0xffffffffffffff9c, &(0x7f0000000240)='/dev/urandom\x00', 0x2, 0x0) 14:47:45 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x2, 0x2) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r4, 0x10, 0x70bd29, 0x25dfdbfc, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x80000001, 0x6, 0x20, 0x8}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x4080) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:45 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r2, 0x4020565b, &(0x7f0000000080)={0x8001003, 0x7, 0x1}) prctl$PR_SET_FP_MODE(0x2d, 0x2) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) [ 1561.506165] binder: 31318:31322 unknown command 0 [ 1561.511088] binder: 31318:31322 ioctl c0306201 20000380 returned -22 14:47:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x2200, 0x0) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) write$smack_current(r1, &(0x7f00000000c0)='r}\xc1eth0*\x00', 0x9) r3 = syz_open_dev$sndpcmp(&(0x7f0000000180)='/dev/snd/pcmC#D#p\x00', 0xffffffffffffffff, 0x1) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f0000000280), 0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000100)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) [ 1561.598705] binder: send failed reply for transaction 390 to 31318:31322 [ 1561.606312] binder: undelivered TRANSACTION_COMPLETE [ 1561.611456] binder: undelivered TRANSACTION_ERROR: 29189 14:47:45 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f00000001c0)={@empty, 0x0}, &(0x7f0000000200)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000280)={'vcan0\x00', r1}) syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0x1, 0x2) move_pages(0x0, 0x270, &(0x7f0000000000)=[&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffe000/0x1000)=nil], &(0x7f0000000040)=[0x5, 0x2], &(0x7f0000000080), 0x0) ioctl$KVM_SET_PIT(r0, 0x8048ae66, &(0x7f0000000080)={[{0xd7ef, 0x7, 0x3, 0x27b72314, 0x9, 0x7, 0x598a, 0x5, 0xffffffffffff0000, 0x47670, 0x37, 0x2, 0x4}, {0x5, 0x7f, 0x80000000, 0x101, 0x101, 0x400, 0x1, 0x800, 0x7, 0x1, 0x1, 0xfffffffffffffddb, 0x3}, {0x9b1, 0x20, 0x0, 0x0, 0x10000, 0x6, 0x9, 0x101, 0x400, 0x3, 0x7, 0x0, 0x7}], 0x6}) [ 1561.946038] irq bypass consumer (token 00000000249aa1cb) registration fails: -16 [ 1561.966704] binder: 31340:31344 transaction failed 29189/-22, size 24-8 line 2834 14:47:46 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = accept4$tipc(r0, &(0x7f0000000180), &(0x7f00000001c0)=0x10, 0x80000) getsockname(r2, &(0x7f0000000200)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000280)=0x80) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) r5 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x20, 0x2800) mkdirat(r5, &(0x7f0000000100)='./file0\x00', 0x4) [ 1562.099748] binder: 31340:31354 ioctl 80086601 20000100 returned -22 [ 1562.236376] binder: 31340:31344 Release 1 refcount change on invalid ref 1 ret -22 [ 1562.332686] irq bypass consumer (token 000000007fb3c421) registration fails: -16 [ 1562.345582] binder: undelivered TRANSACTION_ERROR: 29189 14:47:48 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x4, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) r3 = syz_open_dev$cec(&(0x7f0000000280)='/dev/cec#\x00', 0x1, 0x2) ioctl$VIDIOC_SUBDEV_G_SELECTION(r3, 0xc040563d, &(0x7f00000002c0)={0x0, 0x0, 0x103, 0x2, {0x5, 0x80, 0x9a5b, 0x1ff}}) prctl$PR_GET_UNALIGN(0x5, &(0x7f0000000140)) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000000)={0x0, r2}) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rfkill\x00', 0x480800, 0x0) ioctl$VIDIOC_DV_TIMINGS_CAP(r4, 0xc0905664, &(0x7f0000000340)={0x0, 0x0, [], @bt={0xffffffffffffff81, 0x3ff, 0x120000000000, 0x4, 0x9, 0x0, 0xc, 0x8}}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r5, 0x84, 0x8, &(0x7f00000001c0), &(0x7f0000000200)=0x4) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:48 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x4, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000000)={0xc, 0x100, 0x1, {0x10000, 0x0, 0x20, 0x2}}) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) ioctl$EVIOCGABS3F(r2, 0x8018457f, &(0x7f00000000c0)=""/207) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="0002000000865a00"]], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:47:48 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r2, &(0x7f0000000180)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0x9, 0x3, 0xe8, 0xef, 0x3, 0x3e, 0x3, 0x19f, 0x40, 0x242, 0x101, 0x1, 0x38, 0x2, 0x2, 0x0, 0x3ff}, [{0x0, 0x9, 0x38169ac6, 0x4, 0x1, 0xfff, 0x400, 0x9}], "c58184144eb4d2fb2f00302b2f0d3e84d0f9e1253537be38d23b85e52890a83983852bbfedfe5072231fe160f82da4db01dcf20f8e88e4b619f0fb2340bbe6ebe4dcd0c467ece720937f60048aab55a1c57b2ecdf5d6d3bc6b73c2bf0a7e846fb16da0caa726036b4a", [[], [], [], [], [], []]}, 0x6e1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x7f) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x400000, 0x0) 14:47:48 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) r3 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2) accept4$tipc(r3, &(0x7f0000000100)=@name, &(0x7f0000000140)=0x10, 0x80800) 14:47:48 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x10000000) r4 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x7, 0x200) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r4, 0xc034564b, &(0x7f0000000100)={0x1, 0x3436324d, 0x2, 0x2, 0x3, @discrete={0x6, 0xffffffffffffff00}}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) [ 1564.152520] binder: 31364:31367 got transaction with invalid offset (25480082462081536, min 0 max 24) or object. [ 1564.163669] binder: 31364:31367 transaction failed 29201/-22, size 24-8 line 3035 14:47:48 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) [ 1564.209308] binder: 31364:31367 Release 1 refcount change on invalid ref 1 ret -22 [ 1564.243157] irq bypass consumer (token 000000004ede7d85) registration fails: -16 14:47:48 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) move_pages(r1, 0xa, &(0x7f0000000180)=[&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil], &(0x7f000026bfec), &(0x7f0000002000), 0x1) 14:47:48 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) iopl(0x8) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000000)=0x3, 0x4) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:48 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) r3 = shmget$private(0x0, 0x3000, 0x8, &(0x7f0000ffa000/0x3000)=nil) shmctl$SHM_UNLOCK(r3, 0xc) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:48 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhci\x00', 0x80040, 0x0) setsockopt$packet_buf(r3, 0x107, 0x5, &(0x7f0000000100)="039c11acfe8191cc87bbe63fe69ea70b9d235a2c7e6f82ce58d59bdd96cd8f44f11d968d27031fe2e75fbba243e47293e1cd11318c38a23ed691ca068c5cec079b5db69d052f75a9ab9563f46a6dfbbb31728448ea5d6de3c084252442e162b6e96d6722af7252bcc64de3", 0x6b) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:48 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:48 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x1, 0x2) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0663044001000200e46706f90d312e3da0b1d3940099933e7c6372ba27b5e26f19ec607d87000000003827e085906635ab6a2e25ff1e1981b4d4afaada0506aacccc5bd6c2574233bdd3a0f1b164422d3f00000024a3127d7a3dc226875a9e8ba47c4af779e8d4a931bdf5eb508aa2c2f351dfe020839b774981d50ba9060000009ce6165d05c371e26563f4756a23405594b7ebfd7bb8aa2e87e0dc958ed4236e77e41126274847c19bb43b9659719d1940f397ebbf3a7ad88a88323cffab687d0d4e8c37631a142b6ebf810695848c0602000000000000006756495ff66a7124cc22d6e0b042d43b67ae1903a2fc1aa895c5c84a0fed49d152692b57dd938bf1148cd9b2ce80ccf6accceb074d7e6fbfc8aacddb2e2046611474c42661d729ad289df63bd34cf5f58937aa77c828512f4a5828f7b80c17cf341f9eaeddcf5e4b6b8017c8de3a708b1e541a855dae271059f7d3fe71610f4321dd96950b18dd"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1565.079886] binder: undelivered TRANSACTION_ERROR: 29201 14:47:49 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x6, &(0x7f0000000080)=[{0x2, 0x20, 0xa7, 0x6}, {0xfffffffffffffeff, 0x1f, 0x8, 0x4}, {0xffff, 0x9, 0xfffffffffffeffff, 0xde2}, {0x4, 0x6, 0x800, 0x1}, {0x356, 0xfe55, 0x100000000, 0x2}, {0x1ff, 0x8, 0x5, 0x2}]}) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ashmem\x00', 0x101202, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x4, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:49 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000200)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200200, 0x0) ioctl$VIDIOC_S_AUDIO(r3, 0x40345622, &(0x7f0000000140)={0x2, "9d0a7784714ecb9b9c40c82ae4286517a9c6f3f8eec842f74a3319e96bb021e9", 0x3, 0x1}) r4 = shmget(0x1, 0x4000, 0x54000420, &(0x7f0000ff9000/0x4000)=nil) shmat(r4, &(0x7f0000ffb000/0x2000)=nil, 0x6000) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000180)={0x0, @dev, @multicast2}, &(0x7f00000001c0)=0xc) [ 1565.410220] binder: 31415:31416 Release 1 refcount change on invalid ref 131073 ret -22 14:47:49 executing program 2: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x100, 0x20000) ioctl$UI_GET_VERSION(r0, 0x8004552d, &(0x7f00000001c0)) syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xffffffffffffffc1, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000014c0)={@dev, @dev, 0x0}, &(0x7f0000001500)=0xc) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000001540)={r1, @local, @broadcast}, 0xc) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:49 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x0, 0xa440) ioctl$KVM_GET_XSAVE(r3, 0x9000aea4, &(0x7f0000000240)) r4 = eventfd(0x1) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r4, 0xffffffffffffffff, 0x2, r4}) r5 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x0, 0x2) ioctl$DRM_IOCTL_MODE_SETCRTC(r5, 0xc06864a2, &(0x7f0000000180)={&(0x7f0000000100)=[0x2, 0x3], 0x2, 0x0, 0x7, 0x400, 0x7d9b27fd, 0x6, {0x898, 0xfffffffffffffff8, 0x100000001, 0x8, 0x5, 0xc7, 0x6, 0x2, 0x4, 0x6, 0xe, 0x5, 0x6, 0x2d, "eadaeef7c3ab56695f920187e246d3a97194a0e971f1f7f204e9a486404afd49"}}) 14:47:49 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x40000402208, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x40000, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r2, 0x7, 0x1ff, r3}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0xffffffffffff2f4b, 0x2, r5}) 14:47:50 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x20000, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) write$binfmt_script(r0, &(0x7f00000014c0)=ANY=[@ANYBLOB="2321202e2f66696c653020766d6e6574315b766d6e657430402b7365637572697479202076626f786e6574306574683125b925776c616e316d643573756d76626f786e657431205d76626f786e657430707070306e6f646576202f6465762f736e617073686f74002035206367726f75707d0a94c08f0666af6b8a68c64aec576ca95a979613e53505681489e14849dc6a713af76614a77b711063f94288b7d3f45330fb500ea22a07923a95399bf1cf0d0d7bbe22cb5a77fd04898852ef035be4d2bf5550457969b16dd2dd9a7c5f47226a2775bcb196e32707d6020b4bc59349218a62adebccbe35da50f64cff3ed769a439781a432100318cdda7b51772c8f3bf304be33af6be8530f2614f272255312b8411597624a4f4bb7f88a6b8916b4204eb1c332816c14900d61fd21ba388b6f2d9c0c1ac760ee62cc03335d54a024849f4e04ff8ae7eea5f24fdbaf6a7e1f2dbe90c0596d483bd295f49c3aad7bdb22dc5422296a3a67390ef9506fdb158944110b8554911c74fb9af189676c0e8ab0c942656c0f3127d8e93b63facee11949a9a522a12f320e54193edcf5f8d97dcdd62705a8e76b6027240a1e4bcfa4559cc1c5066ba7fc37d7d14d59cac3843295feca80e9f0d5ee0b75880b8e30ec9e77924064e453d5c50e46de65f2f93e4144f6251de793ae3fb1e55f5e3a832aa43439dd437d1fc6fadaadbbbdfd01fbc9dfa7d51fa9fd31cd757b3a08a4b8ff14d663a8c471f5a690934cb804f3fa5415f224fb11616afb12d3410d24113214f613469280cf7a79356cc0b90fa18d7cfdc75457d63d206400ab6cf4a0a8f50b97eb6c728e05edefe6824ff73d2b4b8c65b617ab906ffa46bbd0dd79f6f861890053d6b02dab0e2bff3d0619a97d2226a034362ce9e74f92bc22f0d29189a664d82018e7f5d5db174b42294bd02f97af2f2740b70bc516fa06dc70af66953b363b1e1dcaf94c551347b2779a05578e20237d20f516c8e55646819dff2dd85df5abba8f3ad381405bcca6b201fcaa53a7b734111bb19347b43c5646e4e2ea90cfd564e47c86586f4abf45f17977e9a7b27fe733eede3d9fc0302e73f1557d09f2cca19b9a01c5517d12061e005908da673c40cbc8ad2c0880cd6dc1266fcaf87c7ac87980c63adfad7b803361c1d06a66b70ec971614d9b6dc6ea7c3578f39ef407316ee60c185d237cce75d84627d584478af01ab62d71d642e5a854f9af509e9f1e072d42f2aa398273c967d5700f25a95f1599f2bf0722bc0c9ef33b53b5bd95cdc03237b1582e057826242fe639daf9777e1de770bdc9bd3d91f4fb4a9db6ccedb81100791d42dcacc11cda1401165917624fe45376cc4c56abc809d06d17743488b659a7d55a41d183176699d6e8b6650ce4a6e2b27834b5d225fccb9b7cf150e933ccd0d54608459523eaebc40e8dbb8bfa257db3cf61d3501fc5379e0d5f41ac4a5a8639c7a8116bcdbc19014c98cb7c2c73f2ab3f88978e198e89f568dede9120bd00f1dd9f044c3719590939b170ed877859d90f5f50ef91ac450b0eaae0ec1cee8104863874962a228aff68d3bf067e90094a1aa8f8088e7d0f16fa6abb33b49cbbc402798f9dad48e3f37690c419289ebdfdcd1cc380fd791794f538ffe1a6597d384c9f8cc5aea4b8c0a374fa25a67f681568c9626cc6cd24f1c1c655e9fc23c560944bfd34cf2036c6f37ce4995880fabfc913ba16b8053b9d117a3fd79feae27f75f9427045452c071d4baa6162ad994a817d42a424a11d0eaf18cf5cf2ca81fa0dba5e01b245946aca944207e508d3daec2288e50bb916120f2cab7675368a810b71e97d55674357b17a8036b3033fdc7059360099a61a0eacf728065fadc45e77e63a998ac3d231acacfffa42c3f4c53e23d5f92f21aa28deaea5ed73efd794885550da578b54077ae5eedfca4a8e4144b4bc75eba72c8dbc1a7f490843e1866c20b6f861975766533b3673e0d0a54c81603aa5fd7831507e3f0a44ef636e5b695d403542cdd38e4c04026152e3f4db0f270bb23ea243bcd7e4d3d031bedc9b92274f4ab2ee92b9495cb670a02995aba379e4422e7e70d566118401dc5b3b34323ced11fc38146146608fd9da5ee2153b729845aba8fad99ceb1bec9913f5c74ff99366d40adae7f81686ed3473784ba74b5c52fd0ce35b37a85c63086e1616a788f395bf1fca2c7b168efb6ad8ad46cd621db18725c45acbf5f336906ae89a2e51dc5d77338d02b502040cbd32603c832dc86096466f4f230d8623b713a94add73c909d41ae5b8b69a2aa002e1a397066ba5609f9f195156bc82293a408445f956108a31f4a8791687869bcd0aef210f03bed086eb8cc04531cc5730e1d282db95bc71cf56717b11ef2c81bd393c7dbaca3ce1d197c8e2293ce01f5fd3f87b1383bd35d4c991ac8096fb52603af8f7349a3fddc7b2059d13f4807b1d5bfda8153317919b1261e7663a3aaca08a48f84105cdda9b03cd19aa3652362347873ea4b83836fa64799e5e870e5e00830109d41c97a4701b7333c3d6c81c41a4e4031def3a519fab9afabceb96aafe1ed64d5823301fd262f6b32ce1a6765755d429b57a1760f5f0fe84323c1b845f06d73f2c6df6e12f8aa63aa129e375157b3c8afe857d5668c4b2ea2ce4d56200afe69d62af18ffe8fad7e2f6cacbd6f3453c7a2cf4af2f66ba205c0345703e8de64991695717499d39a4692d396d352c1f2b35a700b6b18eeba3698f5019c7dca07194ddc4c30ba4946d259f43d8081cba69de253d3fcff9a8dd01475db6ffe003a651b16517fb9291651f2858c84a78615bc2987f085fd90519dc62e026707f1a000ee5b255914b00a86e92191daca7a51a18129655b06a76e93e11518332673261388ccb85dffd2958d6b255f974dea0aca6a577967bf6ae89f40939f84c1e2e001f37502c27739be3bf5bf34c2674c86dc8628395c8658e0bf19cc9ccb252e069d9f10573bad7ca0bd97c3a52a261937a5f8ad3b943341c878985d8d24fd82dd952a1960e60ec27d48d16a80b545d6b7893d4301136a17010ac3dc2c0bf0d83b015044b467b8cddedbd5eb857744b3b18a9cdfc74dfaa338003b85036f368d332d48074847fbb52f6892245ea3467ef82153bd430687c34337686f6006a3146faee241e93504a3bad757a5dd54d9bad0e8582c068d6cc198ce1df7d8a94a1a9533e456414b4c1a86b8b4784df43023c434c7c908c92731c987150bb460dbbf7791293361a12e64f307aeaa1e87e84c77d6a2fc155b5bdb4db6e63c64a89fffc0c9a4ebaaaae1d81b0fbdb7f6422f8ceb849178865ea020eafa0c8f6399e5ca80ff4f7074bde0f5fe2859feb40dd64bee1932881b7da151bc318762a986325729d4e6c1278296eb7505b604de523f4bc20f731dbf7ae1c87228168ad43097333b8d0b7044ff399a8234d8de4391814e1bd658f2bbc4c7c8b522fe97a3cb67b227a3517c4dda46a406e312d9bc54c7e955e2159fddafd347e4d137df7b7fae44e7cf4c444d4195344172a4142ccf3af6dc117d2c34dfa0a7a87a0caea9c6323d53e77ec9a0a06106072aa1b4ca2b6a3dceefa4f0c25a3906511eaeb614cabf373c121013fac2126e04237c528c352b825d59e4fd2f613bbc34077d891a1c8722b293edf47bce84712d403b73c10b2eb5bbea519571a83b3275e23ec01ffe34cf8cd9e0b6d19a0faba7d31b9e6a2d13376c0228b4cb7b654e88df3d7131da81fd5f77e6ebe51b5037de2756e6f9f6713c22932b6029e6ed7f8ab5985588a0341f4db68476e036b39f0368e84b4d3c7d1d0fc2b644cdca571a599b0074a969c088ebbae6af2d684167854ce5a4c1cae49e571f518c11811b0e1d9e40a0feb9d6a57f80fb7686eb72518fb53bb895c05666cd25134d57b758973e054fd0201da876f72d563294ecad7f837e669126ee79e4c8f0c646179a43990642afa52301b89d6a17f7ed37bd0f696fe3420d5a5b49b8588fd05319818556a56d92dc592f4a9a30409bcd323404f6948cad5adef3d7580b0abff481e7901c404a37141c0c26c3e8a04092e1bdc2c1eb2a5a8bb54f21f90454a2e87ff9ccd932bcded0fe46ed8bc896358a55fadf5955368a5cf81a27f8d30274fc4641f79eedc564ba8e99f53105c67fd60a0bbf088e486d8f98b82c1fa4de2e0bd580579d9a10f84be43307fd1c5f322a02adc05542b29ab58180b5afa11e42022dcebafd990caf8f2af3210d723de1780fa76d9114d3a21ff23d0499b4f29ebaf167b4e479a64010e92cf492f3d895584c9152dbcb16e49362a26cc34c501f11f75bb563a182150a5c8ea0a0881a6d14205d3f497c191c6bf9eaeb0e7f80b6d49c0b04f43aa7c3bd8c08a03188a5d41d95afb6c7c84a81bfac932627acae6ccfadd3dcac71a03b572011302a3f8ad45f94e2ee9747e2fe023f864af5b38d9003ec1bc413e099e06f5674875e0b14679daa9267d1fcae0f6b0629c84ae5ad9365ec91b61461d2c0a478803dda8bc0f6efcacbb224de293825c6bd4eb11b575cf07e463d35ebcc088d8dcc87b9f88595ffa5e42bfe71b5ae6278f86a73004513fda568fb48358023cb90027e14278809281e7d069825eff2a9859b3043a19e9e0b5ffd26f747ac292bc0265d524f39697ef1a507b84d62f18d4d664a0454a91d6323a4abab77cc8b8efc232a577d33004c7a38c33aaf8726d7d4402cf7c0d9a77e953c6c5ce7bdba1a25d08f6a8e7bf73dc00f5c94a97660597ee36e6e569bf22bd4ee46f5cd181ba2dc54091d5402e001bc5a525f2bd73161469af5f91b06d0ebfad87cf5d9f6872204f824b40cab7ac8c0fc8434f722a63bcb9f2ce0eedb68811e30e80d3e8f8b689b51c4f88b817bc69af0884aa00f2d9f9750d848e54bb478d75be8f36f163e5432ed8037515ce93dae410728604557bddcafc58b0d9b6d15f971bd5ebb4f86ada86584330a36d069f885c1517fc0dc1ce6b8fb51169b845069151bf35e89aa81427bcc360a2174a9161f05b53fb43cc2e3ed4501307d443eff4843a1c845add6c05464676387d42010e3faee5e11820c0eb1d2cc75c0362e1b34365c465f1650cbf64e9f35a252b62602cd802f8addac572a69445d2c36e8a474f4d63aea87498673766247ecf33fbc27c9120cb1ab7d444917566e7313d75c71bdf4e140e28eefe73b7e13881af1493921f80ef662810cef06a335c37f17d3c5f0bfdcbae033436bd1b485c3f8fe31d5f8b157c04e37fcc17871a6f8512899769df9ebdb664eb1c87a18d2b9aa495bc5f22fd66e197edb7ce234c4e25fd6597355e7c241b5ae31640ed1a0753818a76042ba0dcbbb8cd770b069e19e9cbcfbae9922244064559c239287120c8b4f1b1c3afa1d96af713e902ce88d6611f3ef5455f0824741c98f6ba63e86c67de9232a47b45777a825cf2bc864ad76857a880c2c306f82dd120f8dc6fa547fe854ab21cd5b4b39089cebfb39f03ed3aeb1b44dfa152d58b69dd3b47cb97dc7ab278dab2c41382b78d4b0d077ca0c654f16e368d340df973fa8a16ea0958a6ec08e1020ab6d7b0818b6cf1cdefc57ba06b02eb59509b6c91087529c5a951e2c00402630599a363d135f17b2da275078eecdec78cac5c972622b8b06dfcc7387f90d83ecd6c8d11d3dade8a6c2961ea3a4a421d7bbcc265e901d76ff31eedf3eaa20d2dea74c0a687c814e5e45fdac09f75748906d814a983456de9c693beb5c6436ad83f9393152dffca5756c77d2c78562aa0410aa105bebe15ebfc77e4476a4c034f77cb536da041e7954f7b4d9f4db765be1890204dd24508b535fd39b7de07dff4a5eabf04b9ec3ca0adfdc95d8cf526ac7152be5f6ba4a18b8324411b27dc5d1b90239c9691b9a8a19b6ad36c105aa70d14df486e50139291438da51315261a44e5a743a1655c09cdbc2467cf2cc9158e3ad1dbc149ea9712db3fc35c594937568b1bce0b7c25415a5b41a069385bd8799d28d15211343b7abf4b68ad67775f0a774a35d4d40875f567f41e0b809b3ab2d942425d51e3895eddd43d0cac289e09d0d7da266b15f557ee5c39d282c4141c54198d03118560d0f333c85fead4b7ce41598a090c5208d3e317c11e0289d34e61829d9c65d40f38b60a44dfe338adf3ef6ec88368387269829110c82d69e9b96cebf6afbc13cbd4071373adb2b98"], 0x1073) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000300)='/dev/snapshot\x00', 0x440000, 0x0) ioctl$EVIOCSKEYCODE_V2(r3, 0x40284504, &(0x7f0000000340)={0x59, 0x14, 0x800, 0x2, "46bb2b53be53a3a31159cafbd0a38ad75a7b6e7c6d7d33000fe64fe939a04fd5"}) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x880, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r4, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB="c0040000", @ANYRES16=r5, @ANYBLOB="2b0b25bd7000fcdbdf250a0000000c0005000800010069620000a0000100100001007564703a73797a31000000002c00020008000400f90100000800030004000000080001000b000000080004002000000008000300080000002c0004001400010002004e20000000ff00000000000000001400020002a228c591f9cdaeb700000000000000100001006574683a73797a5f74756e00180001006574683a76657468315f746f5f627269646765000c0002000800010002000000"], 0xc0}, 0x1, 0x0, 0x0, 0x8000}, 0x20000880) 14:47:50 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) close(r0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) [ 1566.277085] binder: send failed reply for transaction 398 to 31415:31416 [ 1566.289158] binder: undelivered TRANSACTION_COMPLETE [ 1566.294546] binder: undelivered TRANSACTION_ERROR: 29189 14:47:50 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) fgetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.origin\x00', &(0x7f0000000140)=""/194, 0xc2) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1566.421493] irq bypass consumer (token 00000000b9bbbb0b) registration fails: -16 14:47:50 executing program 1: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dsp\x00', 0x2000, 0x0) setsockopt$inet_udp_int(r0, 0x11, 0x65, &(0x7f0000000380)=0x1000, 0x4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x10000000000005, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000440)={r4, 0xe47, 0x2, r0}) getsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f00000003c0), &(0x7f0000000400)=0x4) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f0000000000)={r0, 0xfffffffffffffffa, 0x80000001, r0}) r5 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x66, 0x40000) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r5, 0x84, 0x1c, &(0x7f0000000140), &(0x7f0000000180)=0x4) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200)={0xffffffffffffffff}, 0x13f, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r5, &(0x7f0000000280)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x7ff, @empty, 0x800}, {0xa, 0x4e21, 0x8001, @dev={0xfe, 0x80, [], 0x25}, 0x9}, r6, 0x3}}, 0x48) ioctl$sock_inet_tcp_SIOCOUTQNSD(r5, 0x894b, &(0x7f0000000300)) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000480)) 14:47:50 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x1, 0x2) ioctl$TCXONC(r0, 0x540a, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@ipv4={[], [], @multicast1}, 0x0}, &(0x7f0000000080)=0x14) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f00000000c0)={@multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, r1}, 0xc) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:50 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000180)=""/129) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x3, 0x8000, r3}) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000080)={0x0, 0x3, 0x8, 0x6f}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:51 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000100)={0x9, 0x7, 0x3, 0x3, 0x7, [{0x101, 0x2, 0x1, 0x0, 0x0, 0x2002}, {0x101, 0x100000001, 0x3, 0x0, 0x0, 0x2000}, {0x6f7e, 0x3, 0x7fff, 0x0, 0x0, 0x1088}, {0x8, 0x7, 0x9, 0x0, 0x0, 0x2800}, {0x8, 0xffffffffffffffe0, 0x7, 0x0, 0x0, 0x2c85}, {0x3c74ec92, 0x0, 0x7, 0x0, 0x0, 0x408}, {0x18db, 0x47ff, 0x0, 0x0, 0x0, 0x3c00}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x18) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000300)='/dev/dlm-monitor\x00', 0x103040, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r3, 0xc08c5334, &(0x7f0000000340)={0x2e2b, 0x3, 0x40, 'queue1\x00', 0x7fffffff}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x1, 0x0) ioctl$DRM_IOCTL_MARK_BUFS(r4, 0x40206417, &(0x7f00000002c0)={0xfffffffffffff46c, 0x1, 0x2, 0xfc8, 0x8, 0x8}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:47:51 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x10000, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f00000003c0)={0xfffffffffffffffb, {{0x2, 0x4e24, @local}}, {{0x2, 0x4e21, @remote}}}, 0x108) write$P9_RSTATFS(r0, &(0x7f0000000000)={0x43, 0x9, 0x1, {0x5, 0x6, 0x4000000000000000, 0x4, 0x8, 0x7f, 0xa5c, 0x1ff, 0x73e}}, 0x43) 14:47:51 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:51 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x7fff, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000000)='trusted.overlay.origin\x00', &(0x7f0000000140)='y\x00', 0x2, 0x2) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r3 = dup2(r2, r2) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, &(0x7f0000000180)={0x0, 0x2}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000200)={r4, 0x4}, 0x8) [ 1567.586413] binder: 31472:31479 transaction failed 29189/-22, size 24-8 line 2834 [ 1567.622068] binder: 31472:31479 Release 1 refcount change on invalid ref 1 ret -22 [ 1567.643960] binder: undelivered TRANSACTION_ERROR: 29189 14:47:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='t\x00'], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$FIGETBSZ(r2, 0x2, &(0x7f0000000040)) 14:47:51 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000000000)) 14:47:51 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, 0xffffffffffffffff, 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) r5 = dup3(r1, r0, 0x80000) ioctl$KVM_S390_UCAS_MAP(r5, 0x4018ae50, &(0x7f0000000080)={0x2, 0x6, 0x5}) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000100)=0xc) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f0000000180)=r6) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:47:52 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x400000402, 0x0) move_pages(0x0, 0x8, &(0x7f0000000040)=[&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f000026bfec), &(0x7f0000002000), 0x3) [ 1568.305100] binder: 31490:31505 unknown command 116 [ 1568.310179] binder: 31490:31505 ioctl c0306201 20000380 returned -22 14:47:52 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x0, 0x0) bind$alg(r3, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'crct10dif-pclmul\x00'}, 0x58) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) write$FUSE_OPEN(r3, &(0x7f0000000100)={0x20, 0xfffffffffffffff5, 0x4, {0x0, 0x2}}, 0x20) 14:47:52 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000000)) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:52 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000240)={0x0, 0x7, 0x4, 0x800, 0x3, 0x1b8c93f9, 0x3, 0x2, {0x0, @in6={{0xa, 0x4e23, 0x0, @dev={0xfe, 0x80, [], 0xd}, 0x7}}, 0x7, 0x54, 0x5, 0xc00000000000000, 0x20}}, &(0x7f0000000300)=0xb0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000340)={r3, @in={{0x2, 0x4e24, @empty}}, 0xffffffffffff263a, 0x10001, 0x5, 0x5, 0x88}, 0x98) lookup_dcookie(0x8000, &(0x7f0000000100)=""/190, 0xbe) r4 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x7f6, 0x40) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, &(0x7f0000000200)=0xc6d8, 0x32c) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r4, 0x4010ae68, &(0x7f0000000080)={0xf000, 0xc000}) 14:47:52 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x0, 0x0) ioctl$RNDZAPENTCNT(r1, 0x5204, &(0x7f0000000100)=0x3) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) [ 1568.602214] binder: send failed reply for transaction 404 to 31490:31505 [ 1568.617791] binder: undelivered TRANSACTION_COMPLETE [ 1568.623067] binder: undelivered TRANSACTION_ERROR: 29189 14:47:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x200000000000000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vcs\x00', 0x420000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00634040000000000000000000000000392600db0ba82d6fff528a00050000000000000000001800000000000000080000000000000073eda7e1f58f1c7527db3ae278e42cc842e3188a9fcc5cb46ee704b0e4dcf1a482cc9bfd1ecd37d5cf590d58011560a19fcacc37d29a63115369ab0a8fc9d7a4d35c04318a5005be8153361b3b3b07003410e0fc862bfd605c2b9ec1238e5e644431d42a363f92c04bf1391029b078c3f1093b45acba222cb0a474fc2ff5dc60c097d83bec9d47a7d2a5ba9a8a8c1b2bc9a7ca1c", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="0000000000000000e928e3aefbf6bf8d9cc807d4b784bf9ffed52e0b735b7f82b75b11a7fa7a878d7d695911a91c87"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r2 = socket$inet6_sctp(0xa, 0x0, 0x84) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000040)={0x0, 0x9}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000100)={r3, 0xfff, 0x4, 0x9}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000180)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 14:47:52 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000080)={0x3, r0}) move_pages(0x0, 0x2, &(0x7f0000000040)=[&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil], &(0x7f0000000000)=[0x3, 0x9, 0x508, 0x7, 0xffffffffffff8001, 0xff], &(0x7f0000002000), 0x0) 14:47:53 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f0000000000)={r3, 0x0, 0x48a, 0x2, 0x101}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x1}) 14:47:53 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000080)={0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VIDIOC_SUBDEV_G_EDID(r1, 0xc0285628, &(0x7f0000000200)={0x0, 0x100000000, 0x7, [], &(0x7f0000000100)=0x7c}) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000140)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000000180)=0x10) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) syz_open_dev$midi(&(0x7f0000000240)='/dev/midi#\x00', 0x800, 0x4000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:53 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x1f, 0x80000) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000100)=@int=0x1, 0x4) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:53 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) splice(r1, &(0x7f0000000080), r2, &(0x7f0000000100), 0x3, 0xa) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:53 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000000)=0x3, 0x8) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1569.717493] binder: 31540:31549 got transaction to context manager from process owning it [ 1569.726052] binder: 31540:31549 transaction failed 29201/-22, size 1572864-524288 line 2825 [ 1569.779457] irq bypass consumer (token 000000005ab1d326) registration fails: -16 [ 1569.953801] binder: undelivered TRANSACTION_ERROR: 29201 14:47:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f00000000c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) getpid() ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:54 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$admmidi(&(0x7f0000000200)='/dev/admmidi#\x00', 0x4, 0x20000) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r3, &(0x7f0000000480)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)={0x150, r4, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0x20, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x556f}]}, @TIPC_NLA_MEDIA={0x14, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NET={0x2c, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4}]}, @TIPC_NLA_BEARER={0x18, 0x1, [@TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}]}]}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xd5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x800}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0xa0, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa893}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x557bab}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x150}, 0x1, 0x0, 0x0, 0x4040000}, 0x8000) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) r6 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x3, 0x20400) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, r2, &(0x7f0000000100)={0x10}) setsockopt$CAIFSO_LINK_SELECT(r5, 0x116, 0x7f, &(0x7f00000001c0)=0x1d, 0x4) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r6, 0x10e, 0x8, &(0x7f0000000180)=0x8, 0x4) ioctl$KVM_SMI(r6, 0xaeb7) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0x0, 0x2, r5}) 14:47:54 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) r3 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x1, 0x2) setsockopt$sock_int(r3, 0x1, 0x2, &(0x7f0000000140)=0x8001, 0x4) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:54 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x10000, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x140010, r4, 0x180000000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:54 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'broute\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:54 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = accept4$tipc(0xffffffffffffff9c, 0x0, &(0x7f0000000080), 0x80000) setsockopt$TIPC_MCAST_BROADCAST(r3, 0x10f, 0x85) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r2, 0x0, 0x2, r2}) 14:47:54 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x200080, 0x0) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, 0x400000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f00000003c0)={0x9, 0x3f}) fcntl$dupfd(r0, 0x0, r2) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb01001800000000000000e8000000000100000000000357a88a439e9b9c4f1516d0a070d3752a7f5b0117997baed6f65a3226e969bbe3c5c616c04890373a4264761646564f0464d5d72777b9b8fe33a42b6b2a66a895cddca4ed4c35af6408548b6ff8ae57b018c3873cd7eef5cb63be6ff3d864549f48aa11d0a2039fd2511cb34bef68b2dc917a75ce18d936fc042642fef2c342506ab1b64e41f189c0e0feeda69561c3aa8b462452ab6110a65fe3a0db874a044371478ffebd6a97df0e8c8e0cabd97a9504e0d1b046818b437ee7a4511036c4962ecbc54d53044c085747fce9d84e3e79efdf2ce068dc3cd5f2cb60cc6ad11dcf41a9eb1cfbd47c904a3f1aacfc550800000000120fd001a3b4eda6b733e7d141a52b661be10859393756982144a89d55a043f53db5816e81df5d4b68056b2659185cbd1de8b5fd29c1edf749ae1383d45d78e9c2d3328be6c4f052825cf73c51b97cb176b4b1c2160f00645a57f06480fff9cf7100bea94899eec2023c9612b7b311a644a20ac196d6f75eca39b6c3a144eb833880cf331be8b668ddfc790d328d3d0fbabf984e391964cd6b9c763b7e5758317161efcc9358d3bf23c557cdc0ce98bb597a571576c80e"], &(0x7f0000000340)=""/95, 0x1b9, 0x5f, 0x1}, 0x20) 14:47:55 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_ifreq(r1, 0x89fb, &(0x7f0000000000)={'bond0\x00\x00Z\x00', @ifru_ivalue=0x20b17d7b}) openat$autofs(0xffffffffffffff9c, 0x0, 0x800, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:47:55 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x2000000400200) fsetxattr$security_evm(r2, &(0x7f0000000200)='security.evm\x00', &(0x7f0000000240)=@md5={0x1, "df718740421c3c4861b5e724cc61cb09"}, 0x11, 0x2) r4 = eventfd(0x0) r5 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x73cbf6dc, 0x80000) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f0000000100)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r4, 0x0, 0x20200000001, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:55 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x1, 0x0) 14:47:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="e646b03ecfe87194050ea9bba0dcd30a239a4f3e08e7a497b1c5feb7e4f0ad1bfaafdbdc4cfe6fef963523b3dd1c336adf19e7621cec1bdb74b2f6958a0029ac23fe2d484fbd4cfec60ccdceebf927e7eebdbff94b20e6f909b2cc4f6f5197fb490fd9c5568bd3aa33dea7cd5ab1b720c5c92daf72e2f498acf807"], 0x1, 0x0, &(0x7f0000000540)="fc"}) r3 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x400, 0x40) getsockopt$IP6T_SO_GET_REVISION_MATCH(r3, 0x29, 0x44, &(0x7f0000000140)={'icmp6\x00'}, &(0x7f0000000180)=0x1e) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1571.603314] binder: send failed reply for transaction 410 to 31565:31569 [ 1571.610350] binder: undelivered TRANSACTION_COMPLETE [ 1571.615697] binder: undelivered TRANSACTION_ERROR: 29189 14:47:55 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x408000, 0x0) r0 = creat(&(0x7f0000000080)='./file0\x00', 0xa1) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r0, 0x4010ae74, &(0x7f0000000100)={0xbdf2, 0x0, 0x7}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$dmmidi(&(0x7f0000000180)='/dev/dmmidi#\x00', 0x10001, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:55 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0xb) r3 = syz_open_dev$usb(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0x3, 0x1) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f0000000280)={0x3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) r4 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x10040) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000100)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in=@remote}, 0x0, @in6}}, &(0x7f0000000200)=0xe8) 14:47:55 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) r3 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) ioctl$BLKRRPART(r3, 0x125f, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:56 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) r5 = dup(r2) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000000180)={0xffffffffffff9689, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, 0x88) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) [ 1572.122783] binder: 31615:31629 unknown command 1051739878 [ 1572.128639] binder: 31615:31629 ioctl c0306201 20000380 returned -22 14:47:56 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) r4 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x100000000, 0x232040) ioctl$IOC_PR_RELEASE(r4, 0x401070ca, &(0x7f0000000100)={0x8000}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:56 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r0, &(0x7f0000000000)="84f8a4a164e783f3c27c75938749ab852853cdc65abc36e230aa2fcace69c6972ec369c3c648e5305411c9d6f38a6155ad77f044357977a88eb49dbc6d672dc6f8f2a4eef8d26f368d00b9234f81021031", &(0x7f0000000280)=""/232}, 0x18) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1572.292272] binder: send failed reply for transaction 414 to 31615:31629 [ 1572.322194] binder: undelivered TRANSACTION_COMPLETE [ 1572.327408] binder: undelivered TRANSACTION_ERROR: 29189 14:47:56 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080)}) readahead(r0, 0xb52, 0x100000000) get_mempolicy(&(0x7f0000000000), &(0x7f0000000140), 0xffffffff, &(0x7f0000ffd000/0x1000)=nil, 0x4) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0}) pipe(&(0x7f0000000180)={0xffffffffffffffff}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f00000001c0)={0x0, {0xffffffffffff8001, 0x7}}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xffffffffffffffff, 0x4}) 14:47:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x400100, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000000c0)="184a692083773452187f668a50b837c982da90a6f7887a86fd852f2ba45d1bc85a9b03ff1cafc0ceb50e4578bbbb078e2502ee3c13c9675c35faeabef28f9c6bd4712c4580d9ded5a751b0c4a4dbe1a4e154049ab190d1d38462f1218730c88a28561b50f14537261bec79fe3eed6775bde476995b9e54ebfc39b1e8d865ff12be2b15c4b5cecc0824b48f4070753b58fedad461d42e40797f1670336b47f585996996f2cdde6cad5cbdcf792c5a55893584aa81f99175d09c562eb09c7dc7bb8d836550229797c08fd16b56ec356a7460307ff2d9a42a998b2988f8d299457da5be348c5510001f024789d7372157c08d1e4a925da6e2d1cbc7", 0xfa) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) 14:47:56 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440)='/dev/zero\x00', 0x10000, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000540)={{0xa, 0x4e24, 0x1, @loopback, 0x4}, {0xa, 0x4e20, 0x1, @loopback, 0xe9}, 0x10001, [0x5, 0xffffffff7fffffff, 0x4, 0x20, 0x3f, 0x100000000, 0x9, 0x6]}, 0x5c) pipe2(0xfffffffffffffffe, 0x3ff6) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f0000000180)={0xba0000, 0x3, 0x5, [], &(0x7f0000000140)={0x990970, 0x1f, [], @p_u8=&(0x7f0000000100)=0x400}}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000240)={{{@in6=@initdev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0xb, &(0x7f0000000480)=0x1, 0x2) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file0\x00', &(0x7f0000000640)='trusted.overlay.nlink\x00', &(0x7f0000000980)={'U-', 0x100000001}, 0x28, 0x2) r6 = fcntl$getown(r0, 0x9) fcntl$setown(r1, 0x8, r6) setxattr$system_posix_acl(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f00000009c0)=ANY=[@ANYBLOB="020000cc7b02d1719d93aaaa1a78f70005eacda0d0d87a55b068bf7debac96518125b0cc937e6d8b4a2f57ed70b1daa799e285a17dc8e6f09c270775379d7f055a25d65364d0e1aa84b5f1e1c7f2751220b71db8f002e1f2577f65cfc8998f2b4e7d2bb396ed7ad29df2a1760470b9e8159d765982663155982eaae3a9e58cece4f3ddc927c4c7a35a2f9d31d0a513457407fa369bffb712dc1553cf3eeb61742ae68240e72308b6df111cf9719b738e80f3cd708e8ab0d14437bbdad52808cf8e8aa70a3d7bd0252e31de0e32faae86a6b555e5c45c80b7f936888f843b4e20770f9b120168", @ANYRES32=r4, @ANYBLOB="040004000000000057387fe63150f5d04a3bb9469ada08000300", @ANYRES32=r5, @ANYBLOB="10000500000000002000010000000000"], 0x34, 0x1) sendmmsg(r0, &(0x7f0000003680)=[{{0x0, 0x0, &(0x7f0000001d00)=[{&(0x7f00000004c0)="8c3493d020ae2d801bba321866e3798391e27753bf77baaa9a50543cdb67f8f8", 0x20}, {&(0x7f0000000b00)="b68f291386f6d703799ba4d70fe58d99e661475aa4c9ce404d4301e4c5f1ec1ea356750ac9d33e06224720dcc5c940136b712e19111295abe7dd9cebd2e0c05bef4bc387b2b342a7c87b2ae47af97acbd82d1fbd1b433096692b536b9c73a46a4b655477351df69ba23922ae495a437c7782213e77e15d52b54185eaa6d4bd0bbbf241996e998d1f3f8c1d65f68334b7ba4ae7e093ce98b5cc63a81f340f713c574a2d0721e175970721bdb1ca4570f47cecd8b1875c986dc656a63333f73166975d65a78c012684afe7cd6c07ff7f4baa3478ab8dbf55ee7143001dfa4c63143d7004c44aaedf4f81333f2453bf9ca081c8e8ae3582c30635a6b37c0d8c04df69c3fd922a0e6b9679f564b5de4084ce7446d926d7928e8bcf12aa793bb1faab4b1cf285ef87c6eb9ec3ea5ea9f56616a20b28baa54ce659b9eec322ad3667d3be1583a611e68e2a070abde9efd7ca8dfbc0243ddc631b0124b428c136fb1e2a986bab8d4966728783d9dd2d1236552a0bc82e3a67d245fe10dad7a1b3a3801acfdc5202e8fb964e337d33fbfcc68bdac3abf4228cc519f2ee0725ac9045015f6b513861b331c13a2bd1d362084aace895dab15f5dba0f207bb0064a9eae384dbda3b09f55e28b359e96fbba78a8fe2c9d325c1db969167953eed32fe131e5018b925880616cd072e8e3df73ab7a403084ccfbb4968ee59a2a575c48f3e14a43aabe44b9d364b4a21568a06203b3415ac52e207d4a2445f326fe30b2d5564f20e075ae0ec97058993ee632fd4e0bd2946593cacaebe2a775f6201a0bebde8837375038a8d65f7efec09d6747b490aeba9335d02e41613bca056f03b5890bbd811c24d3ab34b366959dc98b37a6c495048cdfc6505617a6c0cb84bea21fff54f88081d3f70ea6d8674631b69c6bf4b7eb8cfef664147ea77d2cd06806dbbd217b258632a7d5cf6de26e19eca0a50b11d98c8b0f54a5e3c72b667e3d70d5acb4f84dea51e67d5455b25a9d5f50a5e22bb0d0dfe12781b23541762480a28e35b3b91edecccab6478856057053cab315e9a04c7373eb4ffa229dd5900313831db6977ab2d31c950b26ecbce809268d64d6c62f8370cc156cd17af8bc9bd45a3419d9b72ad5ad7e70a8f4dbf36b37b154a1fa5558203cce1e5fcadc3e032c4ab11f100469581479ca3129a936456dcb877e0aff1ffe6d2a9966b4a5741a74d3b96f177e91c7fb3dacf8b5bf6924e1f60ed931c7f54bab3dc33f36a74743c7e9a06fe0217e64b6d71d034583b6e367988615f703a93c7843f5009255095463d3d2c875010fa4074aa3a8ae88e9b958dda64b1d3b4ac40f0af1d0929697da229cc336a944381858ba176b4a0543ab50a62ad7bfc17c25b9b8c252668c313f13f425fdfa8c22e1ca23170069beaa1f7d681910766513005990d03a775d2b1de310b47555f285d5261c10344d6ea9f20b5e30054c712b1231d6a52ca19dc232a8d5c6b29469e023c5aea1a27011f476147c5960b60b14488f1695e9fce2ae234c6997562d8daed982a99e9047adbbb2afa78ae1a4dcff1eeea25e655b81067f384f15ca29c944d9d2d1df3c7b1c46d71d27151335469e0f122082a01eb3f01cfa38462fbaa77504141c965c7d1cd94591d2bc34d574eb4950987f93fa659ec1ce4521bd4c483b5112d8c2f3c030bd5109f3818d5cabd23ee669866dad1e8b9f42639b2768410ff5f9c371866e5b22cf80e631c8c2890b886e7060d836cfc3e5cb4ffb22584194733360912a999743cdaa07ac1189f88386f649cb942c3927b0fb3b8a9436fd98bbd628fdb3a9904acbc2ef228e01e001d97a0ae43c9acbac19c7b812285336c3128f852b57863ffc13d88a007682734b08a477e4e31994929604492f137f95d8deffd79eebef6d3579d6615237a2a0009a287dcb3b66d8b1cf36cd5e215b56b01bb3fac84b22438a2c0d9d26dbfaac3910ef3fa35a3438b81a315241eecb5f1c4b8e82c8767b121e27cd4fda408412c8b2d2337b6039bc20068f42f2cc383fcc00c21bc9a83c30ab0b8c55c42bbd6c47a97cac3e7699354a3224c263990bed73cd7b92613b2d17426d95513ccdee5d8dba33bc02a72db69fe9b8215612ea41eec1608c74a65bedb32b7e5165f226017e0db728602380a2eca6a17dcf2213999d8ad099f17a1d16f27f8ea186a7d080c2a7c6c7f88f49406a6c678625ccd33af85a9392752f41dd77fcbff28fd2eacf5b7dcb52d791e4b87f1007fe87fb03a454152cbb784da2c3b410ff1e5aa6789396316fcf1115491a8a19898bd6a829277627b739b218aa0fcbbc2d66d3aa938768e1f158266ae9e5763202d34fba45dbcffebf90e2136b29aecc978ab3f8fadfa8ab62236cc5592a356a9164a507ce33ec4b5c71c4c30ef56fcfad1a2497a9375dbaa32181252942afe45ba220eef401451a7b5be8ba93df0c685a39d698dfaafc85edfd337fee1d333da5db80f6746462a1d7c91980c407fb30bc74552b86d68b3e5adf1f6e0bf9ae81719f0eb13a625290e5791c21533df3f69a220a2ccde5d784f357069f98a8b635e229c8eee9df75bb6a374e67eb6c0feb53984fe855dec367cbf46aacfe05c3434cbb14e7137e438fde5c7c712927862917b30f10f4862a4b5ef750a586c973af4b8ab390a4114f6c596c82baa693e54d09ab19d8882a01f0319b754ce457289275408f27e15799f8661cb0acaae5f84ebd0249d12d90e47476a374fba7fec0b316c69d338dd2bea783000e5b328fa30ccce49c48a8cecd14c827ad2a9bbfc4a59d0b3b80ed595310b46b6ca368b46fbc81817e1a9b2d1234591eb51df24bfa3dbb9b28a2f8fcf58a08b674af920c45018c801c05093c1634d5522a523de40d8b73ae418e6a52d64d5a23885b9eb7053bd635cacc1e810bce3d23f0b5569e6f18b9fdbc151941b35317549233b7db164b861ef6b74c769aa9786ddf7c1d8b55c80ca9aa392944a023f33f9ac699b1304194b1ad3be8918bfab83e80fd1316ce27a7e7d522a99210fbe450726ebb78480250d131841066b8153452fcccfb10004dd42e77ec1381859482a7cab72a5c53e885051279f63dd5644b3eae956529f6ff4c44fe4d7682a6102feef016bf5c0ebfd1706d16c623032d7694165876bda92d97a38cc5701ef5844e7b40573a667cf20c70b6cf07563b4469dad65588dfe67190d13cc3f66a2cd1c53b322147a11791c86e932281a0a858ae747ccdd9c877d6663287ea38f58872a599153847adb4bba59746eac6c70d796edb49b19e4e9b60def724bfcd639c872a25dd83956306c9528f969bc016c7a1514ad48051eb18bc2707156b1bae18727291eea38319bb113d61d5310fb483fa0313ada6bf4833a1e1a362e89d3b227074d460d43a070c694ab113a30881160453ebf00a1771ae2b2b19c01b638622234c82b9e8380bfc54e62317cdcad6e85088ed53c9bcee9fa0a39aec26f839cdb3c1c8afd8bceb530db35c55f2d3a1ce0408809376df330b59498500112716905c99f94fbcec5c0ab2d8b07c14f0710f2720c3c725ae62f9f2329c979827a14ea2611987813b802da374d9a26a54dadfa2753937da1f07542e5866a220f43f472b59bcd0ae5d7dd444ba037a30b9060a519a52c4b1f80c5351c7e117334419d8c1e5db7eb2650e0b1ce25c12bfeddf98f5a6e043d0cf90a1c1657a328e98b5a1cf57c5f9678d96eda53c430c1ea832e3edc49de32c8890a52fc07ef03f83e602dd1e8b6f4c5dc5840ad7ac6f806aa9095f94648ab772aa20c56706c72de4bbd42d59e51fa7e62dbd354a22d00c92fe2f9a912bfed7738ed308fe915d40116bfadc9023b3ec7bed30335151d5d5b8843485f242c5c3ee8b13faf5897eff85e49db2557aee4eef28355b2b7b091177e02bc4ae96c64acdeca9dfe1509d8f95760692ceea7bf281024b7ef745168ed5fc0599e110aeecaa32807ae8732619ecfaeb0e90654ff6362ec7269ec57d6844f76cbebf6f15466c06aa6ce746c8ea4eaf8b58ccdaaafe1774ff5fc27db11e897f5d429cbc3106914c809bed1e1f082a19b15e31d8028a71e7216930f89cb42e400e4f44d393d32f056c53d7c42e441430a58987dad52bd93d4c4ac60669b607915f71b8673d0d9bf8266201fc6b3ce40631348571e81f1a79747255fda28743ab5c25782e667093feeae43c5f8decbbaa70a22c80cf81f02f9f106ad3c26df59565feef3dc97335ae8e11d7b43a7210daf4a85a5216ffcbfbf55dab092c87809be9f09e458505c09e546175ec976d979a047746687fff55c9419002f81d68657ec68f7f22b437e121a2ef18e46b0ec8a3afc76190e86bd8fd3f34d63d66fababafff38f23dc2f2a418811ab9fd6a47ed45406b70f2c01a377b8831c635bb95c5ed7ab1c94ff5961116632fc5a16d8c0d821bf5b243d6d86bff0f575908974e209bb269769b22192c51579d0d21991f4766b670b1482f0500349265752f4e84a1e813fdc4c8bce372c8e132cdd3aadcfe052454c3619a31ca61509be13bb581c7dfcd714c842b7b0bb3bd9ec878c3a3de57bb4eb7195f30680a42628487e351f9e9835400fac5712955e608f5a124653f772838a5f8a2638b9b866bd4635a41c1a39890de40989aaebc05c637336114255c942d5bded6b337dd39e8346f9296cc73495a3453ff38d28d23f215f392fd3605b56b2320f2f251155f440eeba2393fc28a10a2754d7f7ebf735bd553cebdf576d556e7e72cc585f9db48db5b04e85aa99029d7e59f9ed4c569ad3baf2f02f62f0a5969786815cad905d7712e8ecd4c57202cf0a11e79f0739d9689ba9756ece184c8ce75fe85059ecb33f4d3b5e8961342bd6215beff7fb70306d203d4398d5774d1a864ba342378c5191ddfcc42c2d22ef017e3dabf09d410328de1be671cddb2daf1652b39ed1256cd2893cba7a4b34bf887f44c5f973d47ceb578d9266c4282010153b86945ee02567f8101ad7b3692aebc76d251f5f1bba6228821aab4d4fbffbf50424031f5e165906fb7abd9e7b41703b2e806a1d6210fe1132b4d3dc6a601672c630222d393c12e3cc2ec4385e4b947ba644ddb3222ca87a60cafe88a582f4212720d2ec49a33eeadcbd87c8470b9af484336aadc112a0242248e88921df6a1c7daec32fdc5892f122586ff6f16fc74acf68a3ff9ca842e321b08f848dd493b876e9e5df3b1016ce9664306ec1a87068178a29d86a985215f1ba32dd68ec3a0322fe66af7e8c94c8d999a16f8193e11ae0adb5a96988aba7b6bc9c4eec7e133eebc36ae092b694b152feef2df472966138e479b34bf53fec1a3031e5b340d40a7095c9429a2bcee03fd8b1e704046c9ce373b223720d03a1a5e0fb2af8b661056b89cb3568dacd1e819f97a72463873dadb4df3ff84a9de540385f385267b2062f35010e448b587d4751536c12aa70c2cad9c6818dc997252a202636bce8aa1fa2dffd961ae072de1f7de53811b367fdaad10b9348ad1775fb1e12500a1dc9885fb7b13e4b4458994d8f101d1fc424aa100ad7956efeb8cb20f5b8cb4da3a2d679f479f8f3dd96fc06b4adb72697fbe8906ed5dc14f86553ba75bc9ec33026e3356fe9c68cf84d03647664cbe0056b93fc104bbc49524687b909fc9114172b689c3d5a4507e19b93938a820e50bc8925258bcba3b9fb523e27c0cc0879805af64a893e65678a427a4aa39166118a612ffa67903973074b0c23d8ad28351f8bb84026aa3f7503ebff65d20d1d19f9349eb05b260d3990b8e904f36d", 0x1000}, {&(0x7f0000001b00)="7adaf04b8605accbd4d9a0bb8493f8dae6f7cb28a8d58b2fe2e610ad167b8c22c0ab495f38a6a6f4c1a83f01d38f61a7b01744c23e19507c09f5f8cbcb34f70ca86b21aef069a9a2b312efb8bd8d917b59f709cad5134e4a568a4e216c7b7d3537ebda333811d180e185fae42d1616e11f481b57a89c249c58f7c7043c533a1ab82208625a1e8052e24210413e03aa5e24aa169f1caad92d1c704b4c0086ab4b22e841bf3f2815dc4369df28ffee01dc61fbd03f3cf7ee49c4bc44230f10e3e475ff0f0a6a06b3d0cae9a2572f8eb0e9e8718173", 0xd4}, {&(0x7f0000001c00)="baa034357d81f9534b8d832e60170fc607cf25a6c5472fbc163a6b65f5d013c720aba1bc0120fa9c2d3820621a3cb9c4ce410ae8f42061e56c36b3bf6affd1fbebb7ee0ad2a037d3cce5568c946b43015a0f22bec1941a7ff9bea41efc82aab4a99667883a2bcc46c3ac1ba110f8a6f31e9a8a958f73f0987e49562001eee9b44788f34b4ff110f44482892c0ad9199fa7c79ddca18d7e26eef801c5a0b4c5da69a50ba6201beaffc101c22718eec27c977b7875ad3c4d06a11763f414f5a3cb97c8de612392492173e68462c7de68ef31c769ff5c691f4bd0f532f31954ad26cea7635e98f34c92a3b3dbf04a3730d48545ca71f2db35a8decc056ee4", 0xfd}, {&(0x7f0000000500)}], 0x5, &(0x7f0000001d80)=[{0x100, 0x115, 0x1c1, "a14bbd05ab9a4861ffbede8a94791d60620d8e892ea2575c46e87fd6a9c03bd7f562b43f2c3f1071b725535eac2ebef6b4170c68cbb5fc9ae24063803cfecf675c3d6601929b38b1c135fcdfbe1dcdde4a4c6633fa6ceac9390bb1fecbc93bf8ae9fa9fb39965845c67a625d76c71e3136ab089e7d020248c412593aa1a6069ab5882028aecfe3e9ebdb3c4eb1d5e06448818dd84af21d19a1e6994160fd475bba9b11e50d79b07c91afd8458565323f3f868c734340e1345aaf0d3912e47d9e467faab7971eb023c47b6af04f37db2db345bc158b6bd7e75482bbcf652b2a262d0854a1488caf0a2eb1ecce3299"}], 0x100}, 0x591c413e}, {{0x0, 0x0, &(0x7f0000002180)=[{&(0x7f0000001e80)="68c90368d2e15b35c69d62a051e481e3bdfd16131cbdbb0952ab20f4ac21a72049d3a1323da5766eb12d915839a8e34f15e5b72920b91ff8623b50f4552c256269163472c67e01afc0fa43ac84cbb1e4f49da7cd21fd729b7f13958bfd4fb82a40d52d93e51a710df8429ba7e0737717f49bdd0318594066fd5a91f473fe9bc578b380e20078b6f0929e64e8b5fbc518a4a17801856c772bfb4f07b7b5d031c8e21d18e1be57a44c99de0d9d12608bb83de3a8fb0551039a203945f6403eca79567d0c265dda102103b6317ab2a3052d3b00ce32", 0xd4}, {&(0x7f0000001f80)="f507882fa568470497fa28507bd57be298b718eafdd54d8381701af10490d313fac26376aecb2f7414e7215b63f348a5f2ba0cfb4bb667c4f5e85e6dcf009ac0bd5858e684133869e3ab9c660544e327bb65bbcb6bc4a1549a3a9e80c801e409d406a57a23fcec83d39a4d168caf668491eb3d", 0x73}, {&(0x7f0000002000)="213293475096338ceb03600eb6ed038350e9924f2e8c4818df021e35c7759449dbd94ca45d358fa074a3a0b04f9ee18f5f4a20d72f72d266cd986ca60ecb4819c75c47f337a935fa0ce081a58f384628197b02167409d53feb6e0ac63301c9ecb2b0efe6b0fb632e258a9fb884a846a8c45f578179db579aaf4d3c30787e0b71a29b414174af43d165798e2406fff58d0cdda7d3419b83bb06f722c5ea711a80a495b66ddb8d98fc63532c8bd4328be46f8ee37eb775aca0a1b8217473e0085ea475fa791a609be980bce8339c4056fac4a1", 0xd2}, {&(0x7f0000002100)="fdb34eaa5257dc097babff7e28b81b86c9194b01f8b2273ca320ee8071b9c664c5aed055865161b5b0a9d5e8bbb66c81aae4b92c73533f3052c059d3f69b5c4bb96815e820c9fd71573ee70533a6906542a806d4e854ca56bc21b5f0fc22204690723416e255", 0x66}], 0x4, &(0x7f00000021c0)=[{0xa8, 0x84, 0x8, "8b85c6faa8f60221753e29c55d27a970b3fbbca17be93cbd11dafd709fbe412ad2b287ed1e5cbefe18a5dcf0c41444e07d9f3283e1542b88ba1fdb53f25e7cf3b0db154a97c16df20a0c6714f4c257afbb87560c2d88eeb5f1532582484b4320f03332f272cca127ebb26d78d385bc4bf0a1afed0b987145ec7028ccc727b27afea33cd85ab96a2047281ecb788640bd75faa2"}, {0xf0, 0x11, 0x4, "d7a999e382c29f59df0baee4f2031623e06b019e952e9aafcb123a796d7101e1d3b8695581e45049b4d7647bd949fca2d7c8e49d2c5e1f2d603b7c09281dc9dff9c91bb902d5a57821e3f56a7650e9df43f66b878b2d8f4d1095c281c3098b36c1a10e91573eebe8fa4864a5c40d4649ad1c1c08fa0f16b13819efd543a8d27116f45b355bb65bca5768ecc00dfa6c4d9e2c065909d5d1bcb593f008daf1f1804efaa3e454213fe2d38035bbe80540b2836531e2c04948bc59620a87b966535b4b9df751bc9c09fb9b66cf17ce6c553bf65120830c5f3df92673958e"}, {0x88, 0x110, 0x4, "7b416871b4df1a094bc7aa46a27e4d2a4be06c50d8c5dcc3e26a5f3f27c91223ef88c6c69e5aa3ffd7a7c51e722d54ea79e4644451252f8888b983fe6d04fe02e85b2584fd9e1ee9fc558099496509f73905c4bd95e0c21f4e4376bc3764ce1ee94753caa09177cdc9f4a345f67d696355"}], 0x220}, 0x5}, {{&(0x7f0000002400)=@pppoe={0x18, 0x0, {0x0, @random="b78ab4b6b001", 'tunl0\x00'}}, 0x80, &(0x7f0000002580)=[{&(0x7f0000002480)="dee7de8f4c9eaaf2398d80c3b3ca5700d5356e6356e18ad948a939432fbccf5c711d7c7f593baea6d3c541a1fcb3e1d40d2df22a9b1272b5a6f9d71412c6de6dd8fb37760d247c59c02d97654642dc", 0x4f}, {&(0x7f0000002500)="8644f0b25b847fc5e32cb183f40dab4d783d84e4d723e0f1ccdcf5fa377cf336934d5c55e572ae33b68c67686caf668aa4fe23bc9d3c9a3ae59eba09c2962f293f95772ebecbcfe82bf75e2296d7849979fbb64fb4534bf72459f01062931d871c6c5631e57810e2", 0x68}], 0x2, &(0x7f00000025c0)=[{0x1010, 0x13e, 0xffffffff, "11c91ca84cc463ad33125f7e28b527eb3e19bcfcfdf5dac8c0a9e6b7e0948a77bfa5cb4ddfd9ff2b02ae0c8c318181f9ffc1e96f67aba6e62234abc9c52e23220317970b04dcd1c2372744240326cb838a229b7caff52d34549cc3915e94026572193cf8d7895f47c2f5a13c31191d24af20e4f31f68603bbd403b31d5f378af850dd5b3d56fc516e71f715688211dcd74e113635ee5f4cc7f387c09a230c727985442a5df2a6961a84395edd19830db5d1a7b21019186c9074f03ef45ed4d9f2436da620b510387ca87d2a3f258259f7a9821203aa5577871fceeda394584363c8642fc1ae89421a274961c1ecc22b84c60504131e59f7dc51592c9c67352ac8449285bf2a62a70e119471b9c104cd556bc0fbf269aeeae8da063384304790a559d59e3c60f18c951866f85128493621e84c33e7a33c3791067f25db2600909b283c0577466ad8e4147b8a967e317207784b0e0700dd40bc7fbe5d905c54619c701dfd2e07e13167ba8666422d562cb59165f337541ecb47444773ecb2702bb2db386f104d7f1e41b75caefe785f4ae73d8a95d03b356a3a534be1c48c2af9d9127ac6b63341a6230d51907e3eada016bc71012025048e5e1017f4494a45e727c5ace5df60ebf78f3a26275a4ece724b336fdb8cfe44d3afed8ab4efdb286bd04c0dafe19f70edebd62af4a5eb80b6762ee09360ac5350c5e27596e3ffebdee95425a87be251b32ca216a773c75a60839ebb1950a5930ce6f04d5e558364a317310c5d25556c32e4404cf210313eda401b4c0efbb4ba891c407d624d95d7bb8bc0e9425d197bbe0e66698d8d6c342ff0a3f8c7b1069075f65a805aeebf17229e9942cfca5d4bb071d27790d8e2cb0843283fedcc7bb46d3c0625f46f8ad4d217125633e0c756def6381d0a8c04d20027d1723ee9daabd1318c73e901d0ba7f8c50ae3ad39d4768ecbe959c142134539c02ca45c6091686ffff467789be54f4c1aa7c0e89b62970bda823eb05db1c90d93614eedc557497cb82ed437681d9b6d3289ead22895fa355a6f2e346f1a7ffa9e172338e30dc48e16396c517b26e0a3bca494e8617327dd4ff3142a0670da1b0911635c1944ee2382cd11b0658a14cb3f134dbde70ee0fb5541a8c73e7dd5c5c99530ff78accf352a33de086688492a2b43b0dad74f6c4b065b24f4f0fb15c8190c50c60b711481f578305f4c296fc748339b7f223bd9e879adc3a2bf37c6c8e5f8545396938348a7805fbd11073606228c67c4ebe084985a2fe771cb8c0f6ba53464dd71d0ee7d5656df8209ca57d2863d6e97554b39fe5bd170a673352b1f7c75eb54bb0de03e89b0c35e87882d0c3aa0ff85da74a8e4176558894dfdb1a9637ada362987170c4f52c10ad7606df7c1195353c4b73b65f2831ebbbd5ccc0f45dce6ed867e39a069198b77f61eb811224b82876dfe70f4643040503b55274b6accb79739a95908dfce38a8cf64e25676d76e5a6ad8bce1c5e542b69c4dafc8023dcc1da13549dfd3018fa57ac43ada85a3934af7868a8c98da7d3dc171f0ab18347aba9f0d5cca735fc963f3aeeaaa0a74940eec27a3dfa260f06cd4f232a9b2fac8a5d8520a48ed4e921bd909693ad9aacba9aa5ac2c74d77a162d1ffac37bae27b220f947148a03054c0cf4644cb7a3a5a36752db0d4e3ee2eb5454bc9611212b97f015cab9fa7617f5c98e65e14b3a97290287615fe6503be518a370d6090397dc6402148684677ac51369b1e22cfc6b8e7ab96777b8d20fa8257f763ea0ee508f1fe82ca542d31133bc664559119298920c2fc0d048ac2dacd8b3b58793dc7a7e318d56d6fe9cba8dc368ba142f32ab552f9d1b5348b1e7f965a987276b8c4c534b1b4557510991daad438bae252ec10f4b39b6aa34e0235ffc0f9bfd9f1a9dc7658bb15a0c6042bf863a115ac50ac1ddc2ec7eaacbe888ad0d3cdc9f3bb6ed0ad53da4a25acb41156f7e9be71bd00b7b0b4b94e608a9516d099afce32cf09aa43567990edfa2c7f08ea1a29d77b6bbd53727ce077a4c42545bce50e5dd7cb0066a78aaea64d134d7adfb5121294ae92dbbbda45244c6b033e945fae440c07fd0924abbebd7ec4c1d059c03e2fecf7fd69a6c4b9a2972ee977dd4607c45734a42ab89a14cdd16ca3034caecae9287c7c5d3d388026259dd78771f183d207047d452ea23b97b54d206156b848931a3c4c8157c0ba85d44154f6dae73405bccd60deda11dd04864d2857f7c78f33900c178aebed1a47f82e55da07a04700be39da9673ec3cd3bcd9792b1e790ae22474314975c8b079d00755664e8bed80790843578688cfca7af7315935b6243fcb2ac83a8510bc100bef6baea4a6b1c1af891e58e5fd9821611a3b9095d38954d66354a1cae00528c77869407adbc6410cf5255d60ce4654d76d2818f3a69019d16cdaed8d4a6950063e80226d115ec50d5d546a2ec5233273de87dc48fd9988efd8b1a764e7730b34202792cf06f8f812681a0dfd180d5ad3eceeb9be221181feb16a1a57686ef7bcff22e94f160fddfce2fc7ebae8d72887a5fa6f6dd005377b7a95a6bb43a0a09b749fab996419d9cc97038ca29f2901fd81938b91f90a04cc75b50c75518c6b2580cf7f4f5ab29e1898fd160cb54147780c691b3e5c32612948599c9381f1c69697a7056776f348a9cb574a1fe238994479e38bf1f0cee0aa2e5a3d283bbc5be8fa8d8bf2a72cdd04905e7aefdb85ccaa289a3fe65f8904adbf7ed1f44fa1e7239619fb8a55ac7bfeb3daac5cdf81cb2df271cde28f8717ee2ad154244b7a05dc613efbe5bd9a4c87a1192dc7d87016051895770b2b831bc6c40d08247c25adc889af208b17306992991b0720f4d46e37b32912adf8dd7363cfbc8c89de90b11ef831aa9ecd7fe94cff1811a4050fbc0b0a7a019e6229a38c8ebdb758ff0c23938ae48ece1c14123e7983b9527a001f655c44f96cd79305d0ca00aa505c42c12fe6f870d198bd6138709f6da6891f5dd7c8841c2d1a44da1a95f63a4e8cdc67e55093db0dc22f3966a68d883fce18a614b6f9febeb00a0d85f64daf0bda680cdb996fbe7326f58aae0b0d354f064043a81052845382dbbde91c1a496709237dfaff02a1e02e5f473d8855f2be30235ec09dc238749537d0f02ffd4f740c5952d38259bf58cf0f001f328157dcf416f5fd0dbb73b20afd65764fdc9f3d84e87b0670c6391ebdec32a5e51df205bd9e87c7041a45f3146b06cde63ae5e7261d9ce6a1f3a3ed733aea69892d1c5bd032681f461124512ee6515526eca55c0e5616fb8c2ce713fd273601e0f9ec7c7b327f021a672c8c68a403eaf020e8a0c58634408cef14ff64d0a66eead8fec35eb715ad1d9fb792e31abb13a28bf6d61581db5dfab1d3333df841bc1613b02225b4630ddfbf00ab13f9abb3fb4d48cbe06fb31bb3619262d789d6a48882f04e34db658e6e2500b77d2bc10064188287db7165c47890a1df0520f355e63226ffa9519b8a641b41fe128f888f9725e973aff7b9f568a229ae67dde19c47791c32aca59ecbb60e4baf26b0ba2f7a6faa92994ffef08a99ad1bdfe701f5d4cacc7bc25093a4a0b0ac99a7c19af124b71242a6a4c11de1ffa59aa0906abaa79297c569f24a8e576ed532748b29143bde5168d6d60fc95d42f6e2eb7b6df26f54b47dcd255b2e910437139719eefa0ee81e68a229fb09b13af243bcd2369c06f741dd7533bee8699e9c0dddd834762a7761dd530fd50edec83e8412cc66bb2bb430fbe5d28de5d7fb50355ce184d07acd6cb02f4848eef16d8e1dbf25382437b59fc3cc00d4105fadce6af6dd5aa1a533d34d91f50a4b87dff69975df63329fd1be0ca739492e4895bdbc24df3a894b2080b3db1136eb1d3f28032d4cf62f1c1f65b88b560b70ee6661dab87563d7eaf784f69ab980373a758272a5b15ec63cafbfb0d3dcf80f420fec2ff69cd01d0f1e31d69e404b93a64290dbf8effe23471675426504655fe019743ad1708099b7f606a41ebbc5cde817c6a54175aa5b9692bb457fccd31d84d1f501df50f1bdcf0e913866492cccf4cb22f4ffc9bed31801eedb0729f1ff24f72d07afc39f1cd7ecdf68fa111a5fdc0d8b1047c742bea346d33210bb2f1c1f031a6c6a63228da7d1103e52fccd1912be0f4d5d92e265ca664ae8e3af4b62551df9f7c1c310284520556549014160ff73ac323b9c4b4479a4f63104a6a228eb3e72dab331f206bd95a8d48e839743df1cc8fbb4659c519dfc43a6683f1e15ab1eea3bfcd8fff17c65ea46273f71bfd281c938638f1aec5adb45b9d2ff47ef5d3b2dff9d66b1c2debf379a2238a0719fe4eff14feaf2b750351ddb2739cab0aee740a26b817f9548318a253a1efacd0109c8dc18b30dc813d428b34abd867cdc33c7ed55fba424cb402554947ebc5eb631ecd4e8e046c6879b895489f9edcc7ca164cab69abbe28b2a43957fc847d2ffc991ce97197d47af6fb2485a45a072ceb23f009b71dc7d9cf4afa9091f858d5f16e505e8d85691e15b4edd64ae2a5f1d49d1a6674c8df14ee8cfed11dfb8fd9c4761b6caf860172086fdcb9807e9abff9c808a0b701275bcdb814a41dab581f129c384a71aec1ebbed918ea61c686e3f305224dc3935161f09ad72eeb02d0f833a3baa6135fd37a61c28b746fc4fd06ca0ebbf15bd30bf1f2d28d6aedc4bcfce54d5a2df019950949dccded46c67e9065da013d18a743dd7d0e8f9ec5d25e8efd7eb6eee61b09cb4ade9157b468ee83463e381527b8bf8bf98cbc36dcbf5c1f25ea66c9eb4c2e1d48af1f9318d8dff6da361e371b9fe55e4b8712795d48c930f0c7c5cbab5bd03f9006da89ae42727ec7403633e17b3353eb613d003201288899557817546cc721058392e75dd3c095e5418c456d99526a07394b526907a1e2a403ed1702620a5f23cc3d61702dedcf4ca4f11796a153703ffeef7dcb367c6b88aacc8514d2eb5bc8f0d910670f7d5840b962ee8c9a793efcb2ce48a74357b2d4f7db0b7bf9eff7d6af190223a12832d7d32fd6d725d4258fc8172b9875d4e4419d2275c6102a964165e2d7d5004370d402e88d4d10857e63c715b616baf4605cf5955786ddc113a1b7751380a73d106da13e847ee522d019ff31155ec06606afe9b47106c67e5d304519dc3b4ba52fd1f5e43d34f76a0a10c251432d2fe2de35c94b1cd63704e8b0294996160843b7b4fafe8dd394a06348325a7c794b22931b4501b164ce0c70967695e8e8a9defbc5082ad7d1a6b97b235acceac313bf23b4b2900a59ca01dc22ac71dae145df6c08e0bf56c2b08abd036d2439f5fd5dea58598e62af6b1c4a7b548493d7c253578f78a48392dcbcba96b3817b18bfd56eb69117e063e5a89ef3da99192b4d353c5fff5e4fc45b0ede84d57036fda37afcb8e33fcf6cd897dc855c71a79a3325ceac5a3de976ed6bf84e660a00733d1f660d0c5d5a2c1efc34578ca1777cadaef7657f4358fae83fc1be78e66016619f70b4184751d4426f94a2a573a0da4bd730055bdb105402c8612fcdb007a0e8389a6d2c23d446ca00b3d6deaf98099bb058b846f653c42a1481f74fb80f78748741266be9e498ed5ffb41e99a1ee557de78c1535a396a2459f5fd52ad629834b8f4d62bd20613ffc3f22a42ede5b3a31a8959d2f9abaa3f285d634515cf23ba76c033cebc5aa2a2f02ab3dde6c28c786c152a9e9d7fede2bef7abb864b6a4f05afcacf79008e06a0db23e39aaef4ed955cab032e67589c65"}, {0x78, 0x117, 0x3000000000000000, "0a1ceaa329ab236f054eb72b7a1a9fac660b058d7db74da3cde169ebe6978df52cc624924e92786610fe085601f7ffad9e4a54de8f725c558cad45083ef408abf52eae01660c78b0a013ea47743e3ef2e77a867ef5cc9c10c26af3018cd37c1a1208ea909d"}], 0x1088}, 0x3fa2}], 0x3, 0x80) recvmsg(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f00000005c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, &(0x7f0000000800)=[{&(0x7f0000000640)}, {&(0x7f0000000680)=""/120, 0x78}, {&(0x7f0000000700)=""/57, 0x39}, {&(0x7f0000000740)=""/192, 0xc0}], 0x4, &(0x7f0000000840)=""/226, 0xe2}, 0x40) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:56 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) 14:47:56 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) ioctl$VIDIOC_LOG_STATUS(r2, 0x5646, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$DRM_IOCTL_MARK_BUFS(r2, 0x40206417, &(0x7f0000000100)={0x3, 0x7, 0x6, 0x2, 0x14, 0x6}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:47:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x8, 0x68000) ioctl$TIOCSBRK(r2, 0x5427) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r2, 0x399f, 0x1, r2}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:57 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x10, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:47:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000140)="bd306b692d62e38234d78d9bd2fa0c8a1752dfef9e2e4f81a64c557fdcd1d8fa82bf611499ca47bf6c7e7f825e4e9923f45add913179c9c88650b23210141728a82b281ccdac9c64cb0de7dd57a62e37446326a848bc443719b696b3ff41d1953c79cd9dda2b7224d5a96cb808ea18d0cd3104bc1ee389e737e33f97f24fdc0a7a34d8f441b340c3a00d80d5664d547f7ab2c56af9216d68e4fde55b123b122b1117eef6f69741336a538d7417befc7d403084cd4afff8bb27c0e35fe9d30a3866e1770a0ace69d9c742a20b9085826258eb486049a394a2b1dc7f813c42e606994c1097bcbbfc2f602403b1c99320ad8984441a0606a69f79ac4f85ae111170") r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) setsockopt$inet_int(r2, 0x0, 0x3f, &(0x7f0000000240)=0x1000, 0x4) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) r4 = syz_genetlink_get_family_id$team(&(0x7f00000002c0)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000380)={{{@in=@multicast2, @in6=@ipv4={[], [], @dev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={[], [], @multicast2}}}, &(0x7f0000000480)=0xe8) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000004c0)={0x0, @multicast2, @initdev}, &(0x7f0000000500)=0xc) getpeername$packet(r2, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000600)=0x14) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000640)={0x0, @remote, @empty}, &(0x7f0000000680)=0xc) getsockname$packet(r2, &(0x7f0000000800)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000740)=0x14) recvmmsg(r2, &(0x7f0000009d00)=[{{&(0x7f0000003400)=@tipc, 0x80, &(0x7f0000003640)=[{&(0x7f0000003480)=""/25, 0x19}, {&(0x7f00000034c0)=""/240, 0xf0}, {&(0x7f00000035c0)=""/114, 0x72}], 0x3, &(0x7f0000003680)=""/85, 0x55}, 0x600}, {{0x0, 0x0, &(0x7f0000003900)=[{&(0x7f0000003700)=""/71, 0x47}, {&(0x7f0000003780)=""/79, 0x4f}, {&(0x7f0000003800)=""/117, 0x75}, {&(0x7f0000003880)=""/116, 0x74}], 0x4, &(0x7f0000003940)=""/157, 0x9d}, 0x5}, {{&(0x7f0000003a00)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000005e40)=[{&(0x7f0000003a80)=""/149, 0x95}, {&(0x7f0000003b40)=""/181, 0xb5}, {&(0x7f0000003c00)=""/128, 0x80}, {&(0x7f0000003c80)=""/131, 0x83}, {&(0x7f0000003d40)=""/29, 0x1d}, {&(0x7f0000003d80)=""/152, 0x98}, {&(0x7f0000003e40)=""/4096, 0x1000}, {&(0x7f0000004e40)=""/4096, 0x1000}], 0x8, &(0x7f0000005ec0)=""/4096, 0x1000}, 0x96}, {{&(0x7f0000006ec0)=@nfc, 0x80, &(0x7f0000007080)=[{&(0x7f0000006f40)}, {&(0x7f0000006f80)=""/212, 0xd4}], 0x2, &(0x7f00000070c0)=""/13, 0xd}, 0x4d0}, {{&(0x7f0000007100)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000008680)=[{&(0x7f0000007180)=""/21, 0x15}, {&(0x7f00000071c0)=""/153, 0x99}, {&(0x7f0000007280)=""/185, 0xb9}, {&(0x7f0000007340)=""/177, 0xb1}, {&(0x7f0000007400)=""/109, 0x6d}, {&(0x7f0000007480)=""/4096, 0x1000}, {&(0x7f0000008480)=""/77, 0x4d}, {&(0x7f0000008500)=""/129, 0x81}, {&(0x7f00000085c0)=""/174, 0xae}], 0x9, &(0x7f0000008740)=""/106, 0x6a}, 0x8}, {{0x0, 0x0, &(0x7f0000008880)=[{&(0x7f00000087c0)=""/155, 0x9b}], 0x1, &(0x7f00000088c0)=""/4096, 0x1000}, 0x80000000}, {{&(0x7f00000098c0)=@xdp, 0x80, &(0x7f0000009c80)=[{&(0x7f0000009940)=""/135, 0x87}, {&(0x7f0000009a00)=""/141, 0x8d}, {&(0x7f0000009ac0)=""/19, 0x13}, {&(0x7f0000009b00)=""/24, 0x18}, {&(0x7f0000009b40)=""/50, 0x32}, {&(0x7f0000009b80)=""/238, 0xee}], 0x6}, 0x100000001}], 0x7, 0x10002, 0xfffffffffffffffe) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000009ec0)={{{@in6=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000009fc0)=0xe8) getpeername$packet(0xffffffffffffff9c, &(0x7f000000a000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f000000a040)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f000000a080)={{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@multicast2}}, &(0x7f000000a180)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f000000a280)={{{@in=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@dev}}, &(0x7f000000a380)=0xe8) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f000000bb40)={'vcan0\x00', 0x0}) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f000000bb80)={0x0, @remote, @multicast1}, &(0x7f000000bbc0)=0xc) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f000000bc00)={0x0, @broadcast, @empty}, &(0x7f000000bc40)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f000000bc80)={'vxcan1\x00', 0x0}) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000580)={0xf9e0000, 0x9, 0x8, [], &(0x7f0000000540)={0x9f097f, 0x9, [], @value=0xfffffffffffffff9}}) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f000000bcc0)={{{@in6=@ipv4={[], [], @initdev}, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@dev}}, &(0x7f000000bdc0)=0xe8) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f000000bec0)={0x0, @dev, @broadcast}, &(0x7f000000bf00)=0xc) getsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f000000bf40)={@loopback, 0x0}, &(0x7f000000bf80)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f000000c640)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400008}, 0xc, &(0x7f000000c600)={&(0x7f000000bfc0)=ANY=[@ANYBLOB="34060000", @ANYRES16=r4, @ANYBLOB="000625bd7000ffdbdf250100000008000100", @ANYRES32=r5, @ANYBLOB="2402020038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000900000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r6, @ANYBLOB="080007000000000044000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b00000014000400ff0304db03000000080002816a0000003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r7, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000700000008000600", @ANYRES32=r8, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004000000000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004006064000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000700000008000600", @ANYRES32=r9, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r10, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="7c00020038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004000180000040000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000001000040062726f61646361737400000008000100", @ANYRES32=r12, @ANYBLOB="7c00020038000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000080003000300000008000400a301000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000900000008000600", @ANYRES32=r13, @ANYBLOB="08000100", @ANYRES32=r14, @ANYBLOB="300102003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r15, @ANYBLOB="40000100240001007072696f72697479000000000000000000000900000000000000000000000000080003000e000000080004000000000008000600", @ANYRES32=r16, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400ff7fffff3c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000000c0004006861736800000000000000000000000000000000000000000000000000000000000800030003000000080004001f00000008000600000000000000000000000000000000", @ANYRES32=r17, @ANYBLOB="08000100", @ANYRES32=r18, @ANYBLOB="6401020038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000400000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000400000008000600", @ANYRES32=r19, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004003f0000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r20, @ANYBLOB="74000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000004400040000000300ff07000007000501000000000100080908000000ffff01087f00000001fe0101feffffff0900050094000000070000ff070000000500db000300000008000100", @ANYRES32=r21, @ANYBLOB="400002003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r22], 0x634}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000006c0)={0x0, 0x0, 0x0, r1, 0x4}) [ 1573.444080] binder_alloc: binder_alloc_mmap_handler: 31648 20001000-20004000 already mapped failed -16 [ 1573.470715] binder: BINDER_SET_CONTEXT_MGR already set [ 1573.476180] binder: 31648:31649 ioctl 40046207 0 returned -16 [ 1573.485478] binder_alloc: 31648: binder_alloc_buf, no vma [ 1573.491155] binder: 31648:31680 transaction failed 29189/-3, size 24-8 line 2973 14:47:57 executing program 2: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000880)='/proc/self/net/pfkey\x00', 0x200000, 0x0) ioctl$VT_ACTIVATE(r0, 0x5606, 0x74cb) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200)='/dev/hwrng\x00', 0x80202, 0x0) ioctl$DRM_IOCTL_MAP_BUFS(r1, 0xc0186419, &(0x7f0000000840)={0x8, &(0x7f0000000280)=""/13, &(0x7f0000000780)=[{0x0, 0x2a, 0x5, &(0x7f00000002c0)=""/42}, {0x1, 0xa9, 0x8, &(0x7f0000000300)=""/169}, {0x6, 0x31, 0x3f, &(0x7f00000003c0)=""/49}, {0x0, 0xed, 0x7f, &(0x7f0000000400)=""/237}, {0x2, 0xf3, 0x800, &(0x7f0000000500)=""/243}, {0x1, 0x8e, 0x8, &(0x7f0000000600)=""/142}, {0x4, 0x6, 0x100000001, &(0x7f00000006c0)=""/6}, {0x78073bb2, 0x57, 0xadb, &(0x7f0000000700)=""/87}]}) r2 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000180)={&(0x7f00000000c0)=[0x6, 0xffffffffffff7fff, 0x0, 0x7, 0x9, 0x8, 0x5c51, 0xffffffff, 0x5], 0x9, 0x100000001, 0x100000001, 0x9, 0x6, 0x4, {0x6, 0x8, 0x7, 0x7fffffff, 0x0, 0x6, 0x1ff, 0x8db0, 0x7, 0x6, 0x40, 0x8, 0x9, 0x2, "a072b40eff42a74d5b4885b562f8c60e446f7398ae30d17c447bf173d351e25b"}}) ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f00000008c0)={0x7, 0x20, 0x5, 0x8, 0x9, 0x40}) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ppoll(&(0x7f0000000000)=[{r2, 0x5040}, {r2, 0x20}, {r2, 0x4308}, {r2, 0x13b}, {r2, 0x1000}, {r2, 0x4000}, {r2, 0x400}], 0x7, &(0x7f0000000040), &(0x7f0000000080)={0x5}, 0x8) [ 1573.515053] binder: 31648:31678 Release 1 refcount change on invalid ref 1 ret -22 [ 1573.518096] irq bypass consumer (token 00000000bc8ce5f7) registration fails: -16 [ 1573.529106] binder: release 31648:31661 transaction 418 out, still active [ 1573.537678] binder: undelivered TRANSACTION_COMPLETE [ 1573.588428] binder: undelivered TRANSACTION_ERROR: 29189 [ 1573.594151] binder: send failed reply for transaction 418, target dead 14:47:57 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpu.stat\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e23, @loopback}}}, &(0x7f0000000100)=0x84) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000240)={r2, @in6={{0xa, 0x4e22, 0x9, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}, 0x7fffffff}}}, 0x84) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000000c0)={r0, 0x0, 0x7, r5}) 14:47:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) prctl$PR_SET_FPEXC(0xc, 0x3) 14:47:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x40000) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000000, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:47:57 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x1782bb08, 0x8000) ioctl$LOOP_SET_DIRECT_IO(r3, 0x4c08, 0xd95b) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = eventfd(0x7f27) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) [ 1574.075624] binder: 31687:31709 transaction failed 29189/-22, size 24-8 line 2834 [ 1574.096440] irq bypass consumer (token 00000000b52d1f14) registration fails: -16 14:47:58 executing program 2: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={0xffffffffffffff9c}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000240)={0x81, 0x563, 0xf4a, 0x5, 0x6, 0x9}) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000180)={'filter\x00', 0x0, 0x800000000004, 0x31c, [], 0x0, &(0x7f0000001680), &(0x7f0000000080)=""/30}, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x4000, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) clock_settime(0x0, &(0x7f00000002c0)={r2, r3+30000000}) ioctl$UI_BEGIN_FF_ERASE(r1, 0xc00c55ca, &(0x7f0000000040)={0x0, 0x0, 0x9}) socket$unix(0x1, 0x1, 0x0) init_module(&(0x7f0000000100)='\x00', 0x1, &(0x7f0000000140)='nat\x00\x00~\x00') r4 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000200)=0x100000000) move_pages(0x0, 0x0, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x3) 14:47:58 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x400201, 0x0) ioctl$KDMKTONE(r3, 0x4b30, 0x400) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) [ 1574.193384] binder: 31687:31699 Release 1 refcount change on invalid ref 1 ret -22 14:47:58 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) io_setup(0x80, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000001c0)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x3, 0x81, r0, &(0x7f0000000140)="104db1f1656afe315bb76269dd6429eb", 0x10, 0x1, 0x0, 0x3bde9d15d284c4e}]) socket$nl_crypto(0x10, 0x3, 0x15) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) fallocate(r0, 0x65, 0x4, 0x42) 14:47:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x22) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000000180)=ANY=[@ANYBLOB="060000000000000002004e2000000000000000000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000900000002004e237f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000007ac1e010100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e217f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e22ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23ac14140a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e21ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e0000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x510) fcntl$F_GET_FILE_RW_HINT(r3, 0x40d, &(0x7f0000000a40)) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) setsockopt$RDS_GET_MR_FOR_DEST(r3, 0x114, 0x7, &(0x7f0000000980)={@rc={0x1f, {0x8, 0x5, 0x9, 0x8, 0x100, 0x4}}, {&(0x7f0000000840)=""/204, 0xcc}, &(0x7f0000000940)}, 0xa0) syz_emit_ethernet(0x26, &(0x7f0000000780)=ANY=[@ANYBLOB="aaaaaaaaaabbaaaaaaaaaabb9100000094003500000c04000000030200001761bba51e912092"], &(0x7f00000007c0)={0x0, 0x2, [0x83e, 0x437, 0xb1, 0xe09]}) getsockopt$inet6_mreq(r3, 0x29, 0x1c, &(0x7f0000000100)={@mcast1, 0x0}, &(0x7f00000006c0)=0x14) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000a80)={0x6000, 0x5}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000800)={0x3, r3}) ioctl$sock_inet6_SIOCDELRT(r3, 0x890c, &(0x7f0000000700)={@loopback, @mcast2, @ipv4={[], [], @remote}, 0x6, 0x8f, 0x800000000000, 0x500, 0x5, 0x2000000, r5}) 14:47:58 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x51d546301d2fef08, 0x0) write$FUSE_GETXATTR(r3, &(0x7f0000000100)={0x18, 0x0, 0x7, {0x5}}, 0x18) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:47:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1574.568866] binder: undelivered TRANSACTION_ERROR: 29189 [ 1574.805844] irq bypass consumer (token 000000004edcdd60) registration fails: -16 14:47:58 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x40099fd9795eccaf, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, 0x0, 0x15d801, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$sock_ifreq(r1, 0x89da, &(0x7f00000000c0)={'veth0_to_bridge\x00', @ifru_settings={0x1000, 0x6, @raw_hdlc=&(0x7f0000000080)={0xfff}}}) getsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000000)={@dev, @multicast1, @empty}, &(0x7f0000000040)=0xc) 14:47:59 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000180)=""/72) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r3, 0xc35, 0x58e, r3}) 14:47:59 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x44047f, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) r4 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x3, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080), 0x13f, 0x9}}, 0x20) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) [ 1575.112967] irq bypass consumer (token 000000005ab1d326) registration fails: -16 [ 1575.221265] binder: 31740:31742 transaction failed 29189/-22, size 24-8 line 2834 14:47:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1575.283364] binder: undelivered TRANSACTION_ERROR: 29189 14:47:59 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x2000000000000001, 0xfffffffffffffffd) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:47:59 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r3, 0x1, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:47:59 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0xfffffffffffffffc, 0x0) fcntl$setflags(r0, 0x2, 0x1) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x9a0c, 0x40000) ioctl$VHOST_SET_VRING_NUM(r3, 0x4008af10, &(0x7f0000000080)={0x0, 0xfffffffffffffff9}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) arch_prctl$ARCH_SET_GS(0x1001, 0x9) 14:47:59 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x12, [], 0x0, &(0x7f0000000040), &(0x7f0000000240)=""/30}, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x84800) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000001c0)=0x14) sendmsg$kcm(r1, &(0x7f0000002a40)={&(0x7f0000000280)=@ll={0x11, 0xff, r2, 0x1, 0x2, 0x6, @local}, 0x80, &(0x7f0000001580)=[{&(0x7f0000000300)="47794ba22be021d8be3579bbb37b57703de28ae22e29b6c0249f713231d2072fda784a09c1dc9265c7e232cdf59e183268b4ec6f7d3e66264c5e76dbbbaea3746a330f56b81d5ea33124138dafb156499cac3394e00277c7c42a9aebf1499cd286170f579ba13f82bd99372b1112bf046afd7f02eb1ae4e98abcfa54d09471bd489d7473c15de89aa71a7f64154f8068425f89016aacf45997c2bcbd1f07f5d2eae84a8bb3c61dc35c2168cd7b7066a772884373afb71b1c6739b5479fe34160469007b0c67777f8797e7041bae07c88b995d7756f9a18f4ffc0b2b907e9ea9c1afa621dea4f368d51c0bcf2fcae3d339751daf87f8e97", 0xf7}, {&(0x7f0000000400)="3ee0c55bf7a9a5fbb5c1398d9b340480a6107a0eaa7fae7490e0413fd79b09e19074b5b779e6e23ca4025480ebaa29de2b372f1c0ebe69618d06708630d0c3defab2806c27e6e30847d90277d0865a411e1116cbb7acb95a5fe96324698d28cb03088b7b8de440c2b6cebfeb8f1baaeaf2ec042ad76216c5be6145257767616e", 0x80}, {&(0x7f0000000480)="b03d4637ef23a66a5a1c73506cfe647e0a06eaf62b15c23ca7eb71273787af3cafeb7edae25dc97f23c5df4174ab5b3e52d41f10b03c242862f6f565023950713f3fae1cf65a3ab63758a6c2ba2f60f0e9f0eb5b2ef697e3ffdeb058bf549dd2b7fc2504a7bd065e7fb0d0b5e477db8f74b158b9886942a00cc6af9bb5e2435b725312fa4b4dac4041d92f7d9c2e4a1deb822e371f9993c94626d7cfb0940a", 0x9f}, {&(0x7f0000000200)="bbd8e38e07d466579a07f512476dbc96cb08eeb98bbf1616d73bfdeceb0193", 0x1f}, {&(0x7f0000000540)="899168b498027f47e16f", 0xa}, {&(0x7f0000000580)="79e28fb361e29a42bcb278f995fd988dc3ff2505fc8bca84fd28c2a286b784e3eccbc6caa5e5f775acb3ba1c1d24bf0b5ab2db60ce7f3dd88b3e4a943c81d8b7e3a5fb245fa0e4d18068d2c747ba12227f711d0682cde09b4a1c953bc5366093f9872b0e763ecbf6eb8a09dc609ca4db245a362007d7c568e5b48f9c2d4a623044a9ab9bf845559a20e363bd0e00f561a63889d0a1b7f4cb9a85cbd82369ed53203e848da828b253d8479371a296e284479c4104131d09bed023d104825db4c119c69b3ebefd635c5d406832e3cd2e5f4cc8be3fd05f0a403ea0553ff14fea1b26d850af58fda2ec5a575bbaae1a315858b0c66a0ba4daf5a46898f7f0e9993ec65ec3e48210f64b52a6ff86c235fd3d971ede44759a6f3576c0321e09100b430d7173b6e53dcba120060953173c6ffecace086bcdf965e21fd592e6534c40cdc9c31469673f066ea84e1c4446bcee009ec6ad42fe6217b557dbaaf0d85d85cacf38cb7df0e5f24a2973e8994451b2ee77394ae2dc35295b129674fcc964c77c3e3b20f5814cfc3dd046231bd7ccfb9f777b99ce4163a0710e714f61218d0afb4b9d649f92de5fe03dc2bd52876019d8d1fb20e157274b78321abc3ecde0e9b7a4584c7e283c8000b335260a54f49df46f36bcf5787434bc0320fb9893d3b71f4aa7f6b5d6b35fe9f1975faaddc306e6402a800eb5b77d52bd0f3bd2963e8fe3b1123830adacb1a1a5401d7a3b4b5bed50c1aa1190c351d07acf422dd1e0217f6bce3e77d73ee1960c4570c729a9ae2bffe55401bdbaa3223c28fb1c9b84f805c9d3bcc1f78c107cba5bd37ed155df073fd44da5d11bd708edf02f8ce68ca967e32d7a0f2498a4d367d0d440ed71eb48c9f53dc708ba6aef72ec166e50c8349eb93e04efc7d3abd50eccb39220886f212f1a9bef75bf25877b1adb5f9caf84de4572a0f96e263420dae038961c34b0896d69a4e66c7379aafdd3fd8389e7f31260fc09971f221e36033cf61cda72bc0d12da785455eea465b442d25355b725e19e1bd1b53bcd0f559f66de099888355e58d478986cca7efa6fbc6f8314ca172625c5b82836680b559a5081dd6979c2d67ff2164b4db76a81c47644a0d8f00c75b3ebff690ef420af11e30226fbff3f6d472a0d0ed7e27f20366285621614c5d5045095adff5fa6fe7997e2a936ccdd50b58f3dc766d281b4e55253c3676b93a66603b8cfb5c8672aaeec77f2c1e3ca4086c172efa994ce1a949aefde51f9b5f8ba3dab2305d35c8bf57c3f2dabbfc6ff6dc1aad2e82db5cbaba1b306de615639e54383022e7b2dcdd5985f211c8bb022a5f3b49e5b86dc8cfb84d111f4a2fe7fc239e694cc5fbda21ee56c41d43bd66b4caadee5cc497e30cd7739bf80a1effb4832cffaa1522b74acd85da92050579d5d37e91318db3f1dc7eec80097a38480fbbc730a76ccaabcbc2d0ef6e32da3e82146a60f5081e03e6f578f4ebe5230672ecb713f87ceb71db7ea81999475e47cab6fe177de43b023cf0c7b95fab21e8a153edfe3c237cb70b7960d62261dfb0500845e4b657cb2640eb56a79e8c5af8e62eec0eb74177326f403cd8e0ec358e467111449920798e1faf11a48d2e262350fc5394a2e8b2bdb60056118880025b4de0e3e68dda8f699b3f198dab2a3c490d22983a15ef8aa6f267e20845cbe68960d32e9551e06831abd052445aec5f3944f1f03d937005a435cd0c5bf82dfebc774ff01ef4f364f2f8f3454bc0909da8faa5099a6b8781e8dfd80095948f0c31e15e42244b9c6daa78e8838fa59a42f9d0ffd31583a4dfb19fd0085e434472df1ea9fa3e07df076a78fbab097ded73f03e52addc6326eb8e37b66736ac07b604241a720c62e2b346c5f8a3ed650ba5682977d251c45ed985089ae16141e2f10775e8dd64cae41313a2d2619212d3d4420cbb8ad94b370d24db58f93d3f2ab9c2e8179390ea2de99389d39a3a57f1b380cd0677a233db2b6aac4fc1715481150aa601cd4102caeab623de568782d4dd5290474bc3ec884a77031969bcfa78ff47a2010f1e974e0ad8fc2794188eff065cf99c6029e1d8530320734f7e62878067a55c20fad6e051beede4baf16b937d8a504202306c3acc145abce62ff7cd0084751552382d36d44c92eb087e8ba9e2aa86298e750bfe693b03fedaa54850ac7d490c49b8ddf16d9f79ecf11798632c7ef2bd0346f403b93958dfbfb85d3b4438baec410aa10b09f855bb425f40bb076a97511a1c11959a0e045bd335f27a857b3ba80903ef8840a5f3e51aeadb7a2b00c33d2984d1859fdee673b1dfd4fd126656772c8fe1693af42a444de52252312cafaf2b8c0dc5afb50231ed2381a6497e47cb1df5866eed586b6409211c8679b66e940009648f71f63f84b488f952853d5ae62bf21bb7be8b6259b0f8394561d5768e0fb6501e707a2928f08504b48d4cce0ae1094a6b6672a23217dc9c98bae163f8f0c3e389ae07bf43f643716deebb7b4438901afb945753644a814a24160da70d5f7817b7ddd6a484f34e3a6233438db4bee0656430151b56433581a789e17f4949ed28d395a36c8638e935971fa3cef2cc083a68f6a22cae1b8058ead44eddc486ac8232e3d9c06650e6de5cfce8b8d98565a87f3012f697db78d04574567b0ecd9ca8bf49e085fc336e2f5e4949aabd7b2163e8f018ca918d3fbd58fd50b904538fa6dce772aa818ae9fcd856654711ab9e6ec10c75bdb62f523f270e72e61a1ce2446ff3e5f34cc54b041d8def9f3bf8cafd77a324c89126c75ccd9491e8e5cf672928dc99e45b96e022e30859ed0a1ee9e439a20a4db3634886b8454a4345ad14e475c602c273b37c5db1a360f3213a038ece4fc1e605cb89185ec08f02b708152855629770bd2134fa397bb80ea62bf6b61280d9fe489d724d30bf2ceffddea0c8c87750886ad4b5cd121f2f4d903410cd8a9283882777a47cb3117ff5c1232832f68d416f12ce035d596f49643ffca3e3667f86c4c8d4ec90c0f77312474e816411ba4411d13d13d97cb2bd62b4c79b8e065eb3cd7713dbd14bdd4bf6bdf46f251d2248e88a49da7af181b83d0a0f049aa0c54d3decd0dba4f442edc6512dbd2408df10c180ec11dcc4924a1aef2dfc6a9505f7db1e27a0c53f2e412cb8b0da509d4699a88a610bc47f33fb090565a0c0641cf6de2240b942541fb80918862caf93feb43c3ae6e4eec0268d05613b3383c1de3166db94dff2c76801f4f33aae8300b47f569a8eb4dbad9c2b652ea913ccd6e0c4f121a55a8a6c0ee2461e6c8c05269cb9f2eedda236ca8d8d37d0f7291c2f3b1992a037714e77f373283e54279a6b8241d78e6af9025b7e9cb42e613e13c75dd0b5a994083763671656b3a8145bc13d141bb8170f4ec4147527d137a3f59436d5aa6506bebb635e2206ac91f07f23a9bb3a06604962f0ffac3eb2b63ed82bbf4ef7041aa2b54f406f7cb3b691378e8a85a39ec3bf2891ecfbc74bc6d63c642bc5a89d09bc57411b1d58e88bc6aba4759bf40e8c570f0e78c90e97ea14b350a6112b35ca1e54b1cffd0f6c951c7db7e6c778691c4d91a8b956c9a4a6f4fdbc09ac6a5b9d261bfd330c9712437f9387b7c18e3c16a8ed70b7073dfdce381626258d008d61eb82603f75012495d24ca960d5208811c84d92b5fbec64f840c5a720ea7d5637645a7c04d0c2e4f5db9ee2320d8d461c9522e1e8f6a46231d2e5da3d785793078347c2ea7143bc438993866ece9dd6ee9e41a31b65bc72aa5e36ec9b3b6ca92a54400df0f4630681f07c6cf4bf307f1ac3d0ca929bb24abd6f7b01a731d2b1aadd0c8460e57d61daf935656d2e51b50767fc2488a49f796799f7a7055f5e787b547020150f4315dd2af7e6a83d96e5b0d3291a0e8dc2107409dd0a68331307da5da2dc5a6f8703071f31d5a99eab6500351fe66a0cf70e612fcd32f514a45944c131d4968fb7f761db0ddcdccb3d466d69eabe475dfbb51ebe04a97f82efb5dcebe80bc1d3cffec82ec56cbfde077189266ac66b488a76c5664669904ef77131641c5d4acf047291a7d4b45b6d15544b262470f91a320e18799d7d1398d922160f6c9ae3dde9df00b4d3aa498402e657e320d3ee4faffcd01050844b5ff0333178fa50856184190eaf84c3a68e2a4a4b512edd9b28c56a3f9e1fa786875f77f0694bd44dbada166257cb0d437eb04daaad387b111513deaffec0934612d7f5cd3ecb533adf58479dc35b34cb11077587ba2894a54cd07ab9d2bf2ebc5292ada46c36874c153a6400f33d86b5a23983514d4e927889124d31df3af1249092c607c5746045e6b0adaf98ae47c8a8a378087d532ed05dcb7eddae4f299285583702c4bb05cb9036778bba528a4573916c0cdbfa50d4c06bba138b7f7b8ddb03c19fedd82ab36aa51f83431e2d2118b813bec30cd5a41463bb778f53de60b5b8b28a5713677d902c858dbbf1554e91d4ffdb0370139221cbb81716eb09275a1164c1ea536058ff7435df2cb9c1597be811fb7f0bb04c71c67c69c456b5ae13e451aea5dd33ae6e1dcb35ce7041a513cd7c0d234b24cae21d0be948220875ab11c7d0f27012ec64d1575833752f61d3f9b6940ee1e6c8e7520295c4bfe66037ca31c9c7c829891843527b363fa3edfcc1ad617536c9130e5fe7c37bf4d4c89853d4505dc1bf87e5eafd367734a81f8645aa2e03fa0d04e5502837974fb39727112edc889d782e13639899c594f757396b090a3beec9838da0ba8168c4cabd688b7bc9afb844b05bc362c94551290a294013f6bfc43227aa79164f40761341c561fcd4f09793655c1bd596756c30999e0c262c65055ac569453b33926570d82e47b1dbb30f31e7621093d6dc839ae73ecb9a8b3ca0bea8e36649ac15865a1050ed297617dc467f50f458143e78a212c3782f77d316c64de06c2634d34b83ea8e45e37b69be3f02a4b12dc0ccf27b8c788179aaf1d65e629c61b177b8c7b08f52072b2f8e5f77484d0050a21a9856748a721592f89553425e7272e09addc63b3d64c206bd497483ed14b24f9e79485378e60e8198c8d2d49bb48aebf70a7acae77c12d8f96724ec6d2cfdeb92cc0ad4ae9ca8d8f51d42b4fe9e2d6b58e45149f9e70f7530b32adebde1a1adbeef8a6cf6ebdcb9184220cdd2a8f542043685b99cef57e97b101a18e85818befd984ebbf54d7a6a281f67f120dae973d59f0eb5f1c51efad76ad0eb0be0c0f5961cbae4799a549dc603e402431c241f56480175fb006b78535764195e02e98cca42a762c864abec72fd706ae31c6be7781ce967cb75f2869b3a94567a75e9e236288a25cf7e10e6fb7d5050ce5cd834abd629d59ded5353fe623f5de6d230ee317a213c7764029a2b4e9be91ec96a1508c0467a58ec10bb602c43c15019b84150ec82e9f8b961e551d2045690f8fe0a7196fee37530b6f0f1abb547b5e31cce51266c4eb49e0011cae0301c3e6fc2c2ab793c42aed06660a11ea65b08510953ab0cc24e1ba75884bc09d6292ea5b52da293a812b0db3c3a8ac7ca16b8dfef7c86bc560c0f371d5bd37824ff79009faffeb12f65dd141a0307a04d8b54c974bf08dcf638210adf4ad9a0fe5e9bc66239ca50ca136fe55404460ac43fc5b5e579607f523ab60f071b3c957f1e8264423a02dd847cd4b5399c841652dc86c8a2d143b8b67773f192679be5fffdabb5a97c57b700b87d7159d3e63d54b2715233a4c846bd589138788004ad0b12b4207e56648b8a722990ea2a6671cdfced6", 0x1000}], 0x6, &(0x7f0000001600)=[{0x38, 0x102, 0x8, "67a242d865e8b9ce4d7012fdc24cb9390e4b917beb9cb0ced237764eeeba8c7501e4"}, {0xe8, 0x11f, 0x9, "c9f11dd5af1fdc6b4c4635f06046104dd8b31943171380fa2ddbe05de308dc33dd0e543a6fae720f8bf5cc4f36d9c55db43cbe676f1773d88121006c30854822c66fc227c0985de0275fd0f204a554c298234dda35a16f02f3080000e047fbc404d64211944bdc0ff4cae6c4676d8a6e8caf7e9bff638ff1a0de8722b46ae67669b234fc2419979ba4f2f61bbfc0783b7603c8870427ea84c82ec79c26cd10bee7cbb4f8902ab7a52c21f1fe7ca3fa7dea57189fcc9cca868fca0dbd768c66915adbd38991bfe42e6c58d5d17e6ecb109494"}, {0x60, 0x104, 0xecb, "a177894b4270a968f40c31048e3e1a315eff3659126c2c154b842da1af6adf513da458c3fb75e2d325889f8ed0d2b474686b41aada17c46a2d58fc38b59c5c12e85dc9270b45b30b914b"}, {0xc8, 0x117, 0x5, "6da95de5c61bfb05e70b8a55248e8022d1ce3403bdb9833eae6f32492e1ef2997aba84c34ae68e69e2dc6956d9d22d5efda75a8329777b53c19e42d9e52056b16c4c1577e9c3b772934008d8186c8377e9605f248263769cbfa40462768064b11f0f1b7769dc452270209876c4d2c2f4555768a9fb31bddc61ac0cb6cc250a675a053161b6fb6c6652abc09f56db41ee2094ef472b76017ed61567758dd57d7c0161d98c308206201737ac36379ac1a920e7bfe96a"}, {0x50, 0x109, 0x1c00000000, "04bb4df8817d924a94d9da663055994bbbc5e8f53f9cd485787160962258220ba17ca3977ce1c72f07abb0a08ae243f51c580bb5edef6c951f9f58df"}, {0x1010, 0x1, 0xd3b3, "0cc9bbedd7606e8440e0d434b4d6887ae8efa4eb993ada84ec2a1a61ba926a52d1f70413203cc8499997f00f911c7fca29ecb62e8dec7175112754b00557d837c97b76b7f47490201abe2503de9007a86d06658c542aebe701d337a6a463e2cc45ed2728e6428c72b86cfb9ec8ad372616745a0ee81f9c2af7c66a9d0332bebca9a7d0baa3681cfba6e1415580e231cdbf362f2c055added8323e1e80afe233340fbdedf3f0a7aa11bf97431237822e0d8afe7ad3b6249ae47d144b299cac0f07a62a42a555932cd2e73f325a26f90c737d45750886d381857906e850aaa91fb04d8f2f0fd2cab9d6061d104d4b699ad7576c0351fc89e4d8e83f3b33edd5e7c886ea281ac001b58081ee54cbdffe294a927fb1aed0eb980f06cf620b8e17737e5c741e290f2fed5f9cffd3fe959213a25856c6d7f62e7a2615e011d678e55346785ff9f8c56147dbbc533e6fc365556603b673976aae23a7e008541fee3781332c22af40d76fbb91c0491f129e31252fe8f1c461b80bd47f67bb7e22d329013906c4e2d3c461d43847af0e11957f35dff838df11154d468111dcb040df27572d6984e9baf7d443d4ca8a6445fa6bdc838a2725e43f1298abc9263517645e943784e74b96f30b8a016f1cd756f762c6dfc312eca34bcb337fe8f29ee9208c13c88d72a3392768ecc079fbce4868980a7637965c76e7a2e0d76ed92530bf4ced15aacae5bf7c8e9850c78edf6d7088bb062cbf847bae905d7a6009f63de0894bc6e0f5851b339c97f68e6ab93f43d59e8987bea9a059c947a79914bde071860cceac6104fb0747f3fae164bf089fdaef48c47bb766fa3ee89fa137702c401a062201b283f99e42e221b52353917865e6002d7aec42ee8fbe8e336654b839335e34a03a23c82e4ca57dee68b48feacfdb900479bdb19adbc2f6bd92af539f18ebcd8753a8165a274ef273721aa95149ae2783c25a3c69a654511844e4ba7427302b55fcb59a1cf63e1f6b8312bffad6cffb7d35d5cd90b5aaf67818ed0a82e32d514cdecd13250b859193fe5a9d0c3d68072b703308d6f6312f0e887c6e2aabcc1a34158a5d1e91b4907eb1fb5cc2dd5a6814159e9be40773157502a87c198f8051307f54da0edb6334a9a2542d26ed0cb90c65fe0beec51200fd76cb63d86395ec18a6ce8c6b139f5dc4b951f95a1c6d643abfb30174fc10ec3a2c989cee87936622ec868778bfbf6a7df5f3501a6954a891c36164d53651f8e1273ed1b8ebe432844b93fb72cbef4b8e1764ea5a5ce5b69b670219f6a862bb5df04f2d654e1643fffe627322e2a77f49fbf262c8e48eff740aeb12b48dcf3efac781f8d0d27cda4a330331ac253824aa375782eb9947291d2a5e7da5e175a5dae9a5e5e90c1fd6c06009aa3f64fdf295762a7289b8b3158a2befd2606b9ca77e544f29c4635ac19c053b2aed2adb0ba962ce76d9f73f46416a09c96fb73d7db6a3c95fbb6704ef5f5fbc91977e18d2225c69afded05f43741d1290a5425b5c27388b74b93ab58a3bbfaf2564db958bfcbbbf33fbe2d9dd72652db62f5beafe26e9fa01464722082f107f2f901d5ce86b198a1915998dc025b7683517c62a2f647423d3d96620459e26de94f17d3ce063aa5672b757757bf12debedb4ba7378503bf7e670571b9217a0621961eaa354200d08df084486dacfa7656ca20b7248b6ca18427cdf1690b207f48955a6bf84525e68fa6ec6e2aa453675e1b15ab37b8b0eef90c649dde75340e28cba4b5f541e8f6990b5c49c14508e11a485f25bab8544d9b99b65864a79323249f9bf5e001988fda073628aee93e641a4d1418be3509e1d429e1a229542f6f416cf9dc6a900d963c4368b528215352d5d57426480eb1f56ec830c31ac12313047ac2ae3ef5a81d597b21141d0fa6ec8861ba5fa94147929d9dfb7fd1df30cb24c47d3ec69a01236bcdea0af362dcdac63370322d1fb03859398a5face4f7a8177108b0ac3d1c8914ac0d62f3cab9c22cd6a037e2a572f0e3ed65d338e22bfaa570154083821a23551f2ddcb4651daa1e70582c6dd70c8a9f756abbab9c7462eee1c6165e04eaa1a22bbd177b864136cd9cfb7afa0ab813011d6530966f5e921e8bd90a63182ffe939edabf0795e656ae9352d06bd445dbcdedecc088c12c2f144872d71a59787b792ae2a550a456444f6c7c8ee58d7ab81de72f04cd5119717edda1966261aa82108ebd5334fbfa16499f83543a182a6cf5cc0466222e21edf6cb245350a071591d0a54621cbc8021390a338d25243a9ab99fb0ce2dde63599a5a0e6a1a406d2e003d11f0e3e77fcc611f38551a31d7971f213e3800e95da5f43d14fd5552e54a36473f7f97edb621b36b96bd7320c5d3d4a8586605afc5ab197a90f9f7ae61652fa11b02ab5e34065d9a2ec523f121bb38b9924d5fa66c0fa31f4626b21e6fad1cf90e46bd0613f8b46a43690da64628de398dc1705df42b86e46fca8034b0203e7695bcefa94d1d6e6a32118f67d8ad66991094e1829b07eccc3d87126ba4d2cb52365a6c833882fa34ff976286fbfda3461b4cb071239edaaad774d40a73095f09555aa920b8788c9388d84f1250a48e742c9bc9680a22e1ee557895220fc4775116c6ab2a103c3556f1df0ca4ed0df3d463b809afe0a4c1d400148ebeb314a1f0c85fb76b427da6ae72cd9f23214258e1e03a451257c0395bfca2e527c714da87d76759533c327b68635d0c06485412660a5a41ba00ba9b761ad5b31b3d1f4ef6bc7576ab9b4d0cd4d9393a3e41fe032b20ece1db2a59cadad9f55f25158d8922c486af3c803343145173456257c9e7a658ba2ab5af2a69bc1bf0a6292f5bd5ec9b818c29202101261c526ff325940ea44acd9f1aa4f38d83abb693aa8b2dcd9375c5f9fe2cb97844f8aa5e1ef64448360ee2f7e1e52664c14b5e9b4d279e28605d96d3f1a7f13bd624d27f8c1d7527c439ecc908b3d703669decf17e11e34369343331b0bfb8b633bec04ddafdddb164129f87d75a2584a82d0b39851f6638d67ab35c5ff430103e62e5a10877d0fbd0f495b0d0ddc05a4844d52f4aa632d0153514353f29a160bcb036bb1093bde0dfedfa967a4132fe9fbcb4fd7e60655f67c82617c1dc39c4cf033ff9edb5f7beffc4ea53d90535a71b3ff47aa86d413c141c04d460a88c790330f32637bd35afc75ac46f0de275705811a6c52bad8e112625f0a8e0d66295007a8e116cfd04032d53a03151d53a9b91201301d059553529a6f52bd421018ebc48cea8b565c3e65fe1d56b650ed0d8be6babc9cdcc123d577ccce80ada9991a72a5805e27606d7b621cef4c71c2ed5aaa0a5072fad5cecbc8128961725214236772d54c92c777d54fd15b5ccb8ac84f3bbd12cf2adc930e8bf7f22bf5a5559843f90923482c3ad54232a2480fecfdae8b336f01512d7d9512b9eb669496a54e32094e780ee34a6fcb1fe7d3f620b8fb5344558cbd40b0ff6a59925a7b67688f07fc858ea8c543ac21fd2d6f8659d0ec5e391feac0157e7865f7c569657ace41ae9df179ceac5221d4e61172b21e1e875a5151bee4b97bc862fb317ac405dddd4b51ead0d80c0f51b8166aba99b72d9afd52da94e8b4cfbc0a3c94ccc9ee20e74cb5a5242cf5c81561688d0562decdb67b1a8f4be43efe6aae59011ec9851e42a31b10e2197b3b99612a78198344456ac98d182343e4bf37237aef814e81e55f1fd10982cc3bb01368a20433a0ab3a4eded0bd8dff6f90bf319f613e28630f17d9e19f02236f6ff3ecab76108e6be16a5e3dbddb9d2aa230bebf61ccc7139a6febb32c30e8b3a9b133ef4a669414dd0f1d01112f964329dda30e2af3cf8183f4e76812056a8867021952d707fcc3b1eb6fcb84e7851c52ab4767c31cb2876dc70aa859a767cfd28dc1c0f4d3357b2f429ef192abecebadb573184a140cc819d98ac6125afab2c77aa80c52e58de3ffd9a88b39d0e73df27be42982787e36041dcefce1b5e464a4bc0abf7a3510245fe4e684502bf830c719d5aeae878e2a6ef0c5ad8e0b1f3f2b6416f559ef36109aaf6d0f7ddbbafa8dade86ba8857fbca44d13aa93e7f394279461268ffcd4e84b07505fee1f182f9e5a72bb6f4643b986fedbb95c03da3dd58ecc8855b21b25fef5c2968e7bc35734d7c0ab2c13ba2776641fde8be53c0a96045d9dfbe39fb47e446a3c262706b77f71d3cd40bcb8a8383471f24da3f71e1869af0e6af67e97d0bfa20a273cd1fd96e2fa0b8eccbd525bf5e468eecd03cfe194ddf9bfc2f9b025e8fa69b9aad4d564f537ad279969dab9514bdd79918f274b78c56afc4034c5b37d2dd052cfabbba231c43a66ce5cf672f7c62e19d2962ada2469019908d25f125256dee7a1cb62ed0ab3c018dfbfee660e72d80e1ec85a629bfff72160a59ca1c952176c62c49b078e6f58601df503fdd5f157e055d7ba4c45c45316323cad47a1affe3f8c9cb35021c105f359daf5df97bcf5740b04e0350fb30fc0c225117002196b054042d8a883e7dda72f4739789210e37897e70ee095f238b4bf680f823ff12801dfc9fb31b98f4d1f4a7585038e1573bee262b6cad813e7f0f167f2f707152f704d1387cd4a09003c93598dafaaa1410c5aac31f1738e601c0d28aebcaa33a2448bf7b5f090544fb686e6941001ac16aa925e8e9698d47213bbbe36d9d6626d0d0fd4b904fe86f05ecbc1c8baaad54fe5bd5802bdcb949b4253821ee1d2b35b05aefee8c6219c3c2e5b9030161d0aa0864f71ade0aedbb8934e4adf20f4f01573fafa760fe5b44a0b2e28bf762c9f647257258c05af9ab23dfdf1e4dda6612b28c783da36207f46cb846830cb069e81a423e1417f5ad13b4b037e3adab62c1d117c4bdbfa1abe61975eec940235af9766147f6e3cbf7931bcdd4fd1d8d5918ebf239274acd8f19ace346c0c5ca5da851ff573e18fa2e01f39f432b08c53edf382d711f1014d93733e44aafee1c2c061335a7ae91689d25ec257c9487362412fbccfa1d119b22eba83d624af02dc88bf8780868dca5e3e5023563b54d88a4dc23da149de006a56253edc63f67b5bc8a010f42dfd12a3fcf1e6dd5392786ca50c8cb7baeee5a7d71367ffb5ee14d63ba218196ed08da41b5bff180bb6290086b45b6b24d693185bf3420d28f4307cd269b7031245fed540a08a4ff3ec2c940ce2341e02d7bdc9d9f1809af464eca3c47b0dcee26e0e9f32085fadd38a8311e586337f96ce5c232afa1afae1e4395d9e3a3be9d6ae77fa01dfc23cfb9e5d545d0c0a2aaf76ecac07e94fa1e14db7da2d81e496edeeca612c07dcfae1b3bdfc941a11bcb8c41350b8d37914ea02484949520e97b74700c44d544553562af10b3dc5b17623237cfe57798e199131da9455b9b7a3ce92670beae369ebe5b6def4048a8f517bc847599b4d9a98db3ee2edfe0ca4a06814a614525716a6cf5afd808b48ed247beb471bb43985405af34d29adb15728f9ac626417f310909e62984878802e1fcf6f70d1e3d1e2d5bc1bb7c5273146b9e9bb6f679a6fbf003402da92d9df798bbc174485c5af6c4c08be8701e3f2af8c20b09342652c5502b9d647affeda19fcb7b89faadb5063ffddf9a79dc27bd5a51d777d27dbbe4865ca12e939730225365fd6842c341d0dfaec61caecc8df633fb6a516875e45e74196cee4190556496861141f39b7f79c453bacba5c8e484e02fe381ee49bf3e6e75fc4c864566ade4a63a151bf35d4b331f76860a0a2a3ea20e46fd2e6301456c"}, {0xa0, 0x18c, 0x8001, "6b927d5f8325cb989148ff3330b7b2768d541cd595792c0d170d3b69179524997809bc195b12dcdf1ce93681d9275197a86914e98de658e496a7108fa036e811e9bc9453fa13f20f80000b49d99bdaf2217282e3a8495f58764d29087fa25c59cd93c12f6bf6ea332eac3a788cecb4177bc7ccfde811b3c0e60ba6a7b06686a65cd1c0af0cebc734216f"}, {0xb8, 0x115, 0xffff, "e421dd6fa8ba09fd91b2dcb616a0a8fbba32a05378c5ebbd4ccbe6cf1d71905d7defcfd7607747ef088dee0dbb67362b89403152bd67fb3414217956fcfceceafd2b1b7d4c14a6b49eea6fed8cb9922569e8244a4f8db9b639ef801aec054cccdbcacce89a7c10beadf8fc6480bb344350e079bdb38e2ec876073a40989a63ef0d39ac138c7465c340ae1ea3bdf91a0dc22d0089b0da23d9fadece3f1fc96bc5b93a"}, {0x38, 0x104, 0x100, "07362bb47f10e4fab510f49748887befc0ea533ab87617c8ce4e358fcccaff36d1d6284023c053aa"}], 0x1438}, 0x40004) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:00 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x80, 0x0) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000000100)={0x10003, 0x1, 0x5, 0x4}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:48:00 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000200)={&(0x7f00000001c0), 0x8000, 0x1000, 0x401}, 0x18) listxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)=""/62, 0xfffffffffffffe2c) r3 = eventfd(0x0) creat(&(0x7f0000000240)='./file0\x00', 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r2, 0x28, &(0x7f0000000100)}, 0x10) 14:48:00 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r3, 0x0, 0x2, r1}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:48:00 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x100, 0x0) ioctl$KVM_GET_REGS(r3, 0x8090ae81, &(0x7f00000001c0)) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) fstat(r2, &(0x7f0000000140)) 14:48:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0663044001000500"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:00 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000000), 0x4) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:00 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000280)={&(0x7f00000002c0), 0xc, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="38010000100013070000ff0000000000e0000002000000000000000000000000000000000000000000000000007b1b70e8ebfc10e31d0a374139f96b5f0000000000000000000028b000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff000000003200000000000000000000000000ffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200656362286369706865725f6e756c6c2900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x208b}}, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0xfffffffffffffffe, r3}) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x8000, 0x0) getsockopt$inet_sctp_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f0000000180), &(0x7f00000001c0)=0x4) getpeername$tipc(r0, &(0x7f0000000080)=@id, &(0x7f0000000100)=0x10) 14:48:00 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/kvm\x00', 0x40100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = accept$inet6(0xffffffffffffffff, &(0x7f0000000c00)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000c40)=0x1c) setsockopt$inet6_dccp_buf(r3, 0x21, 0xe, &(0x7f0000000c80)="566f55ee6ea3d4a60ed05e3ccf2ba0ab8cbc02438f3545a5c427695ca890575575a45a38fbaaaf5c2f02e3bf75650ff63449b2dfd61ed1ea768f69df8702f8442edcb4918b68b94d4f3494928d92ffd6a46984708e61d717f8e318e9a4c4e13fb9fa9108e92bb639ba72196f64c5b60fa9b3e9f1c5f70e74a0c6e4220d86228debb39a98a4bd6ae8aa68050272a1a7f67c0e57b4586799bf4a917bd49c826bf8ca02065695eb11ff0c772c23ed82a1e7baa36ded0b16ca9a874203e74c8b3420b2a625e85a8cb67b9f92bdfa2bed2c2099815802ab845ff86eaddc0725a31efbe425b64465", 0xe5) r4 = syz_open_dev$vbi(&(0x7f0000000b40)='/dev/vbi#\x00', 0x2, 0x2) ioctl$KVM_GET_DEVICE_ATTR(r4, 0x4018aee2, &(0x7f0000000bc0)={0x0, 0x401, 0x5, &(0x7f0000000b80)}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getresgid(&(0x7f0000000a80), &(0x7f0000000ac0)=0x0, &(0x7f0000000b00)) setgid(r5) r6 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0xec, 0x8200) ioctl$DRM_IOCTL_MAP_BUFS(r6, 0xc0186419, &(0x7f0000000100)={0x7, &(0x7f0000000180)=""/193, &(0x7f0000000800)=[{0x8, 0xff, 0xb90, &(0x7f0000000280)=""/255}, {0xfff, 0x8b, 0x0, &(0x7f0000000380)=""/139}, {0x4, 0x9f, 0x6, &(0x7f0000000440)=""/159}, {0xc774, 0xd6, 0x8, &(0x7f0000000500)=""/214}, {0xfffffffffffffff9, 0xe8, 0x8, &(0x7f0000000600)=""/232}, {0x986, 0x4b, 0x0, &(0x7f0000000700)=""/75}, {0xe24, 0x7c, 0xfc, &(0x7f0000000780)=""/124}]}) fsetxattr$trusted_overlay_opaque(r0, &(0x7f00000008c0)='trusted.overlay.opaque\x00', &(0x7f0000000900)='y\x00', 0x2, 0x0) r7 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r7, 0x0, 0x2, r7}) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d80)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r6, &(0x7f0000000ec0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000e80)={&(0x7f0000000e00)={0x4c, r8, 0x302, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x38, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000980)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r6, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x1c, r9, 0x800, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x4800) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r7, 0x0, 0x2, r7}) 14:48:00 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x200040, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r3, 0x501, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8800000000000000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40010}, 0x40) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0xffffffffffff2f4b, 0x2, r5}) 14:48:00 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000000)=0x9) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) [ 1576.793643] binder_alloc: 31810: binder_alloc_buf, no vma [ 1576.799238] netlink: 72 bytes leftover after parsing attributes in process `syz-executor4'. [ 1576.799265] binder: 31810:31811 transaction failed 29189/-3, size 24-8 line 2973 [ 1576.817344] binder: 31810:31811 Release 1 refcount change on invalid ref 327681 ret -22 [ 1576.849792] irq bypass consumer (token 0000000070124001) registration fails: -16 14:48:00 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x4, 0x0) ioctl$TIOCNXCL(r0, 0x540d) openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x203, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1576.901244] netlink: 72 bytes leftover after parsing attributes in process `syz-executor4'. 14:48:01 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x8000, 0x0) getsockopt$packet_buf(r3, 0x107, 0x3, &(0x7f0000000140)=""/45, &(0x7f0000000180)=0x2d) 14:48:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x5, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:48:01 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x101001, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000100)={0x0, 0x2}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={r3, 0xc4, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0x10000, @remote, 0x8}, @in6={0xa, 0x4e22, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4}, @in6={0xa, 0x4e21, 0x6, @local, 0x3}, @in6={0xa, 0x4e24, 0xfff, @mcast1, 0x2}, @in6={0xa, 0x4e24, 0x100, @dev={0xfe, 0x80, [], 0x2b}, 0x5}, @in6={0xa, 0x4e24, 0x4, @mcast2, 0x9}, @in6={0xa, 0x4e23, 0x38000000000000, @dev={0xfe, 0x80, [], 0x23}, 0x59}]}, &(0x7f00000002c0)=0x10) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r6, 0x3, 0x2000000000000, r6}) shutdown(r4, 0x1) 14:48:01 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) sigaltstack(&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:48:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:01 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x400400, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)="a20b6d15d06ffcc499b47700cef581c948efcb8efa64402bd39219dbf70e63af827e1c949f0a805f736f12a6c4c6f516374511edb6a5d475eff7dd429266e70d0e0f9c69b9c97ff95c0354b26cb06b9b6029c6e8ff158c82e583b8a9488080c5c2e3e9a095affde4404d5f2a6a40777a608b87515bc9bb231b88f983ce207e955061c5b95b61", 0x86}, {&(0x7f0000000180)="36e6e83b7757e992c26cb9d5bbcba0f350434c45c95fd4947a507dab91163438632295fbaebb0a4f384ed24bed2d7d0445ec43e901a124c4df0f8d8f6cbaa295a74e", 0x42}, {&(0x7f0000000280)="f152ca138f8e2696e7165788626ed02311111591a15ad6a63959eaef2b2e275ec279d74c39866c36b6075bf6dfb44f33751c48ded9eca07166310828a95e3f9adbed149019287d079a", 0x49}, {&(0x7f0000000300)="073467ca2a96ebc146c78ae74f3d56ef1066f09dc2019af16ba94d312fea4898b961347e7c2f06b760fef30271af40bce077bfa32495050a731c24ed0dcfd9d6c008409a79e1a29a695f83620499bb9196441eae43c173e186a69ab0bdbf1240d60f048e1972592fcba61bc78f755d4fd4613c772d48c5da63edc0928d3f1e531be19e4c6cee311b3e5b7abf0f065969680c1a93ffeea05f7a864e81ba5658f8b7cde8dc963dd5863805b18eeccb40063ae570e8a999d594ad8bbf4a194878ee428ffe19f1f72a30ef36", 0xca}], 0x4, 0xa) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) 14:48:01 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:01 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x62a4, 0x40) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x2, r2, 0x4}) 14:48:01 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x80000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) [ 1577.767472] binder: undelivered TRANSACTION_ERROR: 29189 [ 1577.946563] binder: 31870:31871 got transaction to context manager from process owning it [ 1577.955271] binder: 31870:31871 transaction failed 29201/-22, size 24-8 line 2825 [ 1577.983073] irq bypass consumer (token 000000009b51d462) registration fails: -16 14:48:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x101000, 0x0) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000180)=""/99) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x82000, 0x0) socket(0x1b, 0x5, 0x9) ioctl$VIDIOC_LOG_STATUS(r1, 0x5646, 0x0) setsockopt$inet6_dccp_buf(r1, 0x21, 0xf, &(0x7f0000000040)="30cab60c4fb92653f4a05d7c8d60d78534f2812003d9f0ba8bc9eb071dbbf3aac4485f3db3b0e5c8d57bc9", 0x2b) ioctl$SNDRV_CTL_IOCTL_PVERSION(r1, 0x80045500, &(0x7f0000000340)) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) io_setup(0x2, &(0x7f00000000c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000300)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xffffffff00000000, r0, &(0x7f0000000280)="ef3c7f6d3b9266c824843c5861431db63f8be9427305879109e7cc17f8033d700742f4891113b08c9b58c2d1890010364c66fba3b722220d5f57f6c85cd893cf6db2075339890805ee7df9fb", 0x4c, 0x10001, 0x0, 0x1, r1}]) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) [ 1578.084757] binder: 31870:31871 Release 1 refcount change on invalid ref 1 ret -22 14:48:02 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video2\x00', 0x2, 0x0) 14:48:02 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000400), &(0x7f0000000440)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r2) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc0\x00', 0x2, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r4, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="27130066", @ANYRES16=r5, @ANYBLOB="200525bd7000ffdbdf251000000000000003ff000000080004000600000008000400000000000c00010008000b8a47a39ebebcc28ca2238a89e338cb0073697000a7f3878dd5c3a1a70122728e30fe514aff93a04bd8733dff8702fd667e84bb008df04b7103869deb9901c10d8958856649a8722c79463d5ea39aa239e1a9d2e1c39f7e01c12ae4555a61b3f8df4e1d525977a67cefe145b29cd5972d992fac6d193e810a0435ff60afc417dd4fc9afa7f5f3f4601419a1670ed70ef7d7c542d5c676f25e0314f58b81d53032842dc0cbbc2d76525e1ac7313123ec7ead"], 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) ioctl$sock_inet_SIOCRTMSG(r4, 0x890d, &(0x7f0000000200)={0x0, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x2b}}, {0x2, 0x4e22, @empty}, {0x2, 0x4e21, @multicast2}, 0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)='veth0_to_team\x00', 0x122, 0xffffffffffffff81, 0x101}) r6 = eventfd(0x5) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r6, 0x0, 0x2, r6}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r6, 0x0, 0x2, r6}) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$RTC_RD_TIME(r4, 0x80247009, &(0x7f0000000280)) getsockopt$inet_mreqn(r7, 0x0, 0x24, &(0x7f0000000080)={@dev}, &(0x7f0000000100)=0xc) ioctl$sock_inet_SIOCGIFNETMASK(r3, 0x891b, &(0x7f0000000340)={'bridge_slave_0\x00', {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}}) 14:48:02 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000000)={0x1, r2, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) socket$packet(0x11, 0x2, 0x300) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:48:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x200000010000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) 14:48:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x400) r2 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000aa89a5e1a81ba0000000000000000000000001f00000000000000000000180000000000000008", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$F_GET_FILE_RW_HINT(r3, 0x40d, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) [ 1578.323165] binder: undelivered TRANSACTION_ERROR: 29201 14:48:02 executing program 4: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x4000, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000100)=0x11, 0x4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x8000) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000080)={r3, 0x0, 0x2, r3}) [ 1578.527203] binder_alloc: 31905: binder_alloc_buf size 2305843009213693952 failed, no address space [ 1578.536729] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1578.545869] binder: 31905:31906 transaction failed 29201/-28, size 1729382256910270464-576460752303423488 line 2973 14:48:02 executing program 2: r0 = syz_open_dev$amidi(&(0x7f0000000180)='/dev/amidi#\x00', 0x10008, 0x80400) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x400000, 0x0) ioctl$RNDADDTOENTCNT(r4, 0x40045201, &(0x7f0000000100)=0x800) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0xffffffffffff2f4b, 0x2, r3}) [ 1578.666526] binder: 31905:31906 Release 1 refcount change on invalid ref 1 ret -22 14:48:02 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) r4 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x0, 0x800) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') sendmsg$TEAM_CMD_OPTIONS_GET(r4, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000004561b13067a6be8e09d4697d0b9e5c9f651173e1eed378f6924f3f74e64f2240dbc6d0d40d8601e225bdf6994efcb0c8552ba4656e6b00bd774a1123a594595dc66cf278c351f6bbef8aef3aba4dfcb1aecc23f4d171a18b395bfd1a1199cbca556189d8c3e95091fb3271e300c2e0635f8a03a22d330964c8e98967bff2479116b8000000000000", @ANYRES16=r5, @ANYBLOB="220528bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x4080}, 0x24000000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f0000000280)={0x0, 0x5, 0x30, 0x100, 0x100000000}, &(0x7f00000002c0)=0x18) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f0000000300)={r6, 0x1, 0x0, 0xffffffff, 0x2}, &(0x7f0000000340)=0x18) 14:48:02 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000000)={0xb6d7}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:48:02 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x1, 0x0, 0x3, 0xffffffffffffffff}) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000040)={r1, 0xffffffff}) 14:48:03 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x2, 0x2) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x4e24, @loopback}}, 0x0, 0x4e, 0x0, "026b42a036507707f738c0972bcdd383a769d92c33d7725e63a2927cd7a9b8b7752f93533bafd981de0a14ac948eb20d00c8b267a7a62af155592a8221b67d6f46276c6a4538ca4dddb615b58508b0a0"}, 0xd8) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) setsockopt$TIPC_IMPORTANCE(r3, 0x10f, 0x7f, &(0x7f0000000200)=0x5, 0x4) 14:48:03 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) ioctl$KDDISABIO(r1, 0x4b37) arch_prctl$ARCH_SET_GS(0x1001, 0x500c338) 14:48:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vsock\x00', 0x40200, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r3, 0x4004ae8b, &(0x7f00000001c0)={0x3d, "9b51cb090ac2eac04905b8d72df8b82c21271b67850a8c23dec4ebb65c65719245849c4ab656a03135b99097a7c2383bb60e32409b1d8f56abc59ae65c"}) r4 = open(&(0x7f0000000080)='./file0\x00', 0x4100, 0x60) write$FUSE_NOTIFY_POLL(r4, &(0x7f0000000100)={0x18, 0x1, 0x0, {0x4}}, 0x18) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0xffffffffffff2f4b, 0x2, r5}) 14:48:03 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) r3 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0xfa0b, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000140)={0x3f1, 0x1, 0x3f, 0xfffffffffffffffd, 0x8e}, 0xc) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:48:03 executing program 2: r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='nat\x00', 0xffffffffffffff9c}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='timers\x00') ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000280)=ANY=[@ANYBLOB="0300000000000000ffff0000000000000200100000000080", @ANYRES32=r1, @ANYBLOB="0000000043f4ffffffffffff00000000000000800000000000000000fe862056325ed05ccba458309ac0f30b793c7ac726b127d2b1259303f35b5ee31057279ac580323743d35f870f9a7a8a07ae9a4074840238b167f09dc0cd5a40278c0db77dc1367d3f996a43f5457b86b9b7d75afe050ac37417cf8bda249fdc57d41afb255ebaf59ca3edb67f16c7b2670320", @ANYRES32=r2, @ANYBLOB="00000000018000000000000000000000000000000000000000000000"]) r3 = msgget$private(0x0, 0x90) msgrcv(r3, &(0x7f0000000400)={0x0, ""/146}, 0x9a, 0x3, 0x800) openat$vhci(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhci\x00', 0x280000, 0x0) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x4, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1579.397572] Unknown ioctl 1074048651 14:48:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000f1e8f8055608bdfd00000000000800000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="066304400100000065a47311de1f53401974589cf34051ade9559e9f32b3ea6f6ba099bb01b17f23abbd863260e76009ea31a99efca257e1dae7d5f699a5124b90b75c7444cdbf194d6870d041d42410fd6fe28da6b6bb96215250378f173b0f37207c3f0cf1218deda221190b22786249"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1579.448941] binder: undelivered TRANSACTION_ERROR: 29201 [ 1579.501342] Unknown ioctl 1074048651 14:48:03 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) io_setup(0x80, &(0x7f0000000080)=0x0) r4 = syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0x7, 0x200) setsockopt$inet6_MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000200)={{0xa, 0x4e20, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4}, {0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, [], 0x1a}}, 0x96, [0x6, 0x6, 0x5, 0x0, 0x4055, 0x508, 0x81, 0x30]}, 0x5c) io_cancel(r3, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0x2, r0, &(0x7f0000000100)="e7a22f2d528d666c16e48664e015cdf75813d4fcc17ec75b79", 0x19, 0xe52d, 0x0, 0x2, r2}, &(0x7f0000000180)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:03 executing program 2: socketpair(0x2, 0x7, 0x5, &(0x7f0000000000)) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x44) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000001c0)={'nat\x00', 0x0, 0x3, 0x1e, [], 0x0, &(0x7f0000000180), &(0x7f00000000c0)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:03 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x1) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f00000001c0)={0x1f0, r4, 0x4, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8494}]}, @TIPC_NLA_MEDIA={0x11c, 0x5, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x674f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x388ce20f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfea5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000000}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x800000000000}]}]}, @TIPC_NLA_MEDIA={0xa4, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}]}]}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x4}, 0x44005) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0x0, 0x2, r5}) 14:48:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={0x0, 0x80000, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000100)={'syz1', "8548cf3727e022eb6f8461078d840c265c146cd29e"}, 0x19) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:48:03 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000001380)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_G_FREQUENCY(r2, 0xc02c5638, &(0x7f0000000300)={0x1}) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f00000001c0)=0xc) write$P9_RLINK(r2, &(0x7f0000000200)={0x7, 0x47, 0x1}, 0x7) fstat(r2, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000000)='./file0\x00', r3, r4) r5 = eventfd2(0x0, 0x4000000080000) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r5}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000240)={0x0, 0x0, 0x0, r5}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r5, 0x4}) r6 = msgget$private(0x0, 0x480) msgctl$IPC_INFO(r6, 0x3, &(0x7f0000000340)=""/4096) ioctl$KVM_REINJECT_CONTROL(r2, 0xae71, &(0x7f0000000140)={0x6c86}) accept4$unix(r2, &(0x7f00000013c0)=@abs, &(0x7f0000001340)=0x6e, 0x0) [ 1579.963335] binder_alloc: 31971: binder_alloc_buf size 8796093022208 failed, no address space [ 1579.972347] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1579.981257] binder: 31971:31988 transaction failed 29201/-28, size 8796093022208-0 line 2973 14:48:04 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) ioctl$KVM_PPC_ALLOCATE_HTAB(r1, 0xc004aea7, &(0x7f0000000080)=0x6) 14:48:04 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x98d, 0xc02c0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000200)={0x79, 0x0, [0x3, 0x380000000, 0x9, 0x3]}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x3) socketpair(0x17, 0x5, 0x101, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCDARP(r5, 0x8953, &(0x7f0000000180)={{0x2, 0x4e24, @multicast2}, {0x0, @dev={[], 0x1f}}, 0x20, {0x2, 0x4e22, @broadcast}, 'veth0_to_bond\x00'}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) [ 1580.044069] binder: 31971:31993 Release 1 refcount change on invalid ref 1 ret -22 14:48:04 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1580.277163] binder: undelivered TRANSACTION_ERROR: 29201 14:48:04 executing program 5: r0 = memfd_create(&(0x7f0000000000)='+\x8b\x8a\x16<\xee\x7f\x04\x00\x00\x00\x00\x00\x00\x04\x00K\x13\xadO', 0x3) write$binfmt_misc(r0, &(0x7f0000000540)=ANY=[@ANYRES32], 0xfffffda2) fcntl$addseals(r0, 0x409, 0x8) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd2(0x0, 0x80000) mq_unlink(&(0x7f0000000000)='securityvmnet1\x00') ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) r4 = accept(0xffffffffffffffff, &(0x7f0000000180)=@ethernet={0x0, @remote}, &(0x7f00000004c0)=0xfffffffffffffc8d) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000500)=0xfff, 0x4) r5 = syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x0, 0x2) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) ioctl$DRM_IOCTL_CONTROL(r5, 0x40086414, &(0x7f0000000200)={0x3, 0x10001}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) 14:48:04 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x58000, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f00000001c0)=[@in={0x2, 0x4e24, @multicast1}, @in={0x2, 0x4e21, @multicast1}, @in6={0xa, 0x4e24, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8001}], 0x3c) syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x5, 0x200) r3 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhci\x00', 0x8280, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0xffffffffffff2f4b, 0x2, r4}) 14:48:04 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x101000, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000280)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000080)=0xe8) sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@bridge_dellink={0x3c, 0x11, 0x200, 0x70bd28, 0x25dfdbff, {0x7, 0x0, 0x0, r1, 0x604, 0x801}, [@IFLA_ADDRESS={0xc, 0x1, @remote}, @IFLA_WEIGHT={0x8, 0xf, 0x1}, @IFLA_LINKMODE={0x8, 0x11, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000800}, 0x4004000) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:04 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x4) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) r3 = accept4$inet(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) ioctl$sock_inet_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000100)={'ip6tnl0\x00', {0x2, 0x4e20, @local}}) r4 = accept4(r3, &(0x7f0000000200)=@alg, &(0x7f0000000280)=0x80, 0x800) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r4, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r5, 0x200, 0x70bd26, 0x25dfdbfe, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x40) 14:48:04 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer2\x00', 0x81, 0x0) ioctl$EVIOCGMTSLOTS(r3, 0x8040450a, &(0x7f0000000200)=""/183) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = eventfd(0x0) r5 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x1, 0x800) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r5, 0x84, 0xc, &(0x7f0000000100), &(0x7f0000000180)=0x4) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r4}) 14:48:04 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x3, [], 0x0, &(0x7f00000000c0), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000040)=0x1e) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:05 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'kw(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000006c80)=[{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000800)="1519cae0c972e6a136f2ce4ec04f7c6c1d6b", 0x12}], 0x1}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000002e40), 0x3ffff79, 0x0, 0x0) 14:48:05 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) r3 = dup(r2) sendmsg$key(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB="0209fb0b3500000028bd7000fcdbdf251e00090020070000b9efb72e9ed5cc4dcb5478f9955a3bdcdb1f77ac1f68e0b8584d6434bb2fa79de390d720af0892a557bd6eefd470e12f4e94f486000d36e198e69154520ea5a263994f80ee5f2382b29896bcdeee7fc56469b8226a5159ebfda1c276b0a7abb5dd22a9679e23188ecb577ffc0353afc766e367c106de3880ecc068c0cc2ed7bedec144e9bc5ebecaf9afd79cbeee07fc3707e8884f183b4c5e17e837d43642363d19a01e24caa1659a4524226e876d409ed5bde4ea33d66dda7b1c690c4573e0d3180151d0b260d18b616401d2fb46982e2801f12823670000000002000b00810000000700000000000000010016004e2200000f0000005803000017b5de0daef4528bd1ee94de14a6290779a38bd7795e1a5afcd4e80199d39ee5c028b635c2f766b881d57f3de47095514a4a69fdf212a2637aa66429786383c7fbfde34b3b344f0c94bf6a77ba96c5f6998f184ee5a2fa116d8eb4bc6574ce85614c53b6967db12a065d800000000000010015004e21000002000000563100000100008000000000"], 0x1a8}}, 0x800) ioctl$TCGETS(r3, 0x5401, &(0x7f0000000000)) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:48:05 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000180)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x20000, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) ioctl$TUNSETIFINDEX(r4, 0x400454da, &(0x7f0000000240)=r5) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:48:05 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x200, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000000)=0xc5, 0x4) 14:48:05 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x7, 0x44000) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r1, 0x114, 0xa, &(0x7f0000000100)={0x2, 'U('}, 0x3) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:48:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x1, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, r0, 0x0, 0xd, &(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) fcntl$lock(r2, 0x6, &(0x7f0000000180)={0x0, 0x3, 0x1, 0x4, r5}) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 1581.307865] binder: send failed reply for transaction 434 to 32015:32016 [ 1581.315911] binder: undelivered TRANSACTION_COMPLETE [ 1581.321173] binder: undelivered TRANSACTION_ERROR: 29189 14:48:05 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'kw(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000006c80)=[{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000800)="15", 0x1}], 0x1}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000002e40), 0x3ffff79, 0x0, 0x0) 14:48:05 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_pts(r0, 0x200000) lsetxattr$trusted_overlay_redirect(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f0000000080)='./file0\x00', 0x8, 0x3) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r0) 14:48:05 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) r3 = accept4$inet(0xffffffffffffff9c, &(0x7f00000001c0)={0x2, 0x0, @dev}, &(0x7f0000000200)=0x10, 0x800) shutdown(r3, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x408000, 0x0) openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x80, 0x0) setsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000140)=0x5, 0x2) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000240)) ioctl$RTC_RD_TIME(r4, 0x80247009, &(0x7f0000000040)) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000180)=0x9, 0x4) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000280)={0x4, 0x0, 0x1000000, r2, 0x4}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000340)={[{0x10001, 0x1, 0xb84, 0x3, 0x200, 0x7, 0x5f938c, 0xc923, 0x7fff, 0x2, 0x0, 0x119, 0x4}, {0x211, 0x6, 0x4, 0x1000, 0x49bc, 0x6, 0x80000000, 0x0, 0x43796dcc, 0x1, 0x800, 0x7fff, 0x100000001}, {0x4, 0x0, 0x3, 0x2, 0x5, 0x6, 0x9, 0x1, 0x9, 0x8, 0xd2, 0x80000000, 0x80}], 0x5}) 14:48:05 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) 14:48:05 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x400, 0x4000000000010001, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) r3 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhci\x00', 0x2400, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000380)={r2, 0x20, 0x2, r2}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x20, &(0x7f0000000100)=[@in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e21, @broadcast}]}, &(0x7f0000000240)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000280)={r4, 0x1}, 0x8) setsockopt$inet_MCAST_LEAVE_GROUP(r3, 0x0, 0x2d, &(0x7f00000002c0)={0x1, {{0x2, 0x4e24, @rand_addr=0x4}}}, 0x88) ioctl$DRM_IOCTL_GET_SAREA_CTX(r3, 0xc010641d, &(0x7f0000000200)={0x0, &(0x7f00000001c0)}) connect$inet(r3, &(0x7f0000000140)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) 14:48:05 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'broute\x00', 0x0, 0x1000020000000, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x612000, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000040)={0x0, {0x2, 0x4e22, @empty}, {0x2, 0x4e24, @multicast1}, {0x2, 0x4e22, @broadcast}, 0x10, 0x0, 0x0, 0x0, 0xd8, &(0x7f0000000000)='tunl0\x00', 0x9, 0x3, 0x7}) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:05 executing program 3: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) write$P9_RLOCK(r0, 0x0, 0x0) 14:48:06 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x200000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0xd000) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dlm-monitor\x00', 0x6100, 0x0) getsockopt$inet_mreqsrc(r3, 0x0, 0x27, &(0x7f00000002c0)={@remote, @remote, @broadcast}, &(0x7f0000000340)=0xc) setsockopt$IP_VS_SO_SET_ZERO(r3, 0x0, 0x48f, &(0x7f0000000380)={0x84, @local, 0x4e20, 0x1, 'none\x00', 0x2, 0x9, 0x3b}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f00000003c0)={0x2f, @multicast1, 0x4e24, 0x0, 'dh\x00', 0x2, 0xffff, 0x4f}, 0x2c) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x600040, 0x0) ioctl$DRM_IOCTL_GET_MAGIC(r4, 0x80046402, &(0x7f0000000040)=0x1) ioctl$VIDIOC_SUBDEV_G_SELECTION(r4, 0xc040563d, &(0x7f00000001c0)={0x1, 0x0, 0x0, 0x2, {0x5, 0x1, 0x4, 0x3}}) write$vnet(r4, &(0x7f0000000200)={0x1, {&(0x7f0000000180)=""/38, 0x26, &(0x7f00000001c0), 0x3, 0x4}}, 0x68) ioctl$GIO_UNIMAP(r4, 0x4b66, &(0x7f0000000440)={0x1, &(0x7f0000000400)=[{}]}) socket$bt_bnep(0x1f, 0x3, 0x4) 14:48:06 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = dup(0xffffffffffffff9c) write$binfmt_misc(r0, &(0x7f0000000000)={'syz1', "5369765390c9e0f1543859d9f94846a2e53aec5be7c40367156abb68fa8cc9065e2715168866cd8c2031dff9a8c7a5eda54ca357c92c0a9114c153d354abae1b9a593f7b360b480e381de9329c8f1c97f98a400fbbaa8379670609a8de9870b3ef8113235a46b219f02dd34bc372f4bcf87fde5142d82c02c03423b2d6a10d947c02e40b860f157e3bdcb9de6b6f0a65bff62ea446d63aa97688c60542b6c5ec343a89283406d90ec36143b8ac8471faf6093a96a2d2db1d1431cb03fe8c1c6b2d07426cf040ba627004c8aa263135c2a0750525da987190c262bb90544ddae8c2dbad050f3e91b25b0494f2b16adbf868"}, 0xf5) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:06 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vcs\x00', 0x400, 0x0) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x301003, 0x0) linkat(r4, &(0x7f0000000100)='./file0\x00', r5, &(0x7f00000001c0)='./file0\x00', 0x1000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:48:06 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) write(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(r0, 0x0, 0x0) 14:48:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x0) ioctl$VHOST_RESET_OWNER(r1, 0xaf02, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) close(r1) eventfd(0x2c3) 14:48:06 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) r3 = socket(0xc, 0x804, 0xd3a) sendto$inet6(r3, &(0x7f0000000240)="f8e2709b2f737ef575d3da317b5b33d2b3884de852c602595452b8daadd355ef1c1b75eab95474ad41c17a6559eacc2fa62c58d30c0de5874d153ced317ae5a309753ac0e5d7eef8bd5e30c7ad3a7b8cc58ddd24937440330e561a00f406b2b7d1fc5236e23d627c25fb07e633dc1738dc9dcb", 0x73, 0x4000, &(0x7f0000000140)={0xa, 0x4e24, 0x536, @mcast1, 0x9}, 0x1c) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x88200, 0x0) syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x0, 0x2) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r4, 0x10f, 0x84, &(0x7f0000000200), &(0x7f0000000180)=0xfffffffffffffdc0) 14:48:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f0000000280)="4eadc14d2640797450a6a8cadba6dbea341794a86663e3617853dc38b7b3d0f6f1df3d8a5ed22e039e457216853055678709", 0x32, 0xfffffffffffffffa) r3 = add_key(&(0x7f0000000440)='pkcs7_test\x00', &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$search(0xa, r2, &(0x7f00000003c0)='syzkaller\x00', &(0x7f0000000400)={'syz', 0x2}, r3) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x200001, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r4, 0x0, 0x48b, &(0x7f00000000c0)={0x1, 'lapb0\x00', 0x3}, 0x18) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/rtc0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0663f54001000000"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f0000000500)={0x5, 0x80, 0x1c}) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x2) [ 1582.355442] binder: send failed reply for transaction 438 to 32066:32068 [ 1582.368734] binder: undelivered TRANSACTION_COMPLETE [ 1582.374105] binder: undelivered TRANSACTION_ERROR: 29189 14:48:06 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f0000000000)=""/142) 14:48:06 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = fcntl$dupfd(r0, 0x406, r1) setsockopt$CAIFSO_REQ_PARAM(r2, 0x116, 0x80, &(0x7f0000000400)="5a4ccd96f28b08179e5a5a46266461a60d808dc7a1d66db3be769ff62ba57b1269b5c00e88f15ebbd549f09746ef21bef1975933d13410d2ca30a6962cac7e62465f7ce2bf9a6b62b57e742d0d8cf0fdb61833506572481e962c5572bb789831803bf4f6c6bb585a8f601ddf62858b1ce96aca101ed9d5df2974c71e95", 0x7d) r3 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r4 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r3, 0x6) connect$inet(r4, &(0x7f0000000180)={0x2, 0x8000000000004e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r5 = accept(r3, 0x0, 0x0) close(r4) close(r5) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x24e000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = eventfd(0x0) r8 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x0, 0x2) ioctl$TUNGETSNDBUF(r8, 0x800454d3, &(0x7f0000000200)) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140)={0x0, 0x1}, &(0x7f0000000180)=0x8) ioctl$FICLONE(r6, 0x40049409, r8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r8, 0x84, 0x75, &(0x7f00000001c0)={r9, 0x80000000}, 0x8) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r7, 0x0, 0x2, r7}) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r8, 0x12, 0x2, &(0x7f0000000480)=""/243, &(0x7f00000003c0)=0x30a) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r7, 0x0, 0x2, r7}) 14:48:06 executing program 3: perf_event_open(&(0x7f0000940000)={0x2, 0x5e, 0xee6a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000001600)=[{0x5}], 0xc}}], 0x488, 0x0) [ 1582.608360] binder: 32128:32129 transaction failed 29189/-22, size 24-8 line 2834 14:48:06 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)=0x0) move_pages(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000ffc000/0x4000)=nil], &(0x7f0000000080)=[0x94b, 0x3ff, 0x98], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], 0x6) 14:48:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r3) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1582.868956] binder: undelivered TRANSACTION_ERROR: 29189 14:48:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x4082, 0x0) syz_open_dev$admmidi(&(0x7f0000000140)='/dev/admmidi#\x00', 0x40, 0x80000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) timerfd_create(0xf, 0x800) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x400000, 0x0) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x100000001) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x4, r2}) 14:48:07 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) recvmmsg(r2, &(0x7f0000003800)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @remote}}}}, 0x80, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/66, 0x42}], 0x1}, 0x6fb4559}, {{&(0x7f0000000240)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000340)=""/134, 0x86}, {&(0x7f0000000400)=""/249, 0xf9}, {&(0x7f0000000500)=""/147, 0x93}, {&(0x7f00000005c0)=""/4096, 0x1000}], 0x4, &(0x7f00000015c0)=""/158, 0x9e}, 0x9}, {{&(0x7f0000001680)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f00000027c0)=[{&(0x7f0000001700)=""/70, 0x46}, {&(0x7f0000001780)=""/4096, 0x1000}, {&(0x7f0000002780)=""/24, 0x18}], 0x3, &(0x7f0000002800)=""/37, 0x25}, 0x6}, {{&(0x7f0000002840)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000002d80)=[{&(0x7f00000028c0)=""/213, 0xd5}, {&(0x7f00000029c0)=""/215, 0xd7}, {&(0x7f0000002ac0)=""/161, 0xa1}, {&(0x7f0000002b80)=""/70, 0x46}, {&(0x7f0000002c00)=""/57, 0x39}, {&(0x7f0000002c40)=""/17, 0x11}, {&(0x7f0000002c80)=""/198, 0xc6}], 0x7, &(0x7f0000002e00)=""/113, 0x71}, 0x1}, {{&(0x7f0000002e80)=@generic, 0x80, &(0x7f0000003180)=[{&(0x7f0000002f00)=""/48, 0x30}, {&(0x7f0000002f40)=""/159, 0x9f}, {&(0x7f0000003000)=""/89, 0x59}, {&(0x7f0000003080)=""/227, 0xe3}], 0x4, &(0x7f00000031c0)=""/111, 0x6f}}, {{0x0, 0x0, &(0x7f00000033c0)=[{&(0x7f0000003240)=""/168, 0xa8}, {&(0x7f0000003300)=""/151, 0x97}], 0x2, &(0x7f0000003400)=""/59, 0x3b}, 0x6}, {{0x0, 0x0, &(0x7f0000003600)=[{&(0x7f0000003440)=""/54, 0x36}, {&(0x7f0000003480)=""/17, 0x11}, {&(0x7f00000034c0)=""/127, 0x7f}, {&(0x7f0000003540)=""/189, 0xbd}], 0x4}, 0x8001}, {{&(0x7f0000003640)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f0000003780)=[{&(0x7f00000036c0)=""/165, 0xa5}], 0x1, &(0x7f00000037c0)=""/6, 0x6}, 0x9}], 0x8, 0x40002040, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x6, &(0x7f0000003a00)="8e5a13a7783c19555f24a3f724705c8931b3d27afc0ea380d1e09c15dc3387d1bcdf", 0x22) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:48:07 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x6) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:48:07 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000000)) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x40, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = gettid() move_pages(r1, 0x0, &(0x7f0000000000), &(0x7f00000000c0)=[0x1, 0xf575, 0x1000, 0x9a5, 0x7b, 0x9, 0xfffffffffffffffd], &(0x7f0000000080), 0x8000) 14:48:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x40, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:07 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x242803, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x200, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000140)={0x8, @tick=0x2, 0x0, {0x1, 0x4}, 0x3, 0x0, 0xf}) 14:48:07 executing program 2: r0 = syz_open_dev$vivid(&(0x7f0000000040)='/dev/video#\x00', 0x3, 0x2) ioctl$VIDIOC_QUERYMENU(r0, 0xc02c5625, &(0x7f0000000080)={0x5, 0x3, @name="0e7a8f4e12669cfaf95e78f3cfc1193be3a7c369809c6fdf9ce2b7bf8595d6f3"}) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000000)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:07 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x80, 0x0) ioctl$RTC_IRQP_SET(r3, 0x4008700c, 0x19d0) r4 = eventfd(0x8) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x1000000, 0x2, r3}) setsockopt$sock_void(r2, 0x1, 0x1b, 0x0, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:48:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x4040, 0x0) write$P9_RRENAME(r3, &(0x7f0000000180)={0x7, 0x15, 0x1}, 0x7) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) r4 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x6, 0x8400) write$P9_RRENAMEAT(r4, &(0x7f0000000100)={0x7, 0x4b, 0x1}, 0x7) [ 1583.932367] binder: send failed reply for transaction 443 to 32159:32160 [ 1583.940017] binder: undelivered TRANSACTION_COMPLETE [ 1583.945381] binder: undelivered TRANSACTION_ERROR: 29189 14:48:08 executing program 3: fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001540)={0xffffffffffffff9c, 0x10, &(0x7f0000001500)={&(0x7f0000000500)=""/4096, 0x1000}}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x1000000105085) add_key(0x0, &(0x7f0000000140)={'syz'}, 0x0, 0x0, 0xfffffffffffffff9) fcntl$setsig(0xffffffffffffffff, 0xa, 0x14) socket$inet_tcp(0x2, 0x1, 0x0) io_setup(0x407, &(0x7f0000000380)=0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat(r0, &(0x7f0000000000)='./file0\x00', 0x224800, 0x40) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000001580)={{{@in6=@remote, @in6=@loopback}}, {{@in=@multicast2}, 0x0, @in=@empty}}, &(0x7f0000000440)=0xe8) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) mlockall(0x2000000001) request_key(0x0, 0x0, 0x0, 0xfffffffffffffffb) syz_open_dev$loop(0x0, 0x8, 0x0) io_submit(r1, 0x1, &(0x7f00000017c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0xffffff47}]) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) add_key$keyring(&(0x7f00000005c0)='keyring\x00', &(0x7f0000000600)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) 14:48:08 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000000)) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:08 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x1000000000005, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:48:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="5bc75156bf05c88bb27fafe1c85d3e4ee7b34b7b00ae0af314d499030b4df4afae047387cb483507c6f532b16da6dd53de4acb2e51678b32e1444c1cbf2c2eaadb2bc29317212ffd48b88b0417c6a28a5a77066f1edb8f8ba11942637d5af8bc324d5e09d44bd3cb5bad122295d7375b71252d4138d329641b8b1f3f9630e73a8470708f4479c3ff283b8fd8f0c5a18b9058324375ace816b3"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:08 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000080)={0x30, 0x5, 0x0, {0x0, 0x1, 0x0, 0x1}}, 0x30) 14:48:08 executing program 4: prctl$PR_GET_THP_DISABLE(0x2a) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x8000000008) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) r3 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)={&(0x7f0000000140)='./file0\x00', 0x0, 0xe64f82a91fa34b5e}, 0x10) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r1, 0x4010ae74, &(0x7f0000000340)={0xfff, 0x5cea, 0x1}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x880, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) io_setup(0x3, &(0x7f00000001c0)=0x0) io_cancel(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x3, r3, &(0x7f0000000240)="d89374b1c829a12b55ecfeabffead7548922373bba1c5a00fd78832e5261e9f317c63f306cfc6a6394972739ebb163563b1d83a20c5e07f0be2bbf010c27b0dfdb4ac4169731893e", 0x48, 0x55, 0x0, 0x0, r4}, &(0x7f0000000300)) syz_open_dev$dmmidi(&(0x7f0000000200)='/dev/dmmidi#\x00', 0xc4, 0x800) ioctl$EVIOCSREP(r4, 0x40084503, &(0x7f0000000100)=[0x10001, 0x8]) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) [ 1584.475407] binder: 32210:32214 unknown command 1448200027 [ 1584.481104] binder: 32210:32214 ioctl c0306201 20000380 returned -22 14:48:08 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00\x00\x00\xff\xeb\x00', 0x0, 0x0, 0x1e, [], 0x10000240, &(0x7f0000000000), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:08 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) r3 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x121000) ioctl$TIOCLINUX5(r3, 0x541c, &(0x7f0000000340)={0x5, 0x4, 0x9, 0x2, 0x3f338d8d}) r4 = syz_open_dev$adsp(&(0x7f0000000140)='/dev/adsp#\x00', 0x8f, 0x420400) setsockopt$inet6_group_source_req(r4, 0x29, 0x2f, &(0x7f0000000180)={0x1, {{0xa, 0x4e23, 0x7, @loopback, 0x20}}, {{0xa, 0x4e20, 0x2, @mcast1}}}, 0x108) ioctl$FUSE_DEV_IOC_CLONE(r3, 0x8004e500, &(0x7f0000000380)=r4) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000000)={0x7, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) openat$urandom(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/urandom\x00', 0x84000, 0x0) 14:48:08 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) r4 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x5, 0x200) getsockopt$inet6_buf(r4, 0x29, 0x20, &(0x7f0000000180)=""/242, &(0x7f0000000100)=0xf2) 14:48:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000080)={0x10000000}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f00000000c0)=0x64d) [ 1584.726003] binder: send failed reply for transaction 447 to 32210:32214 [ 1584.764804] binder: undelivered TRANSACTION_COMPLETE [ 1584.769965] binder: undelivered TRANSACTION_ERROR: 29189 14:48:08 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x200, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000100)={0x0, 0x9, 0x7f, 0x6}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000180)={r4, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2a}}}, 0x6, 0x3}, &(0x7f0000000240)=0x90) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x40, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:09 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) pipe(&(0x7f0000000000)) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:09 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000001c0)=0x14) ioctl$sock_inet6_SIOCDELRT(r3, 0x890c, &(0x7f0000000200)={@mcast2, @mcast1, @empty, 0x2, 0x101, 0x6, 0x400, 0x1, 0x400000, r4}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0x0, 0x2, r5}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x10000, 0x0, 0x3000, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) [ 1585.015205] binder: 32243:32253 ioctl 40086607 200000c0 returned -22 14:48:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x2000000400200) fsetxattr$security_evm(r2, &(0x7f0000000200)='security.evm\x00', &(0x7f0000000240)=@md5={0x1, "df718740421c3c4861b5e724cc61cb09"}, 0x11, 0x2) r4 = eventfd(0x0) r5 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x73cbf6dc, 0x80000) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f0000000100)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r4, 0x0, 0x20200000001, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) [ 1585.225846] QAT: Invalid ioctl 14:48:09 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) r3 = msgget$private(0x0, 0x250) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000380)={0x0, 0x0}, &(0x7f00000000c0)=0xffffffffffffff0f) r5 = getegid() r6 = geteuid() getresgid(&(0x7f0000000080)=0x0, &(0x7f00000003c0), &(0x7f0000000100)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000200)=0x0) r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x204280, 0x0) ioctl$VIDIOC_QUERY_EXT_CTRL(r9, 0xc0e85667, &(0x7f0000000480)={0x0, 0x0, "9b431c0837a42268f1d4ed8c9878b61f062ff67cfe1404fa38200d75724443e8", 0x8000, 0x20, 0x9, 0x0, 0x474a98df, 0x2, 0x7ff, 0xffff, [0xffffffff00000, 0xbb36, 0x8, 0x2]}) r10 = fcntl$getown(r2, 0x9) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f00000002c0)={0x74, 0x0, [0x401, 0x1, 0x10001, 0x80000001]}) msgctl$IPC_SET(r3, 0x1, &(0x7f0000000240)={{0x2b, r4, r5, r6, r7, 0xa0, 0x7}, 0x10001, 0x3, 0x4, 0xd42d, 0x6, 0x4, r8, r10}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ppp\x00', 0x24080, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000440)={r2, 0x0, 0x4, r2}) 14:48:09 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r2}) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x4100, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r3, &(0x7f00000002c0)={&(0x7f00000001c0), 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x20, r4, 0x410, 0x70bd27, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1000}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x80) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x400, 0x0) ioctl$BLKROTATIONAL(r5, 0x127e, &(0x7f0000000140)) 14:48:09 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40002, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000002380)={0x0, 0x3f, "a21ffedafd864c642cf7888a27a5989f9a8207c2fdb0651350199386c3e550f5d6b903dd3b1569c2a7a3badf770bea595b611caffcc6b757e70bfc6eee44ee"}, &(0x7f0000002400)=0x47) sendmsg$inet_sctp(r0, &(0x7f0000002540)={&(0x7f0000000080)=@in6={0xa, 0x4e24, 0xe272, @local, 0x5}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000280)="2e48b1769279ad8299e2b47576ef8bed39ae0cac0d6a003805c1fa5b9fdd5ea95e5bf8bf6feedd0bea1873eee43bbc3ae8d611933abd1e0d65033d650ec7ddbf67e427dcd640f0ec948e1c90dd1da7a224ab69bec45d8db66b07f1d10b045e1e6f217407ef758d1e4b3086df25a58817f249adcaddcc4125332503fb1be54ee537cd0c89465c5c25be31fff3790455da0b7d24d0aea5fa31793c96fe504911a12e7653a98e5c872f553ca6bd9d113e4ed6f07793421dcbf867632544bfa1929105591ebbb9e33b29c05a1377456cbcc89e6affd8adf90d11048eec75a6194099ae2e731e1cb0cc98a54add9794c116ba8b3358b1f9b03bff4a1ca26a528799c02197fc8853cf950597c5b3d7c0784377aec2027e3c38eefc6c7582f4c910831ba372517737ac1e0e0af56766e39773ac8191c6a09e3a97965532f70d78dccd7b7d7d3733efc77d781ae4ca131a01a98219144a95f944177fcdb6595e0130fd16339aad8cafc445657e2a17b199bcd9790774e7de6c94589ce85b7c52e86f0c4b042c3cb8cff9047217d5c0d71ce3ce54bbd0cc207771bcc78e786d0f069f271c3943326ddf29344844dfd891f7aec20571ef908e8c361ff0aff1ac865980c9fdd46cc76ac6a4efac44b5fa9997afce2506eccd9efaca70a124b546fb62f270f7817ed8ea706d6f81fedcad00c5a8d2b1c67d245e1589a24dad0f9914ec20bc582c0e36e4ca95130931dd7268047b2695783c3e8df6d13e92e6807f9adfd296c9b0bfa5815a3ece987a6e9f0d990dfd8121ac3bbcc3b4a10a75b6df54180d7443e6b5abf64be41aac0b0875627209328651d89bff23d7756eb1200b588ebc9ad7cacb8add0fa6c7b161822bd04e8c1e37c53f46baf7b0fd4a277985b78ff76637d4003457cc49a043b45c49618ea4aaf42116bf7776ed076975553bcf9efaa23539e2ada360685e5156ab094a2cae414bc8a301f7ca6cdf9f4f35b1e39656cd3227e5f67f0319546b2136d1d22be297bc468136a43608ca22d148b0167fe59506f3127613fb56ef2fd223a8c0ffb7cd7b74a64f86906a9fe9bd95dbfe4ad74900281926b3ba9cb9f88a53cd37252b6f9348a3a27902958e7a6c56213209970c2bef96f8f87031fafeedfaf8c4069c9b3533b098527b6850d22766e44626d9a7acaf94cb586d904c4754524d73162ec8ff773f66a4a686e464c8ad72c7e90cca531d4d60efceb9dd0d3364f7ccd1d1344999cc49c616fda23326e377f4e0d1a8c1a916b67d6716be08408edf684e02a3e7c99ba0d39164e0f576ab69c23d5b202772594aaf3ef365214e406856d1477cbc4a8378a6e878e72c07b0090a7a2ac575e6752fb1bc0fd25dca67e74a9f6fd0d4a70fc463145cb63dc69e88b942382e9be88339069e3b7ae2f8921fcdf94d3a50d7c032ee85b81e7ea83f32af5f26d406bfa7132eafc4b3e3c99626d3ad0dddbbefb8a7b3eada8d68ea37d927b7ef2843ff100d681ef141d33067f0b8e1d8bd1318bc35f2c2e1d21eb334f55ab776941cb30c9b09c0ebea4eafd567aaeff88b6e29d4f3e0e210defa56ee663a93d387f40eae24313ab98f16423a1677430fa242905bdb56c00d4cc48eb3fed79f679be5093f4ea405e5961da2c6f01002de52c96ee5d37a32092034be20e3f776c3458a9d7491ecb8ab10ebfeeb0ddccb70e172ff0e596d86b46117415998f6136b1f4687d461884daf2a48ae3380579798618bb42c302761b95afad64f1e764205a7a5d4db6690adb4a06a990fff165eec2d50b2a7faaff3a5a4f0373361bec79b83733384639356e30a752ab1895f5da1729da9c09edd9b8e6403197a7abc297a4005a0e638abcd3e45ae9fbb0905094eab6fc436b44471e814131be17d6f9e76dfb1258ed03049b210a4425cf4f41284f208c202922b7460d4a8e38ad3b18138f9b3875088ae7c9b08684e23258c650266d097b02726c6c934fc6d636c200e503a91d989534b87bb0b39be877805733a9cce95a192ca0d55b7be83860d17e9aa8a025e393e410a7e5075870b93fa263ec2bcca041937729c10d99970b3f6e996c4ffbf60fd282764c2957b382669c848b5b913d19b7786f0e2502c252861293f590aa16baa973d20c29b88b5b86d78e6ed704075aff7f58da9161603d13d727f149faafc5739a359c6f330a08a33064358cdf7ac2a4c0b3d0f122534bb038923165812d9715aed6eec2e6a00c51a2bf94ee71465494c08837c0b4c27754b3e38ea93f3fe3c527febcb0ca53aae77bdd8c6b671587c56e86731b8e3750b541be68bb1b0d53141f027439d3e095d80bf5ff4e86c2f0372880a04f2a0284adc7c8e4666e0a5194518089c64645d1c4ef9cc63524e0e7c162d59dabf6db3e1307c075650da31ab53b5f7a36793eb30fc107518b4d751192151e879a763ee4527cdad33d16bee3554f102b25214afe7f6068bd9545a9ab6be35732950497a0fc5d1632dbef86275a05c1c0d84171d362b3f7c08c8f075e5dca05d5580bb6cad2e30be708be5d16167a30679a70124e09dad54f113ae036addee0470074cc8979d9f258adfa2583477fb3586be45a68c539beaaeca854300d3144868c27e89770720d29e23c37af6f600a8ee161b4c3ed4386b899c3bedae30f724db034007f97513404cfa3ad5ebd33af2dd5c6a6dd469f58e8335724eb3cdd0552a5d17b8c687faff6495cfa5dbd0b1ceb8a3ada92e542a28fd0a9d94e98a2e2c1bb745e2cdbac4d87d88e11e3fc5c93efe1c1b62a8f4b56e1019536d5d1fb3899f87f1669db23509289f045f0096bc5951c8cb897aab2a347dcb819214fc1d25ff1fb581d0f647411db2deaee63e7a40ade7d8c28083006d32c3608b2d83f514da900b253420d5ca7e67012fb6f05bf1d2dc8b4e66d36df37b3b90fe09d403b3df1318b41bc9337153b174ac2c9142b09aeb4073325fe554de9eb13dd0ba67de86b3e46e07b692f5f54f362fda3df4d6e3f17836f6f0ee0d42df987272eb84aabe041aec89b0534c0b339892275189bd170ca3ca3affb96b0d43a76521f7104a04029026705e8c0be7960ee3a9a03bbc84955eddd2f28049e678fa19f2e3532eda05cb23f56c8d14bbf008dae66875f938c1f2f4598a938b8eefe05e75272dfaf7e29227b6c4db4020c0ee84af4d47f726dd904fe75c1229f295cf08d188a0c14bf1f01665f739709b5e709bd82c04ba89637dd1cfc9c2aa946bc15ac4139854ff1a9bbaf2fc8b56bd0df40bdee27a987b6e7b3c224595ee7f56b91b5007d8d49836cad1763480a1c4e629c653fad6b606f3c200ab21550cc6ae4c2b6a61056b01e366503803c21313d70027dd2dd774639ed01a9947329bbde6c51b0b7b9b49569e5e256527ae5f9928b0fad915f1fe52bf29fb8a3604455fb93702701555f9c564d53a68d924434baf9bdbdc1d2c97084aa91d790c483ad66cd90eb7bde9a47f021ed5e5f2c41f6caaf3f00ff28b4144f5510af72dd716b1f7deb60add8c51fc78c8eb696ccadf86c9c4cb31af1a0a56614f6790ab525e75920fa1527fa372543e9657d6e25b76bfc13aaad883575965f99b1f6a901f367a39f25a2506591f72cf454a8c93a13f32758a001f8d5297711b7c43aea76b9c70117a512b916c1a1f6dd518ee574ebe8e84b5b9b10d612a9d64bf457ca069fe6c46793ec2711fd5d5bc7492f6f26372bea45c3369e5a2b252d9a5e6d33871f4d673622daad241b2056ec3053b6f12b102bf157c0b676c6d25e2edc4f9d31a2a9a2a27b9ceddc9d0116b7445c5bda858f7d3656394b2c6f0e505d707994e2e03e1fced6c9644fcb34aedb8b1d30b023e8a0d9cb44cac93cc95f73915c5d30007fe051d65db949d49465fe2dbba4b79e34a498a0607949ba45da04303eb22d8d8222d2ee6c342f91f0de787bfc51db739f58476b8428d3c2707b21c6949572b42efb9db2c8d2cb1315f301d918bf8a5db278313d9c29bff91e164c39fd41f1f302e13d3ff284d8849790342330789e88b5c5e96299f738893f8b0bdbc75008141535d8c874252cead1c8e7a253cb510045cdde1516bc72ba939538e445cb89cf7dd80fe21470239a2cced9398e25f8f2f01cb7f4110246bbd2081aae64ad05d9207bbda6584e43c05a4f0b363f97a74df10c4f17ab3a493d0c4d36b20671aca6e0643fed0c4991ec8d44c56100b5c6141dbe223ca996db85f521a0852f805a6bf255028a830e7f5ea6bf31d9e3c74329a2faffff67bcd92f009705a6c11bf91d99c814cfa1b5d8d600832daabdd10662388be080b04f0d90169b60400cc0e588ea6cf932e752c32bc292688015b0e7697ede3a9ea1f196df526b13a14be630f56d2063a1db64fecfc0aaa502d0b9fffa5f9f3df05ae4257dfaac86ad3df59e85e1e6c00e8a942e5ddd18e07939ed17741038d07650a99ab34a7b7ade5b55cec8b3d4f370657c4e69d787e9d1ad7fdf8cf6d68801eaf9999aabd4931423f4efbff407c1dabd27c3f8b2bf59a993d998eeb16bd758b73e50ed969633530036278e1258a03b3ebd27a698c39666112ca8d8912627668b5674b71a179322a497c5038b53e10ce9ddb1fbece162043c10bb7a97e3acc340f9d551bcd58b81771579ecdc45668ced4459ea35b7eb51f2ab91888ad01e5e0ade24e7366df3a74f90c134820752b9f4f00a323ee2267d70cce4de29b4284dfda09f8c7b3623b4dd55c15759d0a49857fbd63b455088cf5603846599f5d0c42b252f34a9c4ead3b50e37821d228daa247a76264c6318830f09693dde295244376e66aed8feef751eac91367fadeba9591bbca0b64c44939dd5a37140e5128faa25756c7023c1d723af72e27e34167a86b37e212adff7c38cb27d9585ed6a6bc1f5b0f373ce8b10f9abfdbe248a344b7de42932a67e38871e61467d5bf07db6e7b177cb3bc1a7dc31aafc16b091183be6bee09185f35121589d9ab5203357f20f30998403f79fc6b131f9dbe6558a050194ba2f90b81bcb291e636af91b5d11c7368156377c69e1c39f4281eccacd1aa7accaa22bfbdef45d05b4def2b4440c40c0760f63ef77460ddb38d7233c4eab4c6d0f463bbd10178c208f745249d01c45311ad6d24af759eb5f112e3dbec5728a03fb3fb7d76fa8b4bb60700e0db33de9220a9cc1acb32543e49253aad75c39a6fa8a2931417ef535f6161004aa4c9d9afffb1f1bc9fd8079decb00a1b496fdf4a8f53617252692911399c281bc24615ebc2178ddb18d35b92b386f8c45fbf50ff0438e1c5447b50e01200de6f50084e508a763ae215c93dced29fa524f70e323361b5f4325a3555c1137f2ed3892f33570498c6629077516384d8ebce21e1529d3294c335d9133a05a20ab37bdae4133628240c5c40b1c01509c75c399569bdefedd1a19cde28b0e6c77d3b8043148611c63d4c9cf2e738c12193032d3b12dd9f2cc62e0c5f3a366b945c0cacfff9fa521cebc1bc74e872d061d6bb9c8d6bd50af1b509ebd9ce9f58cd79bfe4c0cd050beeb31adbb7ebf4975fff27760b7a82df364498ee82a33e228b2bc17c31559da4687056f64f65c5b075d7ff0b942a489713b406f948953840e4465067278b21313ed9efaf1f8eb90d8a5a6f50f5658dbd4e27debf6348c4f22691688de8a3353669f2c8cfbd95661af47afbbc2ae69a0a1b95dbfe2b4ea69805e7aef74cf1b0898a29b73050cc6f4cef3a62703a329b6a391746c6dfc943793ddd37c274dd00adac69d1ace7e9aef9e0845356c091c356c9538cf0e5b297d47cde866414", 0x1000}, {&(0x7f0000001280)="6ba18ebc19a14360a832864c04017f741adf9c82ae0871116d739739ac5c05e6386c05a808ca4e550853c1654d501345f515f74278267959071167716eaade3d1f542ccf89f6089380eb466bb56a47d1b51172d7cafdbc4fe54e2a6bb6cf868a3f2c838f63e280f1b0fe5f8567e61c6d98cc2b28f8c827cda7bafc9c0c587d5a4480d8b56ee64a2a52c7213cbf502b61e4395766aaabd970148a3b4a83d3f7ae661a42a9f1b7870d18603ede508212ddd9fd06dfbf11f4c87cf5c49f85049699bb0c517ad733ec93480f02f7662b3c3fdcec9b0a9a", 0xd5}, {&(0x7f0000000180)="e9175624b6501e5e82c6f25f993b5cf7ff36a19781c4dd05e68d2f162738c9c0fabef4a45f0fe24dcc0336a1b922806a7422037d724737468a60d4e8f16f6256dfd705107c3758840de0412dfa006bf5ea5941b81afef9387bfba2dfbb42cff060bccf9b4a61873b6a017238f4393c8320634bfddb2b9acc0fc1f00bf83adccf10bb6c89803b7c0e0f02ad65bf03bedde3e87b657e946fb3506d38e3c99a4d154ebcab5e7f613838", 0xa8}, {&(0x7f0000001380)="a0106b9889a463578a07e1636e0f4d6bb2840d3f18a311ace10ac45b1a14ff150e519e42396f3b0146c506b22ef3fe09c44c30d91339d9dd7033ee267b4e2ff4564584c2699f7b0058c9ce9ba94dc2069a100f74d1d999762a82875d7a19cc9cbb985387680358684b89430d6c85608555a75d2d828868c38a3ab7fb47f7ae5decab8e52be3af57b1e8bf919fde3a70261f060ba865122194f6f22d1c270429025b560bb529141473f4217a2929b53a720f63e7aa9d3221bb6961aaca6a14da889c8693caf75b4128f2c0eb7508ff6f257ea8c0db962a7c76000c000056d9e7d0aac3b9a84019708718a00b096edab855c6d30152b507a2228c2847ba71f561641ad17f055680f22f8af92a72d4e509d01c78ac49f9a0bd5c534e51f82c33c1df5a88ca1bf04e97d614c5296112b87d6e00c0ded288799a7b7164c90f25a778e6da6cd228911985f44564f5cbf477957ec1e6d5269249b170cb14728e029267775805a3ac698fad5367aaee942b47032466772c39cf33ea3ec1f81f27486c70a770c2f6b46e3c746130c4d95d445fd8e1cfea056ceb3ff9500232192d40a3522d995ddf30395541a7f7bab62adae0c4c2a9f9308a56ae766fd90617624598db3405b53357adf74b99d7a74209334d063cfc1922a376e6959729e0f5b8354c598ac7a6bf681db65253aa738078b6642866f7a0f927a5c06a884a9e384bd772fd97f5cd925008492323c27bbbcf7a3c235d1837d08511137ab6d5936ce112fc088913b030ee503e508b1f1ceb22f44b447152f855cb27b7073fd9dc860a513d9ec95e3caebd01103ff254c86ffe15f935a5708f3e27046bcf7dfa68e88b519d01a6858b7f6f6cd7c251fee15b5372e95d9fc82bf73ddd844dce0fad6c8fd41c97f84e4aaab33d8f48568f2d2afe572908c56a7e642a41fc0377a0233c8e3043954d3a1c00af649b4585fcfbfcbe09610cf32e909aecd9c0c7e9d07d8267b7a4ac8e57e27fc0cfed233f0419dcdfc85dfe35a9e89d5bee2a3fef45575bb174291bd0f5e1450642de988e46bb70c3f2a5627880c35f248a4f5b5955d78fb77cdf6683ccf356223bba346eb9c4c7520111e4fd0bdd682f922a048c957d3615d444b4bfd3bc02d7d0524c7d87b11875e082117731d48bc708ccb450971f2d420cdc2bff451ca0a5d4983e2fdfd4e5f4d51983559c5f9f63b4b332cc2a9c72d1f3775d4086ff8484a7f69b5a6714ebbd606b7d2e1f31c579002a3415a050e9779744c8a8288247f77c755a6293291e7f48418a98b92d1d233cd7fac9cb483c40a5d00fd3223ca6f543d7e058eca5ef3105d5c267240f42a2f9161c10aa6f79ff4060e85508c23d047c87242f94bf01adaecad902f5742c3ef4ba1bf5271331153c48f56ef8a0acfb98629b60b41ea4a0015d0aebcafb4e30464c2eaac06fd8c16744d30bc650038889dbe753040bf26aa841a2108cfd8dbcc0b21a1d74c1371cfaec45fab23f350626ddc3ec33d7767952ea71b0d8f65f79be75e9665e7d794db23a0cd91df14ca98d5b105ed42787d3a6254313903e3446664f1088be1820cd67d2a189132ebf97bce7e6f537d66bfd0e16c475885774a5a822bd60edd405fea968f480de501015a760b543329b73edc2dbb61ba07e5d6fae83a5344f29236fbcd71ae8d567da2e336cda5f822b465249db7580525063ab611345eac1c52140de177c47e2a37eaf8abb780af1f5c2fce89e00a08100001a88ba4523dcf14ee5ca36c3175da02759ce3d00ab124211984e350e6fed5cdaeef79bda3b93f09cd4e3a69a44f7dbaaa2db8bc22b96bd1de2327447f19c614cdd5941b5b7c09663ba0f44cffa02fcce4d99f3e12e274190ff6ae911ffe35f9b133056cd09338f98ea927ecb67922e0c924846f43011df416bf324b29dac6d15d6e8d8b4763653ef04a31ca90006f6606000aabdda4d856a21ef5ccfbd668b5e51c1c1647c727dfc3031c2d6a8218b2f54f7f4903511f649e680cae026656a1718e26bb15c625fed70b9eecafb2851242207dca38519251e0889402cb74864db9ed17638f4fc04fd39c9972bfc7fe6e50ba1fc6dbd0fad8281ac4b359b89b81c7ed9bed1185beb7d5a31a1462932c8f77c9fe32ce84ceb60973744cf7c446ac35431b8f6dbe35e82c7685e1820ac94521eb6e7f4c6d17331a2baa61dce543a7e93c8e79c7c8b00ac5e532ac940c3c965b9548d714a76d2340274d857c56e2f3bb2f7a5e908316866dd3850580aa0804b2375cbc78117e83faa47ad5a8662e05e52de76e1c49ffaa0b8b0c62088fdaff59fa2d02bb87228ce8746453d260d94a321222ab8229b7492650e354781ec9b91752f95ad9853e8e75f2ab373bfae70f4ddcae15afea28b440c208da40e27b203947402ca8583ea2383960cf26b296c979a712865619d49e275db3ac94fd6080c9876b86b60db57f20b409e1ca443f48c9d3e5f5d5b8105ac3bea90dc13eb99cdc3ef9f0203b3dfc93035e7bce6a78028a5f045177c01705b1d6e422d94e42e9906c10c1888f729a0cca2edee6a71003fc3320cc2b69bf2b40fba26fe0061c2ea095f40f29e625e0d84fc53cb4a40c3e3fe73a9a15e4bc5b7fe4937ffa5659588f9e008510b5a5300b51236c045677b6f32cf50075b71b4bd1340e1f252520d9329eea0927871adecd32cf8b7bcea3a8d5ee16887fc5ee5d2dddc163f3022cbd23d250348ef742c73fd4e20352ad177aec1dbfcaee127ecd389cde61b05ddab133d24cf117cdde3e74720d32b407b3d88fc6d2878f0e962fed6a04f1d095199cca8353ef2a2e7076bc1c2aae82fdb3459de59db34dddec79823ce27363e2f73498481de847f41cafc2d06cac7418df2b2a02f90eb64639140832f00e2e547cbb2208293ca30911f78d45d9af96609bfbd6a7cf9f1048df4636a63ceda6e51661bd1bf9fb9c2642e84604aefb287b88e41c3c830695e79dfa84f26428d0e03483073d19081fe49ac5cef4308b4341038e9bab2e6e43469ed1a79132a576cd9c99a261ab416e8dea35777c96eb0468cd0a16c118b1d2d892e0c300de6397b865ff3d1dc62b30ece82f857b623ebad6f6e8ed9e31e1b8a47daf9ac5da63ad5ab2cab249d937dc6c957871b27187c8de63bfde1a40683b1677e9ca80d415c28f060dd3bdc88e0eb19a7fa351bed752a9df4bafec2fd518e27896c7a071a2cc4bb7cb97964077388c6c616b2e731d6d4bf24511465dccd26fa95d72cbaaad8eef3919736a2ea267f5e8724e680116c1c41df663358e805677a8395441f26eadf6e06483422e86adc6c800fb40880732e52ddf34a311ceb3ac8005a6f012703ae1186422152ca441d2e431fee36e339249e3bfe20b8f91c937e94c9bb31709d9852a93fbab6db7fdb6e0ab9bd56f194d86d198ccc32dd7aa2eb92a3019ec76f221976d9f0ad14197f7b86b30893d9308a4f6a4e678b8db0fec48681319fa5d94132e8687ee2341975ed58900be31dfb92511a5f6a74a4feef7b867ad80d197ace9b8955dc92468ef55f4451c990c50e46537dbfbe9454753fd0fc85c65b5b1da7f66021e0021bdcc5ba9b86ba9a3c34fe4c6a4e857612f89b759a4fe4a8f247a48fc26175d38749ab1ae1dcf7ffd5eb442c8c8df45f1beb1fe24d6dc535ad1abda61e879b624b9afc7ee65567fef756b603c7d4a21f57c63993f4b3cddb3ebea2a1ac527518b58c3d05c43d6139c8688190d42661c24e2ea7ae7ec63eef19d870f0506c70c48329adb2e77927563ad697581013bca4b7effddfd1752d8c315fe64e78fb4c6becafeec16ff2fdf1514f27a06b3a92310662935f23d5e94b10d743d27fee20081d8c0a9b1175d43a43e9f98a2ca32b55c678835307c1a3364a7ac55beb407a2e9b9dcd92d2fe3436bd6007af3ce57767bf6408236b845fbfda409496475f9c21476343c2d9443bfa37088d06754a14fe1d9624a0a447d460d501e01ae78edc18e3d9b1f2fcb5770d15803de07db4057c6738b119b789da495bfedba4f9c85a8d400704c7dc7289b2aad7a8a2610d4a98b3c9c275eb605c721bcc0222bd4148b982e08d0fbab79b0fa2037dc6f2c0b851e5ec86c2dce0e80c02a75c13380ad95bf8bd7d3ed35556504b262a506683b568d9faa431583b984e310a44ada04446a51f844c8ddf857dadff6fb2b441c32c59472777ff2bdef41504ff60ade29c9d6c751390d67f020ccc8445758fc0a0a71914a0faaf64dca744d7ec4c92c9d759f6c5a1e68e0cc52894cb12e7eee8b77357a93e795045e49d0ba5df897e793d828b713edf9ed6641828e064800ed4bedb19e23627ca540ae3d1c3883b656ef43c491783737d40b02af25c67530a7a42038107d355486dc4b29077e41bb7465a465c0b6c98057b712aaf5792524964b85cbf028fe7f14d92cdd4c042ce18d4410f666589745dfca60a88b71a087c6142b76ba22e56274f9f509d475683302868a44fab8107689fd4e0bde746d3e8a13c69f547089fba9ca88af36af8cc38d801e600f3c6698a96b02a8f94e71e0c8242539e6b59284131ad50bc6ca2016f06b6dbe1e5843d3c2c8d08cc8d869034c4545edb9b1cc20f9cbde116a4f545c5ec41752a42c263d2288c22d22b7f345cb6768c11e6c381b8032a4159f4a16150da25136ff7880fe95343d5ee4acd7ff4b91b6e88fe148df364bfbf390024370ffd04b6e895ecd13930384527bbbd0258089a5a02c19ad68b3ee3e6657d21c33e5af4709f1ed5662846a20b70007f8358acbdc1f5b003800389db20f4efec28a9a900d9a4225652b145798d04dd4d594362e94f2cfc9a3a28a5d106df9aa734effb4d6b9b35641152dcc69c761d853700e43de50b885caacef27a1e3cbcc2fbcda10bb9a9fc4bd06c3d165b35db139b2d46229aa9dab64c44eae332464ba719db5ddb0bd68ee858d2f8ccad02bfda68f42fcf18c1de6c471a2d04991b63e9a9c83fadb05789084b9564f30e2c3ccf55ac49a1aa4f14e6f3bc1db0da53ec702cd490fd1b9ba62341513d70c840b9a765a313f67e6a876f773bb84758daedab6b62814687d3ac8efb0cf5718c437e75a407a0941dcb99908c4615e77d2d03f85fdc2f62812fb4a828e3405788a1885500abf5ce4c19dd9825ac0cd3bdb14f89ee0c862f4933248fa26677920411697ffb0d58742acbea4a10b6cc294b408d18b2b847af3266b070078ae8c0d36336eda1bf31fece736e8abc8f279f57146a293c7d6b3a89e078105216301d2975cf1f1c60860dcacc39d44d1dff0afb1b88a93c7f7e558900335f1438eaf57be95054237b1e0536ae04e51fa8725959f459430a915cc41eb452e5c4e6ef0dc2806247c24af49992f76028c2e83dffe6691509082dae3fb2ae158e718a6c38407f4b0a8caf26e49b86e4ce74830e9e2d24e2cb067c69ffe853eec4ab93c8c103d6618de03fb6e01212f07e9e87bad6883148c44b905915be508e0d62a4d238c9a8ac48550642bb8477e336502c0d81b17d52e9b5dac1092e43a1dd7178efe2c1f88ecf7ea717f4b83757b283171636db1445907fe8021f6cb0a8cb8350ef0151070d9f60cb4291a1f3f186fb466ecf3640850a2c0ca3a29ded48c4a2f331230f5783ed71d93b2d3049f40823dbf161121951f7b8b5615fa1ed128c9592877c0fd868d1ec9f58bd82859a7d77ba19f1c5068095441ec889906c122637ec6f1edf77799053fedf41df9700fda4b7610d3a8f435e057356be438f3330850ffe8925c18cb0265e4048e98d6451d35c7d9e8e8c2654e", 0x1000}], 0x4, &(0x7f0000002440)=[@authinfo={0x18, 0x84, 0x6, {0x80000001}}, @prinfo={0x18, 0x84, 0x5, {0x20, 0x3ff}}, @dstaddrv6={0x20, 0x84, 0x8, @local}, @prinfo={0x18, 0x84, 0x5, {0x10, 0x3}}, @prinfo={0x18, 0x84, 0x5, {0x20, 0xffffffffffffff89}}, @authinfo={0x18, 0x84, 0x6, {0x1}}, @sndrcv={0x30, 0x84, 0x1, {0x1, 0x1, 0x4, 0x4, 0x3, 0x1f, 0x400, 0x9, r1}}], 0xc8, 0x90}, 0x80) r2 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000040)=0x0) move_pages(r3, 0x200000000000006a, &(0x7f0000000080), &(0x7f000026bfec), &(0x7f0000000000), 0x0) ioctl$KDADDIO(r0, 0x4b34, 0x7) 14:48:09 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x9, 0xbc3c0) write$P9_RMKDIR(r2, &(0x7f0000000100)={0x14, 0x49, 0x2, {0x28, 0x4, 0x6}}, 0x14) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) [ 1585.596509] Unknown ioctl 4734 [ 1585.646099] Unknown ioctl 4734 14:48:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00') ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, 0x0) r4 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) stat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x1, &(0x7f00000001c0)=[0xee01]) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000200)={{{@in6=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000300)=0xe8) write$P9_RSTATu(r4, &(0x7f0000000340)={0x69, 0x7d, 0x2, {{0x0, 0x4b, 0x5, 0x0, {0x80, 0x0, 0x5}, 0x0, 0x9, 0x2, 0x9, 0x9, '/dev/kvm\x00', 0x6, 'md5sum', 0x0, '', 0x9, '/dev/kvm\x00'}, 0x9, '/dev/kvm\x00', r5, r6, r7}}, 0x69) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:10 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x800000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$kcm(0x29, 0x5, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x21) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, &(0x7f0000000140)="c744240005000000c7442402f4ffffffc7442406000000000f0114240f95b30000000066b840000f00d0c4e3794c81020000000cda76070f21d2c4c331216800ae660f38827cedf50f01b5408b0000c4e315386f25ab", 0x56}], 0x1, 0x8, &(0x7f0000000200)=[@cr0={0x0, 0x18}, @dstype3={0x7, 0x9}], 0x2) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x0, r3}) socket$kcm(0x29, 0x2, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x0, r3}) prctl$PR_SET_TIMERSLACK(0x1d, 0x9) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r3, 0x4}) [ 1585.908040] binder: send failed reply for transaction 451 to 32243:32246 [ 1585.933404] binder: undelivered TRANSACTION_COMPLETE [ 1585.938653] binder: undelivered TRANSACTION_ERROR: 29189 14:48:10 executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='/exe\x00\x00\x00\x00\x00\x005\xab\xe1\xe8\r\x90>\rqz\xc1\x00\x00\x00\x00\x00\x00\x00\x00\\\x8f\x95\xf5\xd2\x96\x8a\xe8\xc7g\xe9\xd1\x8f\xd6\x9a') mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800000000004, 0x20011, r1, 0x0) setsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000180)=@assoc_value, 0x8) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x9a9c) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) write$P9_ROPEN(r1, &(0x7f0000000100)={0x18, 0x71, 0x2, {{0x3, 0x1, 0x1}, 0x3}}, 0x18) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000000c0)={r5, 0x0, 0x2, r5}) 14:48:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x2000000400200) fsetxattr$security_evm(r2, &(0x7f0000000200)='security.evm\x00', &(0x7f0000000240)=@md5={0x1, "df718740421c3c4861b5e724cc61cb09"}, 0x11, 0x2) r4 = eventfd(0x0) r5 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x73cbf6dc, 0x80000) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f0000000100)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r4, 0x0, 0x20200000001, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:48:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup2(r0, r0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000080)={0x0, r2, 0x1}) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) 14:48:10 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000000), 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0x0, 0x0, 0x1, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 14:48:10 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syncfs(r2) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:48:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x2000000400200) fsetxattr$security_evm(r2, &(0x7f0000000200)='security.evm\x00', &(0x7f0000000240)=@md5={0x1, "df718740421c3c4861b5e724cc61cb09"}, 0x11, 0x2) r4 = eventfd(0x0) r5 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x73cbf6dc, 0x80000) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f0000000100)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r4, 0x0, 0x20200000001, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:48:10 executing program 5: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000ac5000)='./file0\x00', 0xa400295c) setxattr$security_smack_transmute(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.SMACK64TRANSMUTE\x00', 0x0, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000001c80)='/dev/vga_arbiter\x00', 0x4024c2, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000001d00)={{{@in=@empty, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@mcast1}}, &(0x7f0000001e00)=0xe8) fstat(r2, &(0x7f0000001e40)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000001ec0)={0x0}, &(0x7f0000001f00)=0xc) sendmsg$nl_netfilter(r3, &(0x7f0000003340)={&(0x7f0000001cc0)={0x10, 0x0, 0x0, 0x1000400}, 0xc, &(0x7f0000003300)={&(0x7f0000001f40)={0x1384, 0xa, 0x7, 0x20, 0x70bd2d, 0x25dfdbfb, {0xa, 0x0, 0x4}, [@nested={0x2cc, 0x44, [@generic="b63ad386bb835a10e6a6d1164f76a48c31e23258b94cf12d3bf84e715a458fd3b8589816baca996c5e1d69a2722042b3b7b9f5ad04251cb8f9bb82bf01f48a66011feaa5b16f46cf9633e2ef2c589b0f269f0e85c7a2033dcf", @typed={0x4, 0x2d}, @typed={0x8, 0x50, @uid=r4}, @generic="f1563466fe0ca434b9ebcf2e4ccdc1b2d921ba8403bd3a82ff2795d12afef5ef9e837153622748e21df66264b499dae359baf076e17f85667ad4e84b84d2a10160e843fcf7b56a75edc6978bd008c9a15eaadb45a49051b3414cd76d43d7188637b6ef64b125405dafaf776bdc97ff512c5c2f9821a4a6fe64cfd6037c860ba1afaea1e4f9f868134eb6d1e89a82cb2867307674f9333fd7e1257d8d1b75ce6b2e", @generic="a9411d71a78a31c7096befa3b2996d8bb5323c40be3c108cdaee726519d41e3472d253bcc806a4c37cb58976abaff83e66ab974b3cd5d0b3d6f31802f5c3fbcacdc40118a7de023df0464fbd1ca1d9e3bcd527791153f5ebec2fc55b705b681873f349f1fb6c98d762c6a86452e5334c5c3d502654697f8a91cf47215fec4be784c72fb9d3f368672e4cae6f7d07d0c6f42bdd1d0c1373f47a8b9c84396e2194be0e886b710ff2150881490a1185f14c87ab8af78f70575420f57b993cd96e6fc02e9420f6d1a22322b17f06ea2edea4b6a712d8c903d3d951e1ae81b6dd928dd744d87bda454fa38bb0", @typed={0x4, 0x8f}, @generic="08d44b5500b293ce897a8c838b620404edf88724ae81809a9558af312ec0b987797b08dee6d0cdc89f52bd52ef151fb95a396fbdf114c9d38e290c26428389ffd3625c5a8cfb259dcb978ecaa4f622c2e011eb677350098b9d851c9a2e61a89caa4e63b95f8fc21b96748e1d27167912a4e6ea481b7150f27e74123396acdcdea6f9f98b547e3ecf5b82dd5fab1b0c83c76189ed97b280bca08983aaaee23b1fa7f1e3", @generic="7cb6dcd797821627dd7c90bd8416e1d07e306b1d20459c2687705714223a6046ebef592bdf", @typed={0xc, 0x81, @u64=0x58c1ff52}]}, @nested={0x50, 0x13, [@generic="ccff892fcf2b6788732bc4073ca753730c5caa534fc391d3752cb1560629d267f214daca49362651abd276a9ffdbf8375edb2ecdcf63d047dc067ebeda9de531c0", @typed={0x8, 0x68, @u32=0x7fff}]}, @typed={0x8, 0x26, @uid=r5}, @nested={0x14, 0x13, [@typed={0x8, 0x62, @u32=0x4}, @typed={0x8, 0x81, @pid=r6}]}, @generic="1d39a6c2c5d130db3a3b6f5894306fa53a4cbda47bf2ce19357ccfe276e0647fb0927c4d81a2a12b88b1202b66f7ae006a2e08398c0350a9d60c13caab5618f4724ae8f123b40e1bb234fee9370079741f9492472ca95134ad62e930746a03074106dee23a5cb48387b0f3d019d0871e255a22766caa1d96434220e2130fb0fe765d3b128295c71c6341d89955be37c3dbf77659137c0c693aa18a4646276bb2836e4bb965f3fb249e7286f2f85b0c68edb9429bd8d2ae7f61b4807d77cdfa8312cda3403345c02b677169a34b3583c2f5dccfa226a87adbf65db775f8cdf48a771ed1f9995d8efbd3f4277135bfd32b9b30afcf0a7bed2584dee8a32d1078d9e62094baca0b25a46278f0fc8d71d43c18e60c35ebd2f8735fc33a43baf18bfca160ea883c0abd7210573eb0f46247d7cfba1d1ad39e3cd08d304dca7ac9b10e8f2c4a9fae1a2177bf4f1eb7b0959f3366c23d676636e8a4c88e13a5e2308bcdf35d64eeca0a09fd4fb9e5b092fd579ab9c2c37f6bbe066366c2d09bc2fd98dc43a210fe4d032c33bd20beb19f972692cef48ea72fa2da6343eab230ae77f99809c7e6d085f2c0efc8d845ad28ee7c26aae0e078b4168744b04040a809997996c46ffa0f9b62017dabc83cf3a93cd5362a6640b09cde980feef945ded0fd8c89ecc844c1b70072c3111daf63476f77f4666f5530d4c72a5d5ea33c0377b47eaec881626fa5c0d9ceccb074071cfa45b3ef4f1001ff1b2d476a7b143061699041cf11a9d92c292dd587cbe7bbe344b516ff107fbb93ac7bad949395775f717cf7ec0a6cead6cb626130b7e255656cdf04daaaa4987263687aaf61a320cefb99bd6c0c850239971222df37e6a7d552d6c51ab002dfe098243e7a1f9c5c90f67c082d361044220de98f1486ee379271fd030b4cdc9c029ead023fd0ea6908b78c99dcb7e6b25c3ebe8c9841d4e93027ec182c9c0f137ad7266d52b109b9172bf6be2d89c31bd5699a0ff5a3115a7890b89ff1e7e566b9b8f845bfcbab5003593b4b936578c24564fafb51c7929a9d07c067816222583dc36aac649c63f58ab321fa62b128bb23d0ecc9d0e595345e841c6c670b1d3a4153403a834c2decd4167d5880928f4446bf4795b8d31e6066e52b861e9eb4d081a60424323f41e089d8cf2c34d10a191821a74ea1bb04cb36339c18279cda7765c3f1e73f185b1066de46c6256f656fa49808cbf39f5e3091a337b2a3794171d4310a71e61a7ba199614f772604393fea9e0b3496b9cf90bed8cd4cc24b50e3e25edd77bf61516901437f8d2f55eb8ab723166c525e889affa7ebf25b191f4de844e2861babe7b61abbf5e076908ad91d83d5762637629bb76fc6af80f0082ed9dccd00d2c63ed357116dfc4201e6336ae6ecb5657e7c4ae82aeb0a40220da86520c83de603f74112969fca2e6832a74afeb33285aa4a8ce407daccdb432addd1ab159c09108e9fced81be1db611ab89d43d1eb03bf3fd629aa4ca7bec1422b22dfcf358efeb2ee5ef26f174e62606cd0f36a1641e1a2884f00cc359c8a01dfe1437f06f1ddbf7c7fb5e16599890c80373e92bd98b420770aab9135153570648ad1df734608d0c09922e406c44d526e9a0206923dced65fe64f774f88a5bfcdeb654ba0c82b302f023bcfba562e3527af45c00e2fa2b7b6d5e0485a38d4ee5eee1f9ec5cef57e5696986457ffe01b58e4fb67c2be0153bc09f0810f9079706b7141c14f96c294f3913378f4e690352b3cc36be286c0fdd145551479481f9ee8d218e92b8650e7840274c3c8c227d469e624ac607fbaec2769feafcc673d7bac7e716b05e48f6462b8dac507559e5eff476bba0a401a6b073086780cc9c1c8d471958990b7af10423064f5e00d378488901cdb21fc21984ff61e5af07a70ba9e303ba0cfb3a4d72d3c71fa2fe7c54525b0cd0c50ec87121d019c214870b6c44ed378791509c6a1f58e880412c8a479b624d1679847646937a5c5a802a5781dd4159f2639d17eae5f37b57cac2093bed8ef93b4ed5cccf667629f53f75731a69aeaa02d00278ab31d941ca76dc99d4392f6f6eb92652d260ffacd4a08d14051f08aef6d4ddc3aa3ec1e5968a814cab85a097d765708665353cb5f7f3a3f367417891a3b2a44d729fe15c5e344cf34a9550ce9853b8a0eebe72ced661fe1e174bdaec9aac80c667106e35edf255df117993053e8913d462a1bd17e8a45f75ecd37db156b8cd07feec2199e82bb0eaff533ba5d4aef0e34f9f86c1c6e36021be0e9a8585ac124f362aae696e98958ad18059ce46e267afd30bc34163dd57212a216d0c56a16617a26e1f61c7efdaa8b6f6192a4647dd5499dca9fdb30c2d30bd09c95f407f596f953c72a14dcf66505e5eec780b5671b7407fe5f04eb183622729f1c6f99a6ca1b49761c4404ed8163b1ddd97c5dc5b54802bdc92651bca23902cd64d66a319a36edbf31ded40e5524afecf29081aa1cb399893c96a8f14dd497a3c0551d3e833995558e9b1ad669745e235d4a286acdfb8effdf5d1f1b18bd939875abae53300865817f91456500fd3a58b8158c69ca5f237bf7656e6f9ecd5d89dbf2a37e54d139bc4f497370d62c8909fb46f7f14dcd5034182d17cbdaac98c74ba489d13ff6b9fc6d30e4305dd784c60d55b9d97b111bcca9956350c7d45a967707e952b5de5fe896f91d9374d111ea828bcfaa30cc8257676f2947be735fe0f71b351b2ce58ccd2f95bb3ef9589360b9701503172f494ae58504566720a41629684f690cf3a143705a33d2dd7c47236d29bf862ddd394a123e8d75a446b185565391678b563d9046cd3819601cf0279fcb6fb196036d9384d9e07a8772f8c48b18ca5329cb12d03eb842c9840cac86367542790b79a0f8f5e29271070f0f48c38a4a50f48018221b86cbe9b95b4f898f603d148156175f4fca9917a651edc448256369a36d4c41d45f0d823a562866065149ace4a724051cce84b2a74b44132336713bc977cc66f9fb72e6ff8402a4b1d0df13e02bdde6ead44fc612d1943290b81dc540ec18ff2a88bbc042de6d8aea5f992798e0fa3167213f15f14108edffed17a02a1f8f9bf5ea2b37f6b3a7193e420a445026def8e99ecbbe59d9413bb9133239f779da2fe1cf0e5d037f2540fa978eca673dafd559ae30a6e4809318e8d83f210154be3067903b380013a7432abad067b02821dd6c76900c2431b8851ba6c005aae9ca98a861d046806d61c0444180e6c830c971d429d079ebf7acc9f6d01b0c9454f0bd3dfad013d5b9ede9c5214f0098f73ee2496d426d22bc29b360f992d74a6e16493d23d9ef3b553edf55cad07f1c3cf688d77d505b56d1fae9bb248fcde57afdb3a036a5ee27056ea25d4ca03f365777abc419178aa4921c78505f24101c45ac5d772f3a4fc34c2a4d481c21e72563670f6499f8598d9f68497c8ddeedf9d29c497bda9116417b4a0334f6df656d7b53a7c90cb505e48e7bf3bec8134a3a09234b29cecf2895dda04f9173edad4b124584c5441fd5315e169d47e3e944a9c62646cf7641a477f66a15a3b78270ed83ab269f91d8f9ab5ff49e5f5fd5fd4c3cf5507227b48964b89272f630aad834f434b01dacb7376624838a2894aa8cd969733acc08fcadf5331a19f2b55748eacd9f03fbca6f7459873e433c5788da56d58884af8187a38a13e3c87fcfaa28dbb8029b231e9e6162341ac9f81f1df94a2e0d35401a46d5670358315efe9d9b478573f29632a8adfe374e322ca89c95c04f7a92328f02d1e5f31cabd98d73a56633a5fb281147e1a1b1107272ac86c55472a43c6f721c33b0b6066e9bc639c3951dd7b818ff8d3961868e6e3aa531a9dc3ae14ca33bf3b589e7332cc49ddcf37518ef0d207894e1fa29103108ae392d9a6312700d800461b49ee800fde10a8224a3f88d670e8b33e580e36903bb57ad8f7c1ea011cac9cead527933e06aa326242b35dfef3de60d63a6f44b85286aa1510f24157f2c0abbb78c647d22b75e11ca893fcce8fcaee12d884b02f131d6589da8fd07943703708701cb68fe0dbe380378b2f4fb3f8eacd54398fe6f40d55512a550aafcf3641ecfc3f45e0a7806e62914a0e25e119332cc13cc4e01790a32ef3742b0ec66467d66eb2014537ca8348cff31c30074fd258d0fa77da46b64be147d7de31f02008236df90663c422ba2014bfa7cb9c0cd7204ab9fc2922a931e3e92d177efbdeeb53ed029ecbadae5680053e6a566bac59748a55f838ce8adf8392176673d5ac8582e2476594e2a965e900272760a05da92001de8658edbce0355c1ed7368f924cdae30831760e320c528e324e7adc7d0ad5d284637fbf4b4de2f47765eaebe667beb04f685bf73d6b5b49793e9599e023b1acd29ac610cfc07d8f0cf0f432aa025d8989eefba74a1c4db48cf9d986c30afd07ba02ac8d40b0b74f8c9251bafc9f26467b58f2e1a180a4946566e57b42bcb42534e1df3b505e0509c4f6cea5bbe8965e62dbe0458c2f5008f3a3e7b5cdaa005a52f5d6bdc57ff0a1483e1458718873870d8264c4e9340761618a001bd6463b650a98986593c76d00e803b96009534765ddcfdc030c5daa4b18567aa976aecec8d025694576fa5b87be61834688cab8b65513811ff8e142cde1d9f78843b6a093e96e905d4efebd0353fe1e926388b48078c832bc79f63212d7a0573f63286543d9ebebd928cfd000930c722a07c599591550ad5d8e729f71f5597d742a060a5fc36fe34f8a17018c608a06a5e00b6da02ce268d6c8e20abd17e371ecf5e85a5bb02a1aa12213040fae9e068613bde024aae81946cfa2f36aad8b86202bd2d9858b33bb799bc69196e5cd59a6170e357a7d070d451c7cf6990693768983dec12b1e91ef0dbb15f9efe96ce757ecd62a2d00d2d6b2a145a78bd087e21d333edcbd16f476622a3a5e5c7c0149466db3326abafb3018c40658b71f0df4c2933614843acde77cb62b511e66172cef015d1d80da156d23d8cfba4ea3ee78c318e19ba32e2f5a376bda391aac13ca1790772499aa5d22c3076f136cbb1f9a2b6993d36e8c91faebfe6ddf6f3a469c361ab71567d295998a3fb8d51e6af9682e737c5fff415e1f282d1204b6e8692f19f9ace841c558429cb5632738a3d12a644f001d4c2685c025c70e4e29844e631439d0db629d36284cbd8491464e196a7380f98074882aa76494a2a77ad088677c97da8328ede72af8d4e7101ac57b5749c9c8ab08054327cd059a0bf399fad6209be1585b0a0a393919f8ca76d9b2e3aa62d9edd43fbd5017635895341e2242eebc5985480609e627e2cedec3c3517c9c0311e8674c8a269066c9002dadddb3a0bb399487501b13639c063444c24dccea8911a76076a0c332a3d961028cb836ea5b9c68a92592f4437b634b9a94bc3fa06dcbdc3f2232b2c68a747ffb70648f937eb0f9b12e6894f749a8a8e7b5b4f012e4e98fe59d3beb00849b30837fee3fe0e93c22a512d27e18197feff690dff162d09a40d1a065a5918b62767b26c2639decf390860459424a1c092115c9eb8dd64c9f24a54e791f510c8d853442c04362492a42a5c5258835e734249cc44dfc9172923a4698d126a50fe6638094cc2147453768d7ea7e29e0bf104713d71bd7cc18e63d087514bb5b4c2df86914e048f75842fe88cc49042fca66b342bfa4526eb195ef107bc18371ee8455b4811d07839a389c657e59df430d5d6206c12467377f7c54a3194f28ce8995e61da1a995a9c0a33", @generic="d6374884b55418a7ed57a2928497f9dac051e8dc9cfb7abedf2ad63a036973a624b76cce32b9f09652722d99345348f05d54b229ac"]}, 0x1384}, 0x1, 0x0, 0x0, 0x4000}, 0x80) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000001c40)=ANY=[@ANYBLOB="0000000000000000448020af08e60b941e2cbdfc769309002c00c4727e50f341d25d21af798d694c54a1c8b5d42a"]], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = syz_open_dev$vbi(&(0x7f0000001bc0)='/dev/vbi#\x00', 0x1, 0x2) setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000240), 0x4) ioctl$SCSI_IOCTL_GET_IDLUN(r9, 0x5382, &(0x7f0000001c00)) sendmmsg(r7, &(0x7f0000000480)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="c086cc59b411d8e3ba03324465833d2a0a4702685898de8cef0a32720113c2564b44d1a647fdb3d09e20e2efc2784fb908d5cff137dbcaafb4ed0dae5a772285096ef8fdc43534a46c0b3eee3eccf3eabc5742c12ff68f93def86d076848e180c92050bb5d52314496a4cf9d4d70f3f62d3987611e19cb8dbb22e141f057d6ce6ab0779821833a809e487cdc81ef2a766b75c2ffd7eec3d90f915c88e271af986d663c6600b02b195164322c4cc862dfab517f40256e52aea6abe4619b1544dbdc942c8b7e149701c44d81bf01b970ce884e3380ff56c5a597fb66d8f96899401a645c6a619132cb92b77556ae43", 0xee}], 0x1, &(0x7f0000000580)=[{0x68, 0x107, 0xffffffffffff7fff, "9021b181d6008b8cdc8a1987d0c9ad078a4341f55900a0eb19baa22f636c86ddea588d0c5ee21ffbab354c2dd69af2a8bdfa8a9c27904b1fb30331796ae4b5c07d913e76b1db91ebdff835449f9d931ae536a59b1b8f"}, {0x88, 0x113, 0x9, "d2eae27077be04c0b7c05e20b790a0238956594048c759b35348ea69f373c4575a7949f54794990352cf21879b2e0c4b097c7c533de47bbae4f04e38cac7a92c59e709c31ed01b59779d5ee762eb0fce0f6901e3dcf38b84e25d6b36c9d07577d13760ddcbb7e8f84405f2d625bb1fe378f68a852431fb"}, {0xa0, 0x88, 0x72, "3c4d4c90316377ff6254e02d78c5fb545ff181048462289a4d32fb589c536309da1fd0775f27d11f98f41aea8b0509ae3d019246d9a895a53aa13eb6c438f67d7cfed5f1beb9a8e93893a9fde2edca79d0a2c29cc96a8f426b8661c0b9dbdfa630c394dfeda82542a232d8f36a43ac9a6eef3bf0fd36ab292305256aeccef70e88561fc26434746a1fc4"}, {0x18, 0x10e, 0xffffffffffffff7f, "d47a16aa64"}, {0x108, 0x13f, 0x0, "3fc365fc332429fee25442f37a75542bf6942cd0813d21e95e7bd2ba87d7db0b900d89d923e87ae8bc8cd784a1581d2708b2a76c2041ad9788ab90d8f4d654996f513193909cc51cffacf9d94f1ad35d879d544167b27628cea00d7d5aaa800d9d4de8001f27644cdfa91913d52797cfbb1d937976266eb055b330d02a8b79f8837a99c1c2b6b880cab5d9fa3c16fb74894675091aa0af014f1406da620574c2f07237c38ebb2314fa3ccab722412a53f70668447efc44635a38f378aeb4cd21aae54e196aa94f00e0eed0c658da960c9d2f848bf42d716f7bc7cd875032f9ecb22df53010ec6889f70adc1fd7a4ce8b4a88"}, {0x1010, 0x116, 0x3, "67520250b19d0c463172bd65b64380ddbb4da60ee6a7ff40f63aa9d6048fcd333b29bf14f2be107962751c59b1092e6cffaf413ab9450f845bc40559f1a7c04c8f440078d5b8a8d631c27a82f65fe15fe421de3f480c34a98c0dda910cb198af4ca871a26e8b93e95dbee406b40c495bf16ea9e34bd5477a42e729eb821cfb0391b1330ef9bbcbeba3e377094aa4e037132e96c143c9f9f26af922938338b2ad1dff2eed2030a82aed00a426d3324b7f86e4042dfeac18a49b4dca0970a52b9f41b684960a8070cc6398deedc567de9a1c13fbe6c87a4638b12344c920783f15a2e5f0cfb1f729358d3a312e03b65470622d8ad438a37665ebad8deb3d7bb5c384090f3777892c75967435bfd2f6bbe1e4a9bd89b17257e825d7a380f996312902fdf0d9e7da1243ec91a99912f48d04df654cc4395cabde7171fe7378736e62e169ce06e59be7e6940c3bd8d49bd8c621095babdc5eef90f66ee873e32016fe8c8823d07f0b7230dcb036d87361f48c2ac1fc9c9803b7646a9bdfcd652fdf04e2c849b473585f209d2a6211a70ef47fa5e9cf5b16ac62370ce5910e92f635b92be9822f3195fa8d8206be3f9230328bfd37d28b75be84ea92a077ccf4743fc8da316512ca4b9519c3c3b217e819bf3e75694d53522714e9428a068f437998aec5a78cf469431308fa67dbc593d6513951b8e06558f76c33502ee9337d17bc2ed268a14dc4aadb3af4a7d1a1e579456ce5c633622f7ef170f493b998190ae9348f9877de3497c07052cf27a360e766f781dd94fd76165e9e3819021915dac11554125f39776752dbef5ed9886a82508e3a853859506d68e34bb01b95c94bf03f18245a0c48e9a42002b3d39fb664fdd14c329609787e4c696b86873b68419530b5e9d5ee5aa87d19da86f490d7939cdeb3230303f982dcbbe4a38353b8685b83c4a662a413bf8293f98767876e74551ada0a29cb3c653e869a5c98caf02be07e346eda411708a7e2a876a62bd93ecf30368414b1e812c5d700edaf3533e31d50f0a877470f1d13b8cdb994513324b0abdc5b68d0bd63357e011dfb5ffd46836f3880a6019501225a33f454bd66c9974313d795a0f9dd4e7688bfb0414710198722695d3de39f4a5509d2817efff7a405478b7f3f587acf72949798481c9ffc08dd72ad45f4a04cecd86a4806cf6a4a2442dee697ddeecc3e897c4916041f46d49749bdb0e27de3ff58806fed8b852dd5e9d6ad0b7fa0d1c9f8a533cc35e78d00cf3c0b7de38ac239fa1520992ff546749502ae0f4b0587ee8bd9fa6d0345f67d48812ae99fe16970c7207b58ef912e7d8d1f513e02024f7802e2fa4ba78472e2a2fedaa8d6ae951b37d1340b2ce5b70a40300a7244ce6d117d87440b5ab842b1f9803888094732630263ff56442763c239c0038ef472541f9e5ec8264768dedc955f8b9a65b8f0b885c05d8d902fd281a70b0b1bc01aebb4faaac14932a591727479ea60ec8ef6123a3ad6995b064f8ff070bdaf65f7898ddf1061c5f897a669acd380e9826c83cada705d2c1e6dd94ec1bdd8053d60d39c1bc29dc61e8c991d8ce42cab42b828c1e55a1e2e90498b2c9bcaabec2ed4eed892111888f775b9bd6e60b4e1a33f102499204894b49cdf0fde633982934229fa53fd2e3573f10a9a87f53b25769de1764c646265f054d3300280db7b5707c4b421e3b545a4e0d047a1e72c9a28a623512cd581b0afa556be1438075227231701a1be0c9d4dc1156df4151f651bc2e8489872171b9ef796f6d5fd83310be603170786b7b8bf9fab28689b64174e76054ea606e6369a9d82b9e6be2ac8ffa43e8a141d8b4db870ae06ef814c222367fc932ba1d69a8801d6c8f6892ad272b266f700e96f097d7856403768b8cdcc78b05646746195e9a84383c515a43d4cb8eb84e8d5cf5b72a1dc12ce67bf6e075fbb0791707f038fb5cfadf421842589912fb180969c653faad1ae95f8078f8b7929f8aa149018809c7a0048ed9f0d5c72b2a5bb32686434b1a4bc828ba82d22e02f02649b04fda0be154d796e8d181343dc6af3967b668436286b79c030bef83b061d3590d041cad1b5ba1d4ff3ab3afa701bf660a2b7983da525fa20b5ebddea5c1216c1583c929335ab6fa2256b6ba2b1732193e01b619574df78ffe722137457ca3783dea649ed1d3848bada67199def0731a0518dbb0c7f25b7c167017695bf755b4929b733707aee36faf391f191797a1a6fad3152cbb3d0482e11341aa515685bff40b331e13b90003bf7ac3f21974eb50f9aa8fdc785d8e251af0af53c70704545635f8a4423831dda827f88f214b6b252b9b2a921274426df8171b480a469eb562ff76b8e39c21f53a76d86140609080cd988b0270627d4c8d6227adf3d8d15195e86d20e00667a5a91e58ef67c4ac40262228a39dba231a519cfd13c04c1c511c40caf1062c43525ac5f92e713992e4e19c8b6848e231ad23097eb4b1e0a3b3ff45753784d848933a2492e07e4af1044f7cb2d9c2ebca1abc79c094c19fed883f8d06f35c57760537a3e2ad82978adedc983861935be207555030e3cef1bddb351013211cb945dbf148f248e97613468e6777849de6f0456600e53dad912ed328b4c28e9c188cecb601d1a1dbc1dee12b7ff53dc09a42c6453452344703e559b46354580806c960c19afae34c6858ed0931cd0394b120469fda6e784853f5788ed41b380e91ece51b1f4231a78a4535b60ac6fc2ce712bd82074e5376b4d7e6aa1c231f3aacb3c780623da65642662e474d128af20cfcd39c8984549fe0eba4406f2d859e7d0c4b6cba36100ed8557617604b681bff8bc3db438d8bce0beadbf679a643184d711bae08d099df0da3ca3a42908f734cf0f3161c52a5d09494b1442978a43e9a72b2ec4dbdfe5b70c9453e97c0698a03e379111737930f55f097e2e93553cd3520e142090fd7e58e67b7f6aea3fd837c5b413abf17980a1ad228ca4790aaef54e112ac1ccb1044efaa5cd4eece19cc93988b5ee749171e8f4a0ccb800ed7015525e07cc6ce3124ca2dea6290142c5a6382dfe0d90456eaa22cfb788c68c4b28820df8fbee3860ffa0af04b9400c6650314de086cb993882d3a4940e928dab52cead22845f967d86205c18139f8ab7cc8c1dec82fc5f4ad6a96bc644ff154b333da950b9508a5900b06073f6af13ff9e0eaf45277f23056ad8dc8758e292f043df4c64aa3b4ddec6e9ca864817c16b5859a0e8dc5a6c472a06f39a2a7737095eaf29a017efbca6a7cd4bae36ccd165e51b4d44fd9517e4a77c1e595f998d685cd564e3f0a45b8dca24ad2347e518e45fee253fab0cdb1b89942670d6bd638c5cc0f9575dd9f95d30b1f11a58d215396b96f9d9c6ca18ca03267e9d9dbe21a613298d03f4184cbbea96e169503e1a232f36c7b40adaa9d32e295530a85b130d5904f7418d311edccfde8ab62f00106bba2cd86e064fc91172ecd33a50e22aceef1efdadfda0e9555670e55b94626e974f7f330068a7a407bbdbbba34e59200b236399369c313026d0647affe21438615e38a7a6f6a0d5109957394eb5aa2ffc1e6c5f61394a9a9baabd333c33c8a561626eb76dd99073b82c44536c497a0b6c3795d1a60bb7c0d06d8deb676b522657d82be8f2385d39bab4611252a00e26b836a9d118e75f95046affde955d161b4d611912191cc9603b4b77e314bdac179cbb71a805ccb5aaccf5c538cb9adfb5975b6cf25b1c873702a77cc634b2e215ffe096c4beb4a6afd0d7977a681aa356c2e54abb9f766e48411af31510fda57bee763e4be844075902b9aaa9bf1be7344ad30e17a23306b2c08af26b2f2f39af05b9cc579a3ab754170c18b92226327ef30878d3eb218e12d149f63d9d5c82d384e9ae86006d4cbaf1a99a82e4a4901ec6435161a6c7e29fda499f1c02c66e6060e36c30a2952e01d4b1485cf38fc211802e6b4ce62cd3831c6e4e5242cec073f7300f913bcc6f0df9d9895c670cd431d8f8548254a26b02967ad9532f66819e5a95817ba142c3b73a6b15d50901b40ec4c7e5eff9980b64ffdc46863777f0075e2cad7dbd5469a7262416fe2c2c7f176ff65c5a855f39fdd5d2e9606242d1e81346850d0a4ad92eded0f32afd018448fb1a2edbc253cb8b574cf5f0d901a70cb397492eab44d2fb1265c7165cf51589dbdd9b7df7f51f23e296e01a807d7e73910bcd65747b2c64e3717c0cc40145731a9bb3a51d645382573d8ab557e048d8921d967bc8036d4afc682a608ddc77a503bbb16290da171fe81bfeca2a40b89d78ca3a93eed8e6be6fb9d4554b03d6d91a8dbbda37f15e4074c18583add5b990019e2b1849871628da8d54aae6a43d57c376640ffae37176c8d5942cabc02ce0553b918b1e86d391d2faf5d935449ee2fc923c28724118d45091a4648ab331b12d312647294433a70fbd1082b9ff1d5169cde41a574dc721d46a788248a638eb4e05c702653d1f096b62bd50cbb56929c03f2f7846678493e340e245cb0c273d7ea5ec47c321e9d0f5562a8b4ef01cf56ecdaa634a74a40d478a49dcd3080db2454c86a049ad9fec19a7ceabb55f3316cffefe2882fcb22f0b5f37b0bea7174454b160715ac414235aeeb7f3cffa370abddcd835f2364caf64f07d3b5e3357661b410699a6983419d992c5bee51275037186e2ddc6f58ba6496125038485b3db93e6e45615ef45764c8c7ba7aadf54ad987972163ad899e872d0cbf1066878c24071fd647d469d6320625779d03bdff323a69c38520025addb7116f89fa4a4ffc668c3dfbea143ed8599ee98f34cc4b1df987e0d74fcc84f155d0f535179731481785e20e7c75ac1fa5dc7df8e1dd810e4a2871ca5d13fb68445b6edb74d53c4be42bbd0bb091ebefef815eb477f1aec046495e5dfce86e9ac3bdc61033ef77b211b4a67b7b31ccb325d897608531f7da8a1a60b0082aa74bf020831ee8648465c550b08735b2a9100ff8a34b142f0125f828c22c5254f6b6f50df91f47707eba2070b8479c5315f152c06d93173bd3243b7befd8ec5bb16b0baad453b6485060e3eec5759f3596e17c56de905c9f8cd77468c02ba68729db3d741d287f2b8e6cb2ef53a1aa82296509d3158ce7e0e7b7df2d38d3f9466867e1e2d82b988d957be5e398b1038bf9466afc661fb767ebf8d8243fbd01de2b7ae0a1d9b6dadddc5500bb1c7948a25a2dd6907f6f88fd1378be5885803593d23968f8972a0bbfd2d4b762da6a2786311b0791eec3256305057fa6a2d12d3dd6f50a35da09f7831471e2bacbf2a127595a7bdbe9561208f61490536a2b47fd5f036abe0d11c403e6e8270a40c481f8c16d77c53d3e657b008868ccd516ff8ee0dd1e2445540d97f6fb84bc94f44aff544c19adb2d82116d76b84c6a55f91ed278e95f08dae13e26027fca5707aa2eb2d4be7f6562a56e7a55050c666e530b2365ce4f762b911c0e4c7fd7b7e6c6cf8bcc8b6bca11cdbefd75c2a364e87166588786cdd88f8c26e52abc838b792573ae401843dc13942f8b4adea03b00809cde08f58bb34ae6ae5111a672d858eb16932f4329b1c77bc15a753fc221eca02e729773a85b0e5f705112a8884a059fa1bc5e85ee085aae7fae20d4e8ae7fa7c8263e82c671be90d755f6b91ad928cf55c063083f3b50ed632910e09c3820bbf2628bf3b7100f0fd53511daa8251e690f41d04efd8a6feef45023110a8c4ade88d5115b8e6a0a213a1b6e4a415d885b8eb6ed06e7ce8bd55bc683d44d31"}, {0x90, 0x102, 0xffffffff, "8d8e9203b4220916e905d673d5112e01bbcfa426d6578a55a271d7c6b054e9edb5d7ab1015d9c97d9d23645884276e812f6dce0bf97d0c163afb1c6afcbf89d4aa9f7dce28deada2c56db38da70903495929e17b811a3fe1895efac68918771a369a88caf794f4da0af6ce6375b814de7cc957327493c05db346"}, {0x48, 0x11f, 0xc0, "a4012a8d6debce047b16899a05273b7cb370c2e387d76c7f0e73bfb8665d8cee49286d340f96e378fd16aa45b10d6f6d25daa9fe"}, {0xc0, 0xa8df71be79f481c, 0xb72, "099fe00cc1f763012977a732d860d7702b2aec229c993eb02fc34199868b7a7a9c60518a7269b56f6f5c38fd079063886e0407a3e4af800c5bbc936040603e335efefadbd694c8a569a2df0720b0b744f2526d6f3d3f49331f77166b7aed2a9a97ab99f63b63796284d1b88b6f06a9aec501eef1e8b9985b3e2c025bfc95f7977fd1f64a62ece82321fc801bafccbc688948294cd8f339822c48f1b548dd60292e87f1703ba7ef394aa0173fd8"}, {0xc8, 0x117, 0x8001, "d196c8f8b7a96ac9081d6ea2ed4a4c900d338d507298a85190f43cfc4846407f59c604f16fd2b50dbb0ef45b966f5318a1940f1c86203c55515501c1d8e050991fed566b5840683c3d7d04fb1c7807e851090c79f0f3b44a4168a0cb3405b8c669321eabd90cf68448be57f7e97f1c4dfc380b74b647448d43de3ec51d9c0646ccb476d12d178380e7a0c84e1f1f53f7714e4234340bb67ebae70e78e3b0551d3b2633e6a3908048cc9411a74d27c7085835"}], 0x1520}, 0x8001}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000003c0)="9156d5348421c772c536ea427908c5a4db9a92d603f95e85dc65a00a2d38e686f222a2ce968a03f8f1fec9900d81eb628d0e8db4121b3dc81b4cbcc902c83e3ba431ca6cfd880490fa079a8d25519c4745aaaf911f9da2562638f2e6cb11675afed9371636d7a99b7923d2aa331d86a6400708723e1e270a5b80045003ce668c3eb68e5aa8ed994f786fcae4165e751fe7d59559a789137ee49d3a7912c7c0dfadacea7b967a", 0xa6}, {&(0x7f0000001ac0)="3060ca03a6f370826b372b16a682468c04f70876be54766d65756a6c1a0b99c041a4ee24f0d28c092b2176b241faa73315e4b44aa9e25f154ea47aed2340f502197fe45eb5abbb102d8e67511f093f29bff8fb575241d4b24182f5950c5c3a72f6eb305ef6109037f5df43388bc4ac21454246fe0d6905051acdf0d4fdd4351aa50b09ad0d3f0636a967942003fa41373b31e80823ed6550b8a92560ac11792c95ae419bbb53ad414de08f6deb79ec499262d8b927ac99dc3d422e6315e805430e5c14e34b2d1727bb41c05f5f24828eb2a6fef324d3ce84a13036fa308f63b14ab94ff11b0d3fd28245952fca1995f0888805466288b5", 0xf7}], 0x10000000000001a9}, 0x4}], 0x2, 0x11) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000500)={0xffffffff, 0x5df7, 0x7, 0x83, 0x4}) munlockall() r10 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r11 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r11, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r12, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f00000008c0)={0x90, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x371, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="06ff0f0000000000"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) [ 1587.190567] binder: BINDER_SET_CONTEXT_MGR already set [ 1587.196022] binder: 32323:32326 ioctl 40046207 0 returned -16 [ 1587.206208] binder_alloc: 32286: binder_alloc_buf, no vma [ 1587.211909] binder: 32323:32326 transaction failed 29189/-3, size 24-8 line 2973 [ 1587.220014] binder: send failed reply for transaction 455 to 32286:32287 [ 1587.228231] binder: undelivered TRANSACTION_COMPLETE [ 1587.233633] binder: undelivered TRANSACTION_ERROR: 29189 [ 1587.250437] binder: 32323:32326 ioctl 5382 20001c00 returned -22 [ 1587.258890] binder: 32323:32326 ioctl 401c5820 20000500 returned -22 [ 1587.269310] binder_alloc: 32323: binder_alloc_buf, no vma [ 1587.275074] binder: 32323:32326 transaction failed 29189/-3, size 0-0 line 2973 [ 1587.282732] binder: 32323:32326 ioctl c0306201 200008c0 returned -14 [ 1587.290502] binder: 32323:32326 unknown command 1048326 [ 1587.296055] binder: 32323:32326 ioctl c0306201 20000380 returned -22 [ 1587.308641] binder: undelivered TRANSACTION_ERROR: 29189 [ 1587.323103] binder: undelivered TRANSACTION_ERROR: 29189 14:48:17 executing program 2: inotify_init1(0x80000) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'broute\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000000000), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x2000000400200) fsetxattr$security_evm(r2, &(0x7f0000000200)='security.evm\x00', &(0x7f0000000240)=@md5={0x1, "df718740421c3c4861b5e724cc61cb09"}, 0x11, 0x2) r4 = eventfd(0x0) r5 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x73cbf6dc, 0x80000) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r5, 0x5386, &(0x7f0000000100)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r4, 0x0, 0x20200000001, r4}) 14:48:17 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r3, 0x107, 0x9, &(0x7f0000000040), &(0x7f0000000000)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) r5 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000340)="f641f4273450b1e48f51c72cdd5b757e3c2c03c1312fddaab75963482e1b2210508cee99627a34cb8999b858368978474ed44c38de914f0e86252e3ef0f0df79e4fa4ddc34bf4cc6080745565f832bfd5a", 0x51, 0x0) r6 = request_key(&(0x7f00000001c0)='rxrpc\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f0000000400)='/dev/kvm\x00', 0xffffffffffffffff) r7 = request_key(&(0x7f0000000440)='asymmetric\x00', &(0x7f0000000480)={'syz', 0x2}, &(0x7f00000004c0)='-#$\x00', 0xfffffffffffffffb) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000640)={r2}) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f00000006c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r8, &(0x7f0000000800)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x54000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x84, r9, 0x820, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xb, 0x62db3d1bba650e0f}}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x16}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xc, 0x20}}, @IPVS_SVC_ATTR_AF={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x84}, 0x1, 0x0, 0x0, 0x80}, 0x4040040) r10 = getpgrp(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, r10) keyctl$dh_compute(0x17, &(0x7f0000000500)={r5, r6, r7}, &(0x7f0000000540)=""/114, 0x72, &(0x7f0000000600)={&(0x7f00000005c0)={'sha256\x00'}}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) r11 = dup(r1) ioctl$KVM_SET_NR_MMU_PAGES(r11, 0xae44, 0x800) getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f00000009c0)={@local, 0x0}, &(0x7f0000000980)=0x14) r13 = getuid() setsockopt$inet6_IPV6_XFRM_POLICY(r11, 0x29, 0x23, &(0x7f0000000240)={{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@multicast1, 0x4e21, 0x4, 0x4e20, 0x851, 0xa, 0x20, 0xa0, 0x21, r12, r13}, {0x9, 0x5, 0x2, 0x8, 0x1be, 0x7b7, 0x9, 0x2}, {0x4, 0x80000001, 0x1, 0x5}, 0x3, 0x6e6bb6, 0x0, 0x0, 0x3, 0x2}, {{@in6=@mcast1, 0x4d5, 0x32}, 0xa, @in=@loopback, 0x3503, 0x7, 0x3, 0x3ff, 0x401, 0x6, 0x72113c64}}, 0xe8) 14:48:17 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x1, 0x4000) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000100)) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd(0x7) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000180)=0x9a2, 0x4) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000140)=0x7, 0x4) 14:48:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = gettid() r3 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0xffff, 0x141000) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0xb257, 0x2, 0x1f, 0x4, 0x0, 0x4, 0x20000, 0x4, 0x0, 0x8000, 0x7, 0x7, 0x7, 0x8000, 0x2, 0xffffffffffffffff, 0x8, 0x5, 0x10001, 0x10001, 0x2, 0x40, 0x8b4, 0x2, 0x8, 0x6, 0x9, 0x9, 0x4, 0x8000, 0x1735000000000000, 0x7062, 0x8, 0x100, 0x8, 0x81, 0x0, 0x80000001, 0x1, @perf_config_ext={0x9, 0x1000}, 0x0, 0x0, 0x68e, 0xa, 0xffffffffffffffc1, 0x10001, 0x6e5}, r2, 0xf, r3, 0x2) ioctl$KVM_SET_DEBUGREGS(r3, 0x4080aea2, &(0x7f0000000180)={[0x102000, 0x102002, 0x1, 0x4000], 0x2, 0x4, 0xffffffff}) ioctl$KVM_SMI(r3, 0xaeb7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="031ec1cc53be6858c459b25cd4257f75da74365b235e457b791614c7f7846c22f8d424f79c9fec51f1303b69e48f2e4fc04ebb4596d81aaecd7abf0095c8c97bd2c156304fb24fe2675ea641dbc23b0b39d392973eddc0bd595aab000000000000000000000000002000005e1e7948e4c65eaf281b6bdc6396f25133b8a0d97fa94911e8c6c35ae623e173605fcb0dbd0f218d7c603db8781ba1b2178dd816d081da0ae616452abb3c4272b58e494445f205bd50c6c7b3c2d6ee0a0c3df1df820d96670f68f3ff3f40b475ca4d9b8aa318de7ce4a8231e69b8e064b85c41f448802bba027f3fbf8cdeab076af149b7e6037b3c418ed0d6fdda4e586ea5ebb9e551f3ecc017f87cdde040e5b10ed07a48848d3fede264270c0faed6e0716ca1cf66b9edcbb49034678fabe5036e6b7ac62d29fb14ee2e781226f3423ffbd9fe8a3d9eb8b66e4902d826c2e72491cc28805cf8da6ccf91482604802aa9ef57b4d340a131f195565c66f9cc252e2c6e"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$NBD_SET_BLKSIZE(r3, 0xab01, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 14:48:17 executing program 5 (fault-call:2 fault-nth:0): getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1593.048926] FAULT_INJECTION: forcing a failure. [ 1593.048926] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1593.054185] binder: 32334:32335 unknown command -859759101 [ 1593.061121] CPU: 1 PID: 32342 Comm: syz-executor5 Not tainted 4.20.0-rc7+ #15 [ 1593.066876] binder: 32334:32335 ioctl c0306201 20000380 returned -22 [ 1593.070928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1593.070928] Call Trace: [ 1593.070928] dump_stack+0x173/0x1d0 [ 1593.070928] ? __alloc_pages_nodemask+0x7b0/0x5f20 [ 1593.070928] should_fail+0xa19/0xb20 [ 1593.070928] __alloc_pages_nodemask+0x7b0/0x5f20 [ 1593.070928] ? update_cfs_rq_load_avg+0x5e1/0xa10 [ 1593.070928] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1593.070928] ? update_load_avg+0x11b5/0x1a90 [ 1593.070928] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1593.070928] ? __list_add_valid+0xb8/0x430 [ 1593.070928] alloc_pages_current+0x69d/0x9b0 [ 1593.070928] pte_alloc_one+0x5a/0x1a0 [ 1593.070928] do_huge_pmd_anonymous_page+0x87e/0x28c0 [ 1593.070928] handle_mm_fault+0x5b3b/0x9ef0 [ 1593.070928] ? __schedule+0x6f3/0x830 [ 1593.070928] __do_page_fault+0xf26/0x1a60 [ 1593.070928] do_page_fault+0xe9/0x5c0 [ 1593.070928] ? kmsan_unpoison_pt_regs+0x13/0x20 [ 1593.070928] ? page_fault+0x2b/0x50 [ 1593.070928] page_fault+0x3d/0x50 [ 1593.070928] RIP: 0010:__get_user_4+0x21/0x30 [ 1593.070928] Code: 50 ff 31 c0 0f 1f 00 c3 90 48 83 c0 03 72 55 65 48 8b 14 25 00 fd 02 00 48 3b 82 58 1a 00 00 73 43 48 19 d2 48 21 d0 0f 1f 00 <8b> 50 fd 31 c0 0f 1f 00 c3 66 0f 1f 44 00 00 48 83 c0 07 72 25 65 [ 1593.070928] RSP: 0018:ffff8881895dfc28 EFLAGS: 00010202 [ 1593.070928] RAX: 000000002026bfef RBX: ffff8881895dfc30 RCX: 0000000000000000 [ 1593.070928] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: ffff8881895dfd60 [ 1593.070928] RBP: ffff8881895dfe68 R08: ffff8881895dfd68 R09: 0000000000000000 [ 1593.070928] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffffff [ 1593.070928] R13: 00000000000002c9 R14: 000000002026bfec R15: ffff8881895dfd60 [ 1593.070928] ? kernel_move_pages+0x9bf/0x2b80 [ 1593.070928] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 1593.070928] ? prepare_exit_to_usermode+0x114/0x420 [ 1593.070928] __se_sys_move_pages+0x111/0x130 [ 1593.070928] __x64_sys_move_pages+0x6e/0x90 [ 1593.070928] do_syscall_64+0xbc/0xf0 [ 1593.070928] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1593.070928] RIP: 0033:0x4579b9 [ 1593.070928] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1593.070928] RSP: 002b:00007f7854240c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 [ 1593.070928] RAX: ffffffffffffffda RBX: 00007f7854240c90 RCX: 00000000004579b9 [ 1593.070928] RDX: 0000000020000000 RSI: 00000000000002c9 RDI: 0000000000000000 [ 1593.070928] RBP: 000000000073bf00 R08: 0000000020002000 R09: 0000000000000000 [ 1593.070928] R10: 000000002026bfec R11: 0000000000000246 R12: 00007f78542416d4 [ 1593.070928] R13: 00000000004c371e R14: 00000000004d62e8 R15: 0000000000000004 14:48:17 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x4c000, 0x40) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r3, 0x111, 0x1, 0x4b1, 0x4) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) getpeername$packet(r3, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000001c0)=0x14) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r3, 0x84, 0x4, &(0x7f0000000100)=0x8, 0x4) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2402}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=@gettfilter={0x34, 0x2e, 0x102, 0x70bd28, 0x25dfdbfe, {0x0, r5, {0xfff1}, {0xfff1, 0xfff7}, {0xa}}, [{0x8}, {0x8, 0xb, 0x7}]}, 0x34}}, 0x40) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:48:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = mmap$binder(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x4, 0x80052, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x8c, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="076304400400000010630840030000000000000006630440000000000763044001000000056304400400000011634840030000000000000004000000000000000000000000000000000000000000000000000000000000001000000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="40000000000000001800000000000000"], @ANYBLOB="000000e48f0486bf438af5a8f538ca15bda942d64c75062835ad8ede36096151f45423a72c37f5db9702c8a875f6822b05f8c030887e47322dde27039d2d2d5c1b56d49ac377666b8939e0551be4abebd01853d5562ee7b18036e34aa5e0105a7b6a619a4588578d38e201a8ce89388b617d619346e99f2b91da2323369e5ca30d6bb8f1dc5d01e06345e02b806c3fa9f248ab5d94699399d0daaa25060b23b2d7d2ec79bbe48c56b0d1c110b24a7e8556c80834dedb38512d0782116469edec9b2c38963868427ea95a748ffb6e4adf7127a52fc68e44573537d434be0323dc38a4d340af77db4a11d334196af65ba5efcabdd3bedf787469969cfaf5f88b9b7048d60b7237d12c0b33f2c0190a932bdf366d61f162f4a9cad7b0c629e431014c1570f3095d678850d8e4b222e4c64a682ee72ea612061c54f9a2daf96a44058bd1a700acb228fbe88792c6211dc401509f40b3926fe3033cf2076f6ed0b800000000000000000000000000", @ANYRES64=r1, @ANYBLOB="0200000000000000"], 0x1b, 0x0, &(0x7f0000000180)="256e669b176ba9d9ffa53c461d7396762f6abdab7646f4658a5a38"}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x140, 0x0) ioctl$IOC_PR_PREEMPT(r3, 0x401870cb, &(0x7f00000000c0)={0xffffffffffffff00, 0xfb, 0x8000, 0x10000}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r3, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000580)={0x8c, r4, 0x904, 0x8, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffff}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7ff}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x4}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x5e}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xffffffffffffffff}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x40000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$VIDIOC_G_INPUT(r3, 0x80045626, &(0x7f00000003c0)) 14:48:17 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$TIOCLINUX5(r0, 0x541c, &(0x7f0000000000)={0x5, 0x1, 0xcd8e, 0x8001, 0x191}) [ 1593.434436] binder: send failed reply for transaction 462 to 32334:32335 [ 1593.445409] binder: undelivered TRANSACTION_COMPLETE [ 1593.450748] binder: undelivered TRANSACTION_ERROR: 29189 14:48:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x2000000400200) fsetxattr$security_evm(r2, &(0x7f0000000200)='security.evm\x00', &(0x7f0000000240)=@md5={0x1, "df718740421c3c4861b5e724cc61cb09"}, 0x11, 0x2) r4 = eventfd(0x0) syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x73cbf6dc, 0x80000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r4, 0x0, 0x20200000001, r4}) 14:48:17 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ashmem\x00', 0x40000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x40007ad) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:48:17 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$BLKIOOPT(r1, 0x1279, &(0x7f0000000080)) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000140)={[{0x0, 0x70, 0x8, 0x9, 0x6, 0x5, 0x9, 0x5, 0xc1ac, 0xa8, 0x9, 0x4, 0x8000000000000000}, {0x3, 0x4a9d6568, 0x6, 0xfff, 0xfffffffffffffff9, 0x2, 0x1f, 0x2, 0xffffffffffff8000, 0x8001, 0x1, 0x7}, {0x9, 0xa16, 0x7f, 0x7ff, 0x3, 0x0, 0xfffffffffffffffe, 0x80000000, 0x82ab, 0x4, 0x4, 0x0, 0x2}], 0x401}) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='memory.events\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000200)={0x0, 0x1, 0x71d}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={r4, @in6={{0xa, 0x4e20, 0x7ff, @local}}, 0x3, 0x5, 0x3, 0x1f, 0x28}, &(0x7f0000000340)=0x98) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000100)={0x3, r2}) ioctl$FIONREAD(r3, 0x541b, &(0x7f0000000380)) 14:48:17 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x25c, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x1, 0x0) recvmsg$kcm(r0, &(0x7f0000000700)={&(0x7f0000000080)=@tipc=@name, 0x80, &(0x7f0000000580)=[{&(0x7f0000000180)=""/136, 0x88}, {&(0x7f0000000280)=""/245, 0xf5}, {&(0x7f0000000380)=""/52, 0x34}, {&(0x7f00000003c0)=""/95, 0x5f}, {&(0x7f0000000440)=""/21, 0x15}, {&(0x7f0000000480)=""/25, 0x19}, {&(0x7f00000004c0)=""/148, 0x94}], 0x7, &(0x7f0000000600)=""/198, 0xc6}, 0x40) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x5) ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f00000007c0)) fsetxattr$security_selinux(r0, &(0x7f0000000000)='security.selinux\x00', &(0x7f0000000040)='system_u:object_r:devicekit_power_exec_t:s0\x00', 0x2c, 0x3) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000880)='IPVS\x00') getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000740), &(0x7f0000000780)=0xc) [ 1593.912838] binder: 32362:32363 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 1593.920679] binder: 32362:32363 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 1593.928832] binder: 32362:32363 Release 1 refcount change on invalid ref 0 ret -22 [ 1593.936756] binder: 32362:32363 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 1593.944642] binder: 32362:32363 Acquire 1 refcount change on invalid ref 4 ret -22 [ 1593.952532] binder: 32362:32363 got transaction to invalid handle [ 1593.958883] binder: 32362:32363 transaction failed 29201/-22, size 0-16 line 2834 14:48:18 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x2000000400200) fsetxattr$security_evm(r2, &(0x7f0000000200)='security.evm\x00', &(0x7f0000000240)=@md5={0x1, "df718740421c3c4861b5e724cc61cb09"}, 0x11, 0x2) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r4, 0x0, 0x20200000001, r4}) 14:48:18 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socketpair(0xf, 0xa, 0xa8, &(0x7f0000000080)={0xffffffffffffffff}) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rfkill\x00', 0x480, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, &(0x7f00000001c0)="660f3882b313599f83660f5f7b000f20e035020000000f22e02e0f01d1ea000001001701c74424000d000000c744240200000000c7442406000000000f011424c4c14de2c9660f3881af0e000000c4c21bf6320f09", 0x55}], 0x1, 0x40, &(0x7f0000000280), 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000100), 0x4) r5 = eventfd(0x4) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r5) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x3ff, r5}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r5, 0x0, 0x2, r5}) 14:48:18 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) write$P9_RATTACH(r0, &(0x7f0000000040)={0x14, 0x69, 0x2, {0x4, 0x2, 0x8}}, 0x14) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:18 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x100000010000, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) write(r0, &(0x7f0000000000)="f0cd0e904487a00a035178fa755aef8e8bafb03a2898019759f80c251ccbdeb64e866cf6fc271bcd6ec5b330f8e818a16a4e7f2898e4cc6c8c539855279c4353441e45a7dcc7801d14323a228af4399796bb", 0x52) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000180)=""/145) [ 1594.226039] binder: 32362:32384 transaction failed 29189/-22, size 24-8 line 2834 14:48:18 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x1ffffffffffffff8) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="872a522e00000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000040)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:18 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x2000000400200) fsetxattr$security_evm(r2, &(0x7f0000000200)='security.evm\x00', &(0x7f0000000240)=@md5={0x1, "df718740421c3c4861b5e724cc61cb09"}, 0x11, 0x2) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x20200000001}) [ 1594.503854] binder: undelivered TRANSACTION_ERROR: 29201 [ 1594.509496] binder: undelivered TRANSACTION_ERROR: 29189 14:48:18 executing program 2: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000000)={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0x0, 0x0, 0x1e, [], 0xdc, &(0x7f00000000c0), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1594.622484] binder: 32404:32405 got transaction with invalid offset (0, min 0 max 24) or object. [ 1594.631973] binder: 32404:32405 transaction failed 29201/-22, size 24-8 line 3035 14:48:18 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) r4 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x200, 0x80100) setsockopt$inet6_MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000200)={{0xa, 0x4e22, 0x5ece, @remote, 0x401}, {0xa, 0x4e24, 0x888a, @mcast2, 0x6}, 0x40, [0x1, 0x3, 0x2, 0x8, 0xfffffffffffffff7, 0x8, 0x7, 0x101]}, 0x5c) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0x9}}, 0x20) ioctl$SCSI_IOCTL_STOP_UNIT(r4, 0x6) write$RDMA_USER_CM_CMD_BIND_IP(r4, &(0x7f00000001c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x5, @remote, 0x8}, r5}}, 0x30) 14:48:18 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) bind$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x2711, @my=0x1}, 0x10) move_pages(0x0, 0x9, &(0x7f0000000000)=[&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x6000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil], &(0x7f00000000c0)=[0xaabe, 0x0, 0x2, 0x6000000, 0x3, 0x28, 0x1, 0x3], &(0x7f0000002000), 0x0) [ 1594.676924] binder: 32404:32405 Release 1 refcount change on invalid ref 1 ret -22 14:48:18 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000080)=0x0) sched_rr_get_interval(r3, &(0x7f0000000100)) 14:48:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x2000000400200) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r3, 0x0, 0x20200000001, r3}) 14:48:19 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = creat(&(0x7f0000000000)='./file0\x00', 0xf4) ioctl$VIDIOC_QUERYMENU(r0, 0xc02c5625, &(0x7f0000000040)={0x800, 0x6, @name="49cec4677cd5f74c3a85b60772af9436e48f6f7609298e7631e601911fcc0bbc"}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @multicast1}, @in={0x2, 0x4e24, @loopback}], 0x20) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) statfs(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)=""/3) 14:48:19 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = eventfd(0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x200000, 0x0) write$apparmor_exec(r4, &(0x7f0000000140)={'stack ', '/dev/kvm\x00'}, 0xf) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:48:19 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x3, 0x800000000000a) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x1, 0x91, [0x200002c0, 0x0, 0x0, 0x200002f0, 0x20000320], 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ff0300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff28a4f27200000000000000d1027e7bd433000000000000000000000000000000000000000000000000000000000000000000ffffff"]}, 0x109) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x3}}, 0x20) personality(0xd300007) ioctl$KVM_TPR_ACCESS_REPORTING(r2, 0xc028ae92, &(0x7f00000001c0)={0x5, 0x8}) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000180)={0x10, 0x30, 0xfa00, {&(0x7f0000000000), 0x0, {0xa, 0x4e23, 0x0, @mcast1, 0x3}, r3}}, 0x38) 14:48:19 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) pipe2$9p(&(0x7f0000000080), 0x800) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:19 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1595.295870] kernel msg: ebtables bug: please report to author: entries_size too small [ 1595.393955] kernel msg: ebtables bug: please report to author: Couldn't copy entries from userspace 14:48:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001, r2}) 14:48:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0663004005000000"], 0x1, 0x0, &(0x7f0000000540)="fc"}) r3 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000040), &(0x7f00000000c0)=0x10, 0x80000) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffff9c, 0x84, 0x18, &(0x7f0000000100)={0x0, 0xfffffffffffffff8}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000180)={r4, 0x7fffffff, 0x1f}, 0x8) pkey_alloc(0x0, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:19 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/mixer\x00', 0x2000, 0x0) getpeername$unix(r1, &(0x7f0000000300)=@abs, &(0x7f0000000380)=0x6e) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000080)={0x0, 0x100000001}, 0x2) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r5, 0x0, 0x2, r5}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r5, 0x0, 0x2, r5}) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x40000, 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000240)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r7, 0x10, &(0x7f0000000280)={0x101}) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000140)={0x0, 0x9}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r6, 0x84, 0x78, &(0x7f00000001c0)=r8, 0x4) [ 1595.536071] binder: undelivered TRANSACTION_ERROR: 29201 14:48:19 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) pipe2(&(0x7f0000000080), 0x4000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:19 executing program 5: bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000000)=0x9, 0x4) r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x1, 0x200) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000080)={0x2e, @local, 0x4e23, 0x0, 'lc\x00', 0x10, 0x8, 0xc}, 0x2c) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x80200, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) msync(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2) 14:48:19 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x4200) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f0000000280)="9f912e6000ac21d8057589852465ed39a5442a4b0170018742468988d702cf2f6276b45429621198a9408bc5de9e14802414c8dcb10ea15acc505ad091d0f91e858ee22db2932aee7f4670c67ae8215cc250599c44732521c966fe276a5a96469aa7d0741bcb70a00f56160698b70638849375523e75bef2a83b4074017bade04e758552361d5d4418e6adbf4ab0db7eacd444f805ea81d93ca4a671c82ece6d92489e35d9fda998c351541c68ebf06875220b7b950489b5d306006b1d525720ad6d546373ca293b1b429b1270bac9df95") r1 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000040)=0xe9b2) socket$bt_hidp(0x1f, 0x3, 0x6) [ 1595.732251] binder: 32464:32466 unknown command 1073767174 [ 1595.737990] binder: 32464:32466 ioctl c0306201 20000380 returned -22 14:48:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x18) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001, r2}) 14:48:20 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x8c880, 0x0) ioctl$SG_EMULATED_HOST(r2, 0x2203, &(0x7f0000000100)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400600) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:48:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0xffffffffffffffff) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1595.936687] binder: send failed reply for transaction 470 to 32464:32466 [ 1595.951050] binder: undelivered TRANSACTION_COMPLETE [ 1595.956533] binder: undelivered TRANSACTION_ERROR: 29189 14:48:20 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.upper\x00', &(0x7f0000000180)={0x0, 0xfb, 0x67, 0x1, 0x400000000, "9de9678cdc834b58ae01b8690184215b", "9a9b01d9bce4a3133be5eace67aa0a82d4de9f0ee5e3aadd3e2c7d12de8485bbff61afde2337b621660deafaf9ed59127696422caf116988a48edbd6680c747e9255fd2e25b48a775f6f57bfe211d59a6ee7"}, 0x67, 0x2) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000280)=ANY=[@ANYBLOB="0100000000006e6da34491904af7df2b53182712c78500756c69d11e00200900000000000000000000e91221358b0000000000000000fb416b90320747fc71a7adbbb909303b70d76391618f25a89286e7242b1ca3c0d6461033faa44b7d45235ea620903c4ed611964c3c8f0bc2c0f3c9efd62c237e90e11a19be73de0eed8195a2a81cf703ee0abc81d467b993e42533ab98b170d07e9071"]) [ 1596.120613] binder: 32493:32494 transaction failed 29189/-22, size 24-8 line 2834 14:48:20 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x50, 0x9, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:20 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x8100, 0x0) r1 = dup(0xffffffffffffffff) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000040)={r1, 0x0, 0xfffffffff0000000}) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:20 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001, r2}) 14:48:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) r3 = pkey_alloc(0x0, 0x2) pkey_free(r3) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1596.363120] binder: undelivered TRANSACTION_ERROR: 29189 14:48:20 executing program 1: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000100)="792399e7c68de71f49d4a8687f61a61d", 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:48:20 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r0, &(0x7f00000000c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000002}, 0xf7, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="aa000000", @ANYRES16=r1, @ANYBLOB="080029bd7000fbdbdf25100000000000020000000800ff0700000000010000000000000000000000000000000001000003000200000000000800ffffffff000002004e24000000000100ff010000000000000000000000000001000007007cad000000000400f0f4ffff0000090001000000000003000100000008000500fdffffff00000300000007004e210000000007004e22000000000400ffff0000000007004e24000000000500ac1414bb000002007665746830000000000000000000000000000400cea8000000000400000800000000020073797a6b616c6c65723000000000000008000500000000003800010008000b00736970000c0006006e6f6e6500000000080001000a0000000c00070004000000180000000c000700000000003400000008000600048200001c00020008000b000a0000000800090001040000080009005217a90f"], 0xa8}, 0x1, 0x0, 0x0, 0x44085}, 0x8815) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:20 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001, r2}) 14:48:20 executing program 2: ustat(0xffffffff, &(0x7f0000000080)) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000000080), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, &(0x7f0000000000)) 14:48:20 executing program 4: ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000080)=0x0) process_vm_writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000100)=""/150, 0x96}], 0x1, &(0x7f0000000500)=[{&(0x7f0000000200)=""/194, 0xc2}, {&(0x7f0000000300)=""/171, 0xab}, {&(0x7f00000003c0)=""/13, 0xd}, {&(0x7f0000000400)=""/247, 0xf7}], 0x4, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:48:20 executing program 1: sendmsg(0xffffffffffffffff, 0x0, 0x0) pipe(0x0) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0xc0100, 0x0) getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000100), &(0x7f0000000140)=0x4) 14:48:20 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000080)={r0, 0x0, 0x20200000001, r0}) 14:48:20 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x4, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) fcntl$setsig(r0, 0xa, 0x4) 14:48:21 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0xe5b2, 0x400200) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)=[0x8, 0x400, 0x1, 0x101, 0x3, 0x7, 0x400, 0x3, 0x4a], &(0x7f0000002000), 0x0) 14:48:21 executing program 3: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f0000000080)={r1, 0x0, 0x20200000001, r1}) 14:48:21 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000)="ce5839e0300d7dddd0fc4147470f51eee9f736d132a402658661259093a9bdfc54b6d7c378d83d2a0dd0e8a3f19d3acffa7e8d6aec9196270065aaf9101c379c7c06974092fa88d594eff640d52442a3abb06804c1547dfd97e93186f388543171217058504207d2ce1f69d7e7dbbc03a00a610d8ed43ff4fb3217598b525d58d49f1a6c7dee63b8f1b1e84f2ef17fb5841bd9c07c134becfa9bdc7de5a7e9fbb39b766464c05471ec86c3bb4a957301fa05a6a23e387b35b67b1ff860a39cbb7a79b9afdd504349323d92a60623dfae6c0d3257915f9dda89701b4891c4f83d", 0xe0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x40000, 0x0) ioctl$KVM_GET_DEVICE_ATTR(r3, 0x4018aee2, &(0x7f0000000100)={0x0, 0x6, 0x81, &(0x7f00000000c0)=0x189}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:21 executing program 1: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000340)={{{@in6=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in, 0x0, 0x32}, 0x0, @in6=@mcast2}}, 0xe8) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000140)=0x1, 0x4) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) 14:48:21 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = accept4(0xffffffffffffffff, &(0x7f00000003c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000440)=0x80, 0x800) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000580)={{{@in6=@dev, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000680)=0xe8) sendto$packet(r2, &(0x7f0000000480)="2e1d4298348c281794bdfec8ffec065309f5f3c4bcf1180f5c641a091e92e8ef498d3a7e480678b6d51bb7cc5fcd8d72a4e0758a196661b658a19c03fd8e7b2881d979ffe6d31fa7294b75ee2714fb3cb603ca79431f523a2cc914e712a740a9b59a21f6181005d3fb3684ffdfb75f6d6dbf3b120fc29e1968d85c52a40354882bd14a45ca12511459f47c41fec045fdbac86d6dde00362389b6c46770431ce418d90c2c71fd11c3c511c2e56f0cee9c8b860f4255cfad4188c2190c608a001cff2014c4b03e51c3e0abf968dfcea3674e0310", 0xd3, 0x40, &(0x7f00000006c0)={0x11, 0xd, r3, 0x1, 0x2b05, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:48:21 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x3, 0xfffffffffffffe98, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1597.394977] binder: send failed reply for transaction 475 to 32516:32517 [ 1597.416895] binder: undelivered TRANSACTION_COMPLETE [ 1597.422153] binder: undelivered TRANSACTION_ERROR: 29189 14:48:21 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) r1 = shmget$private(0x0, 0x3000, 0x8c, &(0x7f0000ffd000/0x3000)=nil) shmctl$SHM_INFO(r1, 0xe, &(0x7f0000000040)=""/47) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 14:48:21 executing program 3: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f0000000080)={r1, 0x0, 0x20200000001, r1}) 14:48:21 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$fuse(0x20000000, &(0x7f0000000000)='.\x00', 0x0, 0x7a00, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x40400, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000003c0)={0x0, 0x1ff, 0x7f}, &(0x7f0000000400)=0x8) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f00000001c0)={r1, 0x2, 0x1, 0x0, 0x6, 0x0, 0x0, 0xff, {0x0, @in6={{0xa, 0x4e20, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}, 0x1, 0xffff, 0x3, 0x7f, 0x9}}, &(0x7f0000000440)=0xb0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f00000002c0)=ANY=[@ANYRES32=r2, @ANYBLOB="6c000000406dc65958f32fa708a3c4e06ed5486d1639c5cca42110bd75c17ab4bceea3f4ea1770484239aabcd6fe5b3af10ad75196f08117f2e2162fc73d264bc912ec41ef89dae901537c499dc0f0987fb1e4a87950290f587cbb6b5c91defe6ae974559052e74d17dfeae8d556be52"], &(0x7f0000000380)=0x74) r3 = open(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f0000000080), &(0x7f0000000100)=0x8) ioctl$GIO_UNISCRNMAP(r0, 0x4b69, &(0x7f0000000480)=""/109) mkdirat(r3, &(0x7f0000000340)='./file0\x00', 0x0) renameat2(r3, &(0x7f00000000c0)='./file0/../file0\x00', r3, &(0x7f0000000180)='./file0\x00', 0x0) 14:48:21 executing program 2: socketpair(0x9, 0x80807, 0x3, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x5, 0x10001, 0x8001, 0xe2d}]}, 0x10) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x400000, 0xfffffffffffffc1a, [], 0x0, &(0x7f0000000000), &(0x7f0000000240)=""/30}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:21 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f0000000100)=@sack_info={0x0, 0x200000, 0x200}, &(0x7f0000000140)=0xc) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000180)={r3, 0x2}, &(0x7f00000001c0)=0x8) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r4, 0x0, 0x2, r4}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r4, 0x0, 0x2, r4}) 14:48:21 executing program 3: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f0000000080)={r1, 0x0, 0x20200000001, r1}) 14:48:21 executing program 5: r0 = socket$kcm(0x29, 0x7, 0x0) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e24, @multicast2}}}, &(0x7f00000000c0)=0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000003c0)={r2, @in={{0x2, 0x4e20, @broadcast}}, 0x9, 0x1, 0x5387, 0x5, 0x2}, &(0x7f0000000480)=0x98) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000000)={0xbe6, 0x5, 0x4, 0x0, 0x0, [{r0, 0x0, 0x8}, {r1}, {r1}, {r0, 0x0, 0x81}]}) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) fremovexattr(r1, &(0x7f00000004c0)=@random={'security.', 'em1[\\usertrustedkeyring\x00'}) open_by_handle_at(r1, &(0x7f0000000280)={0x103, 0x8, "9ddc439ea954643d48ba904683a1e72a072e99f12bc5f7a21a884a639db90b7f68973be9c40e6b4817a30eddabc981a880268ddf9e22c00a44d630bb71f62e933d3f7a17c5b38728d43156aa6ca09d55c7b319d64af10d36e88b89ebbd7d780ff63622cfc4a4bef1270d271581df076d41b08d6b007395e664d3be0eea1783abd597f52857d121f9399dbf0098ccae5402a296996a39b474593324fcb8bfc8eb122db864c87de710e8a65271463f522771ed5946179b2996f9acf4ccdce99eb73307b0ecc8dc08c5a40c7d7108703bc4c75391d3aa2b801da81523f0c55ef6138256567fbf937ef52b3b51858f69482025e806aa968865e22b59d3"}, 0x40) 14:48:22 executing program 1: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="850000002e00c963ff45c240a81b1f47308ebfbdb9631437eb000000000000009500000000000000e5b8ac543f21f0f73fd1135aa5b78727cf24954eaf15016e5a48947d886a876b57bef8e8ab69de6ff1325beecab6a8f6b608c012fe27647831289a276ced88a9356245582614598751f17f9012e8154cff5d0d0f95e61a74142ef247bd9162d1e99e054b6db71364b16f7be96f440a1bb8cd23b1cef0b11b7c8b0452fe2c274915a74083b6a7132f5acf63bacd6def8fc5f2b1ba90a7f0fbe69e8858a056e09ee186627acb96683ac6a40721bfca0e40f5f0a4bfad6f40e9f299dec40e936f1a5700"], &(0x7f0000000180)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2\xbf\x18\x01.\xda\x93\xb2\xf7\xc2u9\x89\xb9=\xf2\xfa\x9f<\x8b\xf1\xc5\xcd\xd2\\i\xc7;xy\x98,\xd2(+UY.\x9e3J\x0f( J\xb20\rw\x02PW6\x05`\xf1C\x97\x02\xb6\xc5\xefT\x87T\n\x82\a\xb8\xc2&<\xe5\xfd#', 0x1, 0xc3, &(0x7f0000000000)=""/195}, 0x48) 14:48:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) io_setup(0xa4ae, &(0x7f0000000040)=0x0) io_cancel(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x8, 0x1ff, r0, &(0x7f00000003c0)="55f018bb29fe9bc98fed628021dc6c1c788948aa3cde76b34bfe3060376cce279653e51f87dfb3efcd0c1c8894c96e0b9fc140dd3aa68b4b7a0cc2a47d28cdeb22b6cc0b924ac4cfa5d3ead0ce4c186fa3c3eedaa78acde8accf6bb50849bd40825857ef1aa8c42a3260fb34a2fca60bc7cbf80619150b5e284b3c7cb7e2fd971360a372382c61610b085540c99068c3ee939272f3d6744b0a3bcac7f2cc5a4e806f1f1818e9976fefe41b2bbd23e4139aca6950732f36395c48c5cba96b4cba7eced476092c37a7783691705c3882ed8eac75292e3bfa84d5a7b7321f76d31c805a32096a58161aea5f7affd449422b56c61617848ff890206e33b902", 0xfd, 0x10000, 0x0, 0x2, r0}, &(0x7f0000000280)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xffffffffffffffaf, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup3(r3, r3, 0x0) ioctl$VIDIOC_G_JPEGCOMP(r5, 0x808c563d, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="06630440010000004a5174a9e7161b06719bd391f7815531cf78369498b2f7c3b62bc0138bf7648265760063b8d8c3d85e9c3fdaafac1e624926bab7672f431c5440f04f7851d1d9e291fff38a6478a99e69a9559535c261f774d564a7c4079bae4b7c3dee4509003b692200100000beb5f23afe3dfeaa93c6ed009600ab2c169035266ef0cb7098f866f088cd1d60a8b814a6d85a04001d35e1cc3d06c44392f15d9e832790786111c6a539d83ab46ac3764501d1a417eff57d"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 14:48:22 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x8, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e21, 0x4, @mcast2, 0x4}}}, &(0x7f00000000c0)=0x84) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000180)={r1, 0x8, 0x4, 0x2}, 0x10) 14:48:22 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001, r2}) 14:48:22 executing program 5: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) write$apparmor_exec(r0, &(0x7f0000000000)={'\x84tack ', '&\x00'}, 0x8) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x271, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) migrate_pages(r2, 0x9, &(0x7f0000000080)=0x9, &(0x7f00000000c0)=0x5) 14:48:22 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x400, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:22 executing program 1: sync() ioctl$KVM_ASSIGN_SET_MSIX_NR(0xffffffffffffffff, 0x4008ae73, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x32, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000240)) set_tid_address(&(0x7f0000000040)) ioctl$KVM_GET_PIT(r2, 0xc048ae65, &(0x7f0000001200)) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) [ 1598.341872] binder: send failed reply for transaction 479 to 32571:32573 [ 1598.348875] binder: undelivered TRANSACTION_COMPLETE [ 1598.354262] binder: undelivered TRANSACTION_ERROR: 29189 [ 1598.424408] audit: type=1400 audit(1545922102.486:36): apparmor="DENIED" operation="setprocattr" info="exec" error=-22 profile="unconfined" pid=32624 comm="syz-executor5" [ 1598.492035] audit: type=1400 audit(1545922102.546:37): apparmor="DENIED" operation="setprocattr" info="exec" error=-22 profile="unconfined" pid=32624 comm="syz-executor5" 14:48:22 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$DRM_IOCTL_GET_MAP(r0, 0xc0286404, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x6, 0x7, 0x4, &(0x7f0000ffc000/0x4000)=nil, 0x3}) 14:48:22 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001, r2}) [ 1598.633131] binder: 32628:32629 Release 1 refcount change on invalid ref 1 ret -22 14:48:22 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) ioctl$KVM_SET_LAPIC(r0, 0x4400ae8f, &(0x7f0000000280)={"5190d269185bb19a552a1e4a856fdc193b0a29f1f72540f827cea2c456dc6425a3f62b029ea5d28da120a6c69bbeccfea3277172ee8e6bd5dd3f848b127c1a69d181a01cbd949dd46557e040a588916228be3180aa36c457ea47f44e30a227db796aa8b170e579e15ecd92a88034a53e007ed59dda2bdf978f099da189b3ace410c34a0b94a604ac2f63c94bce543f40035e80b6537ea0de1abab5be4d74edca19defe599ccfff377e0116f2c42221b45a251bd4a3b49c4b4c7d0f4f4bfa814ba0f155ca96f38eb9c8a2aee9df6b6fd7b92d94aa932eb61212cd17f806e0b011c6faa180b13b9e329286425642aad820e43489525aaddc3626bc05ae99654d116a5ef007253b2ac024e0da8729475b59a705042b9c3d5769591e1531773dd4a497221a1198499787377af613b1b0227cc0cc8c24ae9372af773fd7d9ce4caa95dbaced167f6b00744619044bdfa44fc594519e4831e18463325b6b6396fb0750f5a6b45dbbfcbb54c133671a37364dbd64df4dd40a43d6bc37e1201e36ed31c58c93bdf7fb7eb18dbb7d41904bd73c9cbf3443e03d95fcdf745dc6f89f221c8a907b33c785d2c623cd3fb3c9921628c0f7cca4f2e8d842759afbf8e9b93af6f1608f1b06e7d11e38ed502a805d86b6e05863ca6c89bf800a580d426936f4aad6b555f9c7e7d48f6548688351fc0ceb23c708f362a23df01ea00425d79858e13d3174010d3334032bb338c985172052b63e60c28ceb72632f1a460d2c20b60e7cb6690eaaf6f1d2ac725beed312c45f0f54f0c62e9a49fd155c4b0c1280d121c11fae547bf2faa2ab094f4147fe88e5e68ca934683fa7c332facba0b50dce12a15567bab7a4e27bda8d51a6f0d27215435a1f98ab82fcf4e32363f8bef69c5cf0b48fe1ec79ddd077dcdea8bcdc03ebd5edfe06ac8667538fcd3f09530c66410d1d5f500174db696237549d6b8030844449c2fbdefe4a29b16bc28ee36cb9f2a22a9f7d14d861baa0432da3781d5f78f770352df532c768ad428bf2b3340a6ac7a4a26e5e128e6baf6d215910be7634ae35360b4c4587b3a920fe27d1c6ead70402c5618f31a2746f20b6f6eafab90c3c624d49a5c1d08050a9c3881480986cf2a7932b58807a2c2cd1c82fec98908dc8aa4b13a2d8ad03e57a8a54f4b4c3d5260af6717769397c909c9ea14ebc58f106f6a800ae29cf30c9670ffddbad4c994f447cb059a46a68e712d452cafc6927b9a65a9357f4fc4cd4f8a3821e2ea617ac65753130f419832c5d1976a96e18181cbd41b4907fec8d47b7b4b876088798c681da14851887db9aa8d18ae8f75c2bd65fbca882e2f93e9bbea2b7336688817aebfd1fb7dab99eebe4d3dcc61aba76568178748858ae1df182644bda654e25058b2e2d2973e454242b831b3e8a70a72afce882acf40f6ddf0d341af932da00c5"}) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000000)={0x0, 0xfffffffffffffffd}, &(0x7f0000000040)=0x8) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000680)={'filter\x00', 0x0, 0x3, 0x37, [], 0xa, &(0x7f0000000180)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000080)=""/55}, &(0x7f00000000c0)=0x78) 14:48:22 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x10000, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:48:22 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r0, 0x20000000008912, &(0x7f0000004d80)="0a5c2d0240316285717070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='\x00\x00\x00\x00\x00') sync_file_range(r1, 0x0, 0x0, 0x5) 14:48:22 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000000)=0x7, 0x4) 14:48:23 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000040), &(0x7f0000000080)=0x8) openat$cgroup_procs(r0, &(0x7f0000000000)='tasks\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0x9c5, @remote, 0xf06}, @in={0x2, 0x4e23, @multicast2}, @in6={0xa, 0x4e20, 0x8001, @mcast1, 0x1}, @in={0x2, 0x4e24, @multicast2}, @in6={0xa, 0x4e20, 0x67b4, @dev={0xfe, 0x80, [], 0x26}, 0x4}, @in={0x2, 0x4e20, @loopback}, @in6={0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, [], 0x17}, 0xd0}, @in6={0xa, 0x4e20, 0x8, @loopback, 0x3}], 0xbc) 14:48:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x1, 0x2) bind$vsock_stream(r2, &(0x7f00000000c0), 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:48:23 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001, r2}) 14:48:23 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(r0, 0x4010aeab, &(0x7f0000000000)={0x401, 0x3000}) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x100, 0x0) 14:48:23 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000002c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha512\x00'}, 0x58) socketpair(0x4, 0x80807, 0x8, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$netlink(r1, 0x10e, 0xb, &(0x7f0000000140)=""/240, &(0x7f0000000040)=0xf0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_buf(r2, 0x6, 0x1f, &(0x7f0000000080)="f2ed9d95", 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) accept4(r0, &(0x7f0000000340)=@ax25, 0x0, 0x0) 14:48:23 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x10000, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) 14:48:23 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f0000000080)={r1, 0x0, 0x20200000001, r1}) 14:48:23 executing program 2: socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$VIDIOC_G_STD(r0, 0x80085617, &(0x7f0000000000)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) 14:48:23 executing program 1: sendmmsg(0xffffffffffffffff, &(0x7f0000007e00)=[{{&(0x7f00000004c0)=@in6={0xa, 0x4e22, 0x0, @mcast2}, 0x80, 0x0, 0x0, &(0x7f0000002f80)=ANY=[@ANYBLOB="140000000000000029007963e8a15fa089264342d5595ee100004300000004000004"], 0x14}}], 0x1, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) socketpair(0x0, 0x80000, 0x7, &(0x7f0000000000)) recvmmsg(r0, &(0x7f0000002e00)=[{{&(0x7f0000000040)=@tipc=@name, 0x80, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/32, 0x20}, {&(0x7f0000000100)=""/31, 0x1f}, {&(0x7f00000001c0)=""/147, 0x93}, {&(0x7f0000000140)=""/45, 0x2d}], 0x4, &(0x7f00000002c0)=""/52, 0x34}, 0x2}, {{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000300)=""/73, 0x49}], 0x1}, 0xfffffffffffffff7}, {{&(0x7f00000003c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000001780)=[{&(0x7f0000000440)=""/45, 0x2d}, {&(0x7f0000000540)=""/4096, 0x1000}, {&(0x7f0000001540)=""/82, 0x52}, {&(0x7f00000015c0)=""/99, 0x63}, {&(0x7f0000001640)=""/179, 0xb3}, {&(0x7f0000001700)=""/67, 0x43}], 0x6}, 0xf9}, {{&(0x7f0000001800)=@xdp, 0x80, &(0x7f0000001980)=[{&(0x7f0000001880)=""/208, 0xd0}, {&(0x7f0000000480)=""/27, 0x1b}], 0x2, &(0x7f00000019c0)=""/217, 0xd9}, 0x4}, {{&(0x7f0000001ac0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000002d80)=[{&(0x7f0000001b40)=""/4096, 0x1000}, {&(0x7f0000002b40)=""/251, 0xfb}, {&(0x7f0000002c40)=""/218, 0xda}, {&(0x7f0000002d40)=""/62, 0x3e}], 0x4, &(0x7f0000002dc0)=""/30, 0x1e}, 0x1800000}], 0x5, 0x60, &(0x7f0000002f40)) sendmmsg(r0, &(0x7f0000000180), 0x0, 0x0) 14:48:23 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000280)={{{@in=@multicast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000000040)=0xe8) stat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r2, r3) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:23 executing program 4: r0 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x5a1f, 0x4080) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0xf) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:48:23 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f0000000080)={r1, 0x0, 0x20200000001, r1}) 14:48:24 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000040)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FICLONE(r0, 0x40049409, r0) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f00000000c0)={0x1000, 0x4, 0x566, 0xb13, 0xfffffffffffffffc, 0x80000001}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, r0, 0x0, 0x4, &(0x7f0000000100)='nat\x00'}, 0x30) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r0, 0x50, &(0x7f00000001c0)={0x0, 0x0}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={r1, r0, 0x0, 0x4, &(0x7f0000000180)='nat\x00', r2}, 0x30) move_pages(0x0, 0x8, &(0x7f0000000000)=[&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil], &(0x7f0000000040), &(0x7f0000002000), 0x6) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_DISABLE(r0, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000100}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x9c, r3, 0x201, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x70, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7b97cf32}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffc01}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x8001}, 0x800) 14:48:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x100010, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:24 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) close(r0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@loopback={0xff00000000000000}}, 0x20) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000200)={'IDLETIMER\x00'}, &(0x7f0000000240)=0x1e) r2 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x400, 0x0) setsockopt$inet_group_source_req(r2, 0x0, 0x2f, &(0x7f0000000080)={0x80, {{0x2, 0x4e23}}, {{0x2, 0x4e21, @local}}}, 0x108) 14:48:24 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) ptrace$setopts(0x4206, r1, 0x9, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f00000000c0)=0x5, 0x4) setsockopt(r0, 0x3, 0x5, &(0x7f0000000040)="c4d1124284b0f3a69324f0dc15f09c7a28f058822a11334b75cea33bd8a4ea62908d8ab729c978d38aab70f3b4daf870c49d7705637ca4a78a4515ae68f2aa6adb608917f8346b4a5c0c99030ed390293757dd374cac234984db2b58b8b4c0620fa30d05f582", 0x66) 14:48:24 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f0000000080)={r1, 0x0, 0x20200000001, r1}) 14:48:24 executing program 2: r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f00000000c0)) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$KVM_PPC_GET_PVINFO(r1, 0x4080aea1, &(0x7f0000000000)=""/109) fchmod(r1, 0x40) ioctl$VIDIOC_G_ENC_INDEX(r1, 0x8818564c, &(0x7f0000000280)) 14:48:24 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) syncfs(r1) r3 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x1, 0x8000) ioctl$sock_SIOCDELDLCI(r3, 0x8981, &(0x7f0000000100)={'lo\x00', 0xfffffffffffffffe}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) [ 1600.370282] binder: send failed reply for transaction 484 to 32684:32685 [ 1600.377879] binder: undelivered TRANSACTION_COMPLETE [ 1600.383196] binder: undelivered TRANSACTION_ERROR: 29189 14:48:24 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000080)={r1, 0x0, 0x20200000001, r1}) 14:48:24 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x1, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ashmem\x00', 0x4000, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000040)=0x1f, 0x4) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1600.559655] binder_alloc: 32740: binder_alloc_buf, no vma [ 1600.565589] binder: 32740:32741 transaction failed 29189/-3, size 24-8 line 2973 14:48:24 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000000)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) r0 = creat(&(0x7f00000007c0)='./file0\x00', 0x20) setsockopt$RDS_GET_MR(r0, 0x114, 0x2, &(0x7f00000008c0)={{&(0x7f0000000800)=""/127, 0x7f}, &(0x7f0000000880)}, 0x20) r1 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000002000), 0x0) sendmmsg$alg(r1, &(0x7f0000000740)=[{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000080)="2ab56717c04961fd6d9ab76dd5d459aa8c953f641227f6935b66a8f43aa6f988c614d26c11042fcd3211c7d9e1d5975d3471a7fe444855036e20047c6bf944d144ecb3e9b516a7e53daa5906c4ae12bf0e6bfe30cec4d14c596f8a89bf0d0e3d1e9b8a7502a0", 0x66}, {&(0x7f0000000100)="96863351a34c7d088774a0540bf30dcccdb1d6bc18b32d94826cb54fc9e8acd63d81bca01b3fe3f476753596933213652b36ffdbdc63aeec414b5018e568eaca2757b615c8c1225db39f4ce754af097ab9e1c2cc0e24c603b0a9a5f38c66c3c465a6524fb2b516b522d37d9ac68b7c044006914a6adc2d75a78df397f34a8221704f7edf16c78ca57c0c2cc52c37e705b29a08c306c692520c593c9cdd1fb560baf1051e3049935d6b74e2e747905c9c07f6ebdf4bf346bfa5acd196ea63c44dcb540cc22e14b79141f8f261049dd8395362a30b592beeee4e5024ff8108", 0xde}, {&(0x7f0000000280)="9bdb1c6613fc9fdc86d23e7254f11493de93c4676ca32a315e876a3d038cd438744bbca252b084961f3fdcf11fbb46cc70b66f25529bfe044973ad3d0ccc0d0527c724b49fba2406eb07d1482aca8bbdbca77f76f4bc8cba09af815a17592c7e25cc0b58769db770dbfe30bf6dc973520696bcf43cf8738071361864ef6c9ee1399ddc42833f0db4823c70f6d105bc061be7081a2a355dd10d1e8dc0e9f63d90c2db895e1971dadfd474630d7535519222653b6f4b6749e18399297e02c4db7f471fe7c1a3aea9e111e949c28ddfd3352763839139c86e44dc1ba95fc539de43dcd3e678083693371fdcbb6f7f752b3105d6f0bf9ffd1638f5", 0xf9}], 0x3, 0x0, 0x0, 0x4000001}, {0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000380)="a074596baaa941af55be7420e6428a03cd3eb206f4461ca06fc28bcb01b3681d12f838699671af61d05ff27c2caef1b52b18c4570230430bbf52cc0ea5518c0782860ca5028dbb03417bec128292c16986e3a6d8f0a01e782d6775e4c38056913503278aead77353a770c9b707e5da1995953842e5dd9fd7074c60fa85573a0971457fe820c6410b72bb3a50b8f5b58f7017c27a6ad20559a2a7433dc3bb0347fd", 0xa1}], 0x1, &(0x7f0000000480)=[@iv={0xc8, 0x117, 0x2, 0xb1, "c0d44e2273909eb8ec0d05b22630ed59ccf73f5ca848382efd92a91be92d6aedd9887d7ebc41142d0c88a75e53860575af8552447987771638a7efea42c277e235dcc97ae4d4263dc2a67edd202bb6cf05f1a0e67aafe4edb84c45792264baf0e0ba11144bb12b628e33f281b3a846866064b57866250472d4962aaa26e8db8dacfc0cca82b7e0ff5b64d19de43b2c5b13261d2b4688efdd066cbc5abd496434e0e4f9a52eb1b1abb7f671d45dc9010fc4"}, @iv={0x88, 0x117, 0x2, 0x74, "88ee9ef9d56525c02dab2e13726941fb537888e7c23460348512551477df7ba83d02c4872cca1a2b5881c2cfbe924e18d0b0f57d8ca46f4ac95bce034ed880c16117dcaa5449941ead813b1a2f242d65ffe54231f8038ad8b68188fec81901cd47409bf62f8ac5758e2460acc7966b91633e052c"}, @assoc={0x18, 0x117, 0x4, 0x5}, @assoc={0x18, 0x117, 0x4, 0x7}, @assoc={0x18, 0x117, 0x4, 0x8}, @iv={0x60, 0x117, 0x2, 0x4b, "965ce18ff7fb47b442585f619092406e05c0f8604f38cb2c195a3cc05e855633815db2958fc4453a433308e0eb5339209526fdbc8d39f2a495905c6a99ed063ddcd3929cf109144038eaa0"}, @op={0x18}, @iv={0x88, 0x117, 0x2, 0x6f, "8642923b53e6da4fa6559d590892f709bcc0f69bda88514e301d79af7d0382f44f80f137404395a30e8b79524b2b50dc7f060bb1648261865bcb79a2c613172cb573c7ce8235f50dfd07e1a5f9ba6dc9caf6c2b6e5d6d2f7d4ecf479b2458f712e88c5ce8f105e5cbe213dfcff13b1"}], 0x298, 0x40}], 0x2, 0x40) 14:48:24 executing program 1: r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video36\x00', 0x2, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) flistxattr(r0, &(0x7f00000002c0)=""/60, 0x3c) r2 = syz_open_procfs(r1, &(0x7f00000000c0)='net/ip_vs_stats_percpu\x00') r3 = syz_open_dev$radio(&(0x7f0000000140)='/dev/radio#\x00', 0x3, 0x2) setsockopt$inet6_tcp_int(r3, 0x6, 0x7, &(0x7f0000000080)=0x8, 0x1) ioctl$VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f00000001c0)={0x9}) getsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000100), &(0x7f0000000180)=0x8) 14:48:24 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x4000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) r3 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0xb60, 0x2) ioctl$GIO_FONTX(r3, 0x4b6b, &(0x7f0000000100)=""/62) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0x0, 0x2, r2}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000140)={r3, 0xfff, 0x9, r3}) [ 1600.656835] binder: 32740:32741 Release 1 refcount change on invalid ref 1 ret -22 14:48:24 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) 14:48:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x0, 0x800) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f00000000c0)=@sack_info={0x0, 0x81, 0x100000000}, &(0x7f0000000100)=0xc) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r2, 0x84, 0x19, &(0x7f0000000140)={r3, 0x5}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 14:48:25 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={r0, 0x0, 0x2, r0}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={r0, 0x0, 0x2, r0}) 14:48:25 executing program 1: r0 = msgget(0x1, 0x124) r1 = getpgid(0x0) ptrace$poke(0x5, r1, &(0x7f0000000100), 0xfffffffffffeffff) msgrcv(r0, &(0x7f0000000000)={0x0, ""/7}, 0xf, 0x1, 0x3000) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x200, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$KVM_HAS_DEVICE_ATTR(r3, 0x4018aee3, &(0x7f00000001c0)={0x0, 0x7, 0x9, &(0x7f0000000180)=0x9}) ioctl$FS_IOC_MEASURE_VERITY(r2, 0xc0046686, &(0x7f0000000240)=ANY=[@ANYBLOB="2000b70041de226e61ef2d34c42f69d84ce82bb1b227693dfc7ddd93d21ed40200000000000000437b3c86b7d7f40000000000000003be348bd22f23ad287b4d5393d304e0cf31fa2c0842795a99d74f3c4dcdeda585d9de81598f7007c28ee83b0bdb4c0606a50a113238e56a1e19cbef94428310e6e80abbff24dc23d9ab0cefd4eb760700dcc217a83cf3b2f91f39cd5cb9c54d0000e6d46fcc5f17fd0ad9bc380b3dd812eb288fbef9359fe7b73eb2df5e4207007e1d24dc9247a9a0090c737c13577696ddae1d20c2c2fee854796b5a8eb66de78c402c71fe05c8c508347f2ddec98d44d1923e3520d1b60e30452d601cc359c4906ad091451d3d6b88ab011c026af80af5666e19b3a6ccd610b4996307601a4b2b5af0fbe119a74401dc706154ac47117d74bccf"]) write$binfmt_aout(r2, &(0x7f0000000900)=ANY=[@ANYBLOB="0b0101ca04030000d50000008302000044030000030000000000000000000000e0738b3bfc0f310f6c29e8fe95b23008e001275a0a69e62c59f3490ddb51b1b16881857e6c39fe004f03763d8a51f63d8989268de8533b55c0829d123fb66aa662f291128f45acad9dc57202b35cc217ee7632fd80cc7030e2d43467cc2ebd238155272ca2d93e6ac5d21524918d3a2fd6d9d48d3286554fd2a9cd02179d774d0e9ca1e5c19e7bdbbd6370154768fbab5eb6d154bf1b292530f6ab8945bbd0a01bd867cbcfe1c4e66ee9d049f0e8ebe9fe7f6648a4087bb8c0f7d026105f2119c4fcafaeba4119a14ca83f25aee7f18b92482dcbdce923b36672897a36fbcbe4d44fbfe5e0c8b66a1c610d45ad0080d6f36d93f3bd5954dad63c4dbbc61900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ca0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000063a4b162193183446b789b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000022000000000000000000000000000000000000000000000000000000000000a7782362d484414d0577f1ed2d3d5d000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x51e) r4 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x5, 0x2) getgroups(0x7, &(0x7f00000000c0)=[0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0x0, 0xee00]) prctl$PR_SET_PDEATHSIG(0x1, 0x14) munlock(&(0x7f0000fff000/0x1000)=nil, 0x1000) setfsgid(r5) ioctl$KVM_GET_SUPPORTED_CPUID(r4, 0xc008ae05, &(0x7f0000000380)=""/10) ioctl$UI_SET_SNDBIT(r4, 0x4004556a, 0x5) msgrcv(0x0, &(0x7f0000000100)=ANY=[], 0x0, 0x1, 0x3000) 14:48:25 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) getpeername$tipc(r0, &(0x7f0000000000)=@name, &(0x7f0000000040)=0x10) 14:48:25 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000280)={'nat\x00', 0x0, 0x1fffffffffffffff, 0x40f, [], 0x3a8, &(0x7f0000000040), &(0x7f00000000c0)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000000)) 14:48:25 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x20200000001, r2}) [ 1601.366638] binder: undelivered TRANSACTION_ERROR: 29189 [ 1601.485433] QAT: Invalid ioctl 14:48:25 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) setsockopt$inet_dccp_buf(r0, 0x21, 0xcf, &(0x7f0000000000)="c18c57cadddb1a0578b90e632eabfa07142eb692e5a675911ad9f5fed0393490733ad0619e21a776", 0x28) socket$netlink(0x10, 0x3, 0x9) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x120000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0x44, r1, 0x2, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x33}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x1}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x708}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x8015) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:25 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x0, r2}) 14:48:25 executing program 4: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000080)=0x0) ptrace$getsig(0x4202, r0, 0x4, &(0x7f0000000100)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3, 0x0, 0x2, r3}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r3, 0x0, 0x2, r3}) 14:48:25 executing program 2: socketpair(0x1e, 0x3, 0x9, &(0x7f0000000000)) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x81, 0x22000) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) 14:48:25 executing program 5: r0 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x92e3, 0xc0) ioctl$VIDIOC_G_CROP(r0, 0xc014563b, &(0x7f00000000c0)={0x0, {0x7f, 0x3, 0x971f, 0xffffffffffff8000}}) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x0, 0x0) ioctl$VIDIOC_S_INPUT(r1, 0xc0045627, &(0x7f0000000040)=0x2) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) msgget(0x1, 0x40) 14:48:25 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x0, r2}) 14:48:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup3(r1, r0, 0x80000) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000040)={@rand_addr, @multicast2}, &(0x7f00000000c0)=0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) fdatasync(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:48:26 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xd14a, 0x200) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:26 executing program 4: r0 = creat(&(0x7f0000000000)='./file0\x00', 0xa) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000080)=&(0x7f0000000040)) r1 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000140)="cbcca70d1a148ab5398d989c72f1659d25161051b2cdb13e758dc1288968603a69bb6ac4daf5779302cec53f863e96716befe4c5cb87ebd60bb19bac302fffc71e428bf6309632f75c41f3c9025b716e8c99b52138562d7bb3b516ecdf62e6825a7189790aa585886317c6b5b2b74df7380585e2d7da4f0c46ce0868cdec2b10622eec623ac86b07d50c574b1cb8dffb80caa6831af05cd4caa37f82f662e90e2ede0fa2a9b182c1590288a62871c1579d09aa03257b4e61eee62cf0070daed369abbbc1b08efa7abd9279039d9f5600f6806789fc3d8cd69b3520212182783dab10ca1e152b5a07edf5e44787da731c6057328e39", 0xf5, 0x0) keyctl$set_timeout(0xf, r1, 0x7) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000240)={0x0, @initdev, @dev}, &(0x7f0000000280)=0xc) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000002c0)=r2) keyctl$dh_compute(0x17, &(0x7f0000000300)={r1, r1, r1}, &(0x7f0000000340)=""/252, 0xfc, 0x0) r3 = socket(0x1f, 0x5, 0xf000) setsockopt$inet_sctp_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f0000000440)={0x1, 0x5, 0x8, 0x8001}, 0x8) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000480)={0x1, 0x1000}, 0x2) r4 = openat$ashmem(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/ashmem\x00', 0x0, 0x0) ioctl$EXT4_IOC_RESIZE_FS(r0, 0x40086610, &(0x7f0000000500)=0x6) connect$pptp(r3, &(0x7f0000000540)={0x18, 0x2, {0x2, @dev={0xac, 0x14, 0x14, 0x11}}}, 0x1e) ioctl$VIDIOC_SUBDEV_S_SELECTION(r0, 0xc040563e, &(0x7f0000000580)={0x1, 0x0, 0x101, 0x2, {0x401, 0x9, 0x0, 0x5}}) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f00000005c0)) openat$ion(0xffffffffffffff9c, &(0x7f0000000600)='/dev/ion\x00', 0x408000, 0x0) syslog(0x3, &(0x7f0000000640)=""/125, 0x7d) renameat2(r0, &(0x7f00000006c0)='./file0\x00', r0, &(0x7f0000000700)='./file0\x00', 0x2) r5 = add_key(&(0x7f0000000840)='.request_key_auth\x00', &(0x7f0000000880)={'syz', 0x3}, &(0x7f00000008c0)="0dc67901b791e4b52c8a85f1d11049c69837782b25845e733f9035b4f9ec3e461c1308682230b20666aa408581d3add0e6c6909ad2670a0e1bb25c1f21caba5d8ebd291d3d283412", 0x48, 0xfffffffffffffffd) add_key$user(&(0x7f0000000740)='user\x00', &(0x7f0000000780)={'syz', 0x0}, &(0x7f00000007c0)="b4a0b79c1ab52a759bf9a0da3b50ea338a2f6b160169fe33f5c672cf4a2e2b643fbe1fa122d6bcd678dde805f44d67990e2e27e5259c7ebcc07e031e79e90db33b1e4c0d338696542522039aab9d8834459740562652c91eb4300920fc93dd7580aba8d718569eb6acf1c1f7b850a471106819689385ed425cf8b0bef1ba", 0x7e, r5) bind$vsock_dgram(r0, &(0x7f0000000940)={0x28, 0x0, 0xffffffff, @my=0x0}, 0x10) write$input_event(r0, &(0x7f0000000980)={{0x0, 0x7530}, 0x17, 0x0, 0x8}, 0x18) setsockopt$inet6_dccp_int(r0, 0x21, 0xf, &(0x7f00000009c0)=0x10000, 0x4) r6 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/qat_adf_ctl\x00', 0x40, 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r3, 0x84, 0x4, &(0x7f0000000a40), &(0x7f0000000a80)=0x4) getresuid(&(0x7f0000000ac0), &(0x7f0000000b00)=0x0, &(0x7f0000000b40)) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)=0x0) write$P9_RGETATTR(r6, &(0x7f0000000c40)={0xa0, 0x19, 0x2, {0x1, {0x1, 0x3, 0x4}, 0x1e5, r7, r8, 0x0, 0x7, 0xb0, 0x3, 0xe2, 0x7, 0x0, 0x10000000000000, 0x8, 0x100000000, 0xffffffffffff2223, 0x0, 0xacb, 0x2, 0x9}}, 0xa0) lseek(r4, 0x0, 0x5) renameat2(r0, &(0x7f0000000d00)='./file0\x00', r6, &(0x7f0000000d40)='./file0\x00', 0x0) 14:48:26 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x0, r2}) 14:48:26 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000700)='\\:%\\\todevposix_acl_accesscpuset\\$*#\x00\r\xb0\x929\x1c\xc18\t\xf7\x9db\xe9M,\xab\xed\xff*\x18\xf6\x9f(\xe0\x83\x10J\xf8\x18HO}~\xb3\xff\x0fa\xf9\xb9\xe5\x8f\xfb8|\x01\x01\x00\x00\xd32\xf8\xe3\xa4Q\x05\xf9\x9f\xa6K\xf6[\xe5\xbb\xd1L@E\xab\xbbefY\xdc\n\xc6\xe65\bS\xc4\xcdye\x13\xd8\xad\x8f0\xe8V\x9e\x82f\xe4\xccEZ\x93\xberR\x92B\xdf\x0f\xe6\"\x99\xf5S\xaa#P\x7f\x02\xdf\xa0\xd85\xe1\xbb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\"\x8e\xb9W\xbeC\xe7[~\xe9\x8fks\x7f\xcf,p\x1e\xf2\xdea\xb3\x1c\x04\x06\f\xa4\xcd;~\xab\xf2\xe9\x9d\x1b\xbc\xb5\x1d\x1c\xaa\x05 ~\xd7\xea2c(`\xe3\xb7c\xd8_\xdf\xdc\xe1ND\x99`;\xd3mN\xe7\x96P\x04Zu\xfb\xc9Rq\xe9\v\x83`U\xad_}I\f@\xac\xffP\xdc\xd4\x9e\xd8\xdb\x9fO\x11\x10n\xce\xb1\xf0`o\xc6\xb4\xc3\'\x1cx~\x95\xab]\x8e\xce\x1e\xfa\xef\xb0U\xd4\x91@^v\xd73\xd9\xf9a\x81BE\n\"\xa4A\'Y\xb9h\x8a\x19)\x93\xc3EB?7\x80\xb1q\xab\t{\xd1YY\xd82\xa7\x88\x8a&v\x11\xa1\xfa\xa9=\x10\xbblJl\xa3^\x8f\xeb\xca\xfa\xf2\xba\xc2-\x90\xf9\x03v\x95\xe6M\xaf\xe9\xef\xa0\xc2m\xce\xb8\x05xY]\x85H%\xaa\xcc\x1fL\xc6)X\xb1\x8f\xd5\xda\x9c\xd0\x1b\xc9\x80\xee*\x91\xd7\xcf\xfc\x10\xc55/\xe6\xb3A\x1fX\x16\xbd\xa2\xb8\x96\xf6\x85\r\xa6\x1b;\x1d)CR\xce\xa5\xdf\xda\xb0\xef\xe5X\xa30\xcc\xa3)k\xce\x12\xa5\xd1\xf8\xb8\x9c\xec8\xf7I\x7f\xd3\xc8\x941\xabt\xef\xd0\v\x10t3<_f\xb9\xbb\xaa\"\x8f\x8c\xedR\xcan\xec?uO\x13\x93\x9ezR9twQY\xd8\xded\x94\xeck\xc7\x13\xa4154D&\x10\xa3\v\xfe\x92\xc3\xa2\xc5\xee[uL\xcb_TE(\xdek\xb9\xd7\x1f\x89\x1aRr\rM\x94') prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000040)="724a46db8131d6e5a13a65481361ddffd7650d05078f164678755159399bafdbc91b34d4d423c2624df8462ea36276e71eb0bd9406dd14bae68e115d1d02a88cd600039c2312b8958e1dee0c6d2697922a3b10b839f270309dad52413a54d03ca96c1629d990c0ed8078fe88b39d262eb2685dc7e65c900156189aa741ac21d996428e06c7ed4e1647047cde1bdd0381b16a96aa31ad44726b6409603c61d633bd1c16c22010fa64560c75c2478044deee19bdd1be1d", 0xb6, r0}, 0x68) getpeername$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000200)=0x14) 14:48:26 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000001880)='/dev/vcs#\x00', 0x3, 0x100) getsockopt$inet6_udp_int(r0, 0x11, 0xb, &(0x7f00000018c0), &(0x7f0000001900)=0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000080)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4, r1}) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r2, 0x29, 0x2, 0x0, &(0x7f0000013000)=0x26f) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r3, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r4 = socket$packet(0x11, 0x3, 0x300) sendto$inet6(r4, &(0x7f00000002c0)="0500030005006e000000a844eb1ff5ec2c71820fd903378c58160aaacb57a80000061a80e19e33e3c2e7725f4a58611537a0be62", 0x34, 0x0, &(0x7f00000000c0)={0xa, 0x8906, 0x4, @loopback}, 0x1c) r5 = socket(0x1d, 0x2, 0x1ff) setsockopt$inet_mreqsrc(r5, 0x0, 0x26, &(0x7f0000000000)={@empty, @loopback, @multicast1}, 0xc) [ 1602.307356] binder: send failed reply for transaction 490 to 320:321 [ 1602.347605] binder: undelivered TRANSACTION_COMPLETE [ 1602.353008] binder: undelivered TRANSACTION_ERROR: 29189 14:48:26 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) 14:48:26 executing program 5: add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffa) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x0, &(0x7f0000000180), &(0x7f000026bfec), &(0x7f0000002000), 0x0) pwrite64(r0, &(0x7f0000000180)="c3a84a16144c43c7e47614db5aa074d77ccaf8b9ba68486b651f8505c631d1a1c8a585cfa4906d0dc7f763ea9483e2a0dc4157331978706e61b1f1f2bc5c25e2852cc8d7ad074101b0e91daae37ee7cc", 0xe3, 0x0) [ 1602.523329] binder: 370:371 got transaction to context manager from process owning it [ 1602.531500] binder: 370:371 transaction failed 29201/-22, size 24-8 line 2825 14:48:26 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x402000, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r0, 0x8008ae9d, &(0x7f0000000200)=""/61) 14:48:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYBLOB="852a070000000000d7bfa2d4afa781a7cec20638ceca9031bc4f5e60b342dba7d6a3128aa29c4ea3c10387d2e6f5d1ca927f36dad32569fac3082623fd0cd347276d782f1fcb354ea315ece99dc625b0cd90a2d00f4db3c36cf60a5c0855ed824d91115c0eec0d443289b2098ef31366dbcd39a66a386fb5887ecf54a0668c226e6737b6fbd6b67dff3b3f5c417d2ed34a4d4b58b80a955729ddb5bc56cfc18e515a5cbf33b61839c7e4bb50da99e888503179a4f493c7434fd127b45bf7b8d641df12d51b172cb41fc290558a42fa32a292e23a6aed37bf6838dd4b0779625c601f555309d9fc379858cf81a41c70c71f26845638", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="06630440010000002ddaac2beff95b7d857849c04e10eebbec19fe01000000f9f61343e28e842970b6267e9f0dc05e1b33ac9922c9b5878bac030e6cb000a332bb84d881a42a1ce17a5a0bb7395b0a4e5f93f01b4a75b74ed6f52afae43afde9a882d1c9c0effd51787196416ffb2f50221b5d1acc340b5c40e095aa9cfa0da2ee943e7ab421be09a14347d1add1a5edd4390ce73d2bb69086e4152719977f50122abf9404d9f70d6bfcbca1836af542e8f452654a848413ecb35a8d0600cedb39954eecf3d226ef4cf0a0dda9d40486634f35e2b5ff6c12b0215924b35704551655c3856be9476de0bc943a008350f77324211e91ae338951a442d81a51b597"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:26 executing program 3 (fault-call:3 fault-nth:0): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) 14:48:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = accept(r0, &(0x7f00000002c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000340)=0x80) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000080)=0x0) sched_getscheduler(r3) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'rose0\x00', r2}) r5 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x1, 0x2) ioctl$KDSKBMODE(r5, 0x4b45, &(0x7f0000000280)=0xfb96) modify_ldt$write(0x1, &(0x7f0000000200)={0x4, 0x20000000, 0x4400, 0x7, 0x1, 0xfff, 0xa3d, 0x2, 0x81, 0x6}, 0x10) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f00000000c0)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_LINKINFO={0xa, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0x30}}, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r5, 0x84, 0x13, &(0x7f0000000100)={0x0, 0x22d}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000180)={r6, 0x4}, &(0x7f00000001c0)=0x8) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f0000000240)) 14:48:27 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23}, 0x1c) listen(r0, 0x3) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) dup2(r1, r0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x14) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) ftruncate(r1, 0x0) r2 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) symlinkat(&(0x7f0000000000)='./file0\x00', r2, &(0x7f0000000040)='.\x00') move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:27 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) getsockopt$inet_dccp_buf(r0, 0x21, 0xf, &(0x7f0000000000)=""/212, &(0x7f0000000180)=0xd4) 14:48:27 executing program 4: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x101000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x2) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1602.939214] binder: 392:393 got transaction with invalid offset (0, min 0 max 24) or object. [ 1602.948156] binder: 392:393 transaction failed 29201/-22, size 24-8 line 3035 [ 1602.955081] netlink: 6 bytes leftover after parsing attributes in process `syz-executor1'. 14:48:27 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f00000000c0)={{0x3, 0xfd}, {0x1f, 0x3}, 0x9, 0x4, 0xfffffffffffffffe}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) 14:48:27 executing program 1: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x2, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000200)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0x2, 0x0) ioctl$EVIOCGMTSLOTS(r1, 0x400445a0, &(0x7f0000013000)) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000080)) close(r0) [ 1603.183039] binder: 392:393 Release 1 refcount change on invalid ref 1 ret -22 14:48:27 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0xc400, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:27 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x2, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:27 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sendmmsg(0xffffffffffffffff, &(0x7f0000007e00)=[{{&(0x7f00000004c0)=@in6={0xa, 0x4e22, 0x0, @mcast2}, 0x80, &(0x7f00000001c0), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="140000000000000029000000080000000000da00"], 0x14}}], 0x1, 0x0) r1 = socket$inet6(0xa, 0x80c, 0x104) syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmmsg(r1, &(0x7f0000007e00), 0x400000000000166, 0x0) 14:48:27 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = dup(0xffffffffffffff9c) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f00000001c0)=ANY=[@ANYRES64=r0, @ANYRES16=0x0, @ANYRES64=r0]) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000000)={0x5, 0x5, 0x5, 0x1ff}) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000080)) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0)='NET_DM\x00') getitimer(0x2, &(0x7f0000000180)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) syz_open_dev$vivid(&(0x7f0000000280)='/dev/video#\x00', 0x1, 0x2) ioctl$VT_WAITACTIVE(r1, 0x5607) 14:48:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="06e30400"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:27 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80800, 0x0) ioctl$PPPOEIOCDFWD(r2, 0xb101, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r3, 0x0, 0x20200000001}) 14:48:27 executing program 2: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000000000)) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:27 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='/exe\x00\x00\x00\xd4\x00\x04*\x04\x00\x00\x00\xde\x91\xbe\x10\xee\xbf\x00\xf5\xe9J\xae\"\xe8\x9b\xb3l\xc7Ez\xcc\xc32\fg\xa9\x0fy\x80XC\xe9\x01\xd2\xdau\xaf\x1f\x00\x00\x00\x00\x00\x00T\x0er\xcdW\xf4BwR\x88D \x9c~\xd0[\x16\x0e\xf36r\x1b\xf8\x96\x86\xffG/q\xdf\xcaSS\xf62=\xdf\x80\x06\xff\xc1\x05-j\x80\x98Z\xdch\x01ped\x8b5\xc7\xd3!\xfc\\\x04f\x06/\xbf\xadZ\xcb\xe7\xffl\xef\xe5<\x88\xc0Z\xb9p\xce\xeb\xdf\xa5\x89\t\x8a\xd4\r\b\r\xeb$\x88\xf9\xe4\x06\x96\x82\xb1D\x83\xf1\x13\xcbiy\xb2\xf3\x90\x17\x9a\x18\xe2k@\x88\xf1\xf3\x1e\xd0J\nh\x1f\x00.\x00t6\x94tu\xab\a7\x11\xc9\x8a\xe3\xb4%\x9f\x1a\x1a\xff\x9b\t\xaaf\xcb\x90\xcaC\xa1\xdb\xc6\xde\x15\xab\xb4\xaes\x9f\x9e\x8f\x04|\xd2\x9e\xc7k\x9e\xf6\xbe\xb7\x83\x9f\x80q\xaa\xeaM$~j\x95\x14t\x8c\x93\xd0\xbb\x01\xa7\xc3|\xa6\xc8V2z\xf8\x1f)m,,\a\xc2\xd6;') unshare(0x400) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x20060) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e23, @broadcast}}}, &(0x7f0000000240)=0x84) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000280)={r1, 0x1000}, 0x8) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000002c0)={0x0, 0x0, 0x1, 0x0, [], [{0x8000, 0x3, 0x9, 0x1, 0xa8, 0x926c}, {0xff, 0x8000, 0x4, 0x200, 0x401, 0xb3}], [[]]}) 14:48:27 executing program 4: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x0, 0x8, 0x9, 0x3}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x200a) write$eventfd(r3, &(0x7f00000000c0)=0xfffffffffffffffe, 0xfffffffffffffe61) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r3}) read$eventfd(r3, &(0x7f0000000080), 0x8) getsockname(r0, &(0x7f0000000140)=@pppoe={0x18, 0x0, {0x0, @dev}}, &(0x7f00000001c0)=0x80) [ 1603.832725] binder: undelivered TRANSACTION_ERROR: 29201 14:48:27 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000040)={0xc080000000000000, 0x0, 0xffffffffffffffff, 0x8, 0x1e}) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1603.956104] binder: 455:456 unknown command 320262 [ 1603.961307] binder: 455:456 ioctl c0306201 20000380 returned -22 14:48:28 executing program 2: r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video2\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000040)={0xfffffffffffffffc, 0x1, 0x0, "9ad6e8721bfd1f93ddfa7ae8bb18a291f9a2be464c124eb17b60ee1f0a1c7a29"}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x3014c2, 0x0) getresuid(&(0x7f0000000300), &(0x7f0000000340)=0x0, &(0x7f0000000380)) stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = geteuid() r5 = geteuid() getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000000580)=0xe8) fstat(r1, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000700)={0x0, 0x0, 0x0}, &(0x7f0000000740)=0xc) r10 = getgid() fstat(r1, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r12 = getgid() fstat(r0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000880), &(0x7f00000008c0)=0x0, &(0x7f0000000900)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000940)={0x0, 0x0, 0x0}, &(0x7f0000000980)=0xc) stat(&(0x7f00000009c0)='./file0\x00', &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r0, &(0x7f00000002c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {0x1, 0x4}, [{0x2, 0x6, r2}, {0x2, 0x1, r3}, {0x2, 0x3, r4}, {0x2, 0x6, r5}, {0x2, 0x3, r6}, {0x2, 0x7, r7}, {0x2, 0x1, r8}], {0x4, 0x4}, [{0x8, 0x0, r9}, {0x8, 0x5, r10}, {0x8, 0x1, r11}, {0x8, 0x6, r12}, {0x8, 0x1, r13}, {0x8, 0x5, r14}, {0x8, 0x4, r15}, {0x8, 0x1, r16}], {}, {0x20, 0x3}}, 0x9c, 0x1) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000100)={0x0, 0xe9, "7a62e743647686e1b44cee27f44563113fa076cfa1ab4d059a9255f6ebea3e604480a7cc545aa5dfa6cd63370fcf01d41412fb922c5e2e513136f97348fe6864efcdadcafde9482cc41887c21820434d6714ea00ca5d1f319919fa84b3c1c381ad91df0ce347139890f46d5760b87591faa7eace88428c18b60cb012678d0f181fa34eebca92295febe954093719632347945fe99a78f0539dd46739889be7c8f50931b6175d0dde7e76a032b459072ffa5f4f2b40140bc7bcc3e83a5d6c975f2de0902700cbe88d2eb5a38f0b2952d9561a00ed771f2c5fe587ba9d8d12ff1cd03255a131494c50db"}, &(0x7f0000000200)=0xf1) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000240)={0x9, 0x0, 0x9, 0x5, r17}, &(0x7f0000000280)=0x10) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffffd, 0x80000000000}) 14:48:28 executing program 1: r0 = msgget$private(0x0, 0x8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000040)={{{@in6=@dev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@dev}}, &(0x7f0000000140)=0xe8) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000240)={{{@in6=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@broadcast}}, &(0x7f0000000340)=0xe8) r4 = getgid() fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000003c0)=0x0) msgctl$IPC_SET(r0, 0x1, &(0x7f0000000400)={{0x5, r1, r2, r3, r4, 0x0, 0x3}, 0x1, 0x6, 0x7, 0x200, 0x1, 0xc18, r5, r6}) r7 = socket$inet6(0xa, 0x1, 0x8010000000000084) getsockopt$inet_sctp6_SCTP_STATUS(r7, 0x84, 0xb, 0x0, &(0x7f0000000000)=0xfc55) 14:48:28 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) r1 = getpid() r2 = getpgrp(0x0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f00000000c0)={r3, r0, 0x1000}) r4 = getpid() ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r4, 0x2f279d69, &(0x7f0000000000)=""/86) setsockopt$packet_rx_ring(r0, 0x107, 0x5, 0x0, 0x0) 14:48:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xa2, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x194, 0x0, 0x0}) r2 = add_key(&(0x7f0000000140)='rxrpc_s\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f00000003c0)="ce31cd7d449d9d0ad948db2b1a9b12565d1254d2bfa3c378778cf6960cd5b6c7045272f88b488cd796069c64e91caece5106337c5877130dcf55884a2b10ab7f87a9a75b6ad4754c447ea9e464d031607fd1a214a73c0874515ba99a9bbc5619a0b6210d7cb0d80eb5241e6c9b3ce5d332c55195e8c388d6d2e7f212008375dcb054ad7aa11294b644d6329b0f4c67e7c1ce3d6da21e374a5db79abb81137759a91f2ec0bd034217ee84d8040120a9d54eac2f890e1160806f0fd0bdc638a8312bab195cf685512af7fe13a9c819770867072cd31eefe65faf45db4ae910cffc70b6b1ac7480bf63caa66ec86bec78a8f78eb8", 0xf3, 0xffffffffffffffff) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000500)='/dev/mixer\x00', 0x410100, 0x0) read$FUSE(r4, &(0x7f0000001580), 0x1000) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:48:28 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x0, &(0x7f0000000000), &(0x7f0000000180), &(0x7f0000002000), 0x2) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000000080)=0x4) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f00000000c0)) prctl$PR_GET_DUMPABLE(0x3) write$cgroup_pid(r0, &(0x7f0000000040)=r1, 0x12) [ 1604.235299] binder: send failed reply for transaction 498 to 455:456 [ 1604.243020] binder: undelivered TRANSACTION_COMPLETE [ 1604.248243] binder: undelivered TRANSACTION_ERROR: 29189 [ 1604.300721] binder: 474:475 got transaction to context manager from process owning it [ 1604.309150] binder: 474:475 transaction failed 29201/-22, size 24-8 line 2825 [ 1604.316727] binder: 474:475 ioctl c0306201 20000000 returned -14 14:48:28 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) timer_create(0x5, &(0x7f0000000000)={0x0, 0xd, 0x1, @thr={&(0x7f00000000c0)="cfbdd982b559b2a7cbda7b0f41420a84ae96bf83e96700e376e912df8ef68fde74a9e03cc0079ba297dcd4ca291aca9cc9a75b84a33383628dbcc8f56ea5e4defcf37ddaeff0f2d26eb54e0e9debd3dcb6048ff7961eed2d64b6c2a19a811caf359d738f0a9b5e789d2d9f118c03f53d99643c73a9b706b5bffc7b464c9b2415b611a8c35c5e5fd23a6a545e313ccccf6ee45f2ad2c73810ba7adfec0062b69c0697cb971953dbd730f975f59297b5b8ff24db944f0cb8b1d3f4f30860694cc82f7ab87bfb16255c1a671b14ddae0b87a96ff2a89ec08b823b9991cff4d6", &(0x7f00000001c0)="f328a8c39c01ba1ec67cbd748310f97814d77e44f1ad1a655d36429d218b1329e939c75c8f07c6f08e214100f9272e5061025d1fff100847fc0f359fd9eacdbdea4cceb529021d73cc95d77974"}}, &(0x7f0000000240)) eventfd2(0x3ff, 0x80001) 14:48:28 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f00000001c0)=@abs, 0x6e, &(0x7f0000000540), 0x0, &(0x7f0000000180)=[@rights={0x18, 0x1, 0x1, [r1]}], 0x18}, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) sendmmsg(r1, &(0x7f0000000040), 0x324fad809d5a9cf, 0x0) [ 1604.452455] binder: 474:475 Release 1 refcount change on invalid ref 1 ret -22 14:48:28 executing program 5: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000040)=0xc) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x200, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000280)={{{@in6=@remote, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@initdev}}, &(0x7f0000000200)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000380)={{{@in=@rand_addr=0x8, @in=@rand_addr=0x200, 0x4e24, 0x59, 0x4e20, 0x1cd, 0xa, 0x80, 0x20, 0x4, r4, r1}, {0x3, 0x3ff, 0x9414, 0x8, 0x5, 0x8, 0x2, 0x3}, {0x5, 0x7, 0x7, 0xff}, 0x5683, 0x6e6bbf, 0x3, 0x1, 0x3, 0x2}, {{@in=@broadcast, 0x4d4, 0x6c}, 0xa, @in=@broadcast, 0x3507, 0x1, 0x3, 0x0, 0x5, 0x6, 0x6}}, 0xe8) setregid(r0, r2) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:28 executing program 2: getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000240)={'raw\x00'}, 0x0) move_pages(0x0, 0xb6, &(0x7f0000000000)=[&(0x7f0000ffb000/0x1000)=nil], &(0x7f0000000ffc), &(0x7f0000000000), 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x4000, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000080)={0x0, 0x1, 0x1e}) 14:48:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) lsetxattr$security_smack_transmute(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1604.715919] binder: undelivered TRANSACTION_ERROR: 29201 14:48:28 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000401fea)='net/ip_tables_matches\x00') r1 = socket$kcm(0x29, 0xffffffffffffffff, 0x0) ioctl$KVM_TRANSLATE(0xffffffffffffffff, 0xc018ae85, 0x0) sendfile(r1, r0, &(0x7f0000301ff8), 0xffffffff) sendmsg$kcm(r1, &(0x7f0000002540)={&(0x7f0000000100)=@sco, 0x80, &(0x7f0000000080), 0x2f9, &(0x7f0000000080)}, 0x0) 14:48:28 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd(0x4) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) 14:48:28 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB="7c9d"]) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000000)=0x80) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000000), 0x1000000000000040) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14:48:29 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000000)={'\b\x00\x80\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa3\xd4\b\x00', 0x0, 0x0, 0x9, [], 0x0, &(0x7f00000000c0), &(0x7f0000000080)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000100)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r0, 0x40405514, &(0x7f00000000c0)={0x6, 0x7, 0x6, 0x7ff, 'syz0\x00'}) move_pages(r1, 0x0, &(0x7f00000000c0), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:29 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) select(0x40, &(0x7f0000000000)={0x4, 0xfffffffffffffff7, 0xffffffffffffff00, 0x3, 0x9, 0xff, 0x7fff}, &(0x7f0000000040)={0x6, 0x18c7, 0x0, 0x100, 0x9, 0xffffffff, 0x2}, &(0x7f0000000080)={0x5, 0x7, 0x124, 0x0, 0x6d6, 0x0, 0x9, 0xff}, &(0x7f0000000100)={0x77359400}) unshare(0x20400) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x2c) 14:48:29 executing program 2: unshare(0x20400) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x301000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000000100)=0xc) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000140)={r1, 0x7fffffff}, 0x8) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000040)=0x9, 0x8) fremovexattr(r0, &(0x7f00000000c0)=@random={'os2.', 'vboxnet0nodev+\x00'}) 14:48:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) r3 = openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x10040, 0x1) ioctl$KVM_SET_XCRS(r3, 0x4188aea7, &(0x7f0000000140)=ANY=[@ANYBLOB="0800000015cf000007000000000000000300000000000000ff030000000000000900000000000000090000000000000053ab00000000000002000000000000000000ef000000000000000900000000000000e10f00000000000007000000000000000200000000000000010000000100000005000000000000000200000000000200000000000000"]) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) r4 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x4, 0x48040) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) 14:48:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x2, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='\fc'], 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000180)={0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000000080)) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f0000000100)={0x0, 0x2, 0x80, 0x5, 0x0, 0x101}, &(0x7f0000000140)=0x14) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={r3, @in6={{0xa, 0x4e20, 0x3f, @empty, 0x6}}, 0x73a, 0x7, 0x4, 0x65c40, 0x20}, 0x98) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0563b59ec52a0440000000000e630c4000000000"], 0x0, 0x0, 0x0}) ppoll(&(0x7f0000000340)=[{r0, 0x1e}], 0x26b, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0}) 14:48:29 executing program 4: mknod$loop(&(0x7f0000000ff8)='./file0\x00', 0x0, 0xffffffffffffffff) lsetxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='security.capability\x00', &(0x7f0000000140)='\x00\x00\x00\x02\x01\x00\x00\x00\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x00\x00', 0x0, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x200, 0x0) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f00000003c0), &(0x7f0000000480)=0xffffffffffffff2b) unlinkat(r0, &(0x7f0000000180)='./file0\x00', 0x200) setxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64\x00', &(0x7f00000001c0)='\x00\x00\x00\x02\x01\x00\x00\x00\x00\x00\x00\x01\x04\x00', 0xe, 0x0) lgetxattr(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)=@known='security.evm\x00', &(0x7f0000000280)=""/145, 0x91) ioctl$KVM_SET_GUEST_DEBUG(r0, 0x4048ae9b, &(0x7f0000000340)={0x20000, 0x0, [0xfffffffffffffffd, 0x10000, 0x4, 0xa000000, 0x5, 0x3f, 0x1, 0x7]}) 14:48:29 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000000)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1605.417077] binder: BINDER_SET_CONTEXT_MGR already set [ 1605.422722] binder: 539:541 ioctl 40046207 0 returned -16 [ 1605.468045] binder: 539:541 ioctl c008240a 20000180 returned -22 [ 1605.525675] binder: 539:541 unknown command -1632279803 [ 1605.531209] binder: 539:541 ioctl c0306201 20000000 returned -22 14:48:29 executing program 3: eventfd(0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = eventfd(0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000080)={r0, 0x0, 0x20200000001}) [ 1605.572365] binder: 539:547 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:48:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) write(r0, &(0x7f0000000040)="8ef698273d286bdcdaf8022a899a86ae6995a7e0", 0x14) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$FICLONE(r0, 0x40049409, r0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x4, 0x0) r3 = getpgrp(0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f00000003c0)={{0x0, 0x3, 0xffffffffffffffff, 0x100000000, '\x00', 0x5}, 0x6, 0x401, 0x1ff, r3, 0x5, 0x9, 'syz1\x00', &(0x7f0000000100)=['#\x00', 'cpuset\x00', '/dev/binder#\x00', '/dev/binder#\x00', '+^:}\xd8$(\x00'], 0x2b, [], [0x401, 0x22, 0x51654187, 0x8]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 14:48:29 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000180)='/dev/video#\x00', 0x10000080000000, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) clock_gettime(0x3, &(0x7f0000000340)={0x0, 0x0}) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000280)={r3, r4/1000+30000}, 0x10) prctl$PR_CAPBSET_DROP(0x18, 0x3) ioctl(r2, 0x200000, &(0x7f00000000c0)="0a02000000000000007070") bind$rds(r1, &(0x7f0000000080)={0x2, 0x0, @local}, 0xd) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000380)={0x0, 0x0, 0x0, {0x1, @sliced}}) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000000)={0x2, @raw_data="45a638af857e00f4f570a43ca2f54230f6766f25fbd4ac670ce649fc430262eaf27a32f04233fd06c2813d0be7ae7d53ed59c1a6097a620024da9283261fdadc76dc92ee1ea9613b1c29817c5ddee77f0dd0f51ece6840f56986ed96c598c7764f57d00475d6a7604297c0404e8be83a82eed7873e56b10e826043e18afe7279ac373368debcc91d7b553836e5a51b62e398f94425c2a53c6c2581570b28088b17e1551267b97cb0eec4df89197823dc1dba566d012fbe84b19ec3a0f7aac519b09d7420a80c399e"}) ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f00000001c0)={0xe1, 0x9, 0x4, 0x2000000, {0x77359400}, {0x0, 0x3, 0x400, 0x940, 0xb58, 0xb14, "2661ecb2"}, 0x0, 0x2, @planes=&(0x7f0000000100)={0x6, 0x9, @mem_offset=0xdb}, 0x4}) 14:48:29 executing program 4: modify_ldt$read_default(0x2, 0xfffffffffffffffe, 0xfffffffffffffd64) r0 = accept(0xffffffffffffffff, &(0x7f0000000040)=@vsock, &(0x7f00000000c0)=0x80) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000180)={r1, @in={{0x2, 0x4e23, @rand_addr=0x10001}}, 0x20000, 0x5a2}, 0x90) r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x200400, 0x40) ioctl$RTC_EPOCH_SET(r2, 0x4008700e, 0x4) 14:48:29 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x3, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) poll(&(0x7f0000000040)=[{r0, 0x1}, {r0, 0x9889acbb69fad747}, {r0, 0x1400}, {r0, 0x44}, {r0, 0x30}, {r0, 0x4}, {r0, 0x4080}], 0x7, 0xffff) 14:48:29 executing program 1: r0 = inotify_init1(0x0) r1 = dup2(r0, r0) setsockopt$inet_sctp_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000000)=0xfff, 0x4) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f000045fff8)={0x0, 0x0}) tgkill(r2, r2, 0x0) [ 1605.762194] binder: send failed reply for transaction 504 to 504:505 [ 1605.794374] binder: undelivered TRANSACTION_COMPLETE [ 1605.799524] binder: undelivered TRANSACTION_ERROR: 29189 14:48:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x40) lsetxattr$security_evm(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='security.evm\x00', &(0x7f0000000180)=@ng={0x4, 0x0, "2972dc11f0046fcc762e5b"}, 0xd, 0x2) ioctl$RNDADDENTROPY(r3, 0x40085203, &(0x7f00000000c0)={0x7, 0xf, "52c7e123eeb65ba8ba4854e909cfe1"}) 14:48:30 executing program 4: r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000780)=ANY=[@ANYBLOB="e0020002ac1414c4bb562efb57ad0780c41e67087cfc35768ff8beb9016eaa0000bf62"], 0x14) r1 = syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x5, 0x20000) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r1, 0x800448d2, &(0x7f00000001c0)={0x9, &(0x7f0000000240)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) setsockopt$inet_mreqn(r0, 0x0, 0x100000000000026, &(0x7f0000000200)={@multicast2, @local}, 0xc) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhci\x00', 0x100, 0x0) ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f0000000180)=@generic={0x3, 0x20, 0x4}) ioctl$LOOP_SET_FD(r2, 0x4c00, r2) ioctl$PPPOEIOCDFWD(r2, 0xb101, 0x0) 14:48:30 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) epoll_create1(0x80000) 14:48:30 executing program 5: r0 = dup(0xffffffffffffffff) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) r1 = semget(0x0, 0x7, 0x80) semctl$SETVAL(r1, 0x0, 0x10, &(0x7f0000000040)) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000000)={0x5, [0xffffffffffff0e91, 0x0, 0x1a7, 0x10000, 0x8a05]}, 0xe) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000000080), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r0, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, &(0x7f0000000180)={&(0x7f0000000280)={0x1a8, r2, 0x2, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3088}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @local}}, {0x14, 0x2, @in={0x2, 0x4e20, @remote}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xd3de, @ipv4={[], [], @loopback}, 0x7}}, {0x14, 0x2, @in={0x2, 0x4e24, @rand_addr=0x2}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2ab}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7e9e7820}]}]}, @TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7f}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1ff}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8001}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x92}]}, @TIPC_NLA_NET={0x18, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6013}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}]}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x20000801}, 0x4000000) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:30 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000200)='/dev/snd/timer\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r1, 0xc0305302, &(0x7f00000000c0)={0xffffffffffff0000, 0x6c, 0x3ff, 0x4, 0x1, 0x1}) prctl$PR_SET_TIMERSLACK(0x1d, 0x7) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000000)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000040)=""/32) 14:48:30 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x8, 0x4100) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1c0010}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r2, 0x25, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x4}, @TIPC_NLA_BEARER={0x4}, @TIPC_NLA_SOCK={0x8, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x4040004) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000040), &(0x7f0000000200)=0x8) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000080)={r4, 0x0, 0x20200000001}) 14:48:30 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x81, 0x0, 0x10000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) select(0x40, &(0x7f00000000c0)={0x8, 0x2, 0x5, 0xb60, 0xe, 0x5, 0xd816, 0x7}, &(0x7f0000000100)={0x314018d, 0x3, 0x937f, 0x2, 0x7fff, 0xfffffffeffffffff, 0xff, 0x4}, &(0x7f0000000140)={0x4, 0xb83, 0x2, 0x6e, 0x8, 0x8, 0x8000, 0xe47b}, &(0x7f00000001c0)={0x0, 0x2710}) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f0000000700)={0x0, 0x1}, &(0x7f0000000840)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000880)={r2, 0x9a, "b2e3b0dc2166d28f9fb2fd4001a851f6d2bf348e33d2d0873f166fa9c31ff67dea738da5595d4b13110470bb5da27dcb2b60287198469a608d1e83be46c361c3db3b8c1f3a5b6b9a66fbc6566b5c2b6bbad6fa2a72e242c1c09f612bcec1d1f95f987e23cece9b66fc29e031323abfe8213da43c813eb849c582b383ff65941ff39208bd5b102119895521d55a75d226cb253bc7b7d9f362bef2"}, &(0x7f0000000600)=0xa2) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000780)={r3, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x16}}}, 0x7fffffff, 0x2, 0x1f, 0xffffffffffff594f, 0x24}, 0x98) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') read(r1, &(0x7f0000000380)=""/245, 0xfffffffffffffdff) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r4, 0x810c5701, &(0x7f00000004c0)) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40046602, &(0x7f0000000640)=0x80000084000) syz_open_dev$dri(&(0x7f0000000480)='/dev/dri/card#\x00', 0x10001, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r4, 0x4048ae9b, &(0x7f0000000040)={0x10000, 0x0, [0x9, 0x8, 0x0, 0xffffffffffff14af, 0x10000, 0x8, 0xff, 0xffff]}) linkat(r4, &(0x7f0000000680)='./file0\x00', r4, &(0x7f00000006c0)='./file0\x00', 0x1400) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000740)={r5, @multicast2, @multicast1}, 0xc) fcntl$getownex(r1, 0x10, &(0x7f0000000200)) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000000)={0x6, @multicast1, 0x0, 0x0, 'dh\x00', 0x20, 0x80000000, 0x17}, 0x2c) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x40, 0x0) perf_event_open(&(0x7f0000000180)={0x5, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f0000005000), 0x2}, 0x1000000000c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f000000d000), &(0x7f0000001000)=0xfea6) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc1105517, &(0x7f0000001000)) close(r0) 14:48:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x1) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f00000000c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_group_source_req(r3, 0x0, 0x2e, &(0x7f00000005c0)={0xe5ad, {{0x2, 0x4e22, @loopback}}, {{0x2, 0x4e20, @multicast2}}}, 0x108) r4 = mmap$binder(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x2000002, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x3, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="056304400100000008631040", @ANYRES64=r4, @ANYBLOB="0200000000000000ef62044004004000c9c4bf6b898001c076a39e729fc0108c90de64207ec29cb5b1e4e756428b0da1e23bd9d7929fc4e52623b3106ede50ea6b6a9157cbb41ad7a33eab8cbabd2470cf0752f997ecd99f28a24facaca4db0b9de6913a6a99e85125a4eb494de982d40f72935cf8f878948646716323240cf0f665e24251e0f8bc1cf31d286486542c43b30048f9e9e2f954aa6b6959d5c1a6b5de20e50a4dadb4605ce052f7fd17ca708640bee8153890d9cace06adc629679ca07b93d4884df4aa718c4355cfaab5d44a02866efd0000000000000000000000000000"], 0xfffffffffffffe84, 0x0, &(0x7f0000000040)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4000214486) sendmsg$unix(r2, &(0x7f0000000340)={&(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000300)=[{&(0x7f0000000140)="7025b8c11b5bc23c812b2db354dd580e4d1abb24f1946bcda353cb2ceac3b9e2a86df7746131cfd6a77d870a41cf43a8651b4ff663", 0x35}, {&(0x7f00000003c0)="42e30c98a36a3ae69613b5bd18f5d2024bb33e1eb3a08d4002a39314b0330c69b3444698a673ce234fe0980ef8042dab4d465bf1e8583f6faf98c5915de3ac06ed8aa17142c9e2ce2d1c396923c19e9d2a95ff7185ad0203e84dce10ecabcde491f29b3099fdda6b9f1944e5df2775d461de6b39220a72340eebbdda6c9fa4134d30f2d649c17b0b0418f67b9b831e2a2bbd282b0105c4827ebfae0324d3afed78787d368d6570fdf4eb0d325801575c01162c2e04560f2a250317f6c96ba56c2538b8c7b87fd44181f59d98a95b806e74f0a84be5f4322a", 0xd8}, {&(0x7f00000004c0)="233262c9415723301bc8e2d4f0358a432701cb8d6df72dee52da535861c3964dc31ea546f0b8571bfe19f3c87d7c496b5b98de93bf905b0c48f7adcab41ed0846823e9a288e3bb8972925d1d769ba7c3856bd69b57c08ed360b7ec5fe401238ba8cf52fbd224a2630cc8f58175ea73362ea64d62073cb446189928dc80a73be082c184fabd2404716c63b5633eaf3c2fc4b0b340d9e1cce074423c3943aa04f21a52cd7179176343eb7490996124519c71fd657bce344f64ebfb51b7ef1343919ebd422862fea644c2843cd59b4727a42dfdea75bb2af9cd9fc610f4ba44681483fcb8e276", 0xe5}], 0x3, 0x0, 0x0, 0x4000085}, 0x1) r5 = syz_open_dev$vbi(&(0x7f0000000180)='/dev/vbi#\x00', 0x3, 0x2) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000840)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r5, &(0x7f00000009c0)={&(0x7f0000000800), 0xc, &(0x7f0000000980)={&(0x7f0000000880)={0xc4, r6, 0x200, 0x70bd27, 0xfffffffffffffffd, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'team_slave_0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xd64}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7ff}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x20}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x81}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xffffffff}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x22}}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x81}]}, 0xc4}}, 0x4008004) 14:48:30 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) dup3(r0, r0, 0x80000) 14:48:30 executing program 1: socketpair$unix(0x1, 0x802, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'\x00\xacs\x00\x00\x00\x00\x00\xec\x97?\x82\x0f|@\x00', 0x102}) ioctl$TUNSETPERSIST(r1, 0x400454cb, 0x1) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000001c0)={'gpetap0\x00', 0x404}) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci\x00', 0x0, 0x0) mknodat(r2, &(0x7f00000000c0)='./file0\x00', 0x20, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r2, 0xc008551b, &(0x7f0000000100)={0x2, 0x8, [0x0, 0x0]}) close(r1) 14:48:30 executing program 2: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vsock\x00', 0x200000, 0x0) ioctl$KVM_S390_VCPU_FAULT(r0, 0x4008ae52, &(0x7f0000000280)=0x200000000) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000000c0)={0x0, 0x0, 0x0, 'queue1\x00'}) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000180)=0x7fffffff, 0x4) socketpair(0x9, 0x2, 0x7fffffff, &(0x7f00000001c0)={0xffffffffffffffff}) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000200)=0x1, 0x4) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc04c5349, &(0x7f0000000040)) 14:48:30 executing program 4: process_vm_writev(0x0, 0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000002040)=""/224, 0xe0}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000c80)={'\x00\x00\x01\x00\x00\x00\x00\x00\x80\x00'}, 0x0) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r0, 0x800442d4, &(0x7f0000000780)=0x4) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x58, &(0x7f0000000140)=[@in={0x2, 0x4e21, @empty}, @in6={0xa, 0x4e21, 0x3, @mcast2, 0x2}, @in6={0xa, 0x4e20, 0xc596, @mcast1, 0x1ff}, @in={0x2, 0x4e23, @multicast2}]}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000002140)=ANY=[@ANYRES32=r1, @ANYBLOB="8a0000003720f9d6261477fdfc6d2eb3139d228f4b82f93a54adc615dc3ebd78dfe5bc5d4070544b1a64c36bd369695bfe5d7e29c6f85534941af3fb7339de25c92eb54df2ef146373e03050676fd94a765553ec8ce32035df02f4c5e8458335b07a4fdc3c3774147ea4cd0260b0ea79c285a21ef537be06137ef325ca8cc0c27e31c0c126a505cb364bc553a4eae7c20fbada6a9971034e79eb938f01d0f948ada37c512197f6039433ae7eae2ae1ac494f19e62dc24148c2fbe3a6a499d511cdf04ab06dfc74b01a176a11e1aedf600ec3b849708f2e36b3b2d712e61f5cb8ab766b648f426b76ad5a27d5a30b8bf48e13a5e2f0b9e8523a8c910a6eae9ce26f"], &(0x7f00000006c0)=0x92) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000a00)) setsockopt(r0, 0x9, 0x5, &(0x7f00000008c0)="e1d1ef331361901f1e68b3a1897dd3c24fc28dc3113c07120d142b3339bc43c6dd3f", 0x22) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, 0x0, 0x0, &(0x7f0000000e00)=""/241, 0xf1}, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000b80)=[{&(0x7f00000007c0)=""/186, 0xba}, {&(0x7f0000000900)=""/124, 0x7c}, {&(0x7f0000000d00)=""/226, 0xe2}, {&(0x7f0000000980)=""/69, 0x45}], 0x4, 0x0, 0x0, 0x0) syz_open_dev$sndtimer(&(0x7f0000000a40)='/dev/snd/timer\x00', 0x0, 0x2000) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f00000000c0)=""/85, 0xb}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x6c}, {&(0x7f0000000480)=""/60, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x40d}, {&(0x7f0000000340)=""/22, 0x16}], 0x161, &(0x7f0000000600)=""/191, 0xbf}}], 0x40000000000020a, 0x0, &(0x7f0000003700)={0x77359400}) 14:48:30 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x4000) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f00000000c0)) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r3, 0x0, 0x20200000001}) [ 1606.772861] binder: release 568:569 transaction 508 out, still active [ 1606.779485] binder: undelivered TRANSACTION_COMPLETE [ 1606.784927] binder: send failed reply for transaction 508, target dead 14:48:31 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0a5c1f023c126285719070") ioctl(r0, 0xff7fffffbfffbfaa, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000180), &(0x7f0000000100)=0xc) getpid() fcntl$getownex(r1, 0x10, &(0x7f0000000140)={0x0, 0x0}) r3 = getpgid(r2) fcntl$lock(r1, 0x26, &(0x7f0000000000)={0x3, 0x1, 0x401, 0xff, r3}) 14:48:31 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x8000, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:31 executing program 4: unshare(0x400) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/mixer\x00', 0x0, 0x0) socket$unix(0x1, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100)="5f4889a335e578260e33af30a7bcc7f67c85cfed30e6da2035836894f6fc7bd582f962dd04737b5f0b388f803fbfcc3c214a2063c0e3003269ec5bc8a224e1e98268f53cca1f3f16b8710aee7ad5cc3cfb062a90f16d13635982540e3b88ead2ebcf8d29906c0b7d5accbf60a7f13be0fbc884701f70f948812059452a0dd36c0b7d1d38eafc56a579e3f789eec762654cd46e9fd29f78baa7a2b1c8", 0x9c, r0}, 0x68) select(0x40, &(0x7f0000000040), &(0x7f0000000080)={0x72}, &(0x7f00000000c0), &(0x7f0000000240)) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f00000001c0)=[@in6={0xa, 0x4e24, 0x0, @remote, 0x9}, @in6={0xa, 0x4e21, 0x1, @local, 0x1}], 0x38) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) 14:48:31 executing program 1: mmap(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x80000002, 0x8972, 0xffffffffffffffff, 0x0) madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='map_files\x00') fchdir(r0) getdents64(r0, &(0x7f0000000200)=""/116, 0x184) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)=0x0) ptrace$peekuser(0x3, r1, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) quotactl(0x2080000201, &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f00000002c0)) mlock2(&(0x7f0000cb6000/0x3000)=nil, 0x3000, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='numa_maps\x00') r4 = creat(&(0x7f0000000000)='./bus\x00', 0x0) sendfile(r4, r3, &(0x7f0000000180), 0x10013c93a) 14:48:31 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) r3 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x6800, 0x0) getpeername(r3, &(0x7f00000000c0)=@in={0x2, 0x0, @multicast2}, &(0x7f0000000140)=0x80) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000180)={0x0, 0x7fffffff}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000200)={r4, 0x7}, &(0x7f0000000240)=0x8) 14:48:31 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000002180)=""/252, &(0x7f0000002280)=0xfc) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="0206d400020000000080000000009c00"], 0x10}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0}, &(0x7f00000000c0)=0x14) r3 = syz_open_dev$adsp(&(0x7f0000002100)='/dev/adsp#\x00', 0x9, 0x141200) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r3, 0xc0045540, &(0x7f0000002140)=0x1) sendmmsg(r1, &(0x7f0000002040)=[{{&(0x7f0000000100)=@hci={0x1f, r2, 0x3}, 0x80, &(0x7f0000001880)=[{&(0x7f0000000200)="064f73aa130abcb9fca2c65d1daa81c32d9f2c99e654c7c82e9d319c18409fa58f1952627cae46f6ec0c1ed5d74a5a8c3ad71fa52b7ef9d04d28d06ef460a5cae441bfc7d03d9574fa40471e90f52288eeb9b74eed88e65343168f7342145012280355d9ac3c987713b88c4a6490ca6e7cd2cb1fbc2a2326431fd451c38a2e89f18f5bd543d2f575e5421e6657f3bc4c66d371d27ec1157aa1fcdbc780cb0d35c7a53cefedfe860ab65eff319792e92fb9a79c50385bb8d88c93a431d49bae760444a2c41dccb341a531dd6f6b4e4a6e51f05d9093808395bf30e373f56f0f545f250773edb87870f68716f15ebbf344", 0xf0}, {&(0x7f0000000300)="e17b6b2d786c2189df7592b7c67638d2c1994f103c1e7612647356ac33ea1cb774e2be2acdba08794bc541e0088cc3c76f459144761c784b4a5f3296489c1044677a3e81ba8fddf5a0be43b1d431ae3223", 0x51}, {&(0x7f0000000380)="12e27536afd0a94acbbd12f8ec9c092c6744398e895f5eba3ac7f1da734e3e672cb4dbb9f96a8861d2a44b32783767a6b6be615180f3e247414b40734ba514cb13c34934772d70f31a108179f34f54e99dc3c0ad51e2a3764f825db4d1b046ed49b402d7369ce2054dab1738006488f4844094c1603d825c1d36386d1cae45ef3a38bdaf2226c0476f4c517857c1eb1277d4d1567329a52cad305de06c7ec199853346376efb64b924e7ef75ae4077ccc1e5d38995e4fb6a8cf7659a0cf27faef0", 0xc1}, {&(0x7f0000000480)="91bc0babd5064ea3ca782d7443b883e3b5a1d175c514876ec16a5d9a3f552a394ca5d9ce21759e5634b5542726a0a3b23c972053ae73d19b562b10534188e974e89d08af3c2869a5b3", 0x49}, {&(0x7f0000000500)="7a07878b6337939a501a31bd0bf758c3280a0a97ab33e021e7d9f38bc1c7150796c9e577d23a0a2ef0ecf7adae277e5e92c2dc", 0xfffffffffffffe7e}, {&(0x7f0000000540)="4e6e82186ae69ec99ee5183c93b828d8d23bd85cd0484930e4c8e3de0bde3d47042b650839aca259969930604375194bedf42d5100f0e43cfcff083cccde25f007f1d8ef01572a46d16c33590c0f72ac544938ffa726bb2ab761f8b9f237ae66e5f29381a12f5f2e933b3a820f0eb839099981ca24df62acc7818320e5042128ce2a233393b5d368ab583a83e47a1e2d6b82b019a912c1962c6e1a7496f34f03ec40c6b672180241eef25970399d2ebbb52e2d477d1243ed2ec51daeb79410f88a640ccbc4b216c25988bf", 0xcb}, {&(0x7f0000000640)="ea7a54ce2574fa2a3f0357d751f019ebfebae3c7846cd1a59fca21267d3084565ced13e9adaba163d1520c8c230e1430d705d152ca01305f28eca838ed6fb77df56b7c22a0314a8d18e08bb0c88d734389d2229df8eb54bce5535d4c0d1d6c943d9b013ef257e2adfae1c1c24d0b1a3de0a1acc099798379284ce2b2bd698d4dd20838483c19634cfc3f12e42f7d8e843ce3a06e5aba789a7510135524b867441951dd3474f13573dfa51bddef3c5946aa9a3e574598022443eaa04bc117e14541a384eb605ba1b0631858e591f73306a0de74dbce019200d4aca9a443ebcb091cf4309a702496df96c4db7326a0a8a7999275d9161dbc2b52bbbaefabf0374d790c62165b7266d0a5967049c809ada486f52629d57418c4a36c789a8fd5d4cf8dcf30a8dc0cdb920ffc64617ca76ad1fb36bb355e4c02d5182679322cc7c051c7f7587fc59c9c878a3940eac1d7e49f1afe1bb84b09d6fed4b31305b85018d77a1d6d72b72aa85fb33e17865718b418c81ebde918e5e3a37510e8578c3383ec78ead09dac902632a0a6aa75749aa0b6182077bb61a6ff02169b242a21c336b65c0e1e79ca2a03c2cb5ad9f7333096a48b1e7c433dae9ed8cd763e4c3d33b27391988f6ca94689e76040eaa8878ef6073649945ddb62b2ccf734858b3f9e07a5b3f527acda76274e2a8b0da15d3622797002e6c41b1253f50d2aff15f635ae60e0a22cf7a43afc1ed71a3c3d0f90f558754836864aef27393950efabcdac84cbd1f277d6437f86da5bcfdb920f25c923d27a0ff75f4f25ddd4feefbed1b545998db165e97ddb5e46c347ec97e1e45cd149525c654b894eb349e4c1ff4ed3a0ce1a6ecd402d453415022b8a65f6d13c17925de4f2de89cf4829d56494b7dc6e1106dc076b94b949b4f6819c0c65a0635bf1493c9a9eddef4f1f49df97e42c189622944317ecab3418e2a14cedb89406bf897fab17641ee6e81629a6e6159fc4d4408c5d6e9a1f5b99b98e388c58577092153d5928e52cbfb23343f2a71214dbc80f6e91d0773eafaf0b0919b408cd2343895463826653119d5e3ee03259c47a3cca4d375bb55185339b2907ef52507c59fb1ffa728fa65e40097765fe54f1d637fcfa3396e2ec9f8b52913681a200b324aa46cd46d8d6805a8704741f7ddb2fe61703157f1bf62ebba1af71155e795cde2c038a7b063906b1017d3697881831d6ddac69b7d7b15af44aba2d8a09fb7827c34198a3b4460ad8817ac61a3bcaa0c9e6c206c1feba1bdf458e36e03c21ad6a48c11166b7968f62db70b4c9d326f22b524ac902363b657a885f33a06fc9cb32943d4d8e21c2aa09cbf5a7043dd06c80dcf6f163410d7d9a262daffdffc9b88cf3fd7575547dc3d0a9a1e5c4c0dc44e97de5db06b90c5f5f58deb96742b3caf4e88629f2777641c54b30333b783f848051a7cd2dac6916ddf738361363f069065a47907409532952a9d975442304c30df18a8ba3b8198ebf80f320ed8c4af90c8090570ff995b896c0d71d751fa9a66719d2f2a8bc0024abe695a5d155a0549fe8fec730916fec3ce5a1c5674b0dda3d8059fa2eb60358decb3dba46287e71a61e1333b4a7ffeb94453a65fa368dc649193b17dc223b2065a85d0cd64004ee7344f6b965102397f0dd344c079581ba3a1badab8f4216dd52a9c70895ad2ff83c7dafb0148b85efae5f4a5f81740f97e6a1617d7bd456d7ac35565b9ed679e8fedec1e8d0ec1155a76f8ac266da6edbbe69fb690a2e9e32b95145ad4b6524373632ba8079e3a95b7fa837769e935a49ed892c9e169eac8f2367981debd07efe0dfffdbf324c93522c069e1f4bb327c5aa93b7b62a9464ece2e1e265ce9c9497d94b4ab370d078cbc203739b32026813097b1161ce4ea844c49fda8c264343ed2fbb7d5459fbce9d83e9c7c7ff96d0dc1fec20597c8217a38765ed9117b8c766d55c7acb89d515436256313b0f38feb56da051aa15a0468b3d267bbb08fbeab27090e781efb2a296a76a1c7c8ab16fea05765976d55b3edf399f4f4aab81f25fe73da629b1c849c7ded0e05f91aede06d6e9e76787c6e67a39698cd4687cec375b283a0432c2de2e5927fc7196687743cfc1e482e78a08f19a36a66bff8887d9237f7a6220a1be000d2a050e8171584f8a81fcbcb7b54823e4dfdcd8e5675f8ddd2ad7babfd849b65b190f9c5abc3cffdb04f060003fca2d785ab69b1e156bb4b8a7092c0ba857349684c7a725aae07d15bf26506c7d2fd723a0bcdbdee5cd5cfb8fa504d9458f6e90f4d3150465c7c33ed789ab00c311ab95bb20da2aef00d736677d9462d0ab6a4d60db31b41c7bd45860e81e84a364d4c455761ec85a310b35fef861a3aa59dd4c1443f1dbb2a152cc43828f3eefd74d7c3d0feed22a060ed2043e8a0844477ac5db65b795b85b30e04037d5dfb42127931c8b27880f1f8424ea1c9b0e87b17abf74ce870bf5433650973f17266de244d6b634d2b19a57ea87c57b49930b22f8cfcf82ad018143c2f5d12a0aa4377e11aad5329bbcb16a94cd393110483da4f7832e3e5e4df5ff462e3ea7528e15aff5ebb174ad73d3a43bdd9cedc14c1295729d031d1d758cf0291db410135ba9da1186db31120d49e117b0cf40a03416d9af805b165a6f382ebae5282ebba386d4b2d52811bfe58364d5c23b96bcf793153eb233da6b8e52b5aa6aee1da829c6bd8e4b2fc6a9ce48b45520a31459eefc6e26d837f0a820306d3a86475fc7af4cef1d7d26a16a351e9fd10e4997dc8b0d8d5b3744040f84a20725fbf25dba0c1fe8cee0b26c7d6f5c1e318c5b0cc1abf4f8837dc4589a5f86c48d257694323b5413eea03b2fd682f5a7b4c638182fcac9048aaef233be8421845c61e13b50a5d1ea5b981f192e2ff4e12aff9bfadcd2edff5ce18a35c3499ab7407eb4a0b9d62fb7de600f03a7da392c5a6e6943da146d44091de7220a15ea1774fcc21fd44b540430a8436e1ca6fd6514a9981631b519aae83b8ceab38466996c98ac8cf8557d3abd8e5d34fcc2cfc60ce4bce2ee93ec3c2fcbe4c56c7c22823fdab29b97fbc1c18e9969cff980f9066e52731a285080fb531213d7ec53afc6ca1546f481d61ed492c79412ce8eed8c69ca2b4b390c3eba8012503ca5cffce1dda897f497a09db82217571e2ffe84793e8c7887bf8bb88a352fbbe4219aeb3176917579906410c9bcd9f3e320f59191f98b1dd738dc95315f03e42d0b88244873f749c7571fa11781c7bde005e98a3057609f6c4495ed4caf36fdd6afe68a24c16b3771d991f41592796cb2bdd2691fdb2a9a4fae4187a977522f960e9c1e707cf1ae806a48f7b11ac051bad4a56cd49f39770bb2df6d4dd3ff2af1709de9bf5ae5d4a2ba69342a54bd6e27a664eefa67a5c9bdd535fa75bdecccbb81f1c115f54b8c0f700343e227e13f913840215d60dcc774e8a991335e91b686448570232422638776d22b92812f4425e53635c6779a55e72897afcd54edddef8207bda87291f8e6eebfe1f190a82410222834d2a4193f53ec2bb6dc6b55f2c3ad82b42fe42caa20b0864946d664f564b26a4f41511aa5ce688cd336a1f4ca9c045063cc1841eae48784ccb3af86a44e622928f656bd8e265364adfd4fc5cccc65a8f0af2b4abe5a78647dbb2c62a37a460c04bbb11d77f91dcd8a789357d107114497f64451becc8b0354764ab38205190444d237b50ade4a334c825f0cf30f3ef629c9358075c8b184cac9e5f2195820647f14bff6dfb175a868900bdff23271411b2e791b46839304edd8d6ccef7395ba1d1c845e8e6624de474cff0f044aa72257955a22fb9bbf3daec1dba100d22c42eb85cdbc39953d8f7d13ce0d19f7aa4bcfa15e23264d3da6d16d5bb122d9b151cec98c2e74e67adbfb11bd746d908c44ab73ac57b5d64fadec4475d424eb43a78922815847d37131819c59e93ce2b861301956980e26a4876065fd3606992af2ddcc97438c23f1c53e4cc5ffc2491e5f0b069eedb126c6f11dd014a7e4fccbea222f3ca4d17de530eeb2ebe847c414323e7b4d2697075d2d974651873af2fca3d691816229f7a92035b3792fe08d8e3e4cb8ca817c62feec4bcd4a1dedf9f9c926812ad5ecb95d9ed07a00e2c9c93fab89407ff668b9436abefb0a7891af04da60f658146bf5c41bae652b0563fe10b42b9a0e33dff8ae1c8f620d50c9d9ef14f7f6cfd22eae7b2d8a81c1069370701601466aa25ff4fe71bad2d03c34c05b9846374728e1fc82371b8e5a286ca3cb7366c314183ee5eabdbd22f3fd06a6d1aea20b5073cb9d80e0e14ad62b5b6971b4caad45e4dfbda69cc303cc9d0f2118ee28a7b3ab8037bd5454b553db2688a1e79a4f5e902a7be3d3b7cef5e910e4725231af1fde419d517dcd8926066a917f8019075be6c582042f77c517e14cf92f63739096f3f4ff933064383a1c243e436070eed26c47b07b76d3e4391d7d43b6b634a27558a8d0c6abe99a9317ea52a2ea7852cbe92f651edb5afddca35d10d644673a5ef6ef8687cde25253db7fa3f39cd1a54817e1f7f81891f918ad0b7d025587634f18112a2cfa9eee6e016008cf19de2d77449adf3245f67074db5fb4d5ef2ac13d4a53d49d6702c6b2c36ea60177c7bf538dab75007010f15a4a9c025ee88feb22a37e62c3320abc32f847aec92843fc2e4c0f8adb2ea2bdecd6fe88ac5d39986a7e791c4d23af9110e594b96de88f86cbdaf8bddd8fc1b06675b5d7d96fb1267ed277a456dee57443627a9d281dc6dd06d4b5914b3dc1425d4bf1ae3808a29a5fa3ba36b486ccd0ae54c3055b5f7dc929a41a9987f496626f41b54e31202d07325e903976bac299e4fc679ba2c1bcd390277f6fc1e47cfd427713b63cc419b5f69d6715960c8d45e52368724214c0b561f5fd4db31e1334d98ecd7c47c92d5308710e8a182ecc0b28f93a99bb4f0e51e5cc7a101678c8e80c5bfa5ad1f69b090264fef87d03bff6533ea49e5f5e30a9b7a603963f5b620c3e43727380626e20d3be826f90afd53bf7be48adb789829d1e019c2c7e5294170dfbd137c3c01f12ce5cfa8ab865b063c47f476e9eaea3a43ac972788d07f580ce45a6f052b31fd7afacd67bf4f91d1cd9d318804b4032c63ebdb762621401d8714a094b4bcb281651d17235722d88976db9b5636303b5e77f3e6060d37789986dbe75dcf383073075a9dbd8eddca9e93e95ca5636cb708b985cda730d2d88b783f4e0d9edd471dcb1d2c5d0ec8f6da204ad08923655cb759cbc206b440dd2a526321d97d6b6a456a856f5917e18574e50fdcd10dcb7b8ffbf4f218a00eb120528a53df150f0f184aa8d9c41bc00135c00f6ae9d444a4867f231c91cd3d7019c9ab04e7be2c7998ea0a72c8b6321adb6e7bee7660f5208b637b4b67b8822a8eee9023b4b023eedd2b6302bc9271d4103186e04a051a2ed9657693b2cd0aed5243f23341c5ec86fe1ee8d9e0fdf90cea7433ceba768197273645a21d7ec05eb786675d67669da2c5469bd1f7b946cd133d0b9f9d2748fc85662605c4d6414ea756e6b4161c09d9b2065f95bae8383099a7e0277e2c5830ad20b6e66b967af8c0f5ff46da4c5e8f1ef5e0f013151f2a2cc1afd9209f6b3b277b16663110eadd1cbedf55b419bd8f02b1856f3d4f110dd80f9ea3779f75380cefac2ef7c85147bc68f054cfe310abfea5e50899744c385f7019041dfb30dc382ac29fc5e2538fd55d314acea615e003f0459476029611ce6c00223918fa27cfa849d", 0x1000}, {&(0x7f0000001640)="77568744b53b2e303ca51028463fcea9542dd0e8249bf79a118fd29e31404241f0064d5f13c8d596ecabf0fa5561b9308fa52862e4c1937b8e722787f224dd6a429c0debb6af6c0ad6394631e7cab286c240e236af228d00ec774a5506ea9ecd2984de2fa2f0bc9293a196b35deb14b31578aef5b5dae00f6441d5ead871e9b67904d7df24f3ca96e45ab97fe1e95bb284cb65e37875b8e5f7ae30ac1671634552cb13162449ddd41f", 0xa9}, {&(0x7f0000001700)="239cd53e97453f84a259be4451c06f6979b6c6fd8ba84b3e6fc62afcfe84f577d69bdd582efeb95b5a5c83c9a195574638c396c5cc7b08ece2692fb424e9745471fae8ed93da0102", 0x48}, {&(0x7f0000001780)="3f2dd39cfb25c48b6dfb064319dd9af94734f82550792f73f800c5a68411c618e6e83b65604ad040babc5a56762516ece78c95395f3b72fc42544d06430db00d20df539e22c4723490312c3fd9b15fa45a141d12cfb47d87ff18f884ccd21dbfbf128d71fae86352d42eb12ae472fa25cbedbe2e7a81cf12bb0e2d9c4d3342415e802af900ee89bbc2893ab7d229d238a87e46306289e7517984214713cbcc5be30857be14a1b8d6609dfc32dbb9efde92114c18eecc9106cf16869ccd10f6be6d9c762c64a47101ea290cb3abc6031a5cdf712669c5273a495514274eb6528bad06", 0xe2}], 0xa}, 0x8}, {{&(0x7f0000001940)=@x25={0x9, @null=' \x00'}, 0x80, &(0x7f0000001ac0)=[{&(0x7f00000019c0)="ba91f46647691588679996067eeb60e2669c9bdbb8830896bf5ec8f75e1d42bb3059ebf3eef9b69c4b7cff2e5056914dc802f3e840f6b48874c655acd00ff722a5d299b5eae215033fb35ce6b705c9f9ab0e41625c9a98343faa201af0f8126b201e58f769249c96ad18ec", 0x6b}, {&(0x7f0000001a40)="ee46d70ea1b0c49427fe559f3c3907014dfb6423b5b839b60ca702ff994e806995375bc05d5fbac31103c25c8db01609d92e0a70254f62a8ba4b68b19d9b94bc4dc7", 0x42}], 0x2}, 0x1}, {{&(0x7f0000001b00)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x0, 0x3, 0x3, 0x3}}, 0x80, &(0x7f0000001f80)=[{&(0x7f0000001b80)="b45bfedaafddb34d2df44b4180e87008c051714e394287594b21d62380e3191aeb3d0ad8abaf68537bb0ba4f5cc07fad69e5bf778dc1a0dcffe36a511c62937c9fc265a9b546314597bb6ff47b5390d2be79ca831d4fe3872d21af0854d899b8fd19d27880a7e27f479f3e50e6b9eee31f63b35d45882b0f41acfdc1d338403fbc1a7dbcf592989cf131c9ddf68a233ffc5f1bdf388d27c4fc244dff20", 0x9d}, {&(0x7f0000001c40)="c98400897a70c9015975be646c5121cc941f99d2b7056550c89f9b602329b981a892eac19639eb77a88b4efa381761e52e7582a10e666a", 0x37}, {&(0x7f0000001c80)="df1c82f7e9bf8f49710931286d49cb64a5dc2412dd8938d623eeea266d5df042e981ff2b097c083418130c7bae5019aa2a3bbe4f92c5ce17e5e52c2861d49541c0189d64f1c8c6d5f22a2499e0838b26dbc50113f46532d9099bde7bc5", 0x3f}, {&(0x7f0000001d00)="c0b00ec95df5dace89307977ebac8faaa96e6b784105a208888ce4ff9b466ce571c180295a626222575a85ab3421e5dceaae2abf932aac64613b8d090f7b154e1e2ab0c91f8a7efb", 0x48}, {&(0x7f0000001d80)="db478ad7390a1b048f68992bb009777391dd149c1f82206e43522633e49f1194c001ee19a8f55df7428d09d17e6ee29e7eaf7c5d3f2dc42e66fc300ef77c336beb451071e39093738f49d7d9a0fb0e5e2de70364ea8891e97fef6f86de3916c80dbb0ac9d4", 0x65}, {&(0x7f0000001e00)="7e5c0d7548832816d82a6ce31ae40f715b6d9ee79890e7ffeee9c9eaa059f25b2d3679a25796c0ce58e460edb53fe788866a3893f19e4b38bf3ef3e19404f9efce8240526db44669bd3a60b76d2522b5cd1d500751b174fa0ecebba32e058d3960d8901e631e42558fda", 0x6a}, {&(0x7f0000001e80)="304f82ea16f661a0e33769974dc93ab827f2aaf1311ab4d370909d0d048043bbff6a9143da7e67b73c0ceaf55d8a2bcf9e7aea307689703d73a9f806b8466d428a277d970b085c9059bebda4d675d00b14fd73ff15119ffd67bd6077482f10c9b1493590fb8a22a3f7ef8a80fdf71c9b8f147d1d4a1c93c254c1bb96fa87bd6ea564cbb3cf06f2575df0a1f6c9d8352ec77e1b0cbfebcea2be71a3f0d1b82e17d485c8a0b6259275d1fd98dfda83e2a17f5160932802bd806a47ed653eb16986017c1c14afdf0c8c192df9b9d08ceb3caf77ffe96b98ad1593adb2a24cd951c0b087f0d98e1189c476e56ed70606c45c494934935756262b40", 0xf9}], 0x7, &(0x7f0000002000)=[{0x28, 0x19f, 0x4f5, "afe50d46870f60cb6ce20afbd0c4569bbaf8efa6"}], 0xff73}, 0x7f}], 0x3, 0x0) [ 1607.667788] binder_alloc: binder_alloc_mmap_handler: 621 20001000-20004000 already mapped failed -16 [ 1607.681448] binder: BINDER_SET_CONTEXT_MGR already set [ 1607.687051] binder: 621:631 ioctl 40046207 0 returned -16 [ 1607.692434] binder_alloc: 621: binder_alloc_buf, no vma [ 1607.698003] binder: 621:660 transaction failed 29189/-3, size 24-8 line 2973 [ 1607.709061] binder: 621:631 Acquire 1 refcount change on invalid ref 1 ret -22 14:48:31 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:31 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) fallocate(r2, 0x20, 0x1, 0x5) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x4a00, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r3, 0x40505330, &(0x7f0000000180)={{0x3ff, 0x1}, {0x3b8, 0x3ff}, 0x3, 0x7, 0x4}) r4 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x0, 0x2) write$FUSE_STATFS(r4, &(0x7f00000000c0)={0x60, 0x0, 0x2, {{0x6, 0x10001, 0x2, 0x8, 0x4, 0x40, 0x20, 0x3}}}, 0x60) 14:48:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) prctl$PR_GET_CHILD_SUBREAPER(0x25) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffee1, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:31 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) capset(&(0x7f0000000140)={0x19980332}, &(0x7f000047efe8)) ioctl$sock_inet_SIOCDARP(r0, 0x8953, 0x0) 14:48:31 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7f, 0x400001) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x81}) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x800000d) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0x461b0, 0x0, 0x0, 0x2000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xffff, 0x0, 0x0, 0x0, @perf_bp, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0x1b, &(0x7f0000000680)=ANY=[@ANYBLOB="0500db44c7450000bf7ce676b30007000000f0fff8ffffff79a4dcf308000000b4060000ff7fffff2d020000005eafe556b35eb800650404000100000004040000850000001f000001b70000140000000095000000000000000000000000000000058e5c6e6df31b89512208912fa355aaac9ac3ceb3a715daa514383a756c21ad650eeeb3d3243ba48f712c22a00705319534474476b5f9108bfe28aead7f63cfbf5f36c710c2aad29b31eb6f5ab9186a83021d12c295fb0e2728f70fda099f5aedb7c0af9cf3e29b55426a9ca5af25e64a7207448d064a3f3b66c81f5b46"], 0x0}, 0x48) r5 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10001, &(0x7f0000000100)="153f6234488dd25d766070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket(0xa, 0x3, 0x8) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) ioctl$sock_FIOSETOWN(r7, 0x8901, &(0x7f00000002c0)=r9) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) setsockopt$IP_VS_SO_SET_DELDEST(r8, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @remote, 0x4e24, 0x0, 'lblcr\x00', 0x1a, 0x0, 0x13}, {@remote, 0x4e21, 0x7, 0xffff, 0x7e, 0x2}}, 0x44) r10 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02\x05\x00\x00\x00\xac', 0x0) write$binfmt_misc(r10, &(0x7f00000007c0)=ANY=[@ANYPTR64=&(0x7f00000003c0)=ANY=[@ANYRESHEX=r1, @ANYPTR=&(0x7f0000000280)=ANY=[@ANYRES64=r5, @ANYRESHEX=r4, @ANYRES16=r9, @ANYRESOCT=r2, @ANYRES16=r7], @ANYRES32=r3, @ANYRES32=r5, @ANYRESDEC=r5, @ANYRESHEX=r6], @ANYPTR, @ANYPTR64=&(0x7f0000000780)=ANY=[@ANYRESHEX=r10, @ANYPTR64=&(0x7f0000000440)=ANY=[@ANYRESOCT=r3, @ANYRESDEC=r2], @ANYPTR64=&(0x7f0000000480)=ANY=[@ANYRES32, @ANYPTR64, @ANYPTR64, @ANYBLOB="aa8a30e8f3268a7b0251f55278d2fc37e72dbd1f634781821ab755c1ae01d237ba5bb807dc773f7fc9fb46f46768cd3ab323ff7e9c5885c6ca40063209025b8af2b72d5c4d579f0d1f08e3440448f6351921e5caf798fa531dcab34bc209c188de8bb283ffdd7135def1f55cb94aa6ff48d0c42c9ae6538f87479ad3a4c7f31c8755b5f44a4fe1102a5120a111dba27efff9f1e422b36572886ca7c6b6d29d0029efeed4acbf56a01f133f58f206", @ANYRESOCT=r5], @ANYRES16=r9, @ANYRESHEX=r9], @ANYRES16=r1, @ANYRES32], 0xb7) close(r7) r11 = dup3(r6, r10, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r11, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)}}, 0x20) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0x0, 0x2a03}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[]}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020900000200000000000000020000000576ffcdbc5042f9019133184efc17fecdc0effb4f77f9363eb314364edc6a6a7cd36bc92d518b74cc195912f3bcdf6842a7b6ccbbff822fd6f21544bc1de89b517c91449d5ffb9687d75fdeae9539940dca17ff63cc13cf00416c30ca960527f41e92ea7b1cac55c137dbeef2deac498ed23631aef3d93b581778a7df4d"], 0x8e}}, 0x40005) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010000000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b000000000000004000000000"], 0x80}}, 0x0) r12 = socket$key(0xf, 0x3, 0x2) sendmmsg(r12, &(0x7f0000000180), 0x400000000000117, 0x0) syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x1, 0x2) clock_gettime(0x0, &(0x7f0000000380)) 14:48:31 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x1, 0x2) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f0000000180)) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000004c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x2f5}], 0x30}, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x80) ioctl$SG_SET_COMMAND_Q(r3, 0x2271, &(0x7f0000000140)) write$binfmt_script(r2, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmmsg(r2, &(0x7f0000000780)=[{{&(0x7f0000000280)=@vsock, 0x80, &(0x7f0000000ac0)=[{&(0x7f0000000300)=""/242, 0xf2}, {&(0x7f0000000400)=""/137, 0x89}, {&(0x7f0000000500)=""/43, 0x2b}, {&(0x7f0000000540)=""/250, 0xfa}, {&(0x7f0000000640)=""/22, 0xf}, {&(0x7f0000000680)=""/97, 0x61}], 0x6, &(0x7f00000013c0)=""/4096, 0x1000}}], 0x1, 0x0, &(0x7f0000004840)) [ 1607.718933] binder: release 621:623 transaction 512 out, still active [ 1607.725726] binder: unexpected work type, 4, not freed [ 1607.731047] binder: undelivered TRANSACTION_COMPLETE [ 1607.736357] binder: undelivered TRANSACTION_ERROR: 29189 [ 1607.742005] binder: send failed reply for transaction 512, target dead [ 1607.964974] binder: 676:679 ioctl c0306201 20000000 returned -14 [ 1607.976635] bridge0: port 3(gretap0) entered blocking state [ 1607.983003] bridge0: port 3(gretap0) entered disabled state [ 1607.993802] device gretap0 entered promiscuous mode [ 1608.001431] bridge0: port 3(gretap0) entered blocking state [ 1608.007812] bridge0: port 3(gretap0) entered forwarding state 14:48:32 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001880)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000340)='/dev/snapshot\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000380)={0x0, @multicast2, 0x4e20, 0x3, 'lblcr\x00', 0x37, 0xffffffff, 0x61}, 0x2c) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_mr_vif\x00') r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4010641a, &(0x7f0000000400)={0x9, &(0x7f00000003c0)=[0x5, 0x7fffffff, 0x400, 0xff, 0x2, 0x60f8, 0x6, 0x7, 0x33a]}) sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2001021}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r4, 0x0, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40004}, 0x40000) preadv(r3, &(0x7f00000017c0), 0x1d0, 0x8000000) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000140)={@in={{0x2, 0x4e22, @broadcast}}, 0x0, 0x0, 0x0, "f2cf6eb35232a5dfeb612374cbc856a987a40058707b485b37c30f66adb85dc337fa3ab3d5333376af95f919740c66ec8880089b775ae0bd347773cd99f7ee59f277e72b5bba6ead15adb7a11b064de6"}, 0xd8) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) sched_getaffinity(r5, 0x8, &(0x7f0000000080)) 14:48:32 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0xfffffffffffffe63, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) sendmsg$unix(r0, &(0x7f0000000280)={&(0x7f0000000000)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000180)=[{&(0x7f0000000080)="c00efc6459a62c614b3503455dbd2d4781a7e78115dea3e15ff8468d3ced380f0b06beb260f7fb2899a2f369393c95897b858cd5f41596853a7ca9a4c513caec44a2cc1a", 0x44}], 0x1, &(0x7f00000001c0)=[@rights={0x18, 0x1, 0x1, [r0, 0xffffffffffffff9c]}, @rights={0x10}, @rights={0x18, 0x1, 0x1, [r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0, r0]}], 0x60, 0x44000}, 0x20000044) [ 1608.016659] binder: 676:679 Release 1 refcount change on invalid ref 1 ret -22 14:48:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) r3 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000180)=0x1c) bind$pptp(r2, &(0x7f0000000140)={0x18, 0x2, {0x2, @loopback}}, 0x1e) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000100)=0x7, 0x4) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) 14:48:32 executing program 2: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x8000) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000080)={0x0, 0x3, 0xdb5, 0x3, 0x7}) 14:48:32 executing program 5: openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x8800, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f00000000c0), &(0x7f0000000100)=0x4) r3 = eventfd(0x3) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r3, 0x0, 0x20200000001}) 14:48:32 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x30200, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0xfffffffffffffffd, 0x4000) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000000c0)) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x238, [0x200003c0, 0x0, 0x0, 0x200003f0, 0x20000420], 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000006000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000030000000000000008006966623000000000000000000000000064756d6d79300000000000000000000069705f76746930000000000000000000697036746e6c30000000000000000000aaaaaaaaaabb0000000000000180c20000000000000000000000f000000070010000a8010000697000000000000000000000000000000000000000000000000000000000000020000000000000007f00dd0001ac1414000000000000000000008420285b10286f3b230000000000007265616c6d000000000000000000fad7962387d7f8d4000000000000000000001000000000000000000000000000000000000000000000006172707265706c7900000000000000000000001c0000000000000000000000001000000000000000aaaaaaaaa500000000000000000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa00000000000000000000"]}, 0x2b0) 14:48:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {{0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)=[0x38, 0x28, 0x0, 0x28, 0x48, 0x40, 0x58]}, 0x334}}], 0xffffffffffffffa4, 0x0, &(0x7f0000000540)="fc"}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x440000, 0x0) rt_sigpending(&(0x7f0000000180), 0x8) ioctl$KVM_SET_NR_MMU_PAGES(r3, 0xae44, 0x9) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:32 executing program 4: r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x3, 0x2) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x8}, &(0x7f00000000c0)=0x8) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000100)={r1, @in6={{0xa, 0x4e20, 0x1, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x8001}}, [0xfff, 0x0, 0x6, 0xf57c, 0x5, 0x2, 0x4, 0x3, 0x3f, 0x3f, 0x0, 0xfffffffffffffffd, 0x8001, 0x400, 0x101]}, &(0x7f0000000200)=0x100) unshare(0x20040600) socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x13, &(0x7f0000000240)=0xffffffffffffffff, 0xffffffffffffffd9) 14:48:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) 14:48:32 executing program 1: unshare(0x2000400) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x200000, 0x0) ioctl$RTC_EPOCH_READ(r0, 0x8008700d, &(0x7f00000000c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000100)='net/arp\x00') ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x0, 0x3}) 14:48:32 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2, 0x0, 0x23) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:32 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0xa2, 0x200001) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r2, 0xc028ae92, &(0x7f0000000040)={0x1f}) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x2000, 0x0) ioctl$BLKBSZGET(r3, 0x80081270, &(0x7f0000000100)) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000080)={0x7b, 0x0, [0x40000072]}) [ 1609.057956] binder: 731:732 got transaction to invalid handle [ 1609.064183] binder: 731:732 transaction failed 29201/-22, size 0-0 line 2834 14:48:33 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) ioctl(r0, 0x0, &(0x7f0000000000)="9bb624c1b3975ed45f4587ed511e382413109f373903bf2800bb9a578b59ee4c615afd5464b3825c3bc188afd7b20f77157db5b5c890f8b6c0934cb20f4c7b47d1497d7a2867a025b91d7f79e2e0df774e69eff54df4367d38f1008812988057de4d338b9cda545f40a6f0afa40b44e2a352c52e079703f60a83bcf57d42431d7478d7c9b3cd2881f82e8b0b851be64b47ffecfac527932ac3f2f8ac7b14900b18356a1ac0f3cb6f2e26bca070cc0ec2afebe5466de4ee904465f13d4e9fa00d0dac849713ff31cc1017b4a06896829683522e9ce1457954b38f722a7a7b042aeb98fcac0cfc") move_pages(0x0, 0x34, &(0x7f00000001c0), &(0x7f000026bfec), &(0x7f0000000180), 0x0) 14:48:33 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x2005, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xffffffff, 0x204000) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000280)={0x7}, 0x1) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) [ 1609.174912] binder_alloc: binder_alloc_mmap_handler: 731 20001000-20004000 already mapped failed -16 [ 1609.208763] binder: BINDER_SET_CONTEXT_MGR already set [ 1609.214330] binder: 731:732 ioctl 40046207 0 returned -16 14:48:33 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x8000, 0x3}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000, 0x0) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x505000, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r3, 0x80045700, &(0x7f0000000100)) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) 14:48:33 executing program 4: unshare(0x20400) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/igmp\x00') getsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000040)={0x4, [0x8, 0x1ff, 0x8, 0x6]}, &(0x7f00000000c0)=0xc) setsockopt$inet6_int(r0, 0x29, 0x7, &(0x7f0000000080), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000100)=0x2, 0x4) [ 1609.231974] binder_alloc: 731: binder_alloc_buf, no vma [ 1609.237520] binder: 731:747 transaction failed 29189/-3, size 24-8 line 2973 14:48:33 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000080)={'nat\x00', 0x0, 0x0, 0x171, [], 0x29c, &(0x7f0000000000), &(0x7f0000000180)=""/30}, 0x0) pipe2(&(0x7f0000000000), 0x800) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1609.374095] binder: 731:740 got transaction to invalid handle [ 1609.380055] binder: 731:740 transaction failed 29201/-22, size 0-0 line 2834 [ 1609.381913] binder: release 731:732 transaction 518 out, still active [ 1609.394119] binder: unexpected work type, 4, not freed [ 1609.399424] binder: undelivered TRANSACTION_COMPLETE 14:48:33 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x208400, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r0, 0x40045731, &(0x7f00000000c0)=0xfffffffffffffffe) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff3fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) r4 = semget(0x0, 0x3, 0x2) r5 = getuid() r6 = getegid() getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000280)={{{@in=@multicast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@remote}}, &(0x7f0000000380)=0xe8) getresgid(&(0x7f00000003c0)=0x0, &(0x7f0000000400), &(0x7f0000000440)) semctl$IPC_SET(r4, 0x0, 0x1, &(0x7f0000000480)={{0x9, r5, r6, r7, r8, 0xf4991607ab47a11f, 0x200}, 0x5, 0x3, 0xffffffffffff8001}) r9 = getpgrp(0x0) r10 = syz_open_procfs(r9, &(0x7f0000000140)='status\x00') setsockopt$inet6_MRT6_ADD_MFC(r10, 0x29, 0xcc, &(0x7f0000000200)={{0xa, 0x4e22, 0x5, @ipv4={[], [], @empty}, 0xffffffff}, {0xa, 0x4e20, 0x3, @remote}, 0x1000, [0x60c193c0, 0x1f, 0x800, 0x3, 0x80000001, 0x2, 0x9, 0xfff]}, 0x5c) write$tun(r10, &(0x7f0000000180)={@val={0x0, 0x88ff}, @void, @eth={@remote, @dev={[], 0xb}, [], {@canfd={0xd, {{0x3, 0x7, 0x7fffffff, 0xff}, 0x2a, 0x0, 0x0, 0x0, "8ea74f78e55f9b4e1d3ea2dc91984fb3ca472494a963a9e0ea2bee7673176bd0500920e87ced8b85b39993018073cb9206f30998728d017bfba9e4511875d623"}}}}}, 0x5a) [ 1609.435494] binder: undelivered TRANSACTION_ERROR: 29189 [ 1609.441268] binder: send failed reply for transaction 518, target dead 14:48:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x2, 0x200000) ioctl$EVIOCGABS0(r2, 0x80184540, &(0x7f00000000c0)=""/210) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000002, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) getsockopt$IP6T_SO_GET_ENTRIES(r2, 0x29, 0x41, &(0x7f00000003c0)={'filter\x00', 0x81, "65bca2490dc75b27c0abbb2526ca00da6c5b9df16a89702fde03f12418e44803bfa18b687a8e766c7639a7324cf8d2a5610dc2d83714227c035f0867a9b2c12039daab17fbc5fed247b6a50fbb04c38a1f8209460ebb390221009ca4cfb591bf0ce2b8134aa75a4335d2c5afeb5217e9842776ff89831719b76ce5d23659d753c2"}, &(0x7f0000000280)=0xa5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:48:33 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x2005, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xffffffff, 0x204000) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000280)={0x7}, 0x1) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:48:33 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) 14:48:33 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) unshare(0x2000400) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f0000000080)="0ab1e3fa7dd1309b7e951f0f2785b4326be67bc808edfff1b1d9647befc630291833f05b7999d845827a0c748de94f496934afbbf264df8451a8966a186fda7535decfff248ab7cb1569ba371af44010a624d456c47f23f65ed4cad90f24038129a9133d2300c35db1d6fa6a9fa967cfdb5351b7b6fa32cae9d9a508ae5dff8c3d69314f2dcd92c0ccf9ad3b126d0d51694880dd429a4c8c18777c182b7c6e52fdae4f34960d3f65dc84c0bd29a7b9a8fdae293505b52a4ae6b04f12f075f176799fd58d23df6bac0e112aec4e519153ef2b4a40cef873a86b2fe162f124e82cadd471d7a0b6c7b9e359422ac8bba31ba88f6ceb5158d9ae93ed56eea3748886") ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) sendto$inet(0xffffffffffffffff, &(0x7f0000000040)="4e9a", 0x2, 0x0, 0x0, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x800) write$P9_RMKNOD(r2, &(0x7f0000000180)={0x14, 0x13, 0x2, {0x20, 0x0, 0x2}}, 0x14) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000040)=ANY=[]) 14:48:33 executing program 3: r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, &(0x7f00000000c0)=0x1c) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000100)={0x0, @speck128, 0x1, "07ea2e732111b1cf"}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$sock_int(r0, 0x1, 0x22, &(0x7f0000000140)=0x8001, 0x4) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000080)={r3, 0x0, 0x20200000001}) 14:48:33 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fcntl$getflags(r1, 0x40b) r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x80011, r2, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000018c0)='IPVS\x00') futex(&(0x7f0000001ac0), 0x3, 0x0, 0x0, &(0x7f0000001c40), 0x0) ioctl(r0, 0xffffffffffffffff, &(0x7f0000000040)="d21d5ee5caeebc1c15c6ebb12550541e6134953923d4af55fabf5f74ab8bd7ab99e1c25c5207491b2c996d4ba9c9a2326eb369b38cfd0d40a3345ad519b5a469fdee24e29b61ed4f9706f2dbffbb6ee94b2ccbe338068bb0eae5b5c198d48929694f3c5112a0d9eb5ea7051aff59a5f89d707a42d5e112abce2c47dd4f86bdea233ab5ee86fb3a82cbd994") 14:48:34 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x2005, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xffffffff, 0x204000) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000280)={0x7}, 0x1) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:48:34 executing program 4: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002500)='/dev/ppp\x00', 0xa000, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000002580)={{{@in6, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@remote}}, &(0x7f0000002680)=0xe8) sendmsg$nl_route(r0, &(0x7f0000002780)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000002740)={&(0x7f00000026c0)=@ipmr_delroute={0x70, 0x19, 0xf21, 0x70bd2d, 0x25dfdbfc, {0x80, 0x0, 0x94, 0x9, 0x0, 0x1, 0xff, 0x0, 0x400}, [@RTA_METRICS={0x48, 0x8, "7468944c86053ff28207af2be6bd9cea714606dce0f933d9ce78d3fca4546c4a92f38ad70e5279fb57717456902336d156d4549def274ff0aa403a669747a057c8bd"}, @RTA_MULTIPATH={0xc, 0x9, {0x800, 0xb3, 0x1, r1}}]}, 0x70}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[]}}, 0x0) r3 = accept(r2, &(0x7f0000000100)=@llc, &(0x7f0000002380)=0x80) recvfrom$unix(r3, &(0x7f0000002340)=""/60, 0x3c, 0x1, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200aa0802000000000000000000000105000600200000000a00000000000000000500e50000070000001f000000000000250000000000000200010000000000002000020000627c05000500000000000a00000000010000ff1700000000000000000000000001170000000000000000"], 0x80}}, 0x0) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000027c0)={{{@in=@multicast2, @in6=@dev}}, {{@in6}}}, &(0x7f00000028c0)=0xe8) getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f00000023c0)={0x0, 0x4, 0x3, 0x6, 0x80, 0x3, 0x9, 0x4, {0x0, @in={{0x2, 0x4e22, @empty}}, 0xfffffffffffffff9, 0x81, 0x8, 0x5, 0xa33}}, &(0x7f0000000280)=0xb0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000002480)={r4, 0xffffffff}, &(0x7f00000024c0)=0x8) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x2, 0xa, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, [@sadb_x_filter={0x5, 0x1a, @in6=@ipv4={[], [], @local}, @in, 0x0, 0x4}]}, 0x38}}, 0x0) sendmmsg(r2, &(0x7f0000000180), 0x400000000000117, 0x0) ioctl$KVM_GET_NESTED_STATE(r2, 0xc080aebe, &(0x7f00000002c0)={0x0, 0x0, 0x2080}) 14:48:34 executing program 5: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x400, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x4, 0x1e, [], 0x0, &(0x7f00000000c0), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x400, 0x0) write$P9_RVERSION(r1, &(0x7f0000000100)={0x13, 0x65, 0xffff, 0x100, 0x6, '9P2000'}, 0x13) eventfd(0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9, 0x2002) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r2, 0x3) write$P9_RWSTAT(r2, &(0x7f0000000080)={0x7, 0x7f, 0x1}, 0x7) 14:48:34 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) r1 = gettid() r2 = socket$inet(0x2, 0x6, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000080)) setsockopt$inet_opts(r2, 0x0, 0x4, &(0x7f000064effb)="8907040000", 0x5) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000583ffc)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x80000, 0x0) write$P9_RVERSION(r3, &(0x7f0000000100)={0x13, 0x65, 0xffff, 0x4, 0x6, '9P2000'}, 0x13) dup2(r0, r2) tkill(r1, 0x14) 14:48:34 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x2005, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xffffffff, 0x204000) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000280)={0x7}, 0x1) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:48:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x2ee4, 0x8000) getsockopt$netlink(r3, 0x10e, 0xa, &(0x7f00000000c0)=""/163, &(0x7f0000000180)=0xa3) 14:48:34 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000000), 0x0) mq_notify(r0, &(0x7f0000000180)={0x0, 0x41, 0x4, @thr={&(0x7f0000000000)="e6c94a5c4d2c90080de85f1ecdbf8c0e28fcf2d8d2be5399dc519cd5d16e518e1f022dadba47d1baf2a3f9cddce9b9dd07e5a788db35968831106c0814c8524a945d442eaa4c83c8f5fab658339a9652812f99ee1f2fe0b403419ee16e7ca68edcb348bd9161303569d49a8fb963aacc82ad6379515e5ec30a9d3bf1f50d4520c1d0a3505de58c8d0295f07caf0362a3cdcec02bd2ba0596eb4e65eb32b64fc9c0be9de7777109cd40fbb994ae8ebcc790e6afeb7ea768c40834b7a78fec7641239da3216306e2dfb58cf9ce736d55b1386a3fc891d430", &(0x7f0000000280)="480faffe01f2ac6c257bb5fe883a8ffb431aefde09804d8459515d69ee41a852d5d7e24440af635b170d7b1ec74c94d4ed16b60f1a4e50c9a92ad39c957ffe5bdd959c05b18c973b94732fb10b8625792bf0341214423ec30e718f5d9996e9fa3bfdc4e66d75d38527eaa650ae6e52e5de948a0df6de551a782b79f14b6fc2ba214982f78c8ffffc4429fa37644acfc3346a519da2632e4c80567f404c157cd6b88920fdc99b0ad14d04865f0ae35a1e9c6cbe0525f9c12a6625e6e138ba29e3db69d06292d5ce4749c455be530142f84a42200da7e99c1924106d816536fcdf657341be2ba624ffee2a5ce72ae7687a2f8572dbe70d4ba18d6c20f34546fba4393ba92d0ecd52827b9e8b127212484254aad37d3bb7de9b515f90e0245711623ee36b6998c42817ea71835af4cc05b8469e2126c4ef13f7d882393711a0ad0472fb26e05a336fe0366a4a3dc400c44ee2dbdcf45a915824a432a16ceca217bd0ccf382bb1c1e980a962e21b5023dcc826bfaa2697b94065b97568756a5af3c775349159e4dda7a076c65709fa595821d9ef090f05b58bf1d416e74dd1419b6b9806d8a32cc1655cf93a9d51fb3fb975a49572d9dbd080b15a293a1ce83cf3c627b1341050b9570658107169a92db5e03b0f0367b51405673668f335725643e1d9b9bec79b839ce5d6b5719eb7ce0a966f1ed7eb8bae5488784089bbaa3484a36b2493b7fca9ddeef1ea51ad8047dcec21e83e0bd1db9b12ad4e5990a85e61ad2e86602246fb757c83c9d19aae6553caf6ec72283029aad7026919ec1ffc00bc60d58a9868e78cb6183b881b16c72ca7d2e5697c92939daea8c73f7b4623a60d5d92dadee606fe7e9f5a3029a67c9d5bd7fbad41acfe4542d107cbd05df875b19f0903ebd5fa14577335932fc1fe2ee1de2c43aba835a651ca4962ed89f8b436b775f5ba9c9df0206504c8f3d4f6bac75bcc19ede56a8573cd899837e7e439f572687be04fae56a89b007ae88a3a22d25ab1be2beea5d3d032d202bdd96be7d72abe0690f6b410499130a0577f4219784b2b56612acad01d3b56f6beb433a5c3208f1ba087957fa18cfe9f949e04532110292ab9b1bdd34414d8cb8a67a92bb856f14bd1e1a023e4d7020cad92ea56abf04e93070be314998df14a36d0aa44b83e37ab9ecf552899025f5043d387773042d2b072a6b4881922392ece62126c66e27b137849e415194d33dab18e8f66fab7300f1595c4a250de2f3a5580b8dedb3e43654605d41630b35561bf9d63b1bc50c130c8dae9f2ecdaad6ca5d06f02a1dc050c9ede1715dcbc148727ed4d479612936a504cf4c195520670b596ecb3c79694f8caafceea2ed6b0a5e85bc4ac60b41d8f13998f140f1d0375e4427e019706ec0aa2089646499689dbfd16318dc1c633cd0c4682a6e560797e71991badb17e24ce82239026ca57d9a7f1fe6da94a589369f7710847dacac71b87d192cb7ad2453a7a7208c42c54864275b71d8966c8595900e5e707594dca387f03d5cb3065af162f8ba8c8eb4fff8f0205db41b4d61522374c23dda0da8b1afb78582ae354d689ac1b84a37a0474e6af163fff8d4e2087e553e4f7c367a6c4820fef3d9481175356100b412619afcae8bad482d4c8b16c956fb0ac1999cc4180bc9d1f1191db5a99af679f0a2862c9836cfc16d58746819f317bc5bda4fb90cd4b945ba429ec7250574a7360ef822f163133478bc244d5a4c9f511bc36a18102e1d1764c69b708650eade68844b13337e2715fe0c44a97b2d8afe71093f97665f6cb674437bcee69a936a20be9286d536853e3097e9811b4eda804f453f0118fd538621cb3d473b8a6c7b1e3da44afa6c1f364262c9070282046d8f6fe57441be09ff4b325ceea50b5f6309989ee22b8c11d4d165bbb1140f95bc6044246bd4336ab9f6143f2b6aaccccc46a9f7920b900cb793b0d7f8f3b6aeec8b753d0fe4e5841f7557f9af2698577c9cec67453566c659b2ee2151f5e3925a5ce1764e69b93ff8cc00c744f3bea9749ae78ea10150833ce62e3424d014d3880c24457302b95d863f8519abeca84479512f17eac1e5db18e12d538010715fa9a51902ad7b0ce0f0f86cf278bdb79df25c51198611e65928dc60e9a80e34e009ac135b05604a6e4133ce5d0e876caed8ba3251a2064b33d6279d8a10c3b5e6acbf4115ade033f1c1b7a9d7662c083d7d7daa4f8d86c538298173942e70c47bad7cee75028f225c38b6a12373379be66906f7fda545b4c6d60bbe7f2db30d25bdb91120860bbd36ecfcc3a2a3e34d11f261edeea38bcb0e0f5f8f4ade927b214a68f31ba01f14bcc464c8047f901432e1a1d3e9545b66be2a8bfafd89bd8508dd01799fef3572c389600ddf944aa070110f4cda666ec76d5b362d62eab9c5fc838233a93e6886d321722386def6985f0b385372b06476b9566b119d98012af7b0bfdb9b501bb0e9a451029288e12125620b4015a13928451e4d8373bbdfa8b25f8bf9252191dbc85a41ea269332f4aee0bc323ff33c201bdba9a8366701af28fab309eb5e86bf80ee28b664af16386d2cbbb7741710f3686a8ddbf721b2bb694930d7b25fbba3dc9cf02cf42a7f6ba2e421b801a870b6485a34fb5aae90b28a6762368f63f4b26b4b29877d65c85677467c5b9805bc80fb7774d644cdf2bddd513790eef790ef413fca8cc67658fee63f781d3e161c3e4aff272ddf16f19471c24197482b026555f96cd8e9a2950ce81265a05bcb6b574794ff2bcef3a3d06cd05523b8bea9d971636f7558cd977682433d79d5a4ce653e76e24a1c7a859584da8065536795f8862ebe54c0c420589784ad1710d0c6e21a9c828254987c837b8243718e7f6a6911012f04c8677a892d5d471aaa26721518ae88761ef6a8068cbb04f1a542ac99b64b50b354231f46287a29caf4bd4451d8720b7c46752075d20245ce54ef23f1f460c77054a4e940adb59a5a5dd44614ccb90dd9c4f26f6f654ef78ccd61f2ef077c189209d20b4f9b44a9c3e895bf288882e8a398411baef3269791f97839ae42a3115c3c60d6203b4afb872e65ccd908c2b36ebb474ad4ac632ded1fcd486866f1a05aa116a2e80d88ba4f3c9ddfd94b61a7dbf69cbfcacaa12396266788a244445891cfa230b5d2dece43c73479b7d8d0e2ba43fb38b8c0fb364929e4c98b29a34ee6b9bc9ec88736ae69b9bece44130229abee7e493935a90e3cf656438a6b7aaa62169f38eca48adf2de7ed46d7b4473e91ff722d671caf80f05902ad55469ad20f55059ef701b50e87a219b955f0116cfe4b554e06f6d845b52b006e2df62974adf527a645d7ed525b7f8e07691041e44b3c344daba039bebf7befb01e7f0e93247d07e70e401181377ff9920ebaa1245ef90b71243a4e4e95126f554006a1394d42be8978cbbede0bb90a7b9218c08f188def2c3f797c22bde6ea19a975f8ffa7993aa2edc8de1b2f95908380b2abecfaf941d92d5f7fcf49b321403b2464e92531cef32701370ccb9bd2e88419c91aad6fc2600e170a6fad3b6813baf7936db930acfa2ef83908746f3623047a50d11dfdbb51108ac8cdf684cc14144d7fdb034e737b314bab496a0861ad9b2f5a966955ba6fa5cd09be87dc81b6b83b23bc975f86f8bfaa4a2966a51777ebcc28d4fe89eaab13d1821a61ef48024f84ae662db26bbde58ba3ef5685f1f288ba78abc93661bb11d82b5ed0dad9f7287a4f46acb2b6bd6af8f74458e5fdf4d8bcf784b22b150e73b95513267a2c93484a1b548872084199ae5419434256c12dc2121d7fc263246b8b117d32fadd0c7002e040e3bd673fd9e503c680922cfed65283d2c499f89a183cb06ad881887f8b0cdb4de6dcf4816461f933a7df7259c8be0d0881765d7de64da8d90643d5813b373b15471e35e29b5902919e12f8412c8dab0219007b71968216161841a7ae9a062aab722490a35e994517fa8464955f75f55bd1affe3e35e27f316fc18103f1df87fc661b867042748b4d75bc56499f992dde0082984fb9aae093534b6e92a18f0b1f9eab18a3324a8ffbc420ad8c1551be4a549c0ba4e38e99d0e5bcd98c5df354eac2687f5e5faca74946be11a1bb6fb8d1461ed01dca1a79e7ad5b83434b639f06e9c7ba1c1028c7dcc54033828359a7099fddb00f4871e4194453b074c74746b012a768b90c48dd6cecc0f2362cb1e72b7d180b02d003a3c33260424b6de4e5a84fcc80f6ea39bde7dad223873a2c212a36f24e28bbb2b08e561734b26079f75a5b4fffc649a52ba48210bf6799fbb65393363a655c178bc078782c91c7158d429b53a3693a74ad45abb8c5285145f325a4b40dcdf2ce588ecb2bd49fb9c46f1a9d9093254f7cef3add32ba052dbaea255c288b94875ce43878edd0013132f6d71ead7cc737e2b354f2997e731cf260290d4a0c292e0b1876709044b1c9952cb198c8173cf08ed7f3e9476a74abb899ce308cd8152b595b2f25d874d9ecef2c4020dd079fc80443d09cb4d36f0f64388d80c472ddfda24339bc0d42831721cfc4cc0b9ba59aec514aaf3646393f3ff30fe674528a8127a7ae37c6c82ab06c0883de23c575fbd757fca920651b086579a7d364daf4b04f4ce46207756bc15580a9ac4f33e7c71fcbf3c0acd852748297671cbe745b515b126e9f5f2d2f6a7a3c9a10fa66045a6fde0c52a57702f44af841ec83fdcb95fadf85d7242840352c83e9f29935722febf1f06e4d85ad5dc6ccf090fb1e8972f845e57ea2c3e53c68c03133921b26fd99ee824b713efc9edc351fd78a2f13595e08db969a38088947add25dadfd5ab27313130ad5259437cef10e6197064d1f6fc037b56a5b5c4433a50fe9b6fd1a99a696d0eb8c1204630acd3cd2c91cc14aa897972c0b5774fe1a73c7389967a5287dae175a599967d4c57c1460c7b08f3434cd36f788b2943c942ab57855c2b2272870fe6c5968738a694d4ea2be419f9075bef5583c73a07e976c636f9d80fb2d881c1224a58a08c5686f20876c5e8c69bb39004771219fa9bb32aa1e757770a42eb80f2f919549e151a5b9b22c0d4617fe33107ca4e0e4f7e9f3481e7d8ad7f553e2aa67fabb627c6656badc40c1f124d06a481792fff6174511283080b1583e9e9cd7f63e1a5dd0f2cc63777e07773e895a570a7812f6121c2ed0638ae36997f693a4846bc2894e8c6d42965b6be0291af1ee3edf74ef6896e99eaf04cc55c9fe9aad7a7f7f89073e590138655b84678def1fbebb9d534769d1dbea5f8054b3fe0d9a209a8e74776e33811134c295a030f41ea79f1b630cf18714ec7804a11e0c28a67e61fd6e4cc6525b32407aee0b8257a6c6e1234562b6a96e1bba5e09a3d4565bba2bab8314b724fd27d26b7ead60b1d81f6728912a853d2b3c2301f968baf5d8468daa50df9ccb291e610008a84bdcffd5e7bc45b5e9e573ed8791f91d7ffaec30e1bfe94a7181d6bcf9724b17423854b1dd567cb80d0ff30a10389900f0c43af4fff57478aebc2dd6a4ec12a350fd3c27136d84d81d9cdd5ded8261e70c85bcfc718b07410a6e0b5451468964678c6ad8bcbbf7b5c2665febcbcd8bcc2b0b602bc48cd2b625877a89bd9e3f4e1fe419503e54abe1d77f9ca3538c591e46003a90fdb82c2f7c79b9660962d9a2bcc9a42458a317bc2540912f0e9f7508c343fef3cd334321fe0fe8bbf2c51400de43ee10d9be3191f1d64c123f5b1494a2533322e8f586502fe37c37387b98b24b6b726711a0999d888e6d9"}}) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f00000001c0)={@multicast2, @remote, 0x0}, &(0x7f0000000200)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000001280)={'vcan0\x00', r1}) 14:48:34 executing program 4: 14:48:34 executing program 3: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x3, 0x2) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f00000000c0)=ANY=[@ANYBLOB="09000000000000000400000000000000a9000000000000000000000000000000c065590f00000000cf71025b0000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000001000000000006000000000010001f011704000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000004000000000000110900010000000000000000000000000000000000000000000000000000000000000000000000002e3200000000000020000000000000001d22000000000000ff02028c000000000000000000000000000000000000000000000000000000000000000000000000"]) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000080)={r3, 0x0, 0x20200000001}) 14:48:34 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @mcast2, 0x24b}, {0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, r1}}, 0x48) 14:48:34 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x2005, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xffffffff, 0x204000) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000280)={0x7}, 0x1) close(r1) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) [ 1610.692170] binder: send failed reply for transaction 525 to 778:781 [ 1610.699327] binder: undelivered TRANSACTION_COMPLETE [ 1610.704663] binder: undelivered TRANSACTION_ERROR: 29189 14:48:34 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @mcast2, 0x4}, {0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, r1}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000000)={0x3, 0x17, 0xfa00, {{0x2, 0x0, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}}, {0x2, 0x0, 0x2f4, @local}, r1}}, 0x48) 14:48:34 executing program 4: 14:48:34 executing program 5: r0 = semget$private(0x0, 0x2, 0x460) semtimedop(r0, &(0x7f0000000000)=[{0x7, 0x1000, 0x800}, {0x0, 0x2, 0x1800}, {0x3, 0x3, 0x1000}, {0x7, 0x8c2a, 0x1800}, {0x7, 0xffffffff, 0x800}], 0x5, &(0x7f0000000040)) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x1000000000, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x24000, 0x0) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1f, 0x1ff, 0xffff, 0x778}, 0x10) r3 = eventfd(0xa5) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r3, 0x0, 0x20200000001}) 14:48:35 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x2005, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xffffffff, 0x204000) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000280)={0x7}, 0x1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:48:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) r4 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x5, 0x2) ioctl$TUNSETSTEERINGEBPF(r4, 0x800454e0, &(0x7f00000000c0)=r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 1611.122337] binder: send failed reply for transaction 529 to 846:847 [ 1611.129961] binder: undelivered TRANSACTION_COMPLETE [ 1611.135361] binder: undelivered TRANSACTION_ERROR: 29189 14:48:35 executing program 4: 14:48:35 executing program 2: 14:48:35 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x4, 0x1e, [], 0x0, &(0x7f00000000c0), &(0x7f0000000080)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000000)={r0, r0, 0x8, 0x3}, 0x10) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x577b, {{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, 0x88) 14:48:35 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x2005, 0x0) syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xffffffff, 0x204000) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:48:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x3ffffc, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x2, 0x20200000001}) 14:48:35 executing program 2: 14:48:35 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x1f5) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000100)="460f300f07c483614804ee08440f20c03506000000440f22c0c402f93473230f09f20f013cb9b805000000b9c00000000f01d90fc728c4c1f9e79f2e000000", 0x3f}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:48:35 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x4004, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) getsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000000), &(0x7f0000000080)=0x4) ioctl$KVM_GET_XCRS(r0, 0x8188aea6, &(0x7f00000000c0)={0x1, 0xfffffffffffffffb, [{0x3}]}) 14:48:35 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x144a) 14:48:35 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x2005, 0x0) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:48:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) r3 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x2, 0x2) ioctl$KDADDIO(r3, 0x4b34, 0x6) 14:48:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="11632a625cec0000"], 0x1, 0x0, &(0x7f0000000540)="fc"}) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x2, 0x0) openat(r3, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40) sendmmsg$alg(r3, &(0x7f0000000280)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000100)="5a9583af20beb90c4609ea34c6632029a3873d2f10a0d307464dfa08ae66b93e8fb361", 0x23}], 0x1, &(0x7f0000000180)=[@assoc={0x18, 0x117, 0x4, 0xfffffffffffffa24}], 0x18, 0x20000040}], 0x1, 0x20000000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:36 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc) getsockopt$packet_buf(r0, 0x107, 0x12, &(0x7f0000651000)=""/240, &(0x7f00000004c0)=0x1c7) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:36 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000800)='dctcp\x00', 0x7bddb19f035b91ae) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20008001, 0x0, 0x0) 14:48:36 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(r0, &(0x7f00000001c0)={0xf, 0x8}, 0x10) 14:48:36 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) close(0xffffffffffffffff) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0}]) [ 1612.141362] binder: send failed reply for transaction 533 to 870:871 14:48:36 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x40200, 0x0) [ 1612.191855] binder: undelivered TRANSACTION_COMPLETE [ 1612.197017] binder: undelivered TRANSACTION_ERROR: 29189 [ 1612.335826] binder: 919:926 unknown command 1646945041 [ 1612.341247] binder: 919:926 ioctl c0306201 20000380 returned -22 14:48:36 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x10, 0x800000000002, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000100)="1f000000190081ace4051cecff091ffa1c4f99a61cfe7084bce26a23480b0e", 0x1f}], 0x1}, 0x0) 14:48:36 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0xba7) 14:48:36 executing program 1: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x2005, 0x0) close(r0) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(0x0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) 14:48:36 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x2, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000080)=&(0x7f0000000040)) openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x10147e, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1612.530907] netlink: 3 bytes leftover after parsing attributes in process `syz-executor4'. [ 1612.663013] binder: release 919:926 transaction 537 out, still active [ 1612.669645] binder: unexpected work type, 4, not freed [ 1612.675137] binder: undelivered TRANSACTION_COMPLETE [ 1612.680349] binder: send failed reply for transaction 537, target dead 14:48:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x400000) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f0000000100)={0x5, &(0x7f00000000c0)=[{0x0, 0x8}, {0x100000000000, 0x3}, {0xff, 0x7fffffff}, {0x3, 0xffffffffffff7fff}, {0x5, 0x4}]}) 14:48:36 executing program 4: syz_execute_func(&(0x7f00000002c0)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd3196f") clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f00000001c0)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f00000002c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f0000000300)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x3102001ff2, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r2, 0xc0c0583b, 0x0) 14:48:36 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0xba7) 14:48:36 executing program 5: init_module(&(0x7f0000000000)='vboxnet0cpusetbdev\x00', 0x13, &(0x7f0000000040)='[cgroup\'\x00') r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x30e, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ftruncate(r0, 0xde) 14:48:37 executing program 1: io_setup(0x0, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x2005, 0x0) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:48:37 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200000000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) 14:48:37 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0xba7) 14:48:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x81, 0x7955451d7bd93461) ioctl$SNDRV_TIMER_IOCTL_GINFO(r2, 0xc0f85403, &(0x7f00000000c0)={{0x3, 0x0, 0xff, 0x0, 0x1}, 0x81, 0x5, 'id0\x00', 'timer0\x00', 0x0, 0x2, 0x1000, 0x5, 0x9}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f00000003c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0663044001000000c059502bda08f688996af0d31507d36f37a73f99503ab02488829d158b78ede16bdce5319d1823959a471c111bc07336cfa1f1a3146063cefd35ccf01ea8dc9d083979a8cc"], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 1613.166893] binder: send failed reply for transaction 541 to 953:954 [ 1613.174685] binder: undelivered TRANSACTION_COMPLETE [ 1613.180554] binder: undelivered TRANSACTION_ERROR: 29189 14:48:37 executing program 1: io_setup(0x3, 0x0) r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x2005, 0x0) close(r0) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(0x0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) 14:48:37 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x10000000000003ff) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x200, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(r3, 0x4010aeab, &(0x7f00000000c0)={0x7ff}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) [ 1613.726184] cgroup: fork rejected by pids controller in /syz4 14:48:37 executing program 5: bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', 0x0, 0x8}, 0x10) r0 = syz_open_dev$usb(&(0x7f00000002c0)='/dev/bus/usb/00#/00#\x00', 0x2, 0x2) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0xffffffffffffffff, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000280)=""/30}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(r0, 0x40086432, &(0x7f0000000240)=0x3) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x70, r2, 0x0, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0xc}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x3d}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xf3c7}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x4}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000890}, 0x0) 14:48:37 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, 0x0, 0x2005, 0x0) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:48:37 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0xba7) 14:48:38 executing program 4: syz_execute_func(&(0x7f00000002c0)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd3196f") clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) io_setup(0x143, &(0x7f00000003c0)=0x0) io_getevents(r2, 0x3, 0x3, &(0x7f0000000540)=[{}, {}, {}], 0x0) ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, 0x0) 14:48:38 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) 14:48:38 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1d0, 0xba7) 14:48:38 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x0, 0x0) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:48:38 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) setxattr$security_smack_transmute(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000180)='TRUE', 0x4, 0x1) ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[0x8, 0x6]}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000280)={'nat\x00', 0xfb, "c82e146ce6df901ff633a1f4971517258758186d10c4688e7dae2c7c6a2413cf8994aa5bd60f6e36124aa06572fbb5a3961664dbe63f0c6b1816bb51f5ed39cea5e489c9bbdd6a98a8a3966bdc3ffc15a2e3a1a44827d9cc30ff4739244d57791b0f7832ebaa3265cf305f9ae904009edbfaaec0e6484d74765a64913a583c173386937985c8a188f2f2182c0b62cc42ce9b727afa6d1b849dac3bf12c25d278d9410b7078201083dedf9779586c40ca8c48855bf1ce34a3d45dd0bc6285ee9ec8b929f3636c8ecb8790830accfc02204a8d52a4be5541611b3eaa2f2ea4bd96033cd5fb3fcaecd8e2c91d3cf5100484941b7e2326e992d73950f7"}, &(0x7f00000001c0)=0x11f) 14:48:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) syz_open_dev$media(&(0x7f00000000c0)='/dev/media#\x00', 0x3, 0x2000) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x60c000, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001700)={'bcsh0\x00', 0x0}) r6 = syz_open_dev$amidi(&(0x7f0000001740)='/dev/amidi#\x00', 0xfff, 0x80) bind$xdp(r4, &(0x7f0000001780)={0x2c, 0x4, r5, 0x29, r6}, 0x10) [ 1614.475649] binder: send failed reply for transaction 545 to 981:982 [ 1614.483006] binder: undelivered TRANSACTION_COMPLETE [ 1614.488272] binder: undelivered TRANSACTION_ERROR: 29189 14:48:38 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f0000000000)={0x7, 0x3, {0xffffffffffffffff, 0x3, 0x4c9, 0x3, 0x5}}) 14:48:38 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0xba7) [ 1614.679873] binder: 1048:1049 ioctl c0306201 20000380 returned -11 14:48:38 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) io_setup(0x3f, &(0x7f0000000000)=0x0) io_getevents(r2, 0x3, 0x1, &(0x7f00000000c0)=[{}], 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r3, 0x0, 0x20200000001}) [ 1614.835881] binder_alloc: binder_alloc_mmap_handler: 1048 20001000-20004000 already mapped failed -16 14:48:39 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x0, 0x0) close(0xffffffffffffffff) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) [ 1615.011802] binder: BINDER_SET_CONTEXT_MGR already set [ 1615.017231] binder: 1048:1049 ioctl 40046207 0 returned -16 14:48:39 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) [ 1615.066769] binder_alloc: 1048: binder_alloc_buf, no vma [ 1615.072808] binder: 1048:1053 transaction failed 29189/-3, size 24-8 line 2973 [ 1615.113881] binder: 1048:1066 Release 1 refcount change on invalid ref 1 ret -22 14:48:39 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0xba7) [ 1615.236875] binder: release 1048:1049 transaction 549 out, still active [ 1615.243791] binder: undelivered TRANSACTION_COMPLETE [ 1615.252580] binder: undelivered TRANSACTION_ERROR: 29189 [ 1615.258191] binder: send failed reply for transaction 549, target dead 14:48:39 executing program 4: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x10000000000109) dup2(r0, r1) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file1\x00', 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r2) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) 14:48:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x800, 0x0) write$tun(r1, &(0x7f00000000c0)={@val={0x0, 0x6005}, @val={0x3, 0x0, 0x9, 0x0, 0x81, 0x6}, @mpls={[{0xce1, 0x400, 0x1f, 0x1}, {0xffffffffffffb1cb, 0x8000, 0x80000001, 0x5}, {0x0, 0x8000, 0x800, 0x100000000}, {0x8001, 0x75ae639f, 0x3e7, 0x5}, {0x8, 0xd93, 0x80000001, 0x400}, {0x7, 0x8, 0x4, 0x7}, {0x401, 0xffffffffffffff00, 0xb4, 0x3}, {0x1, 0x8, 0x200, 0x2}], @generic="eca2b600ed54ca8497bc68f15c3a0d2ac7a5314c29c97b20720f242398328bbcc0886e254414c12d30ce3a5265f350b380be40d1c0b069aa7e276023f9693421080fd591c101a4e280387064ba23e743bfc72852dae627baa22f74bba7a8b9ba"}}, 0x8e) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x9, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_GET_XCRS(r1, 0x8188aea6, &(0x7f00000003c0)={0xa, 0x5, [{0x1, 0x0, 0x1ff}, {0x9, 0x0, 0x1}, {0x100000000, 0x0, 0xed24}, {0x1, 0x0, 0x3f}, {0x4, 0x0, 0x76}, {0x100000000, 0x0, 0x2}, {0x101, 0x0, 0x6}, {0x6, 0x0, 0x8}, {0x7, 0x0, 0xdce}, {0x1, 0x0, 0xb8}]}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:48:39 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x0, 0x0) close(r1) socket$inet_sctp(0x2, 0x0, 0x84) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 14:48:39 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x420000, 0x0) ioctl$PPPIOCSMRU(r2, 0x40047452, &(0x7f00000000c0)=0x5) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = eventfd(0x40000000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r3, 0x0, 0x20200000001}) 14:48:39 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0xba7) 14:48:40 executing program 5: openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:40 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000000)=""/11, 0x8) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFBR(r1, 0x8940, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$sock_TIOCINQ(r2, 0x541b, 0x0) 14:48:40 executing program 1: io_setup(0x3, &(0x7f0000000240)) r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x0, 0x0) close(r0) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(0x0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) 14:48:40 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f00000001c0)) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001}) 14:48:40 executing program 2: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0xba7) 14:48:40 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000000)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) 14:48:40 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x0, 0x0) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x0, 0x0) [ 1616.493792] binder_alloc: binder_alloc_mmap_handler: 1079 20001000-20004000 already mapped failed -16 [ 1616.535202] binder: BINDER_SET_CONTEXT_MGR already set [ 1616.540635] binder: 1079:1090 ioctl 40046207 0 returned -16 [ 1616.571334] binder_alloc: 1079: binder_alloc_buf, no vma [ 1616.577264] binder: 1079:1128 transaction failed 29189/-3, size 24-8 line 2973 14:48:40 executing program 4: syz_execute_func(&(0x7f00000001c0)="3666440f50f564ff0941c3c401f82ebd92823dcfc4c27d794e00f246160041d25688766d00006636f044ff0fc4225db621") clone(0x3102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000500)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/11, 0x485) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xc000, 0x0) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x7e807659, 0x6, 0x9, 0x2}, {0x10000, 0x2b, 0x101}, {0x6, 0xfff, 0x1, 0x8001}]}) creat(&(0x7f0000000180)='./file1\x00', 0x1) r2 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r2) execve(&(0x7f0000000480)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) r3 = open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) write$P9_RFSYNC(r3, &(0x7f0000000380)={0x7}, 0x7) [ 1616.665940] binder: 1079:1090 Release 1 refcount change on invalid ref 1 ret -22 [ 1616.701060] binder: release 1079:1082 transaction 554 out, still active [ 1616.708057] binder: undelivered TRANSACTION_COMPLETE [ 1616.733798] binder: undelivered TRANSACTION_ERROR: 29189 [ 1616.739450] binder: send failed reply for transaction 554, target dead 14:48:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x804) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000004000000000000000000000001800000000000000080000ecffffff00", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="0000000000000000200414afbb5492d78b336a1a540931d71be11354b444eae7f628a821381f020e2321d19530488ea3ae93935029ef52fcfd69ae1d1589a84dbadfcc96e8235adf383f3b6209925eeed4a2639792deaf97e594f70557e7fcc40349c7fa4a896aee902892358a737ed03a86b4a70d233a22f298a8653df8a6627149f793787397b2ee952e6ec137cb897363ae4c0fd64d0242581dd1d76b2f8a925f5e8180d2223bf83c3a3895d0b8bd3f638a8a358703bf7b00000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:41 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000ff02"]) 14:48:41 executing program 2: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0xba7) 14:48:41 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) move_pages(0x0, 0x0, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000000040), 0x2) 14:48:41 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x0, 0x0) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x0, 0x0) [ 1617.118820] binder_alloc: 1155: binder_alloc_buf size 72057593702383648 failed, no address space [ 1617.128109] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1617.137274] binder: 1155:1156 transaction failed 29201/-28, size 24-72057593702383624 line 2973 [ 1617.155163] binder: 1155:1156 Release 1 refcount change on invalid ref 1 ret -22 [ 1617.163157] binder: 1155:1156 ioctl c0306201 20000380 returned -11 14:48:41 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000000)) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000040)={0x4, [0x0, 0x0, 0x0, 0x0]}) 14:48:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fstatfs(r0, &(0x7f00000000c0)=""/253) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="852a627300000000332f1422f291785034cf24171c78c519276c3bfdb97489904ff4082f979188c8be95894c159450a0cc66de633456144bd8390d57d9a8b88dfe21a4c8b0d95b388276191c771edcbd423821dad877a054040e676fa13347547d9f819389f2bb2149641e9e3e4de2bef201a80119b6ff142d79bdc6a82b4833baee2512786c52fcb3c559b7614056d681dee1cbac534bc371970627b2c96b21104880b292e3af5ece0453eac34f5abc9506696ee75bde2652b27da5441d2853179fc768b744ca36e4756b1e39a6d00825822f176cc257c6a88446a893d738342f88e1e779c1787bb31354394826255090fa7cf9b7d53c77bdadb5dd3a938926ef55c33173b352f46af0222af811a99c42df431ad789de4ee4b538d83f66465f34218f413edadb907ad19d58ab7ce9e997d4c2fdc1befde70bb28f41a61ccf8fefebaabcadab51ae257451e185175c2e4271c8a70fdc03036c891575c1bf1c058773b5e303a910760dc6f40c102b7a3b3a8052a19703dd", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 1617.215339] binder: undelivered TRANSACTION_ERROR: 29201 14:48:41 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x8e4229080ab25cb6, 0x0) ioctl$BLKTRACESTOP(r2, 0x1275, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f00000000c0)=0x6, 0x4) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r3, 0x0, 0x4000000009}) 14:48:41 executing program 2: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0xba7) 14:48:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000180)="0a5c1f023c126285719070") r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r1, 0x5) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f000051c000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560284470080ffe00600000000000000a2bc56038a00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e000000001e0000", 0x48}], 0x1) 14:48:41 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x0, 0x0) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x0, 0x0) [ 1617.398791] binder: 1166:1168 unknown command 0 [ 1617.403663] binder: 1166:1168 ioctl c0306201 20000380 returned -22 14:48:41 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003140), 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0xba7) 14:48:41 executing program 5: r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000080)) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0x0, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001940)='/dev/autofs\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f00000000c0)={0x7, 0x0, 0x1, 0x8}) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000180)={r2, 0x1}) move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0) r3 = getpgrp(0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f0000000280)={{0x2, 0x5, 0x4, 0x0, '\x00', 0x4}, 0x3, 0x3, 0x0, r3, 0x3, 0x1, 'syz1\x00', &(0x7f00000001c0)=['$\x00', 'GPL\x00', '/dev/swradio#\x00'], 0x14, [], [0xf9, 0x2, 0x7fffffff, 0x10000]}) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f00000003c0)={0x2, 0x6b, "acaa46c07961c4f4e816cfdc6481d813e60100f1e55e3141c12b6b8ef2a21c58d4904c81162e51885466b3520de9cb82ce98005eb4cda2c74c427b63e6b216b35a4301116cd11c2b43c0cb42106d018429007de72d6c9d6038549bd77656ec1b047faecf67c2eb5947fcfd"}) syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x0, 0x0) 14:48:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:48:41 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x0, 0x0) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x0, &(0x7f0000000b00)) [ 1617.752944] binder: send failed reply for transaction 561 to 1166:1168 [ 1617.760436] binder: undelivered TRANSACTION_COMPLETE [ 1617.765886] binder: undelivered TRANSACTION_ERROR: 29189 14:48:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000180)="0a5c1f023c126285719070") r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r1, 0x5) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f000051c000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560284470080ffe00600000000000000a2bc56038a00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e000000001e0000", 0x48}], 0x1) 14:48:42 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x440, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x5, 0x4000) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0xc03}, &(0x7f0000000100)=0x8) r4 = shmget$private(0x0, 0x2000, 0x400, &(0x7f0000ffd000/0x2000)=nil) fstat(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x4, &(0x7f00000002c0)=[0xffffffffffffffff, 0x0, 0xee01, 0xee01]) r7 = getuid() getgroups(0x4, &(0x7f0000000300)=[0xee01, 0xffffffffffffffff, 0xee01, 0xffffffffffffffff]) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000340)={0x0}, &(0x7f0000000380)=0xc) r10 = fcntl$getown(r0, 0x9) shmctl$IPC_SET(r4, 0x1, &(0x7f00000003c0)={{0xe6f7, r5, r6, r7, r8, 0x150, 0x80000000}, 0x4b, 0x6, 0x3f8000, 0x6d6436ba, r9, r10, 0x9aea}) shmget$private(0x0, 0x4000, 0x10, &(0x7f0000ffc000/0x4000)=nil) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000140)={r3, @in6={{0xa, 0x4e24, 0x7ff, @local, 0x80000001}}}, &(0x7f0000000200)=0x84) r11 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r11, 0x0, 0x20200000001}) [ 1617.939282] binder: 1187:1191 got transaction to context manager from process owning it [ 1617.947682] binder: 1187:1191 transaction failed 29201/-22, size 24-8 line 2825 14:48:42 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003140), 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0xba7) 14:48:42 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0x0, 0x0) close(r1) socket$inet_sctp(0x2, 0x1, 0x84) io_submit(r0, 0x0, &(0x7f0000000b00)) 14:48:42 executing program 5: getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x0, 0x1e, [], 0xfffffffffffffc4, &(0x7f0000001680), &(0x7f0000000240)=""/30}, 0x0) r0 = shmget(0x3, 0x2000, 0xd00, &(0x7f0000ffe000/0x2000)=nil) shmctl$IPC_INFO(r0, 0x3, &(0x7f0000000000)=""/58) move_pages(0x0, 0x0, &(0x7f00000001c0), &(0x7f000026bfec), &(0x7f0000002000), 0x0) r1 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x7, 0x80080) syncfs(r1) ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0) write$P9_RRENAMEAT(r1, &(0x7f0000000180)={0x7, 0x4b, 0x1}, 0x7) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x10000, 0x0) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r2, 0x800442d4, &(0x7f0000000080)=0x3) sendto$unix(r1, &(0x7f00000001c0)="87fdfe4c443a58263a6c0d013afb9041b8fa8155c2ec7c1cda314e1e38cdcb872ace6da90c39fd45df593968412e5d5e43a6821d124e42db6c67f58c2726f65309bb399680c1a5acc65aefb798db83e6d9225e49c92c7579b3278417db9102b37246f4aa57f2a088f3fb459db9501b400b79f8792b6284b8f6a527f8", 0x7c, 0x40, 0x0, 0x0) 14:48:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = shmget$private(0x0, 0x4000, 0x16, &(0x7f0000001000/0x4000)=nil) shmctl$IPC_STAT(r2, 0x2, &(0x7f00000003c0)=""/70) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000003f67b2bd0630f0fbec55aa6346a5a4ed4ddd2b5fa522b0152794bf4fe7b7f18b0e2c86ecec36dc374b25ccf9d6d4e5d50258c482bc54be523247822a39eac4cd8403e009eca6f8c6c1f3bb0613b076ebc34466f4dac422a96861000000ac66937f9651fb1cbf05607963d1022314f7bccdfc662bb2e156fd60b2bd5e63aa9f"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x61e, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f00000002c0)=[@exit_looper], 0x1, 0x0, &(0x7f0000000540)="fc"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:48:42 executing program 4: r0 = socket$packet(0x11, 0x4000000002, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmmsg(r0, &(0x7f0000003080)=[{{&(0x7f00000000c0)=@ll={0x11, 0x8100, r1, 0x1, 0x0, 0x6, @local}, 0x80, 0x0}}], 0x1, 0x0) [ 1618.242450] binder: undelivered TRANSACTION_ERROR: 29201 14:48:42 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) fremovexattr(r0, &(0x7f0000000000)=@random={'security.', '/dev/kvm\x00'}) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x0, 0x20200000001, r2}) [ 1618.487718] ================================================================== [ 1618.491571] BUG: KMSAN: uninit-value in batadv_interface_tx+0x908/0x1e40 [ 1618.491571] CPU: 1 PID: 1219 Comm: syz-executor4 Not tainted 4.20.0-rc7+ #15 [ 1618.491571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1618.491571] Call Trace: [ 1618.491571] dump_stack+0x173/0x1d0 [ 1618.491571] kmsan_report+0x12e/0x2a0 [ 1618.491571] __msan_warning+0x82/0xf0 [ 1618.491571] batadv_interface_tx+0x908/0x1e40 [ 1618.491571] ? batadv_softif_is_valid+0xb0/0xb0 [ 1618.491571] dev_hard_start_xmit+0x607/0xc40 [ 1618.491571] __dev_queue_xmit+0x2e42/0x3bc0 [ 1618.491571] dev_queue_xmit+0x4b/0x60 [ 1618.491571] ? __netdev_pick_tx+0x1270/0x1270 [ 1618.491571] packet_sendmsg+0x8306/0x8f30 [ 1618.491571] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1618.491571] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 1618.491571] ? rw_copy_check_uvector+0x149/0x6a0 [ 1618.491571] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1618.491571] ___sys_sendmsg+0xdb9/0x11b0 [ 1618.491571] ? do_futex+0x350/0x68a0 [ 1618.491571] ? compat_packet_setsockopt+0x360/0x360 [ 1618.491571] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 1618.491571] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 1618.491571] ? __fget_light+0x6e1/0x750 [ 1618.491571] __sys_sendmmsg+0x570/0xa60 [ 1618.491571] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 1618.491571] ? prepare_exit_to_usermode+0x114/0x420 [ 1618.491571] ? syscall_return_slowpath+0x50/0x650 [ 1618.491571] __se_sys_sendmmsg+0xbd/0xe0 [ 1618.491571] __x64_sys_sendmmsg+0x56/0x70 [ 1618.491571] do_syscall_64+0xbc/0xf0 [ 1618.491571] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1618.491571] RIP: 0033:0x4579b9 [ 1618.491571] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1618.491571] RSP: 002b:00007ff8c6ca5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1618.491571] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004579b9 [ 1618.491571] RDX: 0000000000000001 RSI: 0000000020003080 RDI: 0000000000000003 [ 1618.491571] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1618.491571] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff8c6ca66d4 [ 1618.491571] R13: 00000000004c4727 R14: 00000000004d7d28 R15: 00000000ffffffff [ 1618.491571] [ 1618.491571] Uninit was created at: [ 1618.491571] kmsan_internal_poison_shadow+0x92/0x150 [ 1618.491571] kmsan_kmalloc+0xa6/0x130 [ 1618.491571] kmsan_slab_alloc+0xe/0x10 [ 1618.491571] __kmalloc_node_track_caller+0xe38/0x1060 [ 1618.491571] __alloc_skb+0x309/0xa20 [ 1618.491571] alloc_skb_with_frags+0x1c7/0xaf0 [ 1618.491571] sock_alloc_send_pskb+0xafd/0x10e0 [ 1618.491571] packet_sendmsg+0x661a/0x8f30 [ 1618.491571] ___sys_sendmsg+0xdb9/0x11b0 [ 1618.491571] __sys_sendmmsg+0x570/0xa60 [ 1618.491571] __se_sys_sendmmsg+0xbd/0xe0 [ 1618.491571] __x64_sys_sendmmsg+0x56/0x70 [ 1618.491571] do_syscall_64+0xbc/0xf0 [ 1618.491571] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1618.491571] ================================================================== [ 1618.491571] Disabling lock debugging due to kernel taint [ 1618.491571] Kernel panic - not syncing: panic_on_warn set ... [ 1618.491571] CPU: 1 PID: 1219 Comm: syz-executor4 Tainted: G B 4.20.0-rc7+ #15 [ 1618.491571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1618.491571] Call Trace: [ 1618.491571] dump_stack+0x173/0x1d0 [ 1618.491571] panic+0x3ce/0x961 [ 1618.491571] kmsan_report+0x293/0x2a0 [ 1618.491571] __msan_warning+0x82/0xf0 [ 1618.491571] batadv_interface_tx+0x908/0x1e40 [ 1618.491571] ? batadv_softif_is_valid+0xb0/0xb0 [ 1618.491571] dev_hard_start_xmit+0x607/0xc40 [ 1618.491571] __dev_queue_xmit+0x2e42/0x3bc0 [ 1618.491571] dev_queue_xmit+0x4b/0x60 [ 1618.491571] ? __netdev_pick_tx+0x1270/0x1270 [ 1618.491571] packet_sendmsg+0x8306/0x8f30 [ 1618.491571] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1618.491571] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 1618.491571] ? rw_copy_check_uvector+0x149/0x6a0 [ 1618.491571] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 1618.491571] ___sys_sendmsg+0xdb9/0x11b0 [ 1618.491571] ? do_futex+0x350/0x68a0 [ 1618.491571] ? compat_packet_setsockopt+0x360/0x360 [ 1618.491571] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 1618.491571] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 1618.491571] ? __fget_light+0x6e1/0x750 [ 1618.491571] __sys_sendmmsg+0x570/0xa60 [ 1618.491571] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 1618.491571] ? prepare_exit_to_usermode+0x114/0x420 [ 1618.491571] ? syscall_return_slowpath+0x50/0x650 [ 1618.491571] __se_sys_sendmmsg+0xbd/0xe0 [ 1618.491571] __x64_sys_sendmmsg+0x56/0x70 [ 1618.491571] do_syscall_64+0xbc/0xf0 [ 1618.491571] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 1618.491571] RIP: 0033:0x4579b9 [ 1618.491571] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1618.491571] RSP: 002b:00007ff8c6ca5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1618.491571] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004579b9 [ 1618.491571] RDX: 0000000000000001 RSI: 0000000020003080 RDI: 0000000000000003 [ 1618.491571] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1618.491571] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff8c6ca66d4 [ 1618.491571] R13: 00000000004c4727 R14: 00000000004d7d28 R15: 00000000ffffffff [ 1618.491571] Kernel Offset: disabled [ 1618.491571] Rebooting in 86400 seconds..