r2, r1, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:44 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x0, 0x0, 0x0) 17:19:44 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x8]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:44 executing program 4: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000000040)='#\x00', 0x0) socket$inet6(0xa, 0xb, 0x6) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="9287b748246deeca588edacd5c96d72d9ff1ffcd245d4623bea592fa911a59141ad79770daa350bbd501b4cb95cf19700700030000000000625d08ef137426f4997e282f68591512c4636d34e1d3cc668e8b4f8843a84855908985cc2773f295290a92d6f061f3d87a22968a81d80da9a6c39f5c7aa09f49456049763d7bb11d1171be83d26f047ce47c565dbf107ab9605a473e04c7e779a0c244ca4388df158abbd2eb44b5519597b5dcd531eaf5b40fa5efa57134ba3a90cf3bcabc96ca007cd5feb4cd554479fe35b888d8bb8ff332dbe807f0278d6399ce4ae86d94dd3899e0a88497279de14711c957b07708c2b8031630481ad1a0880ed2001ded067a6abdc60892ed7457b5fd6d537538e77ea5ff56b6ba67075a449ff84f786e598a221dd8c71045d8afc7642cddb781e732a2e64ede6a077b41ebe33a8903474da4c44514e27ac011237bbed9c4c34dc93889dd21362df3c761db3bae1c5f0f75aac48fc04b897639deefc777f81211acf569827a8e7d88b1b5e4687393700f39a24046557e1e8ce64b02424a3f0d7ce3a64e74cd36ab4b9747b0692889ef04e9a511014b61402662fd9ad8c229a561dbcf78c8333b0cf2520f07415fae39b9ef937dfb55b5147952755252762043"], 0x1}, 0x1, 0x0, 0x0, 0x90}, 0xfffffffffffffffd) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='/exe\x00\x00\xc1\x00\x00\x00\x00\x00\xe9\xff\a\x00\x00\x00\x00\x00\x00T\xfa\aBJ\xde\xe9\x16\xd2\xdau\xaf\xe7\v5\xa0\xfdj\x1f\x02\x00\xf5\xab&\xd7\xa0q\xfb53\x1c\xe3\x9cZehd\x10\x06\xd7\xc0 jt\xe33&S\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) mq_open(&(0x7f0000000000)='..\x00', 0x0, 0x0, &(0x7f0000000040)) r2 = getpid() waitid(0x1, r2, &(0x7f0000000340), 0x8, 0x0) r3 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) setsockopt(r3, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r3, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) ioctl$KDGKBMODE(r0, 0x4b44, &(0x7f00000000c0)) r4 = accept(r1, 0x0, &(0x7f0000000080)=0xfe0f) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x44, r5, 0x230, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7d6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfff}]}, 0x44}, 0x1, 0x0, 0x0, 0x400c0}, 0x40) read(r3, &(0x7f00000005c0)=""/144, 0x14c) syz_open_dev$adsp(&(0x7f0000000240)='/dev/adsp#\x00', 0x101, 0x40000) inotify_add_watch(r3, &(0x7f0000000180)='./file0\x00', 0x9) sendmmsg(r3, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000100)='erspan0\x00', 0xfc) sendmmsg(r0, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1, 0x0, 0x0, 0x1}, 0x800}], 0x1, 0x0) [ 908.070943] device hsr_slave_0 left promiscuous mode [ 908.133028] team0 (unregistering): Port device team_slave_1 removed [ 908.180510] team0 (unregistering): Port device team_slave_0 removed [ 908.224560] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 908.284524] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 908.581003] bond0 (unregistering): Released all slaves [ 908.650030] dccp_check_seqno: Step 6 failed for RESET packet, (LSWL(107887282478717) <= P.seqno(0) <= S.SWH(107887282478791)) and (P.ackno exists or LAWL(73054308089661) <= P.ackno(73054308089662) <= S.AWH(73054308089662), sending SYNC... [ 908.727580] dccp_close: ABORT with 1061 bytes unread 17:19:45 executing program 4: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000000040)='#\x00', 0x0) socket$inet6(0xa, 0xb, 0x6) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="9287b748246deeca588edacd5c96d72d9ff1ffcd245d4623bea592fa911a59141ad79770daa350bbd501b4cb95cf19700700030000000000625d08ef137426f4997e282f68591512c4636d34e1d3cc668e8b4f8843a84855908985cc2773f295290a92d6f061f3d87a22968a81d80da9a6c39f5c7aa09f49456049763d7bb11d1171be83d26f047ce47c565dbf107ab9605a473e04c7e779a0c244ca4388df158abbd2eb44b5519597b5dcd531eaf5b40fa5efa57134ba3a90cf3bcabc96ca007cd5feb4cd554479fe35b888d8bb8ff332dbe807f0278d6399ce4ae86d94dd3899e0a88497279de14711c957b07708c2b8031630481ad1a0880ed2001ded067a6abdc60892ed7457b5fd6d537538e77ea5ff56b6ba67075a449ff84f786e598a221dd8c71045d8afc7642cddb781e732a2e64ede6a077b41ebe33a8903474da4c44514e27ac011237bbed9c4c34dc93889dd21362df3c761db3bae1c5f0f75aac48fc04b897639deefc777f81211acf569827a8e7d88b1b5e4687393700f39a24046557e1e8ce64b02424a3f0d7ce3a64e74cd36ab4b9747b0692889ef04e9a511014b61402662fd9ad8c229a561dbcf78c8333b0cf2520f07415fae39b9ef937dfb55b5147952755252762043"], 0x1}, 0x1, 0x0, 0x0, 0x90}, 0xfffffffffffffffd) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='/exe\x00\x00\xc1\x00\x00\x00\x00\x00\xe9\xff\a\x00\x00\x00\x00\x00\x00T\xfa\aBJ\xde\xe9\x16\xd2\xdau\xaf\xe7\v5\xa0\xfdj\x1f\x02\x00\xf5\xab&\xd7\xa0q\xfb53\x1c\xe3\x9cZehd\x10\x06\xd7\xc0 jt\xe33&S\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) mq_open(&(0x7f0000000000)='..\x00', 0x0, 0x0, &(0x7f0000000040)) r2 = getpid() waitid(0x1, r2, &(0x7f0000000340), 0x8, 0x0) r3 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) setsockopt(r3, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r3, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) ioctl$KDGKBMODE(r0, 0x4b44, &(0x7f00000000c0)) r4 = accept(r1, 0x0, &(0x7f0000000080)=0xfe0f) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x44, r5, 0x230, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7d6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfff}]}, 0x44}, 0x1, 0x0, 0x0, 0x400c0}, 0x40) read(r3, &(0x7f00000005c0)=""/144, 0x14c) syz_open_dev$adsp(&(0x7f0000000240)='/dev/adsp#\x00', 0x101, 0x40000) inotify_add_watch(r3, &(0x7f0000000180)='./file0\x00', 0x9) sendmmsg(r3, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000100)='erspan0\x00', 0xfc) sendmmsg(r0, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1, 0x0, 0x0, 0x1}, 0x800}], 0x1, 0x0) 17:19:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r2, r1, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:45 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x0, 0x0, 0x0) [ 909.366404] chnl_net:caif_netlink_parms(): no params data found [ 909.445326] bridge0: port 1(bridge_slave_0) entered blocking state [ 909.483439] bridge0: port 1(bridge_slave_0) entered disabled state [ 909.524943] device bridge_slave_0 entered promiscuous mode [ 909.563083] bridge0: port 2(bridge_slave_1) entered blocking state [ 909.600722] bridge0: port 2(bridge_slave_1) entered disabled state [ 909.645797] device bridge_slave_1 entered promiscuous mode [ 909.711476] dccp_close: ABORT with 1061 bytes unread [ 909.719041] dccp_check_seqno: Step 6 failed for RESET packet, (LSWL(249590378857028) <= P.seqno(0) <= S.SWH(249590378857102)) and (P.ackno exists or LAWL(171456819699505) <= P.ackno(171456819699506) <= S.AWH(171456819699506), sending SYNC... [ 909.815166] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 909.858991] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 909.887904] team0: Port device team_slave_0 added [ 909.894176] team0: Port device team_slave_1 added [ 910.007759] device hsr_slave_0 entered promiscuous mode [ 910.047935] device hsr_slave_1 entered promiscuous mode [ 910.158030] 8021q: adding VLAN 0 to HW filter on device bond0 [ 910.180690] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 910.193565] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 910.210799] 8021q: adding VLAN 0 to HW filter on device team0 [ 910.224531] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 910.232448] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 910.240702] bridge0: port 1(bridge_slave_0) entered blocking state [ 910.247141] bridge0: port 1(bridge_slave_0) entered forwarding state [ 910.271144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 910.282380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 910.294302] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 910.309752] bridge0: port 2(bridge_slave_1) entered blocking state [ 910.316186] bridge0: port 2(bridge_slave_1) entered forwarding state [ 910.323732] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 910.331927] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 910.358976] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 910.369178] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 910.381742] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 910.390512] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 910.399007] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 910.412836] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 910.434014] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 910.441890] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 910.449631] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 910.509291] binder: BINDER_SET_CONTEXT_MGR already set [ 910.521256] binder: 2477:2479 got reply transaction with bad transaction stack, transaction 739 has target 26829:0 [ 910.532146] binder: 2477:2478 ioctl 40046207 0 returned -16 [ 910.539308] binder: 2477:2479 transaction failed 29201/-71, size 0-0 line 2816 [ 910.549143] binder_alloc: binder_alloc_mmap_handler: 2477 20001000-20004000 already mapped failed -16 17:19:47 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x2, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:47 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000031, &(0x7f0000000040)=0x4, 0x4) 17:19:47 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r2, r1, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:47 executing program 5: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000000040)='#\x00', 0x0) socket$inet6(0xa, 0xb, 0x6) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="9287b748246deeca588edacd5c96d72d9ff1ffcd245d4623bea592fa911a59141ad79770daa350bbd501b4cb95cf19700700030000000000625d08ef137426f4997e282f68591512c4636d34e1d3cc668e8b4f8843a84855908985cc2773f295290a92d6f061f3d87a22968a81d80da9a6c39f5c7aa09f49456049763d7bb11d1171be83d26f047ce47c565dbf107ab9605a473e04c7e779a0c244ca4388df158abbd2eb44b5519597b5dcd531eaf5b40fa5efa57134ba3a90cf3bcabc96ca007cd5feb4cd554479fe35b888d8bb8ff332dbe807f0278d6399ce4ae86d94dd3899e0a88497279de14711c957b07708c2b8031630481ad1a0880ed2001ded067a6abdc60892ed7457b5fd6d537538e77ea5ff56b6ba67075a449ff84f786e598a221dd8c71045d8afc7642cddb781e732a2e64ede6a077b41ebe33a8903474da4c44514e27ac011237bbed9c4c34dc93889dd21362df3c761db3bae1c5f0f75aac48fc04b897639deefc777f81211acf569827a8e7d88b1b5e4687393700f39a24046557e1e8ce64b02424a3f0d7ce3a64e74cd36ab4b9747b0692889ef04e9a511014b61402662fd9ad8c229a561dbcf78c8333b0cf2520f07415fae39b9ef937dfb55b5147952755252762043"], 0x1}, 0x1, 0x0, 0x0, 0x90}, 0xfffffffffffffffd) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='/exe\x00\x00\xc1\x00\x00\x00\x00\x00\xe9\xff\a\x00\x00\x00\x00\x00\x00T\xfa\aBJ\xde\xe9\x16\xd2\xdau\xaf\xe7\v5\xa0\xfdj\x1f\x02\x00\xf5\xab&\xd7\xa0q\xfb53\x1c\xe3\x9cZehd\x10\x06\xd7\xc0 jt\xe33&S\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) mq_open(&(0x7f0000000000)='..\x00', 0x0, 0x0, &(0x7f0000000040)) r2 = getpid() waitid(0x1, r2, &(0x7f0000000340), 0x8, 0x0) r3 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) setsockopt(r3, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r3, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) ioctl$KDGKBMODE(r0, 0x4b44, &(0x7f00000000c0)) r4 = accept(r1, 0x0, &(0x7f0000000080)=0xfe0f) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x44, r5, 0x230, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7d6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfff}]}, 0x44}, 0x1, 0x0, 0x0, 0x400c0}, 0x40) read(r3, &(0x7f00000005c0)=""/144, 0x14c) syz_open_dev$adsp(&(0x7f0000000240)='/dev/adsp#\x00', 0x101, 0x40000) inotify_add_watch(r3, &(0x7f0000000180)='./file0\x00', 0x9) sendmmsg(r3, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000100)='erspan0\x00', 0xfc) sendmmsg(r0, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1, 0x0, 0x0, 0x1}, 0x800}], 0x1, 0x0) 17:19:47 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000001f40)=[{{&(0x7f0000001700)=@alg, 0x80, &(0x7f0000001c40)=[{&(0x7f0000001780)=""/203, 0xcb}, {&(0x7f0000001880)=""/129, 0x81}], 0x2}}], 0x1, 0x0, &(0x7f0000001e80)) r0 = socket$alg(0x26, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000c00)={'team0\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x5d559050cdfd0cb7, 0x0, &(0x7f0000000ec0)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x254, 0xfb, &(0x7f0000000dc0)=""/251, 0x4, 0x1, [], r1, 0x4}, 0x48) r3 = socket$kcm(0xa, 0x5, 0x0) r4 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0x6, 0x4) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000002d80)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000580)={'ip6gretap0\x00', @random="6e5b0750f801"}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8937, &(0x7f0000000280)={'bridge_slave_1\x00\xf0', @broadcast}) r5 = fcntl$getown(0xffffffffffffffff, 0x9) ioctl$TIOCCONS(r4, 0x541d) r6 = dup3(r4, r0, 0x80000) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000800)=@can, 0x80, &(0x7f0000000540)=[{&(0x7f0000000880)=""/163, 0xa3}, {&(0x7f0000000940)=""/207, 0xcf}, {&(0x7f0000000a40)=""/76, 0x4c}, {&(0x7f0000000ac0)=""/144, 0x90}], 0x4, &(0x7f0000000cc0)=""/193, 0xc1, 0x3ff}, 0x10041) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000039c0)={{{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000000fc0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000bc0)={'vcan0\x00', r7}) r8 = socket$inet(0x2b, 0x1, 0x1) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f0000000300)={0x3, 0x7ffffffffffff800, 0x800000000000000}) recvmmsg(r8, &(0x7f0000002800)=[{{&(0x7f0000000000)=@can, 0x80, &(0x7f0000000080), 0x0, &(0x7f00000000c0)=""/57, 0xfffffffffffffc8f, 0xffffffffffffff1a}, 0x2}, {{&(0x7f0000000c40)=@ipx, 0x80, &(0x7f0000000f40), 0x0, &(0x7f0000000780)=""/86, 0x56, 0x2}, 0x200}, {{&(0x7f0000001000)=@can, 0x10a, &(0x7f0000002700)=[{&(0x7f0000001080)=""/218, 0xda}, {&(0x7f0000001180)=""/71, 0x47}, {&(0x7f0000001200)=""/194, 0xc2}, {&(0x7f0000001300)=""/33, 0x21}, {&(0x7f0000001340)=""/240, 0xf0}, {&(0x7f0000001440)=""/4096, 0x1000}, {&(0x7f0000002440)=""/138, 0x8a}, {&(0x7f0000002500)=""/89, 0x59}, {&(0x7f0000002580)=""/183, 0x22b}, {&(0x7f0000002640)=""/176, 0xb0}], 0xa, &(0x7f00000027c0), 0x0, 0x7}, 0x1}], 0x3, 0x100, &(0x7f0000002980)) ioctl$FS_IOC_FSSETXATTR(r8, 0x401c5820, &(0x7f0000000080)={0x3c, 0xf3fe, 0x0, 0x6}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0xf, 0x3}, 0x14) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x890b, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet_udp_int(r4, 0x11, 0xb, &(0x7f0000000440)=0x7fffffff, 0x4) getsockopt$inet_sctp_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f0000000480), &(0x7f0000000500)=0x4) listxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000340)=""/141, 0x8d) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x20, &(0x7f0000000080)={@empty, 0xc5, 0x0, 0x3, 0x8, 0x80000000, 0xa6, 0x8}, 0x20) ioctl$KDGETMODE(r6, 0x4b3b, &(0x7f0000000400)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz1\x00', 0x1ff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x20, &(0x7f0000000100)={@ipv4, 0x1e570444, 0x2, 0x0, 0xe, 0x5, 0x1, 0x100}, 0x20) kcmp(r5, r5, 0x0, r9, r4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz0\x00', 0x1ff) 17:19:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x10]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 910.559876] binder: 2477:2479 ioctl c0306201 20000000 returned -14 [ 910.567986] binder: BINDER_SET_CONTEXT_MGR already set [ 910.573388] binder: 2477:2478 ioctl 40046207 0 returned -16 [ 910.580198] binder: 2477:2484 got reply transaction with no transaction stack [ 910.589387] binder: 2477:2484 transaction failed 29201/-71, size 0-0 line 2801 [ 910.597431] binder: 2477:2484 ioctl c0306201 20000000 returned -14 [ 910.757513] binder: BINDER_SET_CONTEXT_MGR already set 17:19:47 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:47 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000032, &(0x7f0000000040)=0x4, 0x4) [ 910.802846] binder: 2497:2498 ioctl 40046207 0 returned -16 [ 910.911016] binder: 2497:2505 got reply transaction with bad transaction stack, transaction 743 has target 26829:0 17:19:47 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000001f40)=[{{&(0x7f0000001700)=@alg, 0x80, &(0x7f0000001c40)=[{&(0x7f0000001780)=""/203, 0xcb}, {&(0x7f0000001880)=""/129, 0x81}], 0x2}}], 0x1, 0x0, &(0x7f0000001e80)) r0 = socket$alg(0x26, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000c00)={'team0\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x5d559050cdfd0cb7, 0x0, &(0x7f0000000ec0)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x254, 0xfb, &(0x7f0000000dc0)=""/251, 0x4, 0x1, [], r1, 0x4}, 0x48) r3 = socket$kcm(0xa, 0x5, 0x0) r4 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0x6, 0x4) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000002d80)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000580)={'ip6gretap0\x00', @random="6e5b0750f801"}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8937, &(0x7f0000000280)={'bridge_slave_1\x00\xf0', @broadcast}) r5 = fcntl$getown(0xffffffffffffffff, 0x9) ioctl$TIOCCONS(r4, 0x541d) r6 = dup3(r4, r0, 0x80000) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000800)=@can, 0x80, &(0x7f0000000540)=[{&(0x7f0000000880)=""/163, 0xa3}, {&(0x7f0000000940)=""/207, 0xcf}, {&(0x7f0000000a40)=""/76, 0x4c}, {&(0x7f0000000ac0)=""/144, 0x90}], 0x4, &(0x7f0000000cc0)=""/193, 0xc1, 0x3ff}, 0x10041) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000039c0)={{{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000000fc0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000bc0)={'vcan0\x00', r7}) r8 = socket$inet(0x2b, 0x1, 0x1) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f0000000300)={0x3, 0x7ffffffffffff800, 0x800000000000000}) recvmmsg(r8, &(0x7f0000002800)=[{{&(0x7f0000000000)=@can, 0x80, &(0x7f0000000080), 0x0, &(0x7f00000000c0)=""/57, 0xfffffffffffffc8f, 0xffffffffffffff1a}, 0x2}, {{&(0x7f0000000c40)=@ipx, 0x80, &(0x7f0000000f40), 0x0, &(0x7f0000000780)=""/86, 0x56, 0x2}, 0x200}, {{&(0x7f0000001000)=@can, 0x10a, &(0x7f0000002700)=[{&(0x7f0000001080)=""/218, 0xda}, {&(0x7f0000001180)=""/71, 0x47}, {&(0x7f0000001200)=""/194, 0xc2}, {&(0x7f0000001300)=""/33, 0x21}, {&(0x7f0000001340)=""/240, 0xf0}, {&(0x7f0000001440)=""/4096, 0x1000}, {&(0x7f0000002440)=""/138, 0x8a}, {&(0x7f0000002500)=""/89, 0x59}, {&(0x7f0000002580)=""/183, 0x22b}, {&(0x7f0000002640)=""/176, 0xb0}], 0xa, &(0x7f00000027c0), 0x0, 0x7}, 0x1}], 0x3, 0x100, &(0x7f0000002980)) ioctl$FS_IOC_FSSETXATTR(r8, 0x401c5820, &(0x7f0000000080)={0x3c, 0xf3fe, 0x0, 0x6}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0xf, 0x3}, 0x14) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x890b, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet_udp_int(r4, 0x11, 0xb, &(0x7f0000000440)=0x7fffffff, 0x4) getsockopt$inet_sctp_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f0000000480), &(0x7f0000000500)=0x4) listxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000340)=""/141, 0x8d) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x20, &(0x7f0000000080)={@empty, 0xc5, 0x0, 0x3, 0x8, 0x80000000, 0xa6, 0x8}, 0x20) ioctl$KDGETMODE(r6, 0x4b3b, &(0x7f0000000400)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz1\x00', 0x1ff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x20, &(0x7f0000000100)={@ipv4, 0x1e570444, 0x2, 0x0, 0xe, 0x5, 0x1, 0x100}, 0x20) kcmp(r5, r5, 0x0, r9, r4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz0\x00', 0x1ff) 17:19:47 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 911.025217] binder: 2497:2505 transaction failed 29201/-71, size 0-0 line 2816 17:19:47 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x3, 0x4) 17:19:48 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 911.504856] binder_alloc: binder_alloc_mmap_handler: 2497 20001000-20004000 already mapped failed -16 [ 911.519082] dccp_close: ABORT with 1061 bytes unread [ 911.528956] dccp_check_seqno: Step 6 failed for RESET packet, (LSWL(219774511862023) <= P.seqno(0) <= S.SWH(219774511862097)) and (P.ackno exists or LAWL(199102839709339) <= P.ackno(199102839709340) <= S.AWH(199102839709340), sending SYNC... [ 911.581909] binder: 2497:2511 got reply transaction with bad transaction stack, transaction 745 has target 26829:0 [ 911.604650] binder: 2497:2511 transaction failed 29201/-71, size 0-0 line 2816 [ 911.638922] binder: BINDER_SET_CONTEXT_MGR already set [ 911.669567] binder: 2497:2505 ioctl 40046207 0 returned -16 [ 911.713975] binder_thread_release: 1 callbacks suppressed [ 911.713986] binder: release 2497:2505 transaction 743 out, still active [ 911.752954] binder_release_work: 1 callbacks suppressed [ 911.752960] binder: undelivered TRANSACTION_COMPLETE 17:19:48 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x3, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:48 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000001f40)=[{{&(0x7f0000001700)=@alg, 0x80, &(0x7f0000001c40)=[{&(0x7f0000001780)=""/203, 0xcb}, {&(0x7f0000001880)=""/129, 0x81}], 0x2}}], 0x1, 0x0, &(0x7f0000001e80)) r0 = socket$alg(0x26, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000c00)={'team0\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x5d559050cdfd0cb7, 0x0, &(0x7f0000000ec0)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x254, 0xfb, &(0x7f0000000dc0)=""/251, 0x4, 0x1, [], r1, 0x4}, 0x48) r3 = socket$kcm(0xa, 0x5, 0x0) r4 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0x6, 0x4) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000002d80)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000580)={'ip6gretap0\x00', @random="6e5b0750f801"}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8937, &(0x7f0000000280)={'bridge_slave_1\x00\xf0', @broadcast}) r5 = fcntl$getown(0xffffffffffffffff, 0x9) ioctl$TIOCCONS(r4, 0x541d) r6 = dup3(r4, r0, 0x80000) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000800)=@can, 0x80, &(0x7f0000000540)=[{&(0x7f0000000880)=""/163, 0xa3}, {&(0x7f0000000940)=""/207, 0xcf}, {&(0x7f0000000a40)=""/76, 0x4c}, {&(0x7f0000000ac0)=""/144, 0x90}], 0x4, &(0x7f0000000cc0)=""/193, 0xc1, 0x3ff}, 0x10041) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000039c0)={{{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000000fc0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000bc0)={'vcan0\x00', r7}) r8 = socket$inet(0x2b, 0x1, 0x1) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f0000000300)={0x3, 0x7ffffffffffff800, 0x800000000000000}) recvmmsg(r8, &(0x7f0000002800)=[{{&(0x7f0000000000)=@can, 0x80, &(0x7f0000000080), 0x0, &(0x7f00000000c0)=""/57, 0xfffffffffffffc8f, 0xffffffffffffff1a}, 0x2}, {{&(0x7f0000000c40)=@ipx, 0x80, &(0x7f0000000f40), 0x0, &(0x7f0000000780)=""/86, 0x56, 0x2}, 0x200}, {{&(0x7f0000001000)=@can, 0x10a, &(0x7f0000002700)=[{&(0x7f0000001080)=""/218, 0xda}, {&(0x7f0000001180)=""/71, 0x47}, {&(0x7f0000001200)=""/194, 0xc2}, {&(0x7f0000001300)=""/33, 0x21}, {&(0x7f0000001340)=""/240, 0xf0}, {&(0x7f0000001440)=""/4096, 0x1000}, {&(0x7f0000002440)=""/138, 0x8a}, {&(0x7f0000002500)=""/89, 0x59}, {&(0x7f0000002580)=""/183, 0x22b}, {&(0x7f0000002640)=""/176, 0xb0}], 0xa, &(0x7f00000027c0), 0x0, 0x7}, 0x1}], 0x3, 0x100, &(0x7f0000002980)) ioctl$FS_IOC_FSSETXATTR(r8, 0x401c5820, &(0x7f0000000080)={0x3c, 0xf3fe, 0x0, 0x6}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0xf, 0x3}, 0x14) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x890b, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet_udp_int(r4, 0x11, 0xb, &(0x7f0000000440)=0x7fffffff, 0x4) getsockopt$inet_sctp_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f0000000480), &(0x7f0000000500)=0x4) listxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000340)=""/141, 0x8d) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x20, &(0x7f0000000080)={@empty, 0xc5, 0x0, 0x3, 0x8, 0x80000000, 0xa6, 0x8}, 0x20) ioctl$KDGETMODE(r6, 0x4b3b, &(0x7f0000000400)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz1\x00', 0x1ff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x20, &(0x7f0000000100)={@ipv4, 0x1e570444, 0x2, 0x0, 0xe, 0x5, 0x1, 0x100}, 0x20) kcmp(r5, r5, 0x0, r9, r4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz0\x00', 0x1ff) 17:19:48 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x3) 17:19:48 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:48 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x40000002b, 0x0, 0x0) [ 911.782353] binder: undelivered TRANSACTION_ERROR: 29201 [ 911.845954] binder: release 2497:2511 transaction 745 out, still active [ 911.896897] binder: undelivered TRANSACTION_COMPLETE [ 911.928268] binder: BINDER_SET_CONTEXT_MGR already set [ 911.936798] binder: undelivered TRANSACTION_ERROR: 29201 [ 911.950906] binder: 2553:2557 got reply transaction with bad transaction stack, transaction 747 has target 26829:0 [ 911.971340] binder: 2553:2554 ioctl 40046207 0 returned -16 [ 912.006712] binder: 2553:2557 transaction failed 29201/-71, size 0-0 line 2816 17:19:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x11]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:48 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000001f40)=[{{&(0x7f0000001700)=@alg, 0x80, &(0x7f0000001c40)=[{&(0x7f0000001780)=""/203, 0xcb}, {&(0x7f0000001880)=""/129, 0x81}], 0x2}}], 0x1, 0x0, &(0x7f0000001e80)) r0 = socket$alg(0x26, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000c00)={'team0\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x5d559050cdfd0cb7, 0x0, &(0x7f0000000ec0)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x254, 0xfb, &(0x7f0000000dc0)=""/251, 0x4, 0x1, [], r1, 0x4}, 0x48) r3 = socket$kcm(0xa, 0x5, 0x0) r4 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0x6, 0x4) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000002d80)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000580)={'ip6gretap0\x00', @random="6e5b0750f801"}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8937, &(0x7f0000000280)={'bridge_slave_1\x00\xf0', @broadcast}) r5 = fcntl$getown(0xffffffffffffffff, 0x9) ioctl$TIOCCONS(r4, 0x541d) r6 = dup3(r4, r0, 0x80000) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000800)=@can, 0x80, &(0x7f0000000540)=[{&(0x7f0000000880)=""/163, 0xa3}, {&(0x7f0000000940)=""/207, 0xcf}, {&(0x7f0000000a40)=""/76, 0x4c}, {&(0x7f0000000ac0)=""/144, 0x90}], 0x4, &(0x7f0000000cc0)=""/193, 0xc1, 0x3ff}, 0x10041) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000039c0)={{{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000000fc0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000bc0)={'vcan0\x00', r7}) r8 = socket$inet(0x2b, 0x1, 0x1) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f0000000300)={0x3, 0x7ffffffffffff800, 0x800000000000000}) recvmmsg(r8, &(0x7f0000002800)=[{{&(0x7f0000000000)=@can, 0x80, &(0x7f0000000080), 0x0, &(0x7f00000000c0)=""/57, 0xfffffffffffffc8f, 0xffffffffffffff1a}, 0x2}, {{&(0x7f0000000c40)=@ipx, 0x80, &(0x7f0000000f40), 0x0, &(0x7f0000000780)=""/86, 0x56, 0x2}, 0x200}, {{&(0x7f0000001000)=@can, 0x10a, &(0x7f0000002700)=[{&(0x7f0000001080)=""/218, 0xda}, {&(0x7f0000001180)=""/71, 0x47}, {&(0x7f0000001200)=""/194, 0xc2}, {&(0x7f0000001300)=""/33, 0x21}, {&(0x7f0000001340)=""/240, 0xf0}, {&(0x7f0000001440)=""/4096, 0x1000}, {&(0x7f0000002440)=""/138, 0x8a}, {&(0x7f0000002500)=""/89, 0x59}, {&(0x7f0000002580)=""/183, 0x22b}, {&(0x7f0000002640)=""/176, 0xb0}], 0xa, &(0x7f00000027c0), 0x0, 0x7}, 0x1}], 0x3, 0x100, &(0x7f0000002980)) ioctl$FS_IOC_FSSETXATTR(r8, 0x401c5820, &(0x7f0000000080)={0x3c, 0xf3fe, 0x0, 0x6}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0xf, 0x3}, 0x14) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x890b, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet_udp_int(r4, 0x11, 0xb, &(0x7f0000000440)=0x7fffffff, 0x4) getsockopt$inet_sctp_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f0000000480), &(0x7f0000000500)=0x4) listxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000340)=""/141, 0x8d) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x20, &(0x7f0000000080)={@empty, 0xc5, 0x0, 0x3, 0x8, 0x80000000, 0xa6, 0x8}, 0x20) ioctl$KDGETMODE(r6, 0x4b3b, &(0x7f0000000400)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz1\x00', 0x1ff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x20, &(0x7f0000000100)={@ipv4, 0x1e570444, 0x2, 0x0, 0xe, 0x5, 0x1, 0x100}, 0x20) kcmp(r5, r5, 0x0, r9, r4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz0\x00', 0x1ff) 17:19:48 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f00000000c0)={'filter\x00', 0x4}, 0x68) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:19:48 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000001f40)=[{{&(0x7f0000001700)=@alg, 0x80, &(0x7f0000001c40)=[{&(0x7f0000001780)=""/203, 0xcb}, {&(0x7f0000001880)=""/129, 0x81}], 0x2}}], 0x1, 0x0, &(0x7f0000001e80)) r0 = socket$alg(0x26, 0x5, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xfffffffffffffffd, 0x0, &(0x7f0000000ec0)=ANY=[], &(0x7f00000004c0)='GPL\x00', 0x254, 0xfb, &(0x7f0000000dc0)=""/251, 0x0, 0x1, [], 0x0, 0x4}, 0x48) r2 = socket$kcm(0xa, 0x5, 0x0) r3 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0x2, 0x4) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000002d80)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000580)={'ip6gretap0\x00', @random="6e5b0750f801"}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8937, &(0x7f0000000280)={'bridge_slave_1\x00\xf0', @broadcast}) r4 = fcntl$getown(0xffffffffffffffff, 0x9) ioctl$TIOCCONS(r3, 0x541d) r5 = dup3(r3, r0, 0x80000) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000800)=@can, 0x80, &(0x7f0000000540)=[{&(0x7f0000000880)=""/163, 0xa3}, {&(0x7f0000000940)=""/207, 0xcf}, {&(0x7f0000000a40)=""/76, 0x4c}, {&(0x7f0000000ac0)=""/144, 0x90}], 0x4, &(0x7f0000000cc0)=""/193, 0xc1, 0x3ff}, 0x10041) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000039c0)={{{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000000fc0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000bc0)={'vcan0\x00', r6}) r7 = socket$inet(0x2b, 0x1, 0x1) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r3, 0xc0105303, &(0x7f0000000300)={0x3, 0x7ffffffffffff800, 0x800000000000000}) recvmmsg(r7, &(0x7f0000002800)=[{{&(0x7f0000000000)=@can, 0x80, &(0x7f0000000080), 0x0, &(0x7f00000000c0)=""/57, 0xfffffffffffffc8f, 0xffffffffffffff1a}, 0x2}, {{&(0x7f0000000c40)=@ipx, 0x80, &(0x7f0000000f40), 0x0, &(0x7f0000000780)=""/86, 0x56, 0x2}, 0x200}, {{&(0x7f0000001000)=@can, 0x10a, &(0x7f0000002700)=[{&(0x7f0000001080)=""/218, 0xda}, {&(0x7f0000001180)=""/71, 0x47}, {&(0x7f0000001200)=""/194, 0xc2}, {&(0x7f0000001300)=""/33, 0x21}, {&(0x7f0000001340)=""/240, 0xf0}, {&(0x7f0000001440)=""/4096, 0x1000}, {&(0x7f0000002440)=""/138, 0x8a}, {&(0x7f0000002500)=""/89, 0x59}, {&(0x7f0000002580)=""/183, 0x22b}, {&(0x7f0000002640)=""/176, 0xb0}], 0xa, &(0x7f00000027c0), 0x0, 0x7}, 0x1}], 0x3, 0x100, &(0x7f0000002980)) ioctl$FS_IOC_FSSETXATTR(r7, 0x401c5820, &(0x7f0000000080)={0x3c, 0xf3fe, 0x0, 0x6}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0xf, 0x3}, 0x14) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x890c, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet_udp_int(r3, 0x11, 0xb, &(0x7f0000000440)=0x7fffffff, 0x4) getsockopt$inet_sctp_SCTP_NODELAY(r3, 0x84, 0x3, &(0x7f0000000480), &(0x7f0000000500)=0x4) listxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000340)=""/141, 0x8d) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000000080)={@empty, 0xc5, 0x0, 0x3, 0x8, 0x80000000, 0xa6, 0x8}, 0x20) ioctl$KDGETMODE(r5, 0x4b3b, &(0x7f0000000400)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz1\x00', 0x1ff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000000100)={@ipv4, 0x1e570444, 0x2, 0x0, 0xe, 0x5, 0x1, 0x100}, 0x20) kcmp(r4, r4, 0x0, r8, r3) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz0\x00', 0x1ff) 17:19:48 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 912.050214] binder_alloc: binder_alloc_mmap_handler: 2553 20001000-20004000 already mapped failed -16 [ 912.136066] binder: BINDER_SET_CONTEXT_MGR already set [ 912.151650] binder: 2553:2554 ioctl 40046207 0 returned -16 17:19:49 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0xc001102c]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 912.224902] binder: 2553:2562 got reply transaction with no transaction stack 17:19:49 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 912.290720] binder: release 2553:2557 transaction 747 out, still active [ 912.305635] binder: 2553:2562 transaction failed 29201/-71, size 0-0 line 2801 [ 912.314851] binder: undelivered TRANSACTION_COMPLETE [ 912.320094] binder: undelivered TRANSACTION_ERROR: 29201 17:19:49 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x4, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:49 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r1, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r0, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) ioctl$sock_rose_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0xb4e4, @bcast, @bpq0='bpq0\x00', 0x4, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) setsockopt$inet_int(r1, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 912.387780] binder: undelivered TRANSACTION_ERROR: 29201 17:19:49 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0xc0010140]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 912.434380] binder: release 2553:2579 transaction 749 out, still active [ 912.487582] binder: undelivered TRANSACTION_COMPLETE [ 912.516791] binder: BINDER_SET_CONTEXT_MGR already set [ 912.559436] binder: 2592:2593 ioctl 40046207 0 returned -16 17:19:49 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x100, 0x0) ioctl$KVM_SET_DEBUGREGS(r3, 0x4080aea2, &(0x7f0000000100)={[0xf001, 0x3000, 0x4, 0xf004], 0x800, 0x4a, 0x100000001}) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) ioctl$TIOCOUTQ(r3, 0x5411, &(0x7f00000001c0)) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 912.690167] binder: 2592:2601 got reply transaction with bad transaction stack, transaction 751 has target 26829:0 17:19:49 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 912.748164] binder: 2592:2601 transaction failed 29201/-71, size 0-0 line 2816 [ 913.256685] binder_alloc: binder_alloc_mmap_handler: 2592 20001000-20004000 already mapped failed -16 [ 913.283307] binder: BINDER_SET_CONTEXT_MGR already set [ 913.324748] binder: 2592:2601 ioctl 40046207 0 returned -16 [ 913.354601] binder: 2592:2604 got reply transaction with bad transaction stack, transaction 753 has target 26829:0 [ 913.394789] binder: 2592:2604 transaction failed 29201/-71, size 0-0 line 2816 [ 913.431149] binder: release 2592:2601 transaction 751 out, still active [ 913.443119] binder: undelivered TRANSACTION_COMPLETE [ 913.497830] binder: undelivered TRANSACTION_ERROR: 29201 [ 913.503328] binder: release 2592:2604 transaction 753 out, still active [ 913.568275] binder: undelivered TRANSACTION_COMPLETE [ 913.573400] binder: undelivered TRANSACTION_ERROR: 29201 17:19:50 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x12]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:50 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:50 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) fadvise64(r2, 0x0, 0x3, 0x7) r3 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x101000, 0x0) connect$llc(r3, &(0x7f0000000100)={0x1a, 0xffff, 0x1, 0x1, 0x800, 0x1}, 0x10) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:19:50 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x5, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 913.754949] binder: BINDER_SET_CONTEXT_MGR already set [ 913.760278] binder: 2625:2628 ioctl 40046207 0 returned -16 [ 913.845472] binder: 2625:2629 got reply transaction with bad transaction stack, transaction 755 has target 26829:0 17:19:50 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0xc0010140]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 913.908149] binder_alloc: binder_alloc_mmap_handler: 2625 20001000-20004000 already mapped failed -16 17:19:50 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0xc0010140]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:50 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:50 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, &(0x7f00000000c0)={0x0, @speck128}) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 913.994003] binder: BINDER_SET_CONTEXT_MGR already set [ 914.034574] binder: 2625:2628 ioctl 40046207 0 returned -16 [ 914.065000] binder: 2625:2629 transaction failed 29201/-71, size 0-0 line 2816 17:19:50 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x6, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:51 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x80002, 0x0) ioctl$RNDZAPENTCNT(r3, 0x5204, &(0x7f0000000100)=0xd2d) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:19:51 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 914.266225] binder: BINDER_SET_CONTEXT_MGR already set [ 914.364385] binder: 2655:2656 ioctl 40046207 0 returned -16 [ 914.393423] binder: 2655:2659 got reply transaction with no transaction stack [ 914.440093] binder: 2655:2659 transaction failed 29201/-71, size 0-0 line 2801 [ 914.518183] binder_alloc: binder_alloc_mmap_handler: 2655 20001000-20004000 already mapped failed -16 17:19:51 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r4 = dup(r0) accept$packet(r4, &(0x7f00000000c0), &(0x7f0000000100)=0x14) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 914.582996] binder: BINDER_SET_CONTEXT_MGR already set [ 914.669658] binder: 2655:2656 ioctl 40046207 0 returned -16 [ 914.724991] binder: 2655:2665 got reply transaction with no transaction stack 17:19:52 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x1b]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:52 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:52 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x7, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:52 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r3 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_G_OUTPUT(r3, 0x8004562e, &(0x7f0000000100)) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) socket$inet(0x2, 0x1, 0xb2fd) 17:19:52 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0xc0010117]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:52 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0xc0010140]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 915.383678] binder: BINDER_SET_CONTEXT_MGR already set [ 915.441783] binder: 2687:2693 ioctl 40046207 0 returned -16 [ 915.495764] binder: 2687:2688 got reply transaction with bad transaction stack, transaction 761 has target 26829:0 17:19:52 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r3 = syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x1, 0x2) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r3, 0xc0305302, &(0x7f00000001c0)={0x200, 0x7c67, 0x3, 0x400, 0x1, 0x8000}) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) r4 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x230a01, 0x0) accept4$netrom(r4, 0x0, &(0x7f0000000100), 0x80800) [ 915.564674] binder_transaction: 1 callbacks suppressed [ 915.564693] binder: 2687:2688 transaction failed 29201/-71, size 0-0 line 2816 17:19:52 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 915.677073] binder_alloc: binder_alloc_mmap_handler: 2687 20001000-20004000 already mapped failed -16 17:19:52 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r1, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, &(0x7f0000000500)="32390d9a2cec71d338a8ad97c750e68fdc0f7fe962231b7cf623aae9b0673120ca7554115053831538b25d5d3335fd18990169e07654dea9f0dbe380514961f2f6ab14054f73c9c5810d6f2265134d9a815044763c670549e4fe91e0c4da69ff9ea972e0ecc9691b646eb788bb244c761cb38b3334930a3c205448014ad8b7cf7c476cd860a5128835212f9a91c358e8eee49d8f2b1b2c35551459d83ca4a031cf6ec5420a8bf8d6d73162230ef5c8a6e343980e9fdda9a8d458e431a318c005e76f711f3da8e56e3b68d7d7f8a38872f3369489131666bba5ad2f3792721577ed8494d29ce7436903c4981bfd74a05325292cb6ec8364a005037463b0d258bf6b232b18de6aba92f734c2646671f8aa55445b40b4526571553df3dccdf2ef2adb488d22bb03d8b078508db347cf8b9fb733c998be4c7890114b9d58cd8bce817e00320eee41e8086421dfb1e3cace1094f6f9b83efe38470bec68fb6013279c6d32bacfd0f93909975694d2b39ca2e5b1921e67f440b0b2a9086cae46bfa47b35badfba6825a77c9eba8e19c6062f1a8d7d57af46f3d56da95916632f91832cade216cfd3a1f2a6ab72acec2e0dbf1881e8cd47fa54e3a8eaad8df087632ba02c7f3afd7f42699e084c5036b5de859edc8524b62a1d578f47cd7ba1897962eed6f2bc6ab9e9916e53a095333de7615251a42226800ce4c7f3d6e89c6307b0261e77cd09b210323ac1052380908f74db41a09d60e2b921372bcbbf73e390745b6862b365d78a5cc427942698b7aaafd31dfb17650ff92d2c1e5e8b9bd8ff347246a42df3e13cf87299fe906a02a1c2c5f905a6bc29471a4ec2fc34e4b706380149a19025a5b0d170f0b984304b46a203aced1c1cf2eb752f2c413f4439e5bc6c5b06a36fbb7856e96506659fe444d83e7c9f9b550e47cf9758823adf6228f925c5a282a7220fb9567a187b7c767c2b057df1595237d9ead7a43d5370c7970c5dc2f3c8b910636f4717a2364814d4da4854b8b26f90897f8af2514e9b0e6dae02e6495e855c3ca68db177670d64e16150d27381e886e61ee783ac78d1d7de1930c016e72cb278e3bbf855f9f7912cae9369b6856ce75bb80792a637c69851945b4bb3c0db08c7285d9f02a3b8166b036891fcecc67c3e45027156cbb90bcc229d58b1cdb44c526230f1b67a890f7853599c735a197646ddfd760d61413d5a602ee9251d8427e3da118384619b55b0b08d45a4e245780b2126ade39551223a717e4c390fd71fcb9cee7fb9f48714c484739f259e62bb34096734035e322bb3c6573eaead8997f74f33b937331daa31388d1cbf5ac1a55b57c443e313db8f9e18993838c0294b71e2822d390f060d697dbeefe05bbdfac116184f84507d08b84f100333721b9437061d44816a15a13d873b7f3df8a47931aa4fe6c7da969fe80e0e33e9435589788cca5a2f99a6df96f69a198d5ee1809621ce698646815bbdccdb12a4b304af51f9c153e3dceda51eef71e1706aeaf86057702a1ba32d31785ad95b4e67a5b00ead98a2068908a06c1e73427ad84dc1311a5507d953dd90c09e71d06a7c0c2aa9809e03998df2d0b236a2ce8685ff3e481a05dd42f7452bca0b18eff90abacfd4cf49bbd37b4cfcd20e8f79639f1ed04df8bb4c0b54cd874837cb17cd18809eb3a6a265c56d61d3ee79bf5ce46ad6d0b1461130ee1ceb24e232812face5ff7177cb477ec8145e2232a2c5875455b315c1a10ec36c7d48ebc9d6d8c4934f163551aa7b1fb42435c1e1f7ccaf9e89816263cf5e9f7f60cd3d9b634ddd01e41bb43388256761435113caed8c008c3b7b2f744f3107aea0613eecf4b98ee1476e44f0dd39709fcf5a5636062193c513448e2edbec12a27eea5a5320d6ba3ff5c6279eed08e89128080f93c92d4ddd36ed8bcff530451ad861e6b99dde8a29a78bc6a4ec13aa01d1e5093e54082756d76468e3b012443b602644650e81558e628dc767a5ba0881fa0eb12e339c15dbc087f914d6409f868c86191e6f66404718ec71337ee972c6956445dba2d33e72e68fc67cb11cafc706abbc341c62e47a6991baabc3c9969189729cd46f772612f25e0b939e782a1319379994b0eefe962c747fb1af20c8b8f4920d703c75fd63f50b4a3fb9df7e7de64fe88738357a5d282078b2978895d39d0afe75287f0d38c28a760bf7cc087b3dd3f02b6425c4c1b587ec11f67d6a16b4adcabbaae49ae99e422f5b092cbdc11dd813a546095406e0a77c954c1f6d7cb72028e18f9f13b2e46ff8d1edd3d0c328c7f01ea1fc169033c0651899505fdfc1b7f8dd53b66ce80a2821e8725699f1832da2d61966acdb5b86b561a404f52028064433d7eff2bf795bed1fd8d0d5acae2c870b088eeb7c817095a6ac7847298e2cf23792b2e11995d91d8b8886c3c5a42625e44c733dba7e1138461ab5b63cbad75ef2d6eae96a79a7dad4b0a10c8ed6b43ca7ed5f7131ccc132dadc594ca5601509a8232a529eb5fdc2786dfc2c1d857bdb443c544315e394bef1e11fa4ecdfba3e61479519e534f9d2bec3c776b1bec1ed30f7582cf2383401415275941dda5f0592f0eb7a1975ca498d1fbaeae85fa076a0936f77ea00d493dad728e1e1f6deb90a71f6a8dd87430b4bf3ec9ece4af4bb8c2f6ca1f8ce99a280f6553514153b92deaaa289520c6234b549a0fe0040ffa3ec96e298b3574f18fe21e3f6694cd963a9f7ad2cc01feab5904eb7a6730b83596409922fe786a0f9db27c162feb4bdbf5038556b21690d3f8bd6f2931f8a75e690161ddb88a45c7e0a9e338795aaae6479ec74c9141fe6f4e9585ef01662fe3d6c742c794bf7410f808fb922079c87e36f44023b31b8c5d5091a7cdfd82b7a34790f64716a8a26304062dfc2c181cb567d187ac62aa5aa10700d91e6ab989bee5ac42c0f8276eea496885a5800235b955ca81d6a1e5043c79fba7c89ae5474f3b680ef82a78ef57cf8aee872de7b6c11b31690d26df54b134cb956a6c731de66f240ec53d1fe00f5a2d489bf3bd94869e40c3ca5638244a49a4dffd173e70567f7046e643fdaf8732b32b4b7b3ad0abb4ed130cc36f586aa222bdea413415f7faab34cb30c679c7f01b0bc345e943465e8031d4514577e72e7aff7848ac6a4db614d4ee69ee2cf25d8db36d155d682533a478205e5b0c544f16038240ac24d847ee09950249bd44899ed4e7f191ca632145c66ecf3a6e560e8506565d0332493ebfe2f7ebca14d6b828261a56e051eb1c62bf07d0644a7b2b9c626a466e7a7b0a3f15635453bdef02a25c3cda082f78ec445ad97892a51c2553794e82fb5600283bc194e37e0831da3f80622eac35d1c17e0d38e37a4516ee9f4db05f85956b14d0759a6b601b43cf56b5e4285816f40ae8759d187cad0bfb9694b3b7efdc679603d392fdd988385f710e11cabd3ed9758e37e88da09238693e51c9d175424ab4ebd491acc0b8961814a0cc09af1fb6af0a15b293b4f73e773ed4f8a7e524fc09455a41513adf9ff683de50b99c659838604d7a0f20017846f79d93711557a6fe91cdf355d35c9c466d456a171e426f67c2c0c59700e5064975094c28b9c760b3ca78c4e7393a0c188a9b263198ef274cb416951e8cae0d8427416812fe3ebafc7e306792262c3b151ed4ebb4f154c209d18ba6b542c30c7498915da309fbf6302f1bff98ecb3ad1520e5a9c85b798d04785f74a06fcb58d3820d7de4e64f7d72b7b513e185ed591d0c9b79c87c3b0d3cac8ce834c6012244a865209db2170c904db97dc48756e674713c24b5fd99323227ea85880205f233f74998f7020c6a31848652617d0861b357b58fb188465d8c2de90b610181ed51bd7f0d4f17958eeabdcf42d283b4415bcfdad8b64c6bc34cdd1fa08985752934d680e58f39e2d5087f568167aeb7342b724318de51c10c8401ae8152be4dfebef447869e3d163d0a9c9df19c10c8e51155384f256bf025e0e59eca1a5f20588707f2d3d2abe6a53c21a270734b7efb9b479466b58b23725f64ae9ec2ae7a7b4128a12597d9c99cb013668df062875c9b597092ff7d7d1d4c069deb2a0742b2222b7732acfa94a84ce7704b4ec5468380f9ac545e46c16be021cf85782c0118f58f66d1e842e7453c421fd13bf2a503d490e54f28cd2af350fb27220079938c49fdcfcf100c0dc16df3ccddf38043e031b46968453ce3cdd83ebd69dca683e7010108050556e35b3e01c8546b8c4551340791a765661b9067604ae7cf7f9fafd7f07382b882a401d710600d8a01cdd49a32e84ba2be0358534067d43209e710728d4c148e109c85e868935b520b4456136fc05135bde3b537105f31a6835f4013f64de0344a58096b4b36f004e9ff26ec5558bc6038341f05799bb1a084b3c5f328db057c1d2212142d5804621f3ac0d88682c833da39216f70d90d9ee578d0c1a495994cb6de20d7b4db751464135b4cbd51a8db9c11e15c537c9ec7ecc2dabac261bf429cf1bdea109951aba4672637ca7b1bc33d14f116b7f8c5140eff29ac75fe884914b36b126ceab01eb416b8ad2f97882a89990239bd787d4dced917723f325e4e84ba56858d429eefba0fa0e39c8ad07140542007baea0d1a6cae89f9a9383f697c62bbee10de1f6f266604211415398051b4e629b195e81f8ff3f1dbd3dbdf5daf2834ecd992c9413a6baa78280cfd9cc47e28a3d164046cd3f8a603927d0f78cb3cce63066321b56ad4ab0feecf042c901d94d67afbb0857a1323fd6d4ad7e6530d4c9e5c0b036057b8ef483641a9574d19b623b2bebab2a01df9c5201d20f54a0743cdfd72652e57ca9a35f9f3bb054cdccf06668ee5d444cc9a634f912444b2315e130ed3ffda46e86e125f39273a760f512288af5bf0261fa84ed8f012f58cd9c5047d45e937ab5b8a732d08ee05b6320f71a05804c7517638e414623482cf21d5f9b9f8b73284525a111e8390951ff09a885512cacaf0d2f5305a7e631368858062179c25ffcf70832aeee850fc947fb3a70532de8902b2aff1f0d335458e1312e9e68f8968537035b6354c111c417d00739a437f7fd5117cab703d1244702fac2a7c35df90a2353cbda549d275945ba42ebdfe32a1450abc9b83718786d0a1e4b5368875c2435ebd56d5b8ed95f9bb608d06304d0d47783b6c845acfc9f3c3021ec71e00b606f63159857142dee90f4e641d2f18f87da7ee8083ea28056d46480a4d6683dfc36ba8efbbfc016c88d136d7beb074749e1cdb96fd54b5346c98138e7a8d017b3ae6f83ec19123fd3ebe4945ed8ad4dea08c1d3f08b655a4d3e709c44d257c78dabcb2f635cd3dd094b08e397648c0a4055f0d2c72ddd62d96dddaab11a6be7f22170acfab6641a038599c486aecb024eee92cf919772175b00f822091b541929fbb6fdf8988fdbede905cd05253dd48417ae274e8838aa5c698028dc62933298f7605192640be52989037671479403c4f3c2ed5e5d4b35ed84049b50ccd5d6907493bc0b0bd01e94bc6dba64b2e9805b6352a8132b5068cbe3e984a2fdf817778e1e0637981e794381c76e382db7ae4bead09d3d694fa0e0ba77254d73ee473cd28a7dd5f8806c813022cc2f5fdec0de2e759162a93e25469c57f92d2b220dc3d7d5511d896bbf25e12bbd63d254fb19934bc184bf2967df4727c46b842a92c993ab21722c3cb9281a2fd70433309b135651ff2876a11f001f2c38d0d6613178c63615c559a185c3ce7f0635a7da6e49eda55d3bfce6bde7a0d6e198e541") ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f00000000c0)={{0x6, 0x8000, 0x9, 0x2, 0x0, 0x2}, 0x3}) setsockopt$inet_int(r1, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 915.760568] binder: BINDER_SET_CONTEXT_MGR already set [ 915.761014] binder: 2687:2717 got reply transaction with no transaction stack [ 915.847953] binder: 2687:2717 transaction failed 29201/-71, size 0-0 line 2801 [ 915.854238] binder: 2687:2716 ioctl 40046207 0 returned -16 17:19:52 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0xa, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:52 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x400, 0x0) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000100)=0x2, 0x4) getsockopt$EBT_SO_GET_INIT_ENTRIES(r1, 0x0, 0x83, &(0x7f00000003c0)={'broute\x00', 0x0, 0x3, 0xea, [], 0x8, &(0x7f0000000240)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f00000002c0)=""/234}, &(0x7f0000000000)=0x78) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:19:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 916.076995] binder: 2723:2724 got reply transaction with bad transaction stack, transaction 765 has target 26829:0 [ 916.167301] binder: 2723:2724 transaction failed 29201/-71, size 0-0 line 2816 [ 916.272854] binder: 2723:2729 got reply transaction with bad transaction stack, transaction 767 has target 26829:0 [ 916.351742] binder: 2723:2729 transaction failed 29201/-71, size 0-0 line 2816 [ 916.463569] binder: release 2723:2729 transaction 767 out, still active [ 916.513667] binder: undelivered TRANSACTION_COMPLETE [ 916.548455] binder: undelivered TRANSACTION_ERROR: 29201 [ 916.603276] binder: release 2723:2724 transaction 765 out, still active [ 916.644526] binder: undelivered TRANSACTION_COMPLETE [ 916.671438] binder: undelivered TRANSACTION_ERROR: 29201 17:19:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x34]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:53 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x8002, 0x0) r4 = getpid() write$P9_RGETLOCK(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="1e00000037020001030000000000000087d700003f9e96ca860bfc56000000", @ANYRES32=r4, @ANYBLOB='\x00\x00'], 0x1e) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:19:53 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x48, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 916.935578] binder: BINDER_SET_CONTEXT_MGR already set [ 916.976279] binder: 2748:2753 ioctl 40046207 0 returned -16 17:19:53 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0xc0010020]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:53 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0xc0010140]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:53 executing program 1: r0 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000100)={0x0, 0x0, {0x30, 0xf, 0x2, 0x18, 0xb, 0x9, 0x3, 0x91, 0x1}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet_udplite(0x2, 0x2, 0x88) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x4e24, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(0xffffffffffffffff, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8937, &(0x7f00000001c0)={'bpq0\x00', @ifru_settings={0x5, 0x7fffffff, @fr=&(0x7f0000000140)={0x7, 0x7, 0x10000, 0x6c, 0x2, 0x7, 0x7}}}) ioctl$sock_ifreq(r3, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:19:53 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x4c, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 917.236321] binder: BINDER_SET_CONTEXT_MGR already set [ 917.241740] binder: 2765:2767 ioctl 40046207 0 returned -16 [ 917.387218] binder: 2765:2778 got reply transaction with bad transaction stack, transaction 770 has target 26829:0 17:19:54 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) r3 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x1, 0x2) readlinkat(r3, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=""/11, 0xb) [ 917.434696] binder: 2765:2778 transaction failed 29201/-71, size 0-0 line 2816 17:19:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:54 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) utime(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x706, 0x8}) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 917.955772] binder_alloc: binder_alloc_mmap_handler: 2765 20001000-20004000 already mapped failed -16 [ 918.014018] binder: BINDER_SET_CONTEXT_MGR already set [ 918.038560] binder: 2765:2778 ioctl 40046207 0 returned -16 [ 918.062610] binder: 2765:2797 got reply transaction with no transaction stack [ 918.097365] binder: 2765:2797 transaction failed 29201/-71, size 0-0 line 2801 [ 918.145135] binder: release 2765:2778 transaction 770 out, still active [ 918.160223] binder: undelivered TRANSACTION_COMPLETE [ 918.191745] binder: undelivered TRANSACTION_ERROR: 29201 [ 918.228635] binder: release 2765:2781 transaction 772 out, still active [ 918.272054] binder: undelivered TRANSACTION_COMPLETE [ 918.288720] binder: undelivered TRANSACTION_ERROR: 29201 17:19:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x3a]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:55 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) creat(&(0x7f00000000c0)='./file0\x00', 0x60) syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x9a, 0x50040) syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x10001, 0xc80) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:19:55 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x60, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:55 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r1, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f0000000080)={0x80, 0x0, 0x2}) 17:19:55 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0xc0000103]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 918.544193] binder: BINDER_SET_CONTEXT_MGR already set [ 918.587293] binder: 2806:2811 got reply transaction with bad transaction stack, transaction 774 has target 26829:0 [ 918.619857] binder: 2806:2810 ioctl 40046207 0 returned -16 17:19:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 918.635752] binder: 2806:2811 transaction failed 29201/-71, size 0-0 line 2816 [ 918.663970] binder_alloc: binder_alloc_mmap_handler: 2806 20001000-20004000 already mapped failed -16 [ 918.689910] binder: BINDER_SET_CONTEXT_MGR already set 17:19:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 918.711159] binder: 2806:2810 ioctl 40046207 0 returned -16 [ 918.733217] binder: 2806:2829 got reply transaction with no transaction stack [ 918.750317] binder: 2806:2829 transaction failed 29201/-71, size 0-0 line 2801 17:19:55 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000240)={'filter\x00', 0xfa, "9a4cb28cbfa2df3cc21c6f1619644bc7fce663f637f90a3410c0b6672a149ff22042da8f72ad3a768d456bfa5439ef080db04103197b399de8dffc1400eefc14523bd67f1d76440c893252f80fc96cebb0fc882c16e8595ba60182cac64b773e269694d1bf29ff90053ecf95fd4b553730d865d0575b6981a4a3e95c5795b6da0567f774528d67ec5e27cbe44009eaeadf6ee6afad0bcc94ef7e3c708eee7726fe6fec4b51daea6bccaa1f1949b201de7a56ccf31cbf06d132f6d16ca8c3c854e50cc1de101e68cfd1ffac7a873d39203b7a401dcef6cf3d268e81ef8f2218602a4b39799ccfd0aa2c69ebcf3d6b2810862e67b563cc28cd9231"}, &(0x7f0000000380)=0x11e) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) getpeername$netrom(r0, &(0x7f00000000c0)={{0x3, @null}, [@default, @bcast, @remote, @netrom, @bcast, @null, @bcast, @rose]}, &(0x7f0000000140)=0x48) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 918.768600] binder: release 2806:2811 transaction 774 out, still active [ 918.778283] binder: undelivered TRANSACTION_COMPLETE [ 918.831401] binder: undelivered TRANSACTION_ERROR: 29201 17:19:55 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x68, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 918.876769] binder: release 2806:2817 transaction 776 out, still active [ 918.883546] binder: undelivered TRANSACTION_COMPLETE [ 918.958433] binder: undelivered TRANSACTION_ERROR: 29201 [ 918.989262] binder: 2837:2839 got reply transaction with bad transaction stack, transaction 778 has target 26829:0 17:19:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:55 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x800, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000080)=0x32, 0xfffffffffffffe26) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) ioctl$sock_rose_SIOCADDRT(r1, 0x890b, &(0x7f0000000240)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x0, @default, @netrom={'nr', 0x0}, 0x7, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default]}) [ 919.087707] binder: 2837:2839 transaction failed 29201/-71, size 0-0 line 2816 [ 919.183980] binder: 2837:2841 got reply transaction with bad transaction stack, transaction 780 has target 26829:0 [ 919.260616] binder: release 2837:2839 transaction 778 out, still active [ 919.269586] binder: 2837:2841 transaction failed 29201/-71, size 0-0 line 2816 [ 919.279418] binder: undelivered TRANSACTION_COMPLETE [ 919.308018] binder: undelivered TRANSACTION_ERROR: 29201 [ 919.331722] binder: release 2837:2841 transaction 780 out, still active [ 919.366916] binder: undelivered TRANSACTION_COMPLETE [ 919.393966] binder: undelivered TRANSACTION_ERROR: 29201 17:19:56 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x3b]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:56 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x6c, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:56 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000140)={0x1, 0x20}, 0x8) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0x2000, 0x0) r4 = openat$cgroup(r3, &(0x7f0000000100)='syz1\x00', 0x200002, 0x0) connect$l2tp(r3, &(0x7f00000001c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r4, 0x0, 0x3, 0x1, 0x1, {0xa, 0x4e24, 0xf3, @mcast2, 0x9}}}, 0x3a) 17:19:56 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r1, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f0000000080)={0x80, 0x0, 0x2}) 17:19:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:56 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0xc0000102]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 919.854002] binder: BINDER_SET_CONTEXT_MGR already set [ 919.873798] binder: 2867:2873 got reply transaction with bad transaction stack, transaction 782 has target 26829:0 17:19:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 919.923363] binder: 2867:2869 ioctl 40046207 0 returned -16 [ 919.952696] binder_alloc: binder_alloc_mmap_handler: 2867 20001000-20004000 already mapped failed -16 17:19:56 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r3 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0xffff, 0x800) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000001c0)={0xffffffffffffffff}, 0x106, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000480)={0x5, 0x10, 0xfa00, {&(0x7f0000000240), r4, 0x1}}, 0x18) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) setsockopt$inet_icmp_ICMP_FILTER(r5, 0x1, 0x1, &(0x7f0000000100)={0x9}, 0x4) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 920.003565] binder: BINDER_SET_CONTEXT_MGR already set [ 920.038941] binder: 2867:2869 ioctl 40046207 0 returned -16 [ 920.063513] binder: 2867:2882 got reply transaction with no transaction stack [ 920.130588] binder: release 2867:2873 transaction 782 out, still active [ 920.142843] binder: undelivered TRANSACTION_COMPLETE 17:19:57 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(0xffffffffffffffff, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x9, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0xa, 0x642668d3, 0x0, 0x3f, 0xa, r2, 0xff}, 0x2c) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 920.175037] binder: undelivered TRANSACTION_ERROR: 29201 17:19:57 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x74, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 920.218053] binder: release 2867:2876 transaction 784 out, still active [ 920.270491] binder: undelivered TRANSACTION_COMPLETE [ 920.308626] binder: undelivered TRANSACTION_ERROR: 29201 17:19:57 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000600)={{0x2, 0x4e20, @multicast1}, {0x306}, 0x8, {0x2, 0x4e21, @remote}, 'bridge_slave_1\x00'}) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) recvmsg(r0, &(0x7f0000000440)={&(0x7f00000000c0)=@x25={0x9, @remote}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000240)=""/194, 0xc2}, {&(0x7f0000000340)=""/251, 0xfb}, {&(0x7f0000000140)=""/33, 0x21}], 0x3, &(0x7f0000000500)=""/242, 0xf2}, 0x100) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:19:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 920.405316] binder: BINDER_SET_CONTEXT_MGR already set [ 920.469709] binder: 2892:2894 got reply transaction with no transaction stack [ 920.524212] binder: 2892:2893 ioctl 40046207 0 returned -16 17:19:57 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x48]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:57 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x7a, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:57 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r1, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f0000000080)={0x80, 0x0, 0x2}) 17:19:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 921.034893] binder: 2912:2913 got reply transaction with bad transaction stack, transaction 788 has target 26829:0 [ 921.095296] binder_transaction: 3 callbacks suppressed [ 921.095314] binder: 2912:2913 transaction failed 29201/-71, size 0-0 line 2816 17:19:58 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 921.142649] binder: 2912:2922 got reply transaction with no transaction stack [ 921.163443] binder: BINDER_SET_CONTEXT_MGR already set 17:19:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 921.189709] binder: 2912:2913 ioctl 40046207 0 returned -16 [ 921.212273] binder: release 2912:2913 transaction 788 out, still active [ 921.230099] binder: 2912:2922 transaction failed 29201/-71, size 0-0 line 2801 [ 921.238986] binder: undelivered TRANSACTION_COMPLETE 17:19:58 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x300, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 921.263730] binder: undelivered TRANSACTION_ERROR: 29201 [ 921.294576] binder: release 2912:2921 transaction 790 out, still active [ 921.343004] binder: undelivered TRANSACTION_COMPLETE [ 921.371473] binder: undelivered TRANSACTION_ERROR: 29201 17:19:58 executing program 1: r0 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x6, 0x34080) write$vhci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="b90000000d385dbc5f61000000000068c7e9e61abc93e9494cae3aad58ee0ec9a859bf3ba77e1d68fa6585da6eb28945fd10"], 0xf) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000100)={0x1, [0x0]}, &(0x7f00000001c0)=0x8) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x81, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000280)=0x100c808, 0x4) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000240)) 17:19:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 921.512292] binder: BINDER_SET_CONTEXT_MGR already set 17:19:58 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x3a]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 921.556751] binder: 2934:2935 ioctl 40046207 0 returned -16 [ 921.591630] binder: 2934:2939 got reply transaction with bad transaction stack, transaction 792 has target 26829:0 17:19:58 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x500, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 921.657219] binder: 2934:2939 transaction failed 29201/-71, size 0-0 line 2816 17:19:58 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)) syz_open_dev$cec(&(0x7f0000000140)='/dev/cec#\x00', 0x3, 0x2) syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x6, 0x40000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400201) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x1, 0x1df) ioctl$TUNSETVNETBE(r3, 0x400454de, &(0x7f0000000100)) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 921.829986] binder: BINDER_SET_CONTEXT_MGR already set [ 921.852007] binder: 2953:2955 got reply transaction with bad transaction stack, transaction 794 has target 26829:0 [ 921.875234] binder: 2953:2954 ioctl 40046207 0 returned -16 [ 921.962430] binder: 2953:2955 transaction failed 29201/-71, size 0-0 line 2816 [ 921.972041] binder_alloc: binder_alloc_mmap_handler: 2953 20001000-20004000 already mapped failed -16 [ 921.991966] binder: BINDER_SET_CONTEXT_MGR already set [ 921.999071] binder: 2953:2954 ioctl 40046207 0 returned -16 [ 922.013649] binder: 2953:2964 got reply transaction with no transaction stack [ 922.023380] binder: 2953:2964 transaction failed 29201/-71, size 0-0 line 2801 17:19:59 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x49]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:19:59 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r1, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 17:19:59 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x600, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:59 executing program 1: socketpair$unix(0x1, 0x100000000002, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$ceph(&(0x7f0000000240)='ceph\x00', &(0x7f0000000280)='./file0\x00', 0x6, 0x1, &(0x7f0000000300)=[{&(0x7f00000002c0)="2d4daae3b890b7c967e8cbe36c39bdf1c01aa508de80217eb9897f20d3e5ae7b5af2116320b9ecef54c3593bf1b62fd3cba3911f1973b4eecd", 0x39, 0x800}], 0x840080, &(0x7f0000000340)='&em1vboxnet1}\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_open_dev$sndpcmp(&(0x7f00000003c0)='/dev/snd/pcmC#D#p\x00', 0x0, 0xa000) ioctl$sock_bt_cmtp_CMTPCONNDEL(r2, 0x400443c9, &(0x7f0000000400)={{0x4, 0x26ed800000000, 0x400001, 0x5c, 0x39b4}, 0x7fff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x20000, 0x0) socket$isdn(0x22, 0x3, 0x31) ioctl$KVM_SET_XSAVE(r4, 0x5000aea5, &(0x7f0000000500)={"f0d720cdf3978f8821b09ad62d81b3a3770f19b404664e0b2a4fbe7fc9b30eaa12dd9cc3fb71cc9a8d9fbbf1b646a8561a1c71db65a59c7455db61d5ddc7ce1d9382b23f3073892f7c309432ff27b6a0aacfdb1b3fb6fefd6ce511d34958051d84201b19053982794355f1ebfc5e7bf9eb4a9938098aabc46c5aef73df8dcf74fcfe9bc97e3f964b72c0aaea1c90126544a897f08f6a86d0302a445e390b5e5e36a04450ac9ffe67c036bd4fb1a44ac9e8591c1c95915bb86f902a7191f95e0aed75d17e931ecd95d98357104bd7ed77ae3447d3cd3168497d7c4b119ce6e437a6086dcc4dc5907a51fee960d075aaec340cbae5574e57a12dae387eb2c9180c5cb0bde8cb4388fc34ec369111ae6c31b4678b823def402fdf850dbf6654915eb5072760001fac42c1306181fe8e26d4950cccc5b0dde8bfbfe85c4d88a26a081f868fc47a6908d553ac0eae7f9b45055e089761789eddd8c366b85b304f2332f0506fac85ea0060b9054a4ce587bd298ac25876a312e4c3c3eff638861b1bda0b6413de0e5478bf3c5c1dfaad13d706790181b663a0f21e85e6842a239ed2e6dcda0dde3c03916ed0986db520b506b2d79fa5134d631f6f7e6773b8bfff0316f0a756c253ff10cd51513bd8e9ca7cd8d73f4c38b8c16b777992130fd9b3bfb85a1a6d04c48e4b0d515bfd6c8f5670635779ed1c47a8b8a2dd72b8d6502438042726c2e9b822f2e9c04622ed6c7fbf92572ef78d93c2a77852ab6f58441efb21995ad98c60ce3eb9d928fc901739ee1740613a36d3c267308c3657ed3e03bea2143f570961417caa417ace78ee6e7903f64f7fd58199e0f8b339eabc2758e835dc7ed68af90726ff885d3de5dde3f29b420a057413d4f62aaf77841300f332cf07268553e870ac71627fe0ad7f2f7135f67d407883aac8ce9b9d32fbc17c306a882b41b22aecd06e4e19188352da3e7db6b8f54d953b00fe53e16bb70d25d38ad2f2b9ab4ccfdd63c4705270163af8ee6189df5f4dfec37d2841c41b66b93f79d67208ca784f0cde37247d2f9fec190461f20afc6e4b5e7c3895ba3678edb5a6049bca9abb461078d99bc1697b9aee205e4342577b14db6279ebb8b4e6cb8aad0728ac8aac605781fca9bbbb2f3295a955e02da7bdc818bb36243a9977fb70951fae2e88fb643cb92e75972762e8f0f2afcf24ae58b9e3aa597af88041077ad5b4b4384b190a9615e5eacafc6a93899c9c6801147a3a370685951da33a6e41a8a26a6b0593c017b85a11f883a226c7c7dcd4eb3631d02f6c59bfcc6950e93790bb8542bae18b7f1b7baa4bb19706828e731f8db95008c493d5067549d2750d2fcd25657b38959bb9039e2e503ecb4f5d4d2b695dbd3192a153bba8d88b321504537467eeb3c6beffd9463b722e3ebfb87a58296b6b6a6d92c4bc4fa0ce72d3f5"}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r4, 0xc05c5340, &(0x7f0000000100)={0x1, 0x80, 0x1, {0x77359400}, 0x6, 0x7f}) ioctl$KVM_SET_MP_STATE(r4, 0x4004ae99, &(0x7f00000001c0)=0x8) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 922.420181] binder: BINDER_SET_CONTEXT_MGR already set 17:19:59 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x4000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x3) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000100)={0x1, 'netdevsim0\x00', 0x2}, 0x18) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 922.481286] binder: 2970:2973 ioctl 40046207 0 returned -16 [ 922.547832] binder: 2970:2973 got reply transaction with no transaction stack [ 922.623121] binder: 2970:2973 transaction failed 29201/-71, size 0-0 line 2801 17:19:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 922.667828] binder_alloc: binder_alloc_mmap_handler: 2970 20001000-20004000 already mapped failed -16 17:19:59 executing program 1: r0 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x0, 0x0) ioctl$VIDIOC_G_PRIORITY(r0, 0x80045643, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 922.776495] binder: BINDER_SET_CONTEXT_MGR already set [ 922.794600] binder: 2970:2973 ioctl 40046207 0 returned -16 17:19:59 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r4 = accept(r0, &(0x7f0000000240)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000140)=0x80) ioctl$SIOCX25SENDCALLACCPT(r4, 0x89e9) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x1) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x50, r5, 0x500, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0xa}}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xff}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40004}, 0x0) fcntl$setlease(r2, 0x400, 0x3) r6 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x4, 0x10000) bind$vsock_dgram(r6, &(0x7f0000000100)={0x28, 0x0, 0xffffffff, @reserved}, 0x10) 17:19:59 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x3a]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:19:59 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x700, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:19:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 923.150823] binder: BINDER_SET_CONTEXT_MGR already set [ 923.206425] binder: 3007:3013 got reply transaction with no transaction stack [ 923.235428] binder: 3007:3012 ioctl 40046207 0 returned -16 [ 923.267529] binder: 3007:3013 transaction failed 29201/-71, size 0-0 line 2801 [ 923.320607] binder_alloc: binder_alloc_mmap_handler: 3007 20001000-20004000 already mapped failed -16 [ 923.349113] binder: BINDER_SET_CONTEXT_MGR already set [ 923.363686] binder: 3007:3012 ioctl 40046207 0 returned -16 [ 923.382266] binder: 3007:3020 got reply transaction with no transaction stack [ 923.397064] binder: 3007:3020 transaction failed 29201/-71, size 0-0 line 2801 [ 923.409565] binder_release_work: 2 callbacks suppressed [ 923.409572] binder: undelivered TRANSACTION_ERROR: 29201 [ 923.423179] binder_thread_release: 3 callbacks suppressed [ 923.423189] binder: release 3007:3016 transaction 801 out, still active [ 923.514730] binder_release_work: 3 callbacks suppressed [ 923.514735] binder: undelivered TRANSACTION_COMPLETE 17:20:00 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x79]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:00 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x4e22, @broadcast}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r0, 0x100000008929, &(0x7f0000000100)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_ivalue=0x2}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:00 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r1, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) 17:20:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:00 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0xa00, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 923.584805] binder: release 3007:3016 transaction 803 out, still active [ 923.591586] binder: undelivered TRANSACTION_COMPLETE [ 923.624784] binder: undelivered TRANSACTION_ERROR: 29201 [ 923.747176] binder: BINDER_SET_CONTEXT_MGR already set 17:20:00 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x46, &(0x7f0000000100)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x10000, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_addrs=@can={0x1d, r3}}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 923.785833] binder: 3031:3036 got reply transaction with bad transaction stack, transaction 805 has target 26829:0 17:20:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 923.857726] binder: 3031:3034 ioctl 40046207 0 returned -16 [ 923.892161] binder: 3031:3036 transaction failed 29201/-71, size 0-0 line 2816 17:20:00 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r3 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x5, 0x220240) ioctl$KVM_GET_NR_MMU_PAGES(r3, 0xae45, 0x7) ioctl$KDGETLED(r3, 0x4b31, &(0x7f0000000100)) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 923.953971] binder_alloc: binder_alloc_mmap_handler: 3031 20001000-20004000 already mapped failed -16 17:20:01 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x2000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 924.162094] binder: release 3031:3034 transaction 807 out, still active [ 924.174263] binder: undelivered TRANSACTION_COMPLETE [ 924.226172] binder: release 3031:3036 transaction 805 out, still active [ 924.273800] binder: undelivered TRANSACTION_COMPLETE [ 924.301821] binder: 3062:3063 got reply transaction with bad transaction stack, transaction 808 has target 26829:0 [ 924.309990] binder: undelivered TRANSACTION_ERROR: 29201 [ 924.359109] binder: 3062:3063 transaction failed 29201/-71, size 0-0 line 2816 [ 924.422555] binder: 3062:3065 got reply transaction with bad transaction stack, transaction 810 has target 26829:0 [ 924.454507] binder: release 3062:3065 transaction 810 out, still active [ 924.475725] binder: undelivered TRANSACTION_COMPLETE [ 924.493299] binder: undelivered TRANSACTION_ERROR: 29201 [ 924.503639] binder: release 3062:3063 transaction 808 out, still active [ 924.523531] binder: undelivered TRANSACTION_COMPLETE [ 924.545640] binder: undelivered TRANSACTION_ERROR: 29201 17:20:01 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x60000000, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:01 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) fcntl$F_SET_FILE_RW_HINT(r2, 0x40e, &(0x7f0000000240)=0x2) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000140), &(0x7f00000001c0)=0x4) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000100)={0xc0000001}) 17:20:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:01 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x8b]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:01 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x3f00, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:01 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r1, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) 17:20:01 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x60000000, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:01 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x4200, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r1, 0x114, 0x1, &(0x7f00000001c0)={0x2, 0x4e22, @empty}, 0x10) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) ioctl$KVM_ASSIGN_SET_MSIX_NR(r4, 0x4008ae73, &(0x7f0000000100)={0x401, 0x7335}) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:01 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x10000000892b, &(0x7f0000000200)={'bWnl0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 924.900603] binder: BINDER_SET_CONTEXT_MGR already set [ 924.928739] binder: BINDER_SET_CONTEXT_MGR already set 17:20:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:01 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x60000000, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 924.954881] binder: 3091:3092 ioctl 40046207 0 returned -16 [ 924.959677] binder: 3094:3109 got reply transaction with no transaction stack [ 924.978668] binder: 3094:3103 ioctl 40046207 0 returned -16 17:20:01 executing program 1: r0 = dup(0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0a85322, &(0x7f00000000c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_int(r0, 0x29, 0xd1, &(0x7f00000001c0), &(0x7f0000000240)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x3f) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) socket$inet6(0xa, 0x80003, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) stat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$msdos(&(0x7f0000000280)='msdos\x00', &(0x7f00000002c0)='./file0\x00', 0x6ddda52e, 0x1, &(0x7f0000000340)=[{&(0x7f0000000300)="44934f48f177905b", 0x8, 0x1}], 0x24000, &(0x7f0000000440)={[], [{@dont_hash='dont_hash'}, {@fowner_gt={'fowner>', r4}}]}) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 925.034427] binder_alloc: binder_alloc_mmap_handler: 3094 20001000-20004000 already mapped failed -16 [ 925.065054] binder: BINDER_SET_CONTEXT_MGR already set 17:20:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:02 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x4800, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 925.109595] binder: 3094:3096 ioctl 40046207 0 returned -16 [ 925.122849] binder: BINDER_SET_CONTEXT_MGR already set [ 925.181953] binder: 3123:3124 ioctl 40046207 0 returned -16 [ 925.182145] binder: release 3094:3096 transaction 812 out, still active [ 925.228883] binder: undelivered TRANSACTION_COMPLETE [ 925.246595] binder: undelivered TRANSACTION_ERROR: 29201 [ 925.263268] binder: 3123:3124 got reply transaction with no transaction stack [ 925.276825] binder: release 3094:3109 transaction 815 out, still active [ 925.285524] binder: undelivered TRANSACTION_COMPLETE [ 925.292467] binder: 3123:3124 ioctl c0306201 20000000 returned -14 [ 925.306830] binder: undelivered TRANSACTION_ERROR: 29201 [ 925.313945] binder: release 3123:3136 transaction 816 out, still active [ 925.363582] binder: undelivered TRANSACTION_COMPLETE [ 925.371465] binder: BINDER_SET_CONTEXT_MGR already set [ 925.417000] binder: 3143:3148 ioctl 40046207 0 returned -16 17:20:02 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x9e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:02 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r3 = syz_open_dev$media(&(0x7f00000001c0)='/dev/media#\x00', 0x423, 0x202) setsockopt$rose(r3, 0x104, 0x7, &(0x7f0000000240)=0x7, 0x4) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x10000, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r4, 0x10e, 0x8, &(0x7f0000000100)=0x80000001, 0x4) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) setsockopt$bt_BT_FLUSHABLE(r4, 0x112, 0x8, &(0x7f0000000140)=0xfffffffffffffff9, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:02 executing program 4 (fault-call:8 fault-nth:0): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:02 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x4c00, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:02 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r1, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) [ 925.927480] binder: BINDER_SET_CONTEXT_MGR already set [ 925.927761] FAULT_INJECTION: forcing a failure. [ 925.927761] name failslab, interval 1, probability 0, space 0, times 0 [ 925.944122] CPU: 1 PID: 3171 Comm: syz-executor4 Not tainted 5.0.0-rc4 #49 [ 925.951169] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 925.959860] binder: 3164:3174 ioctl 40046207 0 returned -16 [ 925.960526] Call Trace: [ 925.968816] dump_stack+0x1db/0x2d0 [ 925.972455] ? dump_stack_print_info.cold+0x20/0x20 [ 925.977503] should_fail.cold+0xa/0x15 [ 925.977521] ? mark_held_locks+0x100/0x100 [ 925.977539] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 925.977558] ? find_held_lock+0x35/0x120 [ 925.985663] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 925.985688] __should_failslab+0x121/0x190 [ 925.985707] should_failslab+0x9/0x14 [ 925.985739] kmem_cache_alloc+0x47/0x710 [ 926.012499] dst_alloc+0x10e/0x1d0 [ 926.016060] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 926.021639] rt_dst_alloc+0xf6/0x510 17:20:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:02 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x23}}, 0x5) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20ncci\x00', 0x40400, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r4, 0x10, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) r5 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x10000, 0x0) ioctl$VIDIOC_DBG_G_REGISTER(r5, 0xc0385650, &(0x7f0000000100)={{0x0, @addr=0x9}, 0x8, 0xffffffffffffffe1, 0x7fff}) [ 926.025371] ? fnhe_flush_routes+0x450/0x450 [ 926.029841] ? __lock_is_held+0xb6/0x140 [ 926.033961] ip_route_output_key_hash_rcu+0xa32/0x3470 [ 926.039270] ? ip_route_input_noref+0x280/0x280 [ 926.043963] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 926.043985] ? check_preemption_disabled+0x48/0x290 [ 926.044029] ? kasan_check_read+0x11/0x20 [ 926.044047] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 926.044063] ? rcu_softirq_qs+0x20/0x20 [ 926.044118] ip_route_output_key_hash+0x25d/0x400 [ 926.044139] ? ip_route_output_key_hash_rcu+0x3470/0x3470 [ 926.044191] ? __lock_is_held+0xb6/0x140 [ 926.044214] ip_route_output_flow+0x28/0xc0 [ 926.044238] ip4_datagram_release_cb+0xa9f/0x1390 [ 926.044260] ? ip4_datagram_connect+0x50/0x50 [ 926.044284] ? rwlock_bug.part.0+0x90/0x90 [ 926.044299] ? lockdep_hardirqs_on+0x415/0x5d0 [ 926.044325] ? ip4_datagram_connect+0x50/0x50 [ 926.044341] release_sock+0x10f/0x2b0 [ 926.044359] ? __release_sock+0x3a0/0x3a0 [ 926.044377] ? __local_bh_enable_ip+0x15a/0x270 [ 926.044400] do_ip_setsockopt.isra.0+0xdf9/0x4950 [ 926.044415] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 926.044433] ? ip_ra_control+0x640/0x640 [ 926.044446] ? add_lock_to_list.isra.0+0x450/0x450 [ 926.044459] ? lock_downgrade+0x910/0x910 [ 926.044474] ? add_lock_to_list.isra.0+0x450/0x450 17:20:03 executing program 4 (fault-call:8 fault-nth:1): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 926.044489] ? __check_object_size+0xa3/0x790 [ 926.044502] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 926.044518] ? __fget+0x472/0x710 [ 926.044534] ? find_held_lock+0x35/0x120 [ 926.044549] ? __fget+0x472/0x710 [ 926.044566] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 926.044584] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 926.044600] ? aa_label_sk_perm+0x103/0xa10 [ 926.044612] ? lock_downgrade+0x910/0x910 [ 926.044636] ? kasan_check_read+0x11/0x20 [ 926.044654] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 926.044672] ? rcu_read_unlock_special+0x380/0x380 [ 926.044688] ? aa_profile_af_perm+0x420/0x420 [ 926.044720] ? ___might_sleep+0x1e7/0x310 [ 926.044737] ? arch_local_save_flags+0x50/0x50 [ 926.044749] ? iterate_fd+0x4b0/0x4b0 [ 926.044768] ? lock_downgrade+0x910/0x910 [ 926.044789] ? __might_sleep+0x95/0x190 [ 926.044807] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 926.044822] ? aa_sk_perm+0x234/0x8e0 [ 926.044838] ? __fget_light+0x2db/0x420 [ 926.044855] ? aa_af_perm+0x5d0/0x5d0 [ 926.044877] ip_setsockopt+0x49/0x100 [ 926.044897] udp_setsockopt+0x68/0xb0 [ 926.044916] sock_common_setsockopt+0x9a/0xe0 [ 926.044938] __sys_setsockopt+0x1b0/0x3a0 [ 926.044957] ? kernel_accept+0x310/0x310 [ 926.044970] ? lockdep_hardirqs_on+0x415/0x5d0 [ 926.044987] ? trace_hardirqs_on+0xbd/0x310 [ 926.045007] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 926.045023] ? trace_hardirqs_off_caller+0x300/0x300 [ 926.045046] __x64_sys_setsockopt+0xbe/0x150 [ 926.045068] do_syscall_64+0x1a3/0x800 [ 926.045087] ? syscall_return_slowpath+0x5f0/0x5f0 [ 926.045117] ? prepare_exit_to_usermode+0x232/0x3b0 [ 926.045139] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 926.045163] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 926.045175] RIP: 0033:0x458099 [ 926.045190] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 926.045199] RSP: 002b:00007f82dc4c3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 926.045214] RAX: ffffffffffffffda RBX: 00007f82dc4c3c90 RCX: 0000000000458099 17:20:03 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x6000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:03 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cuse\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4001ff) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:03 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 926.045223] RDX: 0000000400000007 RSI: 0000000000000000 RDI: 0000000000000006 [ 926.045232] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 926.045241] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82dc4c46d4 [ 926.045250] R13: 00000000004c5e8f R14: 00000000004da2f0 R15: 0000000000000007 [ 926.152427] binder: release 3164:3174 transaction 819 out, still active [ 926.461295] binder: undelivered TRANSACTION_COMPLETE 17:20:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0xc0]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:03 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r3 = dup2(r2, r0) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f00000000c0)={'eql\x00', @link_local}) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000100)={'bond_slave_1\x00'}) 17:20:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:03 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x3, 0x400000007, 0x0, 0x0) 17:20:03 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r1, 0x2000}], 0x1, 0x400) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 17:20:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:03 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x11, 0x400000007, 0x0, 0x0) 17:20:03 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe2(&(0x7f0000000500)={0xffffffffffffffff}, 0x7fffd) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000001}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="9400c8fefc9410f008000000dfc040855b3444d52b92cb351afa74c3f0194997d9c5be0a133f568e522d12f8250ed306d4ca9891d02262df0c85ffb984a0d21688d75bf208c097f6bc475b7616d769ca4109ee2081840b9cbc969b02fb1f3df8f90cab6498cb5c50ee56c7", @ANYRES16=r2, @ANYBLOB="10062abd7000fbdbdf250d000000500004000c00010073797a31000000001c0007000800040008000000080003000200000008000200ff7f0000240007000800020000000000080002000600000008000300ffffffff080001001b0000002000020008000100016700000400040008000200ffffff7f0800010004001d0010000600080001000300000004000200"], 0x94}}, 0x84) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r3, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:03 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x88, 0x400000007, 0x0, 0x0) [ 927.123276] binder: undelivered TRANSACTION_ERROR: 29201 [ 927.132642] binder: undelivered TRANSACTION_ERROR: 29201 [ 927.153579] binder: undelivered TRANSACTION_ERROR: 29201 17:20:04 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x6800, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:04 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:04 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r0, 0x0, &(0x7f0000000100)={'ipddp0\x00', @ifru_names='team0\x00'}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:04 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0xc1]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:04 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x300, 0x400000007, 0x0, 0x0) 17:20:04 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000000c0)={0x2, 0xfffffffffffffffc, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:04 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:04 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r1, 0x2000}], 0x1, 0x400) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 17:20:04 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x1100, 0x400000007, 0x0, 0x0) 17:20:04 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) r0 = syz_open_dev$admmidi(&(0x7f0000001600)='/dev/admmidi#\x00', 0x4, 0x101000) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000001640)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400204) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) socketpair(0x2, 0x5, 0x80000000, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000016c0)='IPVS\x00') vmsplice(r4, &(0x7f0000002980)=[{&(0x7f0000001800)="10d5655fa99e36472447d31865d2d27029dc4b9d80c4b29749a42e20a5cd0dcfd013c3a4dbb3498d6d6f6aef58406db43c1d3476ce26fbf91afd839f0e4e7878c5b02bdf9fa93ecff60bf036d77fc54f2e759e9dc5d1b6887e75a396a6dcd8754243cd4d52ce7e690f99e8b1eb3a887d5b67248fe1110ff3c8f12ebc703783bd0c0e9983cbe0fc9962adddf775e932998e3357658aba6c8933e453312f44b4c41761c77fdebf6a02cf681fef245709e03a1050e487fc6e8ff276e87eaf81450de99e222e2b839c4dad0587321756c4f35330ea086e89c3a14bb15b66c6c9764fa4beea27fd99c3c1d03e3bcec14ff4", 0xef}, {&(0x7f0000001900)="07790b2ca528b963a83828e6150b1edc3b9b4b36f0020949cbd78114aaa0366c4c7c37126877511268559d706f8e07c4df47bdbebdaca4f509c7ec011efc269711eb6b8b85f4e0bc7a4b3edb324204ed4f238564e35f908b7d066486161bcc2ad85348960da9d1361c15de58e6ffb20f127e32a129bc3bb155b9c205920bcafe9a5764a686a045b3454f5cf27089558e52638950930c948e58f37c09c12674c836096a4e1c332ece4ccd26e2dc77e6e4db622996cfdb13b25862a8f45ea85ec7e37e67a77f42c2e5b07f3d9b6a38dac4fc85525c68d2757b2362b4e3c18aeedfd08ea9ca7309683b9c6fa105048269f2cfe38881512d5ed5829bf6c2a382a5038c2129adee22cf502b96d44d75fae9a7f5467aad1c1472490246dd125b8ac869fd3a56bd183c5a3fcb11ab653503b35f1a95b97c28d6fd8b476695d21ab9b545a92f73a4c83ddd5f77022c5a162d0a7a956a8bbe7a500b48c2fe813d740ec31a99b3fdff96d138604cfabb487527f0328982f27ede32f0a54e82e8b0c910dbfdad9342e439736169d2fb87d0d5631e8da2760aad33f40fafa29d8fc9a6aca789052089844aae0a172e6642f48186d69fa7d6b2a81d123f1e05234cec320bed8482a134e01f4d50b748ff3f8169a0ec2c15354de5108fdcaa979bbac618c5a0ff53de96625031c3a338949a38a0ce9888629c6ea563d6b745331259d49e92b6c057599df40a8411b107b2dfab86bbe36d826ae194b0bd8bee404feedd2db00b398c7c42e83d0e8b5ac7b1c723204529ea9728bef20ac641e272e368705889349e68881f7c1d748759f20e2f0b21bf779f6da7c93665997c192d3852211b584f11f3a19630e733b3b481ebe4964893eafeb6e4e9ee01a01a0438ce0e65e9ac933daec0945bf62f4558faecf3583fd0d4ba456a510091de686a31bffda5ccfbfa2f790d0190a213b18afbe178c10cab9af6ad8b856ce3da39871e93ed58104eb0aff3ef6dc052ef485b34e37c33ebe41aff03b4425d9d5affa6710b04d28c339f868379dcd486554221faf48d2a4f6d54f262dc2e2a6fe4bf1c97b49d5b5f1496cf91cdea8bd991a4031359f4364b8577912381f06dd01e376a14afa63e54e482c7ebe91161d672a33b6d7dea5915087407bfdfd9abbab38aaebd7c9589ad0f24fa7940f231fc7302de5113e86cf2c17b0381f00a70aa7c490af4e8d0d28ec7c203c19655b75835e9a7b00285c81b050045576d4eb3455a7cb5fa5ffe402111fde8380ca2022a5bdfe615e43343699d0badd2683dbd31f3bb8dbf90be0d11f4167eeab80f1a3d6f3edf6d5e1a13d3d6758f9904cc7ce0ad5c73897d1eedd0cfc633a9aa8a1c3d1b3a8682d9db637f00803a32e56d4bf3439497de1c934543c7e2c79245997cd0fec4d2a1f8dbd935aac141fd8e2710c89605e4be89be34d6f7f75a12eb6179d979fced83d9a91fe236b43da54476089d18b0a9275f462741380af93357610fba20d68069543110df401198fd39cf22f0b21d3bd72843021fb507c8e5564129dc7e57c34257b5365846978796e7e65608b3b835f1abe787ffa981d35d1ee414f5bb2e51bcd494568d7234446ea22b0575e4232af79fdfb378263f8cc299568cc2d0b54467c2821f854afb9410f6feacc96c3e52c97e548bcd9e3b7336f1e45b31b94cad9bee9ce0cd89948325b4ee75b3b9886c18bf7f356c23e869303035b3b09461dd5f6d136781bace7c1893988bbc581f7255903fc510133d2ffbc740637a389c8f83d175d21518822732e4452a5a3969f6919e9ea8d530da3a4ffe1fc924792001c5374bcae070eea5e59858445313011a807032b96d92e6a72d1204c8f7e574e48ca393310c5c380dad76b5ff6abac7478b6e26bd447ec79511d90d557832d3172f6552937074a769a51481b10d9b9aee78e0b3144bee1529558072bfe8acb6cc8fe5e1330c763aa4544e8bb4332c2642006312e83b1039202e80030178181f91a8e2f8f4bbed2dfe6b9c45103f4d7e72c0fc4c302eaa4475d50328fa1fcb4b9065b1ea474d49a2bc6440618ed77bc341966cc12ba78f8d561a7b6b47aa9d61396e9e889a3a6c693fd67fe37a0d2d4a5c3c5dae35787ea20788ba95c3e79c3e355688d4a9621bc110973984715736c55b2042df87c72c966ce041ff83999919d654abb2727e4abf743f1c7bff7780eda97ee4251b99a6a4974f6fb4965f8e9a83f45cd4b1baeecd188c9a5ef80c8c7c520120e8d6f8ef24cb5346f285fe2f8c684067475b6805c0c42339ead6eb7e1792a1ed9a298b68ceba55068d5a2a09891dc822ff954aff2cbb6dcb8810d79856dd2cd50d236c166f6dfcb65d46d50aad8f963174f2284ca83659fda3f4b49554f7b9ebe417aac2b51355adc5218f9610c1ca7533a476c631db5dbb5930add8003c3b4d38eaf0ce1cffdb4855574a05cc80162ac34f9ddbd4fcf94580e02bcdc758d84d5100c17af92bd92c0ba54ac371b11fbf7c33807412b3fe86665f3025ee08b4ab14a1479d8ff7027c95b62aa3e3614abc22ac105cafbc20cfb6b23d22053296d3e11f9666b3f0a574d02b94d95e4c17924ba6d66823bc2be8fb70ee7f01ef133321e4c5f81ec9dfccfed830a81b002476f2feee7a1757af99714dbf67251d07df0f1d8b43400fc343030e4f0c7fddc9ecb87a9a790db352ae4ae16e2c24098efadb6d2830a659ce729480f64b7de280bf07197fa4241de3b1b5c8019c5138febdefb870f0e2ba1067531c2687ac835d0c7f558b522c5a27d65ed3bd298589a27d897e928cef875ccf7b41dd63a490221c8045602b73714d67fd89837048cde32913fe60d7fb027cfc47f8f94b5f6f3ad1420ceeee7865c71e3d4af2c93532ae6befabdec5e9e7b62781862a7bb553b99ff261eaea5af438630a6d32eee57acd0ce7c93c9db2ca378c1660509f5b73d01e6e1c8bffa68a6f88eede58de369aaac5c8c3247970ac76c1ace20c2cb55778e8dd84008608b502643e550ef6043c4203fdba2a84e7f798ae1c0ae6d93e79c9b9518e674bb77f2c3e437a8e3db6fec1ef0851213e115d230744aa6f08b0186562ac965cf54832f42c6aa00c739e7e0369950008a4707764d637b3f78d0592a0451958be30b405f4fa3d3f9a3e1a4d71f7350bbe5a0c8261b53089dd46474daba213d47dbf485d52e4e052da3340d0652f3fec5cd0996f27abaed3933000dfff571b3b4b090d550020f1fb8e4d43185b1fe9eccfa302cd128d40cce1038a00a7e10f657110a046a310582e5f2bb8f0a1f289e33007ea353c8dbb5572fe6efba4905c85a51099ab0fb86d422e17f734c0211f2f96852b7fb77a2e39a1c990555927f94837372c6e33dd20dc07fb346a038d8925228f7e0a31971a69f8f2574ff864b00e16da4108c64e615a2ceb0bd54dabd8e7f51b3b5cf3fc69d754ec8acd900d95deba45fa3c461e77322a70f8c44c8746718e7bbf27fff2059b492873c2f4f668837b1ffb2010d524f61b1dab0c71af63a49bfe407849f7098d4b1a1ce3392972cf84cc0e5f30ab969fb6024fd547870f3b04241916cfe665d69e5716c18f6d49bf9180ee7d21dd74af6fe569fe9cef108b2c2dc31ebc533c17823ad1a024db75743efbfe2aa47161fdf6668d2d7e3160a2f26197fc161e51359203bbda0c2138ea0ea478389d3a163ec5bbcc5224b88fbc5ca01316a856b1668e8d873205022e0d1d0feaf39ef4c52102d6fb3ec149d3d70e211fe395b4644a58bd4fee09f5ef740f7d83b66e3c054c57de6c255be02eecabc9a47894ddafb1f9885edbf3bbc864e79ba6abe5e2dac1b58a87359358d0b9572af171fdf301845fe0c870ac2a0c46f89730c28c3e4714914e64b5c6f2b09208621794ce2de00ad0599775c6c33dcaf0537e6cb68c7297ca0118ded3417b940e962a3166745606a7661ab538f31d6c314d560e423a8771493dd5192b256d526401f7525358906b3d75770a44b547cebce133b719f992d7569c8743985ae634cf4b7e60dfd4fb3f433db338cf9105dd623abee9e1f6712c69d3d4210a4b0e94bba7149fe34b0da96fc69accaa40f3dbc56af5133799513fb4d1a5e252eeeffdb120ddfc81dec1a6258dd7a320d0af45e7ae67c2f3ede2c37510aef0e192d9207bf9b2c0432991784bc6da11b6b865d4fd4575b431011fddc9f1bc1ffd13ea5eea121b5d26141b7b8b45dfe15d8ca108f18499244f1dcf097f934acbfd354f2fd676a2625aa6a74006e99d5d1a7600c76d4a6adde230870df6db2ee4209fab33e62cb072682063c68454cfa8eb682036d909d27050dea781779f2a673d7f65abe7f075560047d5d199bcffca0f93a9e8715f210828774fac89e881e8b9a75ae2cdfc597daf2287def17280c16d0b296b00ddabae0c7673b1419213fbbfdfcd0a027b508ed046cc10837f94638e530ba015a925357c57fa7d8fd9c437bbbbcb20098988b26773b1d4798672cabec8632ef9b04a816de2dbb70db2ba55d58173a1a67fab7ee1452374c631ebba12197de7c4f4314ffb5a6857331819fec94674c275115c1e0be268ae6a5123c2222b20086ed406ba52eb351e528784a02b3064af2a10672ed9b36828c6ce8253c1edaa5fac5a2d119f5ff3ff1f730ff93e4963ac9112c3ffba92e2809655b7229fe90492ce8cd8955543e219500c8a6201bc227860cb7ad063516206613f10d79249c65d4218b30195485b6720fd72c5bdc026b14b88f4f03609821f05205e48abf7724b354c68100921ba51e009505303e89f38012a0f1123627d1b185c474ceedc4bfe57598993c858b8164d5999c088fca56fa20dfc788d0dc337f206e309ec028987013d41a1acfa4a087101c90a24a4fc327977102a5669211ef5c0ea89e6db5fd5dc65688d7453718c489a52f50620ae388fd993159b0904d81ecee4c43ebd213a2c6b2594b75d221c7f103376b01129d2284cd0879814925aab292aa571da754c5e92d35a1cbc77dd3874be64e69a0d26595f1b713b31d73fc6f985c5b1a41e61f206c6f401da6fac725275b5358948eea5eaeafeaa71be6d5f30eee7efa2c513fcf9f0caee335ae29aab0b0e0de1789dd4e57b0da73c896250be5b8d3cbd8793fcb666d721bd1679fb34047fe8562a5877e5bed1306ce73ea6afb23bbc241f7941d39b5ff0cbe3f4bb43c385cb538833efcdaf8ada9e2a51d34d24a85331e517cfc41524f0dcb94c2074ee9db047e557845abaf0c433d83c7af2c336154e10fc0f24261ca1ca1a62b109bcaa69b4e561512df339d34164f50bdcfee14912c1c3e1b40e106d958693b2e205a07f0add2ac4b41d8c0869329ba2f2dbf23e1440228273cd3e6a74cb9f0c667e0026e57c1ccb0910b5a03f313e0f232fd07d6482d11a8baf17cba3890a57e0f84e0b266693724e24d2d76988dafd961597e05692b6c2aba43deadf8f10f5e4d119175352ef236428c97e565b21b01cffcdfbb74124f701f61a6c9b3ca8d55fb899d79f6a19a5bfb52169043eacceb257a368ece9f9e54f7b14141386374b3012b4f8de9c8044bba4feb152d14533cb1a55ce91b1cb4ca2ce45d336054a4f4513e1697ae330a0c3b54b2d73fcbf6d7ebc9a9522921aa4ed6bc3127e84b845cb46c61fb58611271f364a7f1ee532bef955aa86b5b33dbadbc0bc928c57b24ea49c87ddee8163d0dd2d9c1e31cd799995ebf2a30992df680556c9875271a39d6cfdff973b46b999939d23a78b93c160f7f065db85ba58813497850811cc79d9611936f12c9c12aaaea04a", 0x1000}, {&(0x7f0000002900)="a7d93ca4370c2c6192fe97e2dc2ff98608ea310cc6a90a28ba0293333c517c3a3b3a208942f48da0b081f7be4585f53494956f80e66708dd9a831372314c43da03a15a256a3df5015c1f6cb3b6fcd8b0b0ff43688d2db0db8ee3d04e2585d380e5673a170157bdf29879348692320b346bf13fd92737472e85b0c7af", 0x7c}], 0x3, 0x1) sendmsg$IPVS_CMD_NEW_DEST(r3, &(0x7f00000017c0)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0xa0010}, 0xc, &(0x7f0000001780)={&(0x7f0000001700)=ANY=[@ANYBLOB, @ANYRES16=r5, @ANYBLOB="08002abd7000fddbdf25050000000c000200080003000600000038000100140003000000000000000000000000000000000008000200010000000800090052000000080001000a00000008000800400000000800060007000000"], 0x60}, 0x1, 0x0, 0x0, 0x20000800}, 0x4000001) recvmsg$kcm(r3, &(0x7f0000000480)={&(0x7f0000000100)=@x25, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/76, 0x4c}, {&(0x7f00000001c0)=""/11, 0xb}, {&(0x7f00000002c0)=""/21, 0x15}, {&(0x7f0000000300)=""/126, 0x7e}, {&(0x7f0000000380)=""/119, 0x77}, {&(0x7f0000000500)=""/244, 0xf4}], 0x6, &(0x7f0000000600)=""/4096, 0x1000}, 0x40000000) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:04 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 927.855983] IPVS: ftp: loaded support on port[0] = 21 [ 927.885084] device bridge_slave_1 left promiscuous mode [ 927.890720] bridge0: port 2(bridge_slave_1) entered disabled state 17:20:04 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x8800, 0x400000007, 0x0, 0x0) [ 927.972955] device bridge_slave_0 left promiscuous mode [ 927.985440] bridge0: port 1(bridge_slave_0) entered disabled state [ 928.247593] device hsr_slave_1 left promiscuous mode [ 928.321653] device hsr_slave_0 left promiscuous mode [ 928.372584] team0 (unregistering): Port device team_slave_1 removed [ 928.399152] team0 (unregistering): Port device team_slave_0 removed [ 928.411975] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 928.491786] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 928.632841] bond0 (unregistering): Released all slaves [ 928.928984] chnl_net:caif_netlink_parms(): no params data found [ 928.965874] bridge0: port 1(bridge_slave_0) entered blocking state [ 928.972302] bridge0: port 1(bridge_slave_0) entered disabled state [ 928.979771] device bridge_slave_0 entered promiscuous mode [ 928.987645] bridge0: port 2(bridge_slave_1) entered blocking state [ 928.994060] bridge0: port 2(bridge_slave_1) entered disabled state [ 929.001522] device bridge_slave_1 entered promiscuous mode [ 929.023961] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 929.033602] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 929.057081] team0: Port device team_slave_0 added [ 929.063634] team0: Port device team_slave_1 added [ 929.147612] device hsr_slave_0 entered promiscuous mode [ 929.184792] device hsr_slave_1 entered promiscuous mode [ 929.261597] bridge0: port 2(bridge_slave_1) entered blocking state [ 929.268018] bridge0: port 2(bridge_slave_1) entered forwarding state [ 929.274750] bridge0: port 1(bridge_slave_0) entered blocking state [ 929.281136] bridge0: port 1(bridge_slave_0) entered forwarding state [ 929.359675] 8021q: adding VLAN 0 to HW filter on device bond0 [ 929.381690] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 929.397076] bridge0: port 1(bridge_slave_0) entered disabled state [ 929.404309] bridge0: port 2(bridge_slave_1) entered disabled state [ 929.426116] 8021q: adding VLAN 0 to HW filter on device team0 [ 929.445686] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 929.453335] bridge0: port 1(bridge_slave_0) entered blocking state [ 929.459755] bridge0: port 1(bridge_slave_0) entered forwarding state [ 929.492348] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 929.500300] bridge0: port 2(bridge_slave_1) entered blocking state [ 929.506719] bridge0: port 2(bridge_slave_1) entered forwarding state [ 929.534377] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 929.544653] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 929.557028] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 929.566028] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 929.573786] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 929.581959] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 929.601449] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 929.608845] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 929.618751] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 929.682397] binder: BINDER_SET_CONTEXT_MGR already set [ 929.696209] binder: 3338:3339 ioctl 40046207 0 returned -16 [ 929.703052] binder: 3338:3340 got reply transaction with bad transaction stack, transaction 820 has target 26829:0 [ 929.721945] binder_transaction: 3 callbacks suppressed [ 929.721960] binder: 3338:3340 transaction failed 29201/-71, size 0-0 line 2816 [ 929.736442] binder_alloc: binder_alloc_mmap_handler: 3338 20001000-20004000 already mapped failed -16 [ 929.746646] binder: 3338:3342 got reply transaction with no transaction stack [ 929.753935] binder: 3338:3342 transaction failed 29201/-71, size 0-0 line 2801 [ 929.761876] binder_thread_release: 12 callbacks suppressed [ 929.761887] binder: release 3338:3340 transaction 820 out, still active [ 929.762031] binder: BINDER_SET_CONTEXT_MGR already set 17:20:06 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x6c00, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:06 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0xc2]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:06 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r1, 0x2000}], 0x1, 0x400) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 17:20:06 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) shutdown(r0, 0x1) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:06 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:06 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x1000000, 0x400000007, 0x0, 0x0) [ 929.767878] binder_release_work: 12 callbacks suppressed [ 929.767883] binder: undelivered TRANSACTION_COMPLETE [ 929.791153] binder_release_work: 7 callbacks suppressed [ 929.791160] binder: undelivered TRANSACTION_ERROR: 29201 [ 929.802200] binder: 3338:3339 ioctl 40046207 0 returned -16 [ 929.808290] binder: release 3338:3341 transaction 822 out, still active [ 929.819243] binder: undelivered TRANSACTION_COMPLETE [ 929.824372] binder: undelivered TRANSACTION_ERROR: 29201 [ 929.961862] binder: BINDER_SET_CONTEXT_MGR already set [ 929.986522] binder: 3360:3360 ioctl 40046207 0 returned -16 [ 929.995467] binder: 3360:3356 got reply transaction with bad transaction stack, transaction 824 has target 26829:0 17:20:06 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e24, 0x7, @dev={0xfe, 0x80, [], 0x28}, 0x9}}, 0x1, 0xfffffffffffffffb, 0x0, 0xffffffff, 0x9}, &(0x7f00000001c0)=0x98) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:06 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x3000000, 0x400000007, 0x0, 0x0) [ 930.061221] binder: 3360:3356 transaction failed 29201/-71, size 0-0 line 2816 [ 930.085563] binder: BINDER_SET_CONTEXT_MGR already set 17:20:07 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 930.128542] binder: 3360:3360 ioctl 40046207 0 returned -16 [ 930.165906] binder: 3355:3367 got reply transaction with no transaction stack 17:20:07 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x7400, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 930.204210] binder: 3355:3367 transaction failed 29201/-71, size 0-0 line 2801 17:20:07 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x11000000, 0x400000007, 0x0, 0x0) 17:20:07 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r3 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0xff, 0x0) write$uinput_user_dev(r3, &(0x7f0000000500)={'syz0\x00', {0x400, 0xf4e92b6, 0x1f, 0x6}, 0x53, [0x7f, 0x1105, 0x101, 0x200, 0x80000001, 0xffffffffffffb53d, 0x1, 0x220, 0xfffffffffffffffe, 0x5, 0x7, 0x1000, 0xeec83ca, 0x2a82, 0x81, 0x3, 0x2, 0xe5, 0x3, 0xd5, 0x200, 0x0, 0x6, 0x56b7b020, 0x0, 0x100000001, 0x5, 0x400, 0x9, 0xafef, 0x5, 0x100000000, 0x2, 0x5b55, 0x80000000, 0x1, 0x4, 0x400, 0x6c, 0x9, 0x6, 0x3, 0x8, 0x53, 0xed1, 0xffffffffffffffff, 0x8, 0x6, 0x2, 0x10001, 0x5, 0x8, 0x80000000, 0xfffffffffffffff8, 0xbc6, 0x1000, 0xb19, 0xd8f, 0x3, 0x3f, 0x2, 0x5, 0x67, 0xdc21], [0x7, 0x401, 0x1, 0x2, 0x1, 0x3, 0x7, 0xdca, 0x0, 0xfffffffffffffff9, 0x1, 0x6, 0x2, 0x8, 0xc0, 0x100000001, 0x71, 0x4, 0x5, 0x7382, 0x0, 0x4e0, 0x6, 0x3, 0x1, 0x80000000, 0x0, 0x9, 0x1, 0x9baf, 0x8c42, 0x20, 0x7e39, 0x100, 0x7f, 0x9dc, 0x400, 0x0, 0x305b6a11, 0x6, 0x6, 0x5, 0x0, 0x0, 0x5, 0x81, 0x10001, 0x1f, 0x100000000, 0x2, 0x0, 0x8, 0x6, 0x81, 0x10001, 0xfffffffffffffff8, 0x3, 0x7ff, 0x6, 0x7ff, 0x78, 0x9, 0x1f, 0x5e2b3564], [0x0, 0x8, 0x4, 0x1f, 0x200, 0x40, 0x4, 0x3, 0x400, 0x2, 0x8, 0x4e, 0x80000000, 0x8, 0x40, 0x1, 0x5, 0xffffffffffffff62, 0x0, 0x19b, 0x8001, 0xb, 0x7, 0x4, 0x132cfd18, 0x7269, 0x6, 0x1, 0x1, 0x0, 0xfff, 0x1, 0x0, 0x0, 0x0, 0x10001, 0x5, 0x0, 0x2, 0x40, 0x2, 0x9, 0x1ff, 0xc37, 0x9535, 0x3, 0x4, 0x8, 0x40, 0xff, 0x0, 0x97d, 0x8b, 0x956c, 0xffff, 0x40, 0x4, 0x5, 0x4, 0xfff, 0x9, 0x9f, 0x40, 0x40], [0x1, 0x1004000, 0x3, 0xfffffffffffffff7, 0x3, 0x95, 0x7fff, 0xfffffffffffff71f, 0xbc, 0x4, 0x100, 0xe00000, 0x59ce, 0x9, 0xb4cc000000000, 0x40, 0x0, 0x6, 0xc1f, 0x3, 0x7, 0x2, 0xffff, 0x2, 0x200, 0x5, 0x4, 0x0, 0x1, 0x1, 0x2e12, 0x8, 0x2, 0x1000, 0x6, 0x1, 0x1ff, 0x100, 0x6, 0x80, 0x0, 0xfffffffffffffffb, 0x2, 0x1e, 0x8, 0x0, 0x6, 0x10001, 0x1, 0x1, 0x8000, 0x101, 0x2, 0x6998, 0x8001, 0x2, 0x6, 0x2, 0x6, 0x5, 0x1, 0x0, 0x101, 0x101]}, 0x45c) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:07 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 930.418777] binder: BINDER_SET_CONTEXT_MGR already set [ 930.424143] binder: 3378:3380 ioctl 40046207 0 returned -16 [ 930.592373] binder: 3378:3391 got reply transaction with bad transaction stack, transaction 828 has target 26829:0 [ 930.667505] binder: 3378:3391 transaction failed 29201/-71, size 0-0 line 2816 17:20:07 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0xce]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:07 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f00000002c0)=0xc) sched_setparam(r3, &(0x7f0000000300)=0xbf) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r5 = dup(r1) write$vnet(r5, &(0x7f0000000240)={0x1, {&(0x7f00000000c0)=""/43, 0xfffffffffffffd51, &(0x7f0000000140), 0x3, 0x3}}, 0x68) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e21, 0x0, @ipv4={[], [], @local}}, 0x1c) sendmmsg(r6, &(0x7f0000007e00), 0x26e, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) getresuid(&(0x7f0000003780), 0x0, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) ioctl$sock_SIOCOUTQ(r1, 0x5411, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x4, 0x4c0, 0x300, 0x0, 0x300, 0x300, 0x0, 0x3f0, 0x3f0, 0x3f0, 0x3f0, 0x3f0, 0x4, &(0x7f0000000140), {[{{@ipv6={@mcast1, @local, [0xffffff00, 0x0, 0xff000000, 0xff], [0x0, 0xff000000, 0xffffff00, 0xffffffff], 'veth0\x00', 'nr0\x00', {0xff}, {}, 0x62, 0x5, 0x1, 0x51}, 0x0, 0x120, 0x148, 0x0, {}, [@common=@hl={0x28, 'hl\x00', 0x0, {0x2, 0x979}}, @common=@srh={0x30, 'srh\x00', 0x0, {0xff, 0x10001, 0x3, 0x0, 0x7fff, 0x2208}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@uncond, 0x0, 0x158, 0x1b8, 0x0, {}, [@common=@srh1={0x90, 'srh\x00', 0x1, {0x25, 0x6, 0x4, 0xffffffffffffffff, 0x3, @dev={0xfe, 0x80, [], 0x2b}, @local, @mcast1, [0xffffffff, 0xff, 0xff000000, 0xff000000], [0xff0000ff, 0xffffff00, 0xffffffff], [0xffffffff, 0xff, 0xff, 0xffffffff], 0x2800, 0x101}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@dev={0xfe, 0x80, [], 0x1e}, [0xffffffff, 0xffffffff, 0x0, 0xffffffff], 0x4e23, 0x38, 0x4e21, 0x4e22, 0x1ff, 0x24, 0x0, 0x2, 0x200}}}, {{@ipv6={@ipv4={[], [], @empty}, @ipv4={[], [], @multicast1}, [0xff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xff0000ff, 0x0, 0xffffffff], 'veth1_to_bridge\x00', 'rose0\x00', {}, {0xff}, 0x32, 0xd650, 0x5, 0x11}, 0x0, 0xc8, 0xf0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x520) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f000000ac80), 0x400000000000302, 0x4008800) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0xffffffffffffff50) 17:20:07 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x88000000, 0x400000007, 0x0, 0x0) 17:20:07 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, 0x0) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:07 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 931.146338] binder_alloc: binder_alloc_mmap_handler: 3378 20001000-20004000 already mapped failed -16 [ 931.181410] binder: BINDER_SET_CONTEXT_MGR already set 17:20:08 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0xa4ffffff, 0x400000007, 0x0, 0x0) [ 931.234305] binder: 3378:3391 ioctl 40046207 0 returned -16 [ 931.234509] binder: 3378:3415 got reply transaction with no transaction stack [ 931.329328] binder: 3378:3415 transaction failed 29201/-71, size 0-0 line 2801 [ 931.361725] binder: release 3378:3391 transaction 828 out, still active 17:20:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, 0x0) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 931.404572] binder: undelivered TRANSACTION_COMPLETE 17:20:08 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0xffffffa4, 0x400000007, 0x0, 0x0) [ 931.433257] binder: undelivered TRANSACTION_ERROR: 29201 [ 931.460574] binder: release 3378:3393 transaction 830 out, still active [ 931.499987] binder: undelivered TRANSACTION_COMPLETE [ 931.529950] binder: undelivered TRANSACTION_ERROR: 29201 17:20:08 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x7a00, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, 0x0) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:08 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x100000000000000, 0x400000007, 0x0, 0x0) [ 931.793124] binder: 3431:3432 got reply transaction with bad transaction stack, transaction 832 has target 26829:0 [ 931.874641] binder: 3431:3432 transaction failed 29201/-71, size 0-0 line 2816 17:20:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 931.933744] binder: 3431:3438 got reply transaction with bad transaction stack, transaction 834 has target 26829:0 [ 931.969375] binder: 3431:3438 transaction failed 29201/-71, size 0-0 line 2816 [ 932.059652] binder: release 3431:3432 transaction 832 out, still active [ 932.074700] binder: undelivered TRANSACTION_COMPLETE [ 932.079823] binder: undelivered TRANSACTION_ERROR: 29201 [ 932.134823] binder: release 3431:3438 transaction 834 out, still active [ 932.165169] binder: undelivered TRANSACTION_COMPLETE [ 932.186376] binder: undelivered TRANSACTION_ERROR: 29201 17:20:09 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x10a]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f0000000080)=0x2e, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:09 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 17:20:09 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x300000000000000, 0x400000007, 0x0, 0x0) 17:20:09 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x1000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 932.759373] binder: BINDER_SET_CONTEXT_MGR already set [ 932.805389] binder: 3464:3469 got reply transaction with bad transaction stack, transaction 836 has target 26829:0 [ 932.839101] binder: 3464:3465 ioctl 40046207 0 returned -16 17:20:09 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x1100000000000000, 0x400000007, 0x0, 0x0) [ 932.850414] binder_alloc: binder_alloc_mmap_handler: 3464 20001000-20004000 already mapped failed -16 [ 932.873950] binder: BINDER_SET_CONTEXT_MGR already set [ 932.889439] binder: 3464:3469 transaction failed 29201/-71, size 0-0 line 2816 [ 932.897512] binder: 3464:3465 ioctl 40046207 0 returned -16 17:20:09 executing program 1: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0x1, 0x0) ioctl$KVM_DIRTY_TLB(r0, 0x4010aeaa, &(0x7f0000000100)={0x2, 0x7fff}) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000140)={0x0, 0x15f7b97f}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000240)={r1, 0x3}, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet_udplite(0x2, 0x2, 0x88) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000280)='trusted.overlay.upper\x00', &(0x7f00000002c0)={0x0, 0xfb, 0x1d, 0x2, 0xfef, "81566023ef6d6fd49f9533b1751f8fb9", "f6257f840fb73e68"}, 0x1d, 0x3) r4 = socket$inet_udp(0x2, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r3, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 932.919430] binder: 3464:3477 got reply transaction with no transaction stack [ 932.938198] binder: 3464:3477 transaction failed 29201/-71, size 0-0 line 2801 17:20:09 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x2000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 932.967584] binder: release 3464:3473 transaction 838 out, still active [ 932.980750] binder: undelivered TRANSACTION_COMPLETE [ 933.008478] binder: undelivered TRANSACTION_ERROR: 29201 [ 933.072649] binder: release 3464:3469 transaction 836 out, still active [ 933.091159] binder: undelivered TRANSACTION_COMPLETE 17:20:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) pipe2(&(0x7f0000000140), 0x4000) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000002c0)={0x2, 0x0, @multicast2}, 0xfffffffffffffdc5) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_netdev_private(r0, 0x89fe, &(0x7f0000000240)="b893ff862f1e4d16aa0a1bce290a5537c5f3f4c0c76ebcf93574c7bba2a61cde4dd74825c35cd668b434f761c3cc8e6bc457d175d949b5e9673d3fa8a954968edef81ccf7b133428850c0835900f7c8b3ddfc14c83926de5710aeb01a426f45c936ed95813386d1a559b54") ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r4 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x80, 0x10000) openat$cgroup_ro(r4, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x2f, &(0x7f00000001c0)=0x100, 0x4) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:10 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x8800000000000000, 0x400000007, 0x0, 0x0) [ 933.131230] binder: undelivered TRANSACTION_ERROR: 29201 [ 933.176504] binder: BINDER_SET_CONTEXT_MGR already set [ 933.212306] binder: 3491:3493 got reply transaction with bad transaction stack, transaction 840 has target 26829:0 [ 933.265410] binder: 3491:3492 ioctl 40046207 0 returned -16 [ 933.307838] binder_alloc: binder_alloc_mmap_handler: 3491 20001000-20004000 already mapped failed -16 [ 933.339597] binder: BINDER_SET_CONTEXT_MGR already set [ 933.375296] binder: 3491:3492 ioctl 40046207 0 returned -16 [ 933.398437] binder: 3491:3506 got reply transaction with no transaction stack [ 933.410725] binder: release 3491:3493 transaction 840 out, still active [ 933.422586] binder: undelivered TRANSACTION_COMPLETE [ 933.432956] binder: undelivered TRANSACTION_ERROR: 29201 [ 933.447637] binder: release 3491:3502 transaction 842 out, still active [ 933.459793] binder: undelivered TRANSACTION_COMPLETE [ 933.471271] binder: undelivered TRANSACTION_ERROR: 29201 17:20:10 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x11e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:10 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0xa4ffffff00000000, 0x400000007, 0x0, 0x0) 17:20:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x1ff) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x8e240, 0x0) getsockopt$ARPT_SO_GET_INFO(r2, 0x0, 0x60, &(0x7f0000000240)={'filter\x00'}, &(0x7f0000000140)=0x44) connect$tipc(r3, &(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x1, {0x0, 0x2, 0x2}}, 0x5) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:10 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x3000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:10 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) mkdirat$cgroup(r0, &(0x7f0000000100)='syz1\x00', 0x1ff) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 933.746563] binder: BINDER_SET_CONTEXT_MGR already set [ 933.783029] binder: 3518:3528 got reply transaction with bad transaction stack, transaction 844 has target 26829:0 17:20:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0xffffffff00000000, 0x100) ioctl$SG_GET_VERSION_NUM(r2, 0x2282, &(0x7f0000000240)) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f00000000c0), 0x10) setsockopt$sock_timeval(r0, 0x1, 0x0, &(0x7f0000000140)={0x77359400}, 0x10) syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x4f, 0x200) 17:20:10 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000002, 0x0, 0x0) 17:20:10 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x4000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 933.836552] binder: 3518:3527 ioctl 40046207 0 returned -16 17:20:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x1, 0x0) ioctl$BLKPG(r1, 0x1269, &(0x7f0000000140)={0x9, 0x400, 0x0, &(0x7f0000000100)}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) prctl$PR_CAPBSET_DROP(0x18, 0x24) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:10 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000003, 0x0, 0x0) [ 934.070445] binder: BINDER_SET_CONTEXT_MGR already set [ 934.115961] binder: 3546:3549 got reply transaction with bad transaction stack, transaction 846 has target 26829:0 [ 934.177162] binder: 3546:3548 ioctl 40046207 0 returned -16 [ 934.228553] binder_alloc: binder_alloc_mmap_handler: 3546 20001000-20004000 already mapped failed -16 [ 934.245200] binder: BINDER_SET_CONTEXT_MGR already set [ 934.253636] binder: 3546:3548 ioctl 40046207 0 returned -16 [ 934.278082] binder: 3546:3556 got reply transaction with bad transaction stack, transaction 848 has target 26829:0 17:20:11 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x140]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:11 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000004, 0x0, 0x0) 17:20:11 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x5000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x40000, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r3, 0x4004ae8b, &(0x7f0000000240)={0x96, "d3329db6d38c77d947537ff3d324bf49855b03537dc340cdefb36c0b3e28a15fae9cfc05c7d148cf0ddbaa7c52f42fb7f4063674ba31fae2596bf5fbed8cf9aff2058776fde8f0655f1ab13e230681b0461fc3c0296b078bafd36a35973d40ead91e9f15ce7279f808755875e4f768e994a6043fe1ac0c225df6fa6b1511f19a0f6c9634ac3f61accc7feb9272e1f45f9d105b5a4ff9"}) 17:20:11 executing program 5: syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x4, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 934.699691] binder: BINDER_SET_CONTEXT_MGR already set [ 934.710112] QAT: Invalid ioctl [ 934.713991] binder: 3572:3581 got reply transaction with bad transaction stack, transaction 850 has target 26829:0 17:20:11 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000005, 0x0, 0x0) [ 934.765479] QAT: Invalid ioctl [ 934.776107] binder: 3572:3574 ioctl 40046207 0 returned -16 17:20:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 934.806493] binder_transaction: 5 callbacks suppressed [ 934.806509] binder: 3572:3581 transaction failed 29201/-71, size 0-0 line 2816 17:20:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) finit_module(r1, &(0x7f0000000300)='/proc/sys/net/ipv4/vs/sync_threshold=', 0x1000001) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) ioctl$VHOST_GET_FEATURES(r3, 0x8008af00, &(0x7f0000000180)) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 934.896832] binder_alloc: binder_alloc_mmap_handler: 3572 20001000-20004000 already mapped failed -16 [ 934.941804] binder: BINDER_SET_CONTEXT_MGR already set 17:20:11 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000006, 0x0, 0x0) [ 934.966876] binder: 3572:3574 ioctl 40046207 0 returned -16 [ 934.999323] binder: 3572:3599 got reply transaction with bad transaction stack, transaction 852 has target 26829:0 [ 935.077191] binder: release 3572:3581 transaction 850 out, still active [ 935.089768] binder: 3572:3599 transaction failed 29201/-71, size 0-0 line 2816 17:20:11 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r1, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r2 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x8849, 0x40000) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000100)={{0x81, 0x8, 0x8000, 0x103b711f}, 'syz1\x00', 0x39}) ioctl$sock_ifreq(r0, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r1, 0x0, 0x400000007, &(0x7f00000001c0)=0x4, 0x4) [ 935.118778] binder: undelivered TRANSACTION_COMPLETE 17:20:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 935.148360] binder: undelivered TRANSACTION_ERROR: 29201 [ 935.184704] binder: release 3572:3599 transaction 852 out, still active [ 935.232977] binder: undelivered TRANSACTION_COMPLETE [ 935.258332] binder: undelivered TRANSACTION_ERROR: 29201 17:20:12 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x174]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:12 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x6000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:12 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000008, 0x0, 0x0) 17:20:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:12 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x5c, @broadcast, 0x4e22, 0x0, 'ovf\x00', 0x0, 0x100, 0x16}, 0x2c) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) 17:20:12 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 935.710058] IPVS: set_ctl: invalid protocol: 92 255.255.255.255:20002 [ 935.739219] binder: BINDER_SET_CONTEXT_MGR already set [ 935.752944] binder: 3621:3633 got reply transaction with bad transaction stack, transaction 854 has target 26829:0 17:20:12 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x40000000a, 0x0, 0x0) [ 935.841228] binder: 3621:3622 ioctl 40046207 0 returned -16 [ 935.858956] binder: 3621:3633 transaction failed 29201/-71, size 0-0 line 2816 17:20:12 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x20880, 0x0) getsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f00000002c0), 0x2) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'veth1_to_hsr\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/attr/exec\x00', 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f00000000c0)={{0x2, 0x4e22, @multicast2}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x16ba06ad64612842}}, 0x20, {0x2, 0x4e21, @loopback}, 'hwsim0\x00'}) r4 = syz_open_dev$sndpcmc(&(0x7f0000000140)='/dev/snd/pcmC#D#c\x00', 0x8f1, 0x42) ioctl$VIDIOC_ENUMOUTPUT(r4, 0xc0485630, &(0x7f0000000240)={0x9, "c4c6b900f25afca3d286a245fdb4b737d9608e8da68d1b00", 0x3, 0x0, 0xffffffffffff0001, 0xc0ff00}) 17:20:12 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f00000002c0)=0xc) sched_setparam(r3, &(0x7f0000000300)=0xbf) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r5 = dup(r1) write$vnet(r5, &(0x7f0000000240)={0x1, {&(0x7f00000000c0)=""/43, 0xfffffffffffffd51, &(0x7f0000000140), 0x3, 0x3}}, 0x68) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e21, 0x0, @ipv4={[], [], @local}}, 0x1c) sendmmsg(r6, &(0x7f0000007e00), 0x26e, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) getresuid(&(0x7f0000003780), 0x0, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) ioctl$sock_SIOCOUTQ(r1, 0x5411, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x4, 0x4c0, 0x300, 0x0, 0x300, 0x300, 0x0, 0x3f0, 0x3f0, 0x3f0, 0x3f0, 0x3f0, 0x4, &(0x7f0000000140), {[{{@ipv6={@mcast1, @local, [0xffffff00, 0x0, 0xff000000, 0xff], [0x0, 0xff000000, 0xffffff00, 0xffffffff], 'veth0\x00', 'nr0\x00', {0xff}, {}, 0x62, 0x5, 0x1, 0x51}, 0x0, 0x120, 0x148, 0x0, {}, [@common=@hl={0x28, 'hl\x00', 0x0, {0x2, 0x979}}, @common=@srh={0x30, 'srh\x00', 0x0, {0xff, 0x10001, 0x3, 0x0, 0x7fff, 0x2208}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@uncond, 0x0, 0x158, 0x1b8, 0x0, {}, [@common=@srh1={0x90, 'srh\x00', 0x1, {0x25, 0x6, 0x4, 0xffffffffffffffff, 0x3, @dev={0xfe, 0x80, [], 0x2b}, @local, @mcast1, [0xffffffff, 0xff, 0xff000000, 0xff000000], [0xff0000ff, 0xffffff00, 0xffffffff], [0xffffffff, 0xff, 0xff, 0xffffffff], 0x2800, 0x101}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@dev={0xfe, 0x80, [], 0x1e}, [0xffffffff, 0xffffffff, 0x0, 0xffffffff], 0x4e23, 0x38, 0x4e21, 0x4e22, 0x1ff, 0x24, 0x0, 0x2, 0x200}}}, {{@ipv6={@ipv4={[], [], @empty}, @ipv4={[], [], @multicast1}, [0xff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xff0000ff, 0x0, 0xffffffff], 'veth1_to_bridge\x00', 'rose0\x00', {}, {0xff}, 0x32, 0xd650, 0x5, 0x11}, 0x0, 0xc8, 0xf0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x520) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmmsg(r6, &(0x7f000000ac80), 0x400000000000302, 0x4008800) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0xffffffffffffff50) [ 935.923824] binder_alloc: binder_alloc_mmap_handler: 3621 20001000-20004000 already mapped failed -16 [ 936.010339] binder: BINDER_SET_CONTEXT_MGR already set 17:20:12 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x40000000b, 0x0, 0x0) 17:20:12 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 936.050189] binder: 3621:3622 ioctl 40046207 0 returned -16 [ 936.088377] binder: 3621:3640 got reply transaction with no transaction stack 17:20:13 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x7000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 936.175205] binder: 3621:3640 transaction failed 29201/-71, size 0-0 line 2801 [ 936.351039] binder: 3664:3665 got reply transaction with bad transaction stack, transaction 858 has target 26829:0 [ 936.455568] binder: 3664:3665 transaction failed 29201/-71, size 0-0 line 2816 [ 936.495210] binder: BINDER_SET_CONTEXT_MGR already set [ 936.532061] binder: 3664:3671 got reply transaction with no transaction stack [ 936.582892] binder: 3664:3665 ioctl 40046207 0 returned -16 [ 936.583276] binder: release 3664:3665 transaction 858 out, still active [ 936.604622] binder: undelivered TRANSACTION_COMPLETE [ 936.615869] binder: undelivered TRANSACTION_ERROR: 29201 [ 936.634581] binder: 3664:3671 transaction failed 29201/-71, size 0-0 line 2801 [ 936.642537] binder: release 3664:3670 transaction 860 out, still active [ 936.659532] binder: undelivered TRANSACTION_COMPLETE [ 936.687997] binder: undelivered TRANSACTION_ERROR: 29201 17:20:13 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x175]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:13 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x40000000c, 0x0, 0x0) 17:20:13 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x24080, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000140)={0x0, 0x1ff}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000240)={r3, 0x7}, &(0x7f0000000280)=0x8) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x3, 0x40200) 17:20:13 executing program 5: r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) poll(&(0x7f0000000040)=[{r0, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 17:20:13 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0xa000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:13 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0xce]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 936.995407] binder: BINDER_SET_CONTEXT_MGR already set 17:20:13 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000001740)='/dev/dsp#\x00', 0x180000000000000, 0x800) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000001780)=@assoc_value={0x0, 0x7}, &(0x7f00000017c0)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f0000001800)={r4, 0x2}, 0x8) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r5 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000100)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r3, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, r5, 0x602, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4004000) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 937.037897] binder: 3684:3696 got reply transaction with bad transaction stack, transaction 862 has target 26829:0 17:20:13 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x40000000d, 0x0, 0x0) [ 937.082308] binder: 3684:3693 ioctl 40046207 0 returned -16 [ 937.113648] binder: 3684:3696 transaction failed 29201/-71, size 0-0 line 2816 17:20:14 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f00000001c0)) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) chroot(&(0x7f00000000c0)='./file0\x00') connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$VIDIOC_G_CROP(r0, 0xc014563b, &(0x7f0000000240)={0xa, {0x1000000000000, 0x4, 0x2, 0x8}}) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) r3 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x3, 0x400440) getsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, &(0x7f0000000140)=0x1, &(0x7f0000000180)=0x4) [ 937.189464] binder_alloc: binder_alloc_mmap_handler: 3684 20001000-20004000 already mapped failed -16 [ 937.242694] binder: BINDER_SET_CONTEXT_MGR already set 17:20:14 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x20000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 937.276570] binder: 3684:3693 ioctl 40046207 0 returned -16 17:20:14 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x40000000f, 0x0, 0x0) [ 937.434052] binder: BINDER_SET_CONTEXT_MGR already set [ 937.445047] binder: 3717:3718 ioctl 40046207 0 returned -16 17:20:14 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x20000, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000000100)={0x0, 0x0, 0x20}, &(0x7f0000000140)=0xc) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f00000001c0)={r4, 0x20}, 0x8) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 937.526738] binder: 3717:3724 got reply transaction with no transaction stack [ 937.563498] binder: 3717:3724 transaction failed 29201/-71, size 0-0 line 2801 17:20:14 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x176]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:14 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000010, 0x0, 0x0) 17:20:14 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000000240)={0x0, 0x1, 0x8000}) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000100)=0x31, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000140)={[{0x5, 0x5, 0x5, 0x8, 0x3bd5, 0x6, 0x3ff, 0x6, 0x7, 0x3, 0x8}, {0x9, 0x401, 0x8, 0x1000, 0xfb5, 0x7, 0x7, 0x400, 0x401, 0x7fffffff, 0x5, 0x10000, 0xffffffffffff54b5}, {0xfffffffffffffffe, 0x94, 0xc242, 0x0, 0x7fd6, 0x5, 0xefdd, 0x7, 0x1, 0xffffffff, 0x5, 0x7c5, 0x8000}]}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:14 executing program 5: r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) poll(&(0x7f0000000040)=[{r0, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 17:20:14 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x400000006, &(0x7f00000000c0)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r3 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x410000, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000340)={0x0}, &(0x7f0000000380)=0xc) syz_open_procfs$namespace(r4, &(0x7f00000003c0)='ns/cgroup\x00') write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000280)={0xffffffffffffffff}, 0x111, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000300)={0x1, 0x10, 0xfa00, {&(0x7f0000000240), r5}}, 0x18) ioctl$sock_inet_SIOCDELRT(r2, 0x890c, &(0x7f0000000100)={0x0, {0x2, 0x4e24, @rand_addr=0x8001}, {0x2, 0x4e20, @remote}, {0x2, 0x4e21, @empty}, 0x292, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000080)='dummy0\x00', 0x0, 0x9, 0xfce}) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:15 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0xce]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:15 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000011, 0x0, 0x0) [ 938.205221] binder_alloc: binder_alloc_mmap_handler: 3717 20001000-20004000 already mapped failed -16 17:20:15 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) accept$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000100)=0x14) connect$packet(r2, &(0x7f0000000200)={0x11, 0x1b, r3, 0x1, 0x7, 0x6, @remote}, 0x14) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000140)={0x5, 0x2, 0x7}, 0xc) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_ifreq(r1, 0x8939, &(0x7f00000001c0)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 938.272120] binder: 3717:3729 got reply transaction with no transaction stack [ 938.316990] binder: BINDER_SET_CONTEXT_MGR already set [ 938.328345] binder: 3717:3729 transaction failed 29201/-71, size 0-0 line 2801 [ 938.334070] binder: 3717:3724 ioctl 40046207 0 returned -16 [ 938.335894] binder: release 3717:3718 transaction 864 out, still active [ 938.377182] binder: undelivered TRANSACTION_COMPLETE [ 938.396035] binder: undelivered TRANSACTION_ERROR: 29201 [ 938.412214] binder: release 3717:3726 transaction 866 out, still active 17:20:15 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x3f000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 938.430249] binder: undelivered TRANSACTION_COMPLETE [ 938.442065] binder: undelivered TRANSACTION_ERROR: 29201 17:20:15 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000280)={'batadv0\x00', 0x400}) syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x80000001, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) accept$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) bind$bt_hci(r2, &(0x7f0000000300)={0x1f, r3, 0x80001}, 0xffffff94) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x6) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r5, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r4, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r5, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:15 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000012, 0x0, 0x0) [ 938.569194] binder: BINDER_SET_CONTEXT_MGR already set [ 938.639285] binder: 3772:3773 ioctl 40046207 0 returned -16 [ 938.675038] binder: 3772:3774 got reply transaction with no transaction stack [ 938.682389] binder: 3772:3774 transaction failed 29201/-71, size 0-0 line 2801 17:20:15 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x48000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 938.801368] binder: BINDER_SET_CONTEXT_MGR already set [ 938.811070] binder: 3786:3788 got reply transaction with bad transaction stack, transaction 870 has target 26829:0 [ 938.822621] binder: 3786:3787 ioctl 40046207 0 returned -16 [ 938.848831] binder_alloc: binder_alloc_mmap_handler: 3786 20001000-20004000 already mapped failed -16 17:20:15 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x17a]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:15 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000013, 0x0, 0x0) 17:20:15 executing program 1: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x1c1480, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000300)=0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f00000002c0)=0x30, 0xfffffffffffffcf9) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r3, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x20000, 0x0) r6 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x0, 0x0) readv(r2, &(0x7f00000001c0)=[{&(0x7f0000000240)=""/118, 0x76}], 0x1) mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) ioctl$KVM_HYPERV_EVENTFD(r5, 0x4018aebd, &(0x7f0000000140)={0x2, r6, 0x1}) 17:20:15 executing program 5: r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) poll(&(0x7f0000000040)=[{r0, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 938.923813] binder: 3786:3793 got reply transaction with bad transaction stack, transaction 872 has target 26829:0 [ 938.980473] binder: BINDER_SET_CONTEXT_MGR already set 17:20:15 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x4c000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 939.051687] binder: 3786:3787 ioctl 40046207 0 returned -16 [ 939.051785] binder: release 3786:3788 transaction 870 out, still active [ 939.122361] binder: undelivered TRANSACTION_COMPLETE [ 939.157622] binder: undelivered TRANSACTION_ERROR: 29201 [ 939.194591] binder: release 3786:3793 transaction 872 out, still active [ 939.219072] binder: undelivered TRANSACTION_COMPLETE [ 939.234914] binder: undelivered TRANSACTION_ERROR: 29201 17:20:16 executing program 3 (fault-call:7 fault-nth:0): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:16 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000014, 0x0, 0x0) 17:20:16 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x60000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 939.535998] binder: BINDER_SET_CONTEXT_MGR already set [ 939.554663] binder: 3815:3816 ioctl 40046207 0 returned -16 17:20:16 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000015, 0x0, 0x0) [ 939.601183] FAULT_INJECTION: forcing a failure. [ 939.601183] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 939.623625] binder: 3815:3824 got reply transaction with no transaction stack [ 939.642126] CPU: 0 PID: 3822 Comm: syz-executor3 Not tainted 5.0.0-rc4 #49 [ 939.649166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 939.658526] Call Trace: [ 939.661157] dump_stack+0x1db/0x2d0 [ 939.664810] ? dump_stack_print_info.cold+0x20/0x20 [ 939.669848] ? __lock_acquire+0x572/0x4a30 [ 939.674143] should_fail.cold+0xa/0x15 [ 939.678054] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 939.683211] ? arch_local_save_flags+0x50/0x50 [ 939.687805] ? lock_release+0xc40/0xc40 [ 939.691809] should_fail_alloc_page+0x50/0x60 [ 939.696336] __alloc_pages_nodemask+0x323/0xdc0 [ 939.701028] ? __alloc_pages_slowpath+0x2cc0/0x2cc0 [ 939.706170] ? get_pid_task+0xd4/0x190 [ 939.710117] ? mark_held_locks+0x100/0x100 [ 939.714377] ? pmd_val+0x85/0x100 [ 939.717848] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 939.723399] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 939.728957] alloc_pages_vma+0xdd/0x540 [ 939.732956] __handle_mm_fault+0x2537/0x55a0 [ 939.737396] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 939.742261] ? check_preemption_disabled+0x48/0x290 [ 939.747299] ? handle_mm_fault+0x3cc/0xc80 [ 939.751565] ? lock_downgrade+0x910/0x910 [ 939.755736] ? kasan_check_read+0x11/0x20 [ 939.759898] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 939.765192] ? rcu_read_unlock_special+0x380/0x380 [ 939.770158] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 939.775718] ? check_preemption_disabled+0x48/0x290 [ 939.780757] handle_mm_fault+0x4ec/0xc80 [ 939.784840] ? __handle_mm_fault+0x55a0/0x55a0 [ 939.789438] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 939.794989] ? vmacache_update+0x114/0x140 [ 939.799296] __do_page_fault+0x5da/0xd60 [ 939.803393] do_page_fault+0xe6/0x7d8 [ 939.807214] ? trace_hardirqs_on_caller+0xc0/0x310 [ 939.812167] ? vmalloc_sync_all+0x30/0x30 [ 939.816333] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 939.821801] ? syscall_return_slowpath+0x5f0/0x5f0 [ 939.821821] ? prepare_exit_to_usermode+0x232/0x3b0 [ 939.821840] ? page_fault+0x8/0x30 [ 939.821860] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 939.821880] ? page_fault+0x8/0x30 [ 939.821898] page_fault+0x1e/0x30 [ 939.821911] RIP: 0033:0x4074ed [ 939.821927] Code: 0f 1f 44 00 00 c6 44 24 0e 06 48 c7 04 24 10 00 00 00 e9 56 ff ff ff e8 81 47 05 00 90 41 55 41 54 55 53 48 81 ec a8 1b 00 00 <48> 89 74 24 18 48 89 7c 24 30 64 48 8b 34 25 28 00 00 00 48 89 b4 [ 939.821940] RSP: 002b:00007f481d3510a0 EFLAGS: 00010206 [ 939.831883] RAX: 00000000004074e0 RBX: 00007f481d352c90 RCX: 0000000000000000 [ 939.831893] RDX: 0000000020013000 RSI: 0000000000000006 RDI: 0000000000000007 [ 939.831902] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 939.831911] R10: 0000000000000064 R11: 0000000000000000 R12: 00007f481d3536d4 [ 939.831921] R13: 00000000004c67fd R14: 00000000004dbbf8 R15: 0000000000000008 [ 939.915684] syz-executor3 invoked oom-killer: gfp_mask=0x0(), order=0, oom_score_adj=1000 [ 939.925946] CPU: 1 PID: 3822 Comm: syz-executor3 Not tainted 5.0.0-rc4 #49 [ 939.932974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 939.942334] Call Trace: [ 939.944941] dump_stack+0x1db/0x2d0 [ 939.948592] ? dump_stack_print_info.cold+0x20/0x20 [ 939.953713] dump_header+0x1e6/0x116c [ 939.957540] ? add_lock_to_list.isra.0+0x450/0x450 [ 939.962492] ? print_usage_bug+0xd0/0xd0 [ 939.966574] ? pagefault_out_of_memory+0x1a1/0x1a1 [ 939.971532] ? ___ratelimit+0x37c/0x686 [ 939.971559] ? mark_held_locks+0xb1/0x100 [ 939.971579] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 939.971597] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 939.979726] ? lockdep_hardirqs_on+0x415/0x5d0 [ 939.979745] ? trace_hardirqs_on+0xbd/0x310 [ 939.979761] ? kasan_check_read+0x11/0x20 [ 939.979777] ? ___ratelimit+0x37c/0x686 [ 939.979794] ? trace_hardirqs_off_caller+0x300/0x300 [ 940.012117] ? do_raw_spin_trylock+0x270/0x270 [ 940.016716] ? trace_hardirqs_on_caller+0x310/0x310 [ 940.021745] ? lock_acquire+0x1db/0x570 [ 940.025759] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 940.030877] ? ___ratelimit+0xac/0x686 [ 940.030898] ? idr_get_free+0xee0/0xee0 [ 940.030928] oom_kill_process.cold+0x10/0x9d4 [ 940.030948] ? oom_badness+0xca/0xa50 [ 940.047115] ? out_of_memory+0xc8f/0x1420 [ 940.047132] ? find_held_lock+0x35/0x120 [ 940.047153] ? oom_evaluate_task+0x540/0x540 [ 940.047170] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 940.047189] ? lock_downgrade+0x910/0x910 [ 940.059795] ? kasan_check_read+0x11/0x20 [ 940.059814] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 940.059833] ? rcu_read_unlock_special+0x380/0x380 [ 940.059851] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 940.059869] ? oom_evaluate_task+0x305/0x540 [ 940.083896] out_of_memory+0x885/0x1420 [ 940.083919] ? __do_page_fault+0x610/0xd60 [ 940.083942] ? oom_killer_disable+0x340/0x340 [ 940.083957] ? mutex_trylock+0x248/0x2d0 [ 940.083975] ? __ww_mutex_check_waiters+0x160/0x160 [ 940.106634] ? lock_downgrade+0x910/0x910 [ 940.106652] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 940.106679] pagefault_out_of_memory+0x17c/0x1a1 [ 940.106697] ? out_of_memory+0x1420/0x1420 [ 940.106717] ? up_read+0x212/0x2b0 [ 940.106736] ? up_read_non_owner+0x100/0x100 [ 940.129977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 940.130000] mm_fault_error+0x100/0x3a0 17:20:16 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000016, 0x0, 0x0) 17:20:16 executing program 5: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(0x0, 0x0, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 17:20:16 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = accept(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, &(0x7f00000001c0)=0x80) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r2, 0x114, 0xa, &(0x7f00000002c0)={0x1, "f1"}, 0x2) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) sigaltstack(&(0x7f0000ffa000/0x3000)=nil, &(0x7f00000000c0)) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r5 = dup(r0) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffff9c, 0xc008640a, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r5, 0xc008640a, &(0x7f0000000140)={r6}) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000340)='/dev/cachefiles\x00', 0x80, 0x0) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r3, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000300)) [ 940.130024] __do_page_fault+0xc13/0xd60 [ 940.130052] do_page_fault+0xe6/0x7d8 [ 940.130070] ? trace_hardirqs_on_caller+0xc0/0x310 [ 940.142274] ? vmalloc_sync_all+0x30/0x30 [ 940.142290] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 940.142310] ? syscall_return_slowpath+0x5f0/0x5f0 [ 940.142329] ? prepare_exit_to_usermode+0x232/0x3b0 [ 940.142348] ? page_fault+0x8/0x30 [ 940.142366] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 940.151878] ? page_fault+0x8/0x30 [ 940.151898] page_fault+0x1e/0x30 [ 940.151911] RIP: 0033:0x4074ed [ 940.151928] Code: 0f 1f 44 00 00 c6 44 24 0e 06 48 c7 04 24 10 00 00 00 e9 56 ff ff ff e8 81 47 05 00 90 41 55 41 54 55 53 48 81 ec a8 1b 00 00 <48> 89 74 24 18 48 89 7c 24 30 64 48 8b 34 25 28 00 00 00 48 89 b4 [ 940.151937] RSP: 002b:00007f481d3510a0 EFLAGS: 00010206 [ 940.151949] RAX: 00000000004074e0 RBX: 00007f481d352c90 RCX: 0000000000000000 [ 940.151962] RDX: 0000000020013000 RSI: 0000000000000006 RDI: 0000000000000007 [ 940.241913] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 940.249355] R10: 0000000000000064 R11: 0000000000000000 R12: 00007f481d3536d4 [ 940.256640] R13: 00000000004c67fd R14: 00000000004dbbf8 R15: 0000000000000008 [ 940.283502] Mem-Info: [ 940.286050] active_anon:153995 inactive_anon:189 isolated_anon:0 [ 940.286050] active_file:17162 inactive_file:34952 isolated_file:0 [ 940.286050] unevictable:0 dirty:477 writeback:0 unstable:0 [ 940.286050] slab_reclaimable:15684 slab_unreclaimable:109104 [ 940.286050] mapped:58561 shmem:750 pagetables:1720 bounce:0 [ 940.286050] free:1193594 free_pcp:485 free_cma:0 [ 940.322540] binder_alloc: binder_alloc_mmap_handler: 3815 20001000-20004000 already mapped failed -16 [ 940.333473] binder: BINDER_SET_CONTEXT_MGR already set [ 940.338896] binder: 3815:3824 ioctl 40046207 0 returned -16 [ 940.345475] binder: 3815:3853 got reply transaction with no transaction stack [ 940.353310] binder_transaction: 3 callbacks suppressed [ 940.353328] binder: 3815:3853 transaction failed 29201/-71, size 0-0 line 2801 [ 940.359559] binder: release 3815:3816 transaction 874 out, still active [ 940.386538] binder: undelivered TRANSACTION_COMPLETE [ 940.393303] binder: undelivered TRANSACTION_ERROR: 29201 17:20:17 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x17b]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:17 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0xd2c02, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r2, 0x114, 0xa, &(0x7f00000001c0)={0x3, "d7832a"}, 0x4) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r1, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) accept$inet6(r2, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000280)=0x1c) ioctl$sock_ifreq(r0, 0x8924, &(0x7f0000000200)={'netdevsim0\x00', @ifru_flags=0xa002}) setsockopt$inet_int(r1, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) r3 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x1, 0x2) ioctl$UI_GET_SYSNAME(r3, 0x8040552c, &(0x7f0000000240)) 17:20:17 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000017, 0x0, 0x0) 17:20:17 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x68000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 940.400218] Node 0 active_anon:613848kB inactive_anon:756kB active_file:68508kB inactive_file:139808kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:234344kB dirty:1904kB writeback:0kB shmem:3000kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 118784kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 940.429299] binder: release 3815:3851 transaction 876 out, still active [ 940.436204] binder: undelivered TRANSACTION_COMPLETE [ 940.441406] binder: undelivered TRANSACTION_ERROR: 29201 [ 940.464569] Node 1 active_anon:0kB inactive_anon:0kB active_file:140kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 940.571348] binder: BINDER_SET_CONTEXT_MGR already set 17:20:17 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x41, &(0x7f00000000c0)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000003000000000000000000ffffffffffffffff0000000000000000000000000000000000000000000000000080000000000000000000000000"], 0x58) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 940.614525] Node 0 DMA free:15908kB min:220kB low:272kB high:324kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 940.654993] binder: 3864:3865 ioctl 40046207 0 returned -16 [ 940.655729] binder: 3864:3871 got reply transaction with bad transaction stack, transaction 878 has target 26829:0 [ 940.755777] lowmem_reserve[]: 0 2535 2537 2537 [ 940.769562] binder: 3864:3871 transaction failed 29201/-71, size 0-0 line 2816 [ 940.791301] Node 0 DMA32 free:979340kB min:36080kB low:45100kB high:54120kB active_anon:613984kB inactive_anon:1248kB active_file:68508kB inactive_file:139856kB unevictable:0kB writepending:1952kB present:3129332kB managed:2599664kB mlocked:0kB kernel_stack:8096kB pagetables:7020kB bounce:0kB free_pcp:2076kB local_pcp:1036kB free_cma:0kB [ 940.809193] binder_alloc: binder_alloc_mmap_handler: 3864 20001000-20004000 already mapped failed -16 [ 940.843393] binder: BINDER_SET_CONTEXT_MGR already set [ 940.884669] binder: 3864:3865 ioctl 40046207 0 returned -16 [ 940.914746] binder: 3864:3880 got reply transaction with no transaction stack [ 940.928627] lowmem_reserve[]: 0 0 2 2 [ 940.932549] Node 0 Normal free:1816kB min:2076kB low:2080kB high:2084kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:2204kB mlocked:0kB kernel_stack:96kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 940.959535] binder: release 3864:3871 transaction 878 out, still active [ 940.978668] binder: undelivered TRANSACTION_COMPLETE [ 940.983884] binder: undelivered TRANSACTION_ERROR: 29201 [ 940.989908] binder: 3864:3880 transaction failed 29201/-71, size 0-0 line 2801 [ 941.004457] lowmem_reserve[]: 0 0 0 0 [ 941.008289] Node 1 Normal free:3780624kB min:53780kB low:67224kB high:80668kB active_anon:0kB inactive_anon:0kB active_file:140kB inactive_file:0kB unevictable:0kB writepending:4kB present:3932160kB managed:3870184kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:272kB local_pcp:132kB free_cma:0kB [ 941.045533] binder: release 3864:3871 transaction 880 out, still active [ 941.046540] lowmem_reserve[]: 0 0 0 0 [ 941.052332] binder: undelivered TRANSACTION_COMPLETE [ 941.052358] binder: undelivered TRANSACTION_ERROR: 29201 [ 941.066962] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 941.080797] Node 0 DMA32: 160*4kB (UME) 297*8kB (UME) 946*16kB (UME) 1083*32kB (UME) 460*64kB (UME) 31*128kB (UME) 43*256kB (UM) 39*512kB (UM) 18*1024kB (UME) 4*2048kB (UM) 205*4096kB (UM) = 983496kB [ 941.100106] Node 0 Normal: 2*4kB (UM) 2*8kB (UM) 2*16kB (UM) 3*32kB (UM) 0*64kB 1*128kB (M) 0*256kB 1*512kB (U) 1*1024kB (U) 0*2048kB 0*4096kB = 1816kB [ 941.114113] Node 1 Normal: 64*4kB (U) 266*8kB (UE) 288*16kB (UE) 62*32kB (UME) 18*64kB (UM) 9*128kB (U) 4*256kB (UME) 6*512kB (UM) 3*1024kB (UM) 1*2048kB (E) 918*4096kB (M) = 3780624kB [ 941.135208] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 941.145562] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 941.154310] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 941.163353] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 941.172196] 52794 total pagecache pages [ 941.176484] 0 pages in swap cache [ 941.180074] Swap cache stats: add 0, delete 0, find 0/0 [ 941.185659] Free swap = 0kB [ 941.188814] Total swap = 0kB [ 941.191959] 1965979 pages RAM [ 941.197504] 0 pages HighMem/MovableOnly [ 941.201580] 343989 pages reserved [ 941.211607] 0 pages cma reserved [ 941.215778] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz3,mems_allowed=0-1,global_oom,task_memcg=/syz1,task=syz-executor1,pid=23342,uid=0 [ 941.236583] Out of memory: Kill process 23342 (syz-executor1) score 1005 or sacrifice child [ 941.251570] Killed process 23342 (syz-executor1) total-vm:72708kB, anon-rss:2192kB, file-rss:35828kB, shmem-rss:0kB 17:20:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 17:20:18 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000018, 0x0, 0x0) 17:20:18 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r3 = syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x0, 0x2) ioctl$sock_inet_tcp_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000240)) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) socketpair(0x10, 0x6, 0x0, &(0x7f0000000280)) r4 = semget(0x2, 0x2, 0x80) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) semtimedop(r4, &(0x7f00000000c0)=[{0x4, 0x4, 0x1800}, {0x3, 0x5, 0x1000}, {0x0, 0x1, 0x1000}], 0x3, &(0x7f0000000140)={r5, r6+30000000}) 17:20:18 executing program 5: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(0x0, 0x0, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 17:20:18 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x6c000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 941.378141] binder: BINDER_SET_CONTEXT_MGR already set 17:20:18 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x4000, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e23, 0x10000, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}}, &(0x7f0000000100)=0x84) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f0000000140)={r4, 0x1, 0x6, [0x5, 0x2b40, 0xffff, 0x8, 0x1831, 0x387]}, &(0x7f00000001c0)=0x14) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 941.410711] binder: 3886:3895 got reply transaction with bad transaction stack, transaction 882 has target 26829:0 [ 941.441961] binder: 3886:3893 ioctl 40046207 0 returned -16 [ 941.467406] binder: 3886:3895 transaction failed 29201/-71, size 0-0 line 2816 [ 941.501170] binder_alloc: binder_alloc_mmap_handler: 3886 20001000-20004000 already mapped failed -16 17:20:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x2, 0x0, 0x0, 0x0) [ 941.530793] binder: BINDER_SET_CONTEXT_MGR already set [ 941.540224] binder: 3886:3893 ioctl 40046207 0 returned -16 [ 941.559965] binder: 3886:3905 got reply transaction with no transaction stack [ 941.567721] binder: 3886:3905 transaction failed 29201/-71, size 0-0 line 2801 [ 941.628464] binder: release 3886:3900 transaction 884 out, still active [ 941.636749] binder: undelivered TRANSACTION_COMPLETE [ 941.642182] binder: undelivered TRANSACTION_ERROR: 29201 [ 941.674874] binder: release 3886:3895 transaction 882 out, still active [ 941.681696] binder: undelivered TRANSACTION_COMPLETE [ 941.686962] binder: undelivered TRANSACTION_ERROR: 29201 17:20:18 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x74000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:18 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000019, 0x0, 0x0) 17:20:18 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x7, 0x200000) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffff9c, 0x84, 0x18, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f00000001c0)={r2, 0xd0b}, &(0x7f0000000240)=0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r3, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000017, &(0x7f0000000040)=0x4, 0xfffffffffffffc90) 17:20:18 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x185]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x4, 0x0, 0x0, 0x0) [ 941.848647] binder: BINDER_SET_CONTEXT_MGR already set [ 941.869280] binder: 3915:3924 got reply transaction with bad transaction stack, transaction 886 has target 26829:0 [ 941.905907] binder: 3915:3921 ioctl 40046207 0 returned -16 17:20:18 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000021, 0x0, 0x0) 17:20:18 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x4) r3 = accept$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @empty}, &(0x7f0000000100)=0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r4 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x80380) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, &(0x7f0000000340)={0xffffffffffff0001, 0x0, {0x3, 0x67302f749c715c99, 0x6, 0x3, 0x3}}) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) ioctl(r3, 0x0, &(0x7f0000000240)="eb0daa9762d7f5f86831d189b7acff7f99c222a2edd72c313a8ef5e99bcf03ce7ca338109311b953b57442a4c09473cf2ee28ae6b5f64ddfad957c1c07054b6e195c8bcf428e20c74e27e299e58f9762a6d51bad55f32c8f4ceb6aca6c166bc6dc38c96aa2732cdabf7db4c90e25f1bad2cf6d96b995f963e7209ee177d2b58ed433ecf71462d7d86f73a3fae77321a8bd8c382ca9eebbca1982bb6d332fd7bd520e23298b3b6d3ad87dffaf7e403b7c3602c952effd4f34b2c1b193ec3674e3a00968638c53761d93f29ebb355973eb3649352538c15c0daa") [ 941.936377] binder: 3915:3924 transaction failed 29201/-71, size 0-0 line 2816 [ 942.007818] binder_alloc: binder_alloc_mmap_handler: 3915 20001000-20004000 already mapped failed -16 [ 942.063694] binder: BINDER_SET_CONTEXT_MGR already set 17:20:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x5, 0x0, 0x0, 0x0) [ 942.094719] binder: 3915:3941 got reply transaction with no transaction stack [ 942.138328] binder: 3915:3940 ioctl 40046207 0 returned -16 17:20:19 executing program 5: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(0x0, 0x0, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 17:20:19 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) fsetxattr$trusted_overlay_nlink(r0, &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000100)={'U+', 0x100000001}, 0x28, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:19 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000022, 0x0, 0x0) [ 942.180872] binder: release 3915:3924 transaction 886 out, still active [ 942.191057] binder: 3915:3941 transaction failed 29201/-71, size 0-0 line 2801 [ 942.202295] binder: undelivered TRANSACTION_COMPLETE 17:20:19 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x7a000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 942.264280] binder: undelivered TRANSACTION_ERROR: 29201 [ 942.293656] binder: release 3915:3921 transaction 888 out, still active [ 942.319545] binder: undelivered TRANSACTION_COMPLETE [ 942.339794] binder: undelivered TRANSACTION_ERROR: 29201 17:20:19 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) r0 = socket$inet6(0xa, 0x1000000000005, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") getsockopt$inet_buf(r0, 0x84, 0x3, &(0x7f0000dcffe8)=""/24, &(0x7f0000000080)=0x18) r2 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x7, 0x40000) ioctl$TIOCSCTTY(r2, 0x540e, 0x9) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x3) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f0000000100)={0x2, 0x0, @remote}, 0x10) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f00000001c0), &(0x7f0000000380)=0x30) ioctl$sock_ifreq(r3, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r5 = gettid() ptrace$poke(0x5, r5, &(0x7f0000000140), 0x6) setsockopt$inet_int(r4, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000000240)={0xff, {{0xa, 0x4e20, 0xfffffffffffffff9, @rand_addr="62daf5637fba1fc442edafdb4bf11e8f", 0x7}}, {{0xa, 0xf0e, 0x2, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8}}}, 0x108) 17:20:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x6, 0x0, 0x0, 0x0) [ 942.422727] binder: BINDER_SET_CONTEXT_MGR already set [ 942.463157] binder: 3958:3962 got reply transaction with bad transaction stack, transaction 890 has target 26829:0 17:20:19 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000023, 0x0, 0x0) [ 942.519227] binder: 3958:3961 ioctl 40046207 0 returned -16 [ 942.554937] binder: 3958:3962 transaction failed 29201/-71, size 0-0 line 2816 [ 942.606054] binder_alloc: binder_alloc_mmap_handler: 3958 20001000-20004000 already mapped failed -16 [ 942.659615] binder: BINDER_SET_CONTEXT_MGR already set [ 942.684233] binder: 3958:3961 ioctl 40046207 0 returned -16 17:20:19 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x186]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:19 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0xfdfdffff, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:19 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$sndpcmc(&(0x7f00000001c0)='/dev/snd/pcmC#D#c\x00', 0xf323, 0x204000) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000200)=0x0) write$FUSE_LK(r2, &(0x7f0000000240)={0x28, 0x0, 0x1, {{0x4, 0xfffffffffffffff7, 0x2, r3}}}, 0x28) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) fanotify_init(0x41, 0x141800) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x2000, 0x0) ioctl$RTC_ALM_READ(r5, 0x80247008, &(0x7f0000000140)) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) fsetxattr$security_smack_transmute(r0, &(0x7f0000000280)='security.SMACK64TRANSMUTE\x00', &(0x7f00000002c0)='TRUE', 0x4, 0x1) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r0, 0x8916, &(0x7f00000000c0)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x7, 0x0, 0x0, 0x0) 17:20:19 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000024, 0x0, 0x0) 17:20:20 executing program 5: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040), 0x0, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 943.120332] binder: BINDER_SET_CONTEXT_MGR already set [ 943.132397] binder: 3991:3994 ioctl 40046207 0 returned -16 17:20:20 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f00000000c0), 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r1, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x119) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:20 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000025, 0x0, 0x0) [ 943.188473] binder: 3991:4002 got reply transaction with no transaction stack [ 943.206664] binder: 3991:4002 transaction failed 29201/-71, size 0-0 line 2801 17:20:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x8, 0x0, 0x0, 0x0) 17:20:20 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0xfffffffffffffde1) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x40, 0x0) recvfrom$inet6(r3, &(0x7f0000000100)=""/119, 0x77, 0x40, &(0x7f00000001c0)={0xa, 0x4e23, 0xfff, @empty, 0x20}, 0x1c) 17:20:20 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000028, 0x0, 0x0) 17:20:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x9, 0x0, 0x0, 0x0) [ 943.896776] binder_alloc: binder_alloc_mmap_handler: 3991 20001000-20004000 already mapped failed -16 [ 943.953863] binder: release 3991:4009 transaction 895 out, still active [ 943.962263] binder: undelivered TRANSACTION_COMPLETE [ 943.980688] binder: release 3991:3994 transaction 893 out, still active [ 943.995200] binder: undelivered TRANSACTION_COMPLETE [ 944.009340] binder: undelivered TRANSACTION_ERROR: 29201 17:20:20 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x187]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:20 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x80, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0x7, &(0x7f0000000100)={0x1, 0x7f, 0x84, 0x8}, 0x10) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:20 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000029, 0x0, 0x0) 17:20:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xa, 0x0, 0x0, 0x0) 17:20:20 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0xfffffdfd, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:20 executing program 5: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040), 0x0, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 944.142710] binder: BINDER_SET_CONTEXT_MGR already set 17:20:21 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x100000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 944.186353] binder: 4048:4054 ioctl 40046207 0 returned -16 17:20:21 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000440)='/dev/hwrng\x00', 0x200000007c, 0x0) ioctl$PPPIOCGNPMODE(r3, 0xc008744c, &(0x7f0000000100)={0xc2a7}) write$P9_RWALK(r3, &(0x7f0000000900)={0x4a, 0x6f, 0x2, {0x5, [{0x21, 0x0, 0x4}, {0x2, 0x2, 0x5}, {0x80, 0x1, 0x4}, {0x4, 0x4, 0x7}, {0x1}]}}, 0x4a) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) recvfrom$rxrpc(r3, &(0x7f0000000140)=""/56, 0x38, 0x2002, &(0x7f00000001c0)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e21, 0x9, @loopback, 0x6}}, 0x24) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) ioctl$KVM_SET_XSAVE(r2, 0x5000aea5, &(0x7f0000000500)={"27996310941332ccc8604f9fbca3199fecbb4d079010c539fc47988a34914613e2541494ae51dfa2e3311ea872a536ca0807ec497ebf355858becae4479ddd8d3960e106a81506bf2a2c69adef354dc4d2b7dc147428a6a2ac3f32febcb03b2446cd0be6b5708a9787fcce835e0546cdb1574301f2538006f068038fbde31b7f56517c9c1a3ae08293ab4a20b99f0083d1d5e1c7a7df40446a4eab6e9b1fc1f2a29f1e5485530f1365abb739cfcad584cf397f409971fbe1d6cc6e9e6b04d523cfe43efd3110952f3c1559fb6a14ca9f26f28191faae187c5e08d7705ef56ff62b57098c90f8e85dc2c3a0ebe9cb2f16ab24b61cd2568fd8aeaea632106b4cf09ff6bda9986c6ac90833a54ac2663f33c348e844f27aeacf084a8e8c3fdd893016914304dd2e857173a0b0e1960965a89cbbe9bd59c10609c820529ce551422eb5c4bcbaaf251a74dd586be00f4bac8b4999c27c6d9ece6f22e8b0ddac399e1087b82bcc019aac43ff3d6a928864d62190ec4f05e662547619f572255103aad0deb4e6fd663d34145d00f72c12744ca952eaafb6f6d693d80b8ca2cc26a07650fdc07dabc6b4b1ba88085a22021b2253a67250cb8ca02976d17d3f0e5a0b32bed2adcda1079441f24bb0125758511e65eacc1963cd1ef5793f885a58369d53597222f78e5d6b2742dbbcd97b092471cc710643d3e3d713e8f43033bc74e1f33b8f7bf59d237165926f82ab257c97a6b476ed14ce0a6f7743915ee551788c38a7efc237d67edd8d3dfec8d2b3aa5bde3b0a075939e4029fa4b6eca918912fee1d7453bdda817fc76a80e5d42dc7c01d08a1718241de0d79c3880bb425503d9bd325adaa57909f6a96cf71876d80c5d98acbd5bfbcdcc7d4a88a98c79f24ce78b876a480fd57c60438a8389de5cb87cdb2d8cafd65bd9c968cd327e53ec9ef02850a34f058cbfc96bd057539910173644908dad5f2d36d575dfabb0716d23d3f6820b259053c1737b1729f009e14a1d9e31516aec0f4879b325b4f40d03b73d175b76668339daea089258aa913f73720242f54e99f6d9db09190862b759acb16136c905ac826f2eb7893ab6a03864966c2750ebc8f0e1f533b5edd21172a52ba7598b4ea46dfa09fb459eb595066422b5e9a715332849659ec46d53830a81a510a921493e931cd5f626756d792e4c1459a412b708f30115776182718e59913b1bdff5e1b1bad48d682f62e55768c90705f1b0df29cd17a6f73e05efdc74b0af6f01c0fd99dea623948493b795ea98a7714746062dabe5dcfcd58fad483360eb682769485ac8ad71074e43f07f48a767b4b1ecdb15ef6996bb8a5b652e6cb9f84ec0134a6d68d7fb0569a654e8f7ba95fcf546fb74067918d51a6e4c552a1be72b897fc1315fd289cf832527b5245871c245f661c5e0a3087ac15c756cfb46e881e"}) getsockopt$inet_int(r3, 0x0, 0x8, &(0x7f00000000c0), &(0x7f00000003c0)=0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) getsockopt$IPT_SO_GET_ENTRIES(r2, 0x0, 0x41, &(0x7f0000000240)={'mangle\x00', 0xe1, "e6d69d3b812e3da021e61677a488b6d69d75ab39a469480cd4d36288d995a9c513b429263c207d3dde9df7eabbb5ce66a65a3e8400ad162a040eadbc5f629a66f5b86962bd8373ff4a68c2c3e573efed26839c5d902a6089a826e66ba681f9ffade3eb826e7657cea4a48910038fb9654be19456108f2882b6688ed2935e3a59bc58f889f8f68106e6d6507aefa8c9ff0cd27a449d0b76937f0391b4d0b0ac371bd666bd179457203c68e84ede9422c7fbd0f769d946e9b9e61a90c6fc3524d0ede4e3104b44fe3b323e8fd3fc040ccb7178295f5dd0a499c67b5d7bdaecc95646"}, &(0x7f0000000380)=0x105) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:21 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x40000002a, 0x0, 0x0) 17:20:21 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xb, 0x0, 0x0, 0x0) [ 944.370993] binder: BINDER_SET_CONTEXT_MGR already set [ 944.405014] binder: 4070:4072 ioctl 40046207 0 returned -16 17:20:21 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x40000002b, 0x0, 0x0) 17:20:21 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x200000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 944.696355] binder: BINDER_SET_CONTEXT_MGR already set [ 944.724997] binder: 4091:4092 ioctl 40046207 0 returned -16 17:20:21 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x1a0]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:21 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r3 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x2, 0x2) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, &(0x7f00000000c0), 0x4) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) ioctl$KVM_GET_VCPU_EVENTS(r3, 0x8040ae9f, &(0x7f0000000100)) 17:20:21 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xd, 0x0, 0x0, 0x0) 17:20:21 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x40000002c, 0x0, 0x0) 17:20:21 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x300000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:21 executing program 5: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040), 0x0, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 945.148682] binder: BINDER_SET_CONTEXT_MGR already set 17:20:22 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond_slave_0\x00', @ifru_mtu=0x80000001}) pkey_alloc(0x0, 0x3) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 945.177758] binder: 4110:4112 ioctl 40046207 0 returned -16 17:20:22 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x40000002d, 0x0, 0x0) [ 945.257259] binder: 4110:4120 got reply transaction with bad transaction stack, transaction 897 has target 26829:0 [ 945.287723] binder: 4110:4120 transaction failed 29201/-71, size 0-0 line 2816 17:20:22 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x14, 0x0, 0x0, 0x0) 17:20:22 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r3 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_AUDOUT(r3, 0x40345632, &(0x7f0000000100)={0x746, "ef6204725df362d574d56c0e066cc9368943c991da6f704a839562d0b193b56f", 0x3, 0x1}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:22 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x400000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 945.432216] binder: release 4110:4120 transaction 897 out, still active [ 945.448910] binder: undelivered TRANSACTION_COMPLETE 17:20:22 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x40000002e, 0x0, 0x0) [ 945.489701] binder: undelivered TRANSACTION_ERROR: 29201 [ 945.581013] binder: BINDER_SET_CONTEXT_MGR already set [ 945.629417] binder: 4139:4140 ioctl 40046207 0 returned -16 [ 945.668378] binder: 4139:4143 got reply transaction with bad transaction stack, transaction 899 has target 26829:0 [ 945.709842] binder: 4139:4143 transaction failed 29201/-71, size 0-0 line 2816 [ 945.787328] binder: release 4139:4143 transaction 899 out, still active [ 945.794899] binder: undelivered TRANSACTION_COMPLETE [ 945.811731] binder: undelivered TRANSACTION_ERROR: 29201 17:20:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x1c0]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:22 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) mount(&(0x7f00000000c0)=@sr0='/dev/sr0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='ecryptfs\x00', 0x1000004, &(0x7f00000001c0)='wlan0\x00') setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:22 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x50, 0x0, 0x0, 0x0) 17:20:22 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x500000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:22 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x40000002f, 0x0, 0x0) 17:20:22 executing program 5: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 946.171846] binder: BINDER_SET_CONTEXT_MGR already set [ 946.201391] binder: 4156:4164 got reply transaction with bad transaction stack, transaction 901 has target 26829:0 [ 946.231727] binder: 4156:4157 ioctl 40046207 0 returned -16 17:20:23 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000030, 0x0, 0x0) 17:20:23 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x600000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 946.251927] binder: 4156:4164 transaction failed 29201/-71, size 0-0 line 2816 17:20:23 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm_plock\x00', 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xa, &(0x7f0000000080)=0x5, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) write$sndseq(r2, &(0x7f0000000300)=[{0x0, 0x7, 0x10000, 0x6, @tick=0xfffffffffffffe01, {0x7, 0xdbd8}, {0x3f, 0xffff}, @result={0x400000000, 0x3}}, {0x1, 0x9, 0x0, 0x5, @time={r3, r4+10000000}, {0x5, 0x2}, {0xffffffffffff0000, 0x5}, @ext={0xbb, &(0x7f0000000240)="6dd5109927f46edda295465e9b5ddbe5d7aa727768c0adfcd407d735d6b02b6cd53a21305dc7009f90f2e7de0841eca8c1089aae270c1bbbbd932bf30aaeb682c7599444743524f7c705b8c4a0922d52ce0117b842307c25cb9f7aae262029298bf1a8c02249128cd8a0331a623400cde8b8b5c0697e87f7095f1ed52709f0e6efb37306c0b57ba94f2dc478f21b858ca788d854650225a82c27b410ae51075ed268b41cb9c0ad519d140bb59397eb27c6f2bd73d99444c09edbf7"}}, {0x5, 0xc8, 0xd7, 0x9, @time={0x77359400}, {0x100000001, 0xec}, {0x234e}, @quote={{0x0, 0x10000}, 0x7, &(0x7f0000000140)={0x5, 0x5, 0x3, 0x1, @time={0x0, 0x989680}, {0x7, 0xffff}, {0x7fff, 0x3}, @result={0x0, 0x106b}}}}, {0x4, 0x7, 0x82, 0x9, @tick=0x10000, {0x5, 0x4}, {0xd6c0, 0x9}, @time=@tick=0x9}], 0xc0) 17:20:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xc0, 0x0, 0x0, 0x0) 17:20:23 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000031, 0x0, 0x0) 17:20:23 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) getsockname(r2, &(0x7f0000000240)=@xdp, &(0x7f00000002c0)=0x80) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000300)=ANY=[], 0x0, 0x2) setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x484, &(0x7f00000001c0)={0x3a, @rand_addr, 0x4e20, 0x0, 'rr\x00', 0x3b, 0x8, 0x43}, 0x2c) [ 946.663222] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 946.931206] binder: release 3546:3556 transaction 848 out, still active [ 946.941362] binder: undelivered TRANSACTION_COMPLETE [ 946.953846] binder: undelivered TRANSACTION_ERROR: 29201 [ 946.979312] binder: undelivered TRANSACTION_ERROR: 29201 [ 947.000565] binder: release 3621:3653 transaction 856 out, still active [ 947.044501] binder: undelivered TRANSACTION_COMPLETE [ 947.049707] binder: release 4048:4057 transaction 896 out, still active [ 947.079909] binder: undelivered TRANSACTION_COMPLETE [ 947.086458] binder: release 4156:4164 transaction 901 out, still active [ 947.093217] binder: undelivered TRANSACTION_COMPLETE [ 947.105871] binder: undelivered TRANSACTION_ERROR: 29201 [ 947.111423] binder: release 3355:3361 transaction 826 out, still active [ 947.123886] binder: undelivered TRANSACTION_COMPLETE [ 947.130231] binder: undelivered TRANSACTION_ERROR: 29201 [ 947.141958] binder: release 3360:3356 transaction 824 out, still active [ 947.150205] binder: undelivered TRANSACTION_COMPLETE [ 947.161615] binder: undelivered TRANSACTION_ERROR: 29201 [ 947.168756] binder: release 3684:3696 transaction 862 out, still active 17:20:24 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000032, 0x0, 0x0) 17:20:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x500, 0x0, 0x0, 0x0) 17:20:24 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4001fe) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) chmod(&(0x7f00000000c0)='./file0\x00', 0x100) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000100)=0x9e41) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:24 executing program 5: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 17:20:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x1d9]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 947.204463] binder: undelivered TRANSACTION_COMPLETE [ 947.209607] binder: undelivered TRANSACTION_ERROR: 29201 [ 947.239246] binder: undelivered TRANSACTION_ERROR: 29201 [ 947.282821] binder: release 3772:3778 transaction 868 out, still active [ 947.319319] binder: undelivered TRANSACTION_COMPLETE [ 947.336068] binder: undelivered TRANSACTION_ERROR: 29201 17:20:24 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000240)={0x40, 0xffffffff, 0x6, 0x0, 0x0, [{r0, 0x0, 0xdaf}, {r1, 0x0, 0xffffffff}, {r1, 0x0, 0xa4}, {r1, 0x0, 0x9}, {r1, 0x0, 0x10000}, {r0}]}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r4, 0x1, &(0x7f0000000500)=""/4096) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r5 = syz_open_dev$admmidi(&(0x7f0000000140)='/dev/admmidi#\x00', 0x4, 0x4100) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000001c0)={0x3, 0x0, 0x10003, 0x2}) ioctl$DRM_IOCTL_SG_ALLOC(r5, 0xc0106438, &(0x7f0000000340)={0x81, r6}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:24 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x3) 17:20:24 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x700000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x600, 0x0, 0x0, 0x0) 17:20:24 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r1, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_int(r1, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x20000, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e24, @rand_addr=0x3}}, 0x3ff, 0x1}, &(0x7f0000000100)=0x90) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000140)=@sack_info={r3, 0x5, 0x1}, &(0x7f0000000280)=0xc) 17:20:24 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x11) 17:20:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x700, 0x0, 0x0, 0x0) 17:20:24 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 947.991052] device bridge_slave_1 left promiscuous mode [ 947.997270] bridge0: port 2(bridge_slave_1) entered disabled state 17:20:24 executing program 5: syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x2000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 948.068017] device bridge_slave_0 left promiscuous mode [ 948.073673] bridge0: port 1(bridge_slave_0) entered disabled state [ 948.346870] device hsr_slave_1 left promiscuous mode 17:20:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x277]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 948.401841] device hsr_slave_0 left promiscuous mode [ 948.460265] team0 (unregistering): Port device team_slave_1 removed [ 948.505840] team0 (unregistering): Port device team_slave_0 removed [ 948.542456] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 948.601007] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 948.829141] bond0 (unregistering): Released all slaves 17:20:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x2ff]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:25 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x88) [ 948.990075] IPVS: ftp: loaded support on port[0] = 21 17:20:25 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x900, 0x0, 0x0, 0x0) 17:20:25 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 949.518803] chnl_net:caif_netlink_parms(): no params data found [ 949.639319] bridge0: port 1(bridge_slave_0) entered blocking state [ 949.653765] bridge0: port 1(bridge_slave_0) entered disabled state [ 949.669239] device bridge_slave_0 entered promiscuous mode [ 949.684254] bridge0: port 2(bridge_slave_1) entered blocking state [ 949.698657] bridge0: port 2(bridge_slave_1) entered disabled state [ 949.714075] device bridge_slave_1 entered promiscuous mode [ 949.767196] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 949.792012] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 949.839647] team0: Port device team_slave_0 added [ 949.854114] team0: Port device team_slave_1 added [ 949.957647] device hsr_slave_0 entered promiscuous mode [ 949.994767] device hsr_slave_1 entered promiscuous mode [ 950.051504] bridge0: port 2(bridge_slave_1) entered blocking state [ 950.057916] bridge0: port 2(bridge_slave_1) entered forwarding state [ 950.064637] bridge0: port 1(bridge_slave_0) entered blocking state [ 950.071005] bridge0: port 1(bridge_slave_0) entered forwarding state [ 950.085978] bridge0: port 1(bridge_slave_0) entered disabled state [ 950.093379] bridge0: port 2(bridge_slave_1) entered disabled state [ 950.160284] 8021q: adding VLAN 0 to HW filter on device bond0 [ 950.181211] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 950.196260] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 950.212710] 8021q: adding VLAN 0 to HW filter on device team0 [ 950.224110] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 950.238958] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 950.249643] bridge0: port 1(bridge_slave_0) entered blocking state [ 950.256073] bridge0: port 1(bridge_slave_0) entered forwarding state [ 950.284537] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 950.292423] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 950.300571] bridge0: port 2(bridge_slave_1) entered blocking state [ 950.306976] bridge0: port 2(bridge_slave_1) entered forwarding state [ 950.314031] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 950.322838] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 950.331388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 950.339645] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 950.360549] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 950.367765] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 950.376682] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 950.385155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 950.392819] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 950.400917] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 950.414242] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 950.425126] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 950.463129] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 950.550412] binder: BINDER_SET_CONTEXT_MGR already set [ 950.556340] binder: 4294:4295 ioctl 40046207 0 returned -16 [ 950.608407] binder: 4294:4297 got reply transaction with no transaction stack [ 950.619839] binder: 4294:4297 transaction failed 29201/-71, size 0-0 line 2801 [ 951.348900] binder_alloc: binder_alloc_mmap_handler: 4294 20001000-20004000 already mapped failed -16 [ 951.358622] binder: BINDER_SET_CONTEXT_MGR already set [ 951.363921] binder: 4294:4297 ioctl 40046207 0 returned -16 [ 951.365048] binder: 4294:4299 got reply transaction with no transaction stack [ 951.377060] binder: 4294:4299 transaction failed 29201/-71, size 0-0 line 2801 [ 951.385246] binder_thread_release: 5 callbacks suppressed [ 951.385257] binder: release 4294:4296 transaction 903 out, still active 17:20:28 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0xa00000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:28 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r3, &(0x7f0000000100)={0xc, 0x8, 0xfa00, {&(0x7f0000000240)}}, 0x10) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_flags=0x400}) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000003c0)={0xffffffffffffffff}, 0x106, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f0000000500)={0x14, 0x88, 0xfa00, {r4, 0x1c, 0x0, @in={0x2, 0x4e21, @loopback}}}, 0x90) r5 = syz_open_procfs(0x0, &(0x7f0000000440)='net/ip_tables_targets\x00') setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f0000000480)=0x2, 0x4) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuset.memory_pressure\x00', 0x0, 0x0) dup2(r3, r1) read$eventfd(r6, &(0x7f00000001c0), 0x8) 17:20:28 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x300) 17:20:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xa00, 0x0, 0x0, 0x0) 17:20:28 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x308]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 951.404487] binder_release_work: 5 callbacks suppressed [ 951.404493] binder: undelivered TRANSACTION_COMPLETE [ 951.415332] binder_release_work: 3 callbacks suppressed [ 951.415338] binder: undelivered TRANSACTION_ERROR: 29201 [ 951.486846] binder: release 4294:4298 transaction 905 out, still active [ 951.503728] binder: undelivered TRANSACTION_COMPLETE [ 951.512875] binder: undelivered TRANSACTION_ERROR: 29201 [ 951.523973] binder: BINDER_SET_CONTEXT_MGR already set 17:20:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 951.532222] binder: 4311:4315 got reply transaction with bad transaction stack, transaction 907 has target 26829:0 [ 951.543508] binder: 4311:4314 ioctl 40046207 0 returned -16 17:20:28 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x1100) [ 951.612199] binder_alloc: binder_alloc_mmap_handler: 4311 20001000-20004000 already mapped failed -16 [ 951.672134] binder: BINDER_SET_CONTEXT_MGR already set 17:20:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xb00, 0x0, 0x0, 0x0) [ 951.700837] binder: 4311:4315 transaction failed 29201/-71, size 0-0 line 2816 [ 951.737315] binder: 4311:4314 ioctl 40046207 0 returned -16 17:20:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 951.762399] binder: 4311:4322 got reply transaction with no transaction stack [ 951.819347] binder: release 4311:4315 transaction 907 out, still active [ 951.827075] binder: 4311:4322 transaction failed 29201/-71, size 0-0 line 2801 [ 951.855863] binder: undelivered TRANSACTION_COMPLETE 17:20:28 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x2000000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:28 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x8800) [ 951.885476] binder: undelivered TRANSACTION_ERROR: 29201 [ 951.917878] binder: undelivered TRANSACTION_ERROR: 29201 [ 951.949670] binder: release 4311:4331 transaction 909 out, still active [ 951.993733] binder: undelivered TRANSACTION_COMPLETE 17:20:28 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 952.067253] binder: BINDER_SET_CONTEXT_MGR already set [ 952.089505] binder: 4341:4345 got reply transaction with bad transaction stack, transaction 911 has target 26829:0 [ 952.114165] binder: 4341:4343 ioctl 40046207 0 returned -16 [ 952.123467] binder: 4341:4345 transaction failed 29201/-71, size 0-0 line 2816 [ 952.144498] binder_alloc: binder_alloc_mmap_handler: 4341 20001000-20004000 already mapped failed -16 [ 952.164219] binder: BINDER_SET_CONTEXT_MGR already set [ 952.189517] binder: 4341:4343 ioctl 40046207 0 returned -16 [ 952.204284] binder: 4341:4354 got reply transaction with no transaction stack [ 952.212954] binder: 4341:4354 transaction failed 29201/-71, size 0-0 line 2801 [ 952.229223] binder: release 4341:4345 transaction 911 out, still active [ 952.241234] binder: undelivered TRANSACTION_COMPLETE [ 952.262054] binder: undelivered TRANSACTION_ERROR: 29201 [ 952.278090] binder: release 4341:4349 transaction 913 out, still active 17:20:29 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) mlockall(0x3) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r3 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000240)="7bdb97b295917cb88d619a39eb04ec14842cac10573b43de043e3ea0d24651db013d4f0ea826e4fc2f342355c7a7eec076c3667cbe43d83950b8edb091d0f32580921ee9f875d7e7677d4815e45208ca1ae000b55eae994fc26ceaf2490e80927bd3db269dbbecb1939a7d94da617590eda883eecd97f42287f2bdd4edeaa42a3c07b261a56c76dc5a2ac3b23c67cee2976d0c5c6e08f96442d24f8f6b7cf6cd374ec612716242761f01dbed2a95d25be1d2d6a761234f1c123f635c61e2ea0f33e1017faf2317d597fdd028fa86c0257b", 0xd1, 0xfffffffffffffffd) keyctl$set_timeout(0xf, r3, 0x800) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xd00, 0x0, 0x0, 0x0) 17:20:29 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x1000000) [ 952.339492] binder: undelivered TRANSACTION_COMPLETE [ 952.350261] binder: undelivered TRANSACTION_ERROR: 29201 17:20:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x47f]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:29 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x3f00000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:29 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x3000000) 17:20:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x1400, 0x0, 0x0, 0x0) [ 952.789464] binder: BINDER_SET_CONTEXT_MGR already set [ 952.809255] binder: 4375:4383 got reply transaction with bad transaction stack, transaction 915 has target 26829:0 17:20:29 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x11000000) [ 952.835305] binder: 4375:4381 ioctl 40046207 0 returned -16 [ 952.847609] binder: 4375:4383 transaction failed 29201/-71, size 0-0 line 2816 17:20:29 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x4800000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x2000, 0x0, 0x0, 0x0) 17:20:29 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 17:20:30 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x88000000) [ 953.134091] binder: BINDER_SET_CONTEXT_MGR already set [ 953.173773] binder: 4399:4401 ioctl 40046207 0 returned -16 17:20:30 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r3 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x2, 0x185180) setsockopt$packet_int(r3, 0x107, 0x0, &(0x7f0000000100)=0x6, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) [ 953.281478] binder: 4399:4408 got reply transaction with bad transaction stack, transaction 917 has target 26829:0 17:20:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x4000, 0x0, 0x0, 0x0) 17:20:30 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0xa4ffffff) [ 953.395202] binder: 4399:4408 transaction failed 29201/-71, size 0-0 line 2816 17:20:30 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x480]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:30 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = geteuid() syz_mount_image$reiserfs(&(0x7f00000000c0)='reiserfs\x00', &(0x7f0000000100)='./file0\x00', 0x100000001, 0x0, &(0x7f0000000140), 0x400, &(0x7f00000002c0)={[{@tails_off='tails=off'}, {@balloc_hashed_reloc='block-allocator=hashed_relocation'}], [{@dont_hash='dont_hash'}, {@subj_user={'subj_user', 0x3d, '$\'-posix_acl_accessmime_type^!vboxnet0'}}, {@defcontext={'defcontext', 0x3d, 'root'}}, {@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@fowner_lt={'fowner<', r3}}, {@uid_eq={'uid', 0x3d, r4}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}]}) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r1, 0x0, 0x400000007, &(0x7f0000000140)=0x4, 0x4) 17:20:30 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0xffffffa4) 17:20:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x5000, 0x0, 0x0, 0x0) [ 953.897653] binder_alloc: binder_alloc_mmap_handler: 4399 20001000-20004000 already mapped failed -16 [ 953.927634] binder: BINDER_SET_CONTEXT_MGR already set [ 953.932157] REISERFS warning (device loop1): super-6502 reiserfs_getopt: unknown mount option "dont_hash" [ 953.951102] binder: 4399:4408 ioctl 40046207 0 returned -16 [ 953.987017] binder: 4399:4413 got reply transaction with bad transaction stack, transaction 919 has target 26829:0 17:20:30 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 954.001795] binder: 4399:4413 transaction failed 29201/-71, size 0-0 line 2816 [ 954.028156] binder: release 4399:4408 transaction 917 out, still active [ 954.049553] binder: undelivered TRANSACTION_COMPLETE 17:20:30 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x4c00000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:30 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x100000000000000) [ 954.072810] binder: undelivered TRANSACTION_ERROR: 29201 [ 954.093403] binder: release 4399:4413 transaction 919 out, still active [ 954.112866] binder: undelivered TRANSACTION_COMPLETE [ 954.122836] binder: undelivered TRANSACTION_ERROR: 29201 17:20:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x60ff, 0x0, 0x0, 0x0) [ 954.179930] REISERFS warning (device loop1): super-6502 reiserfs_getopt: unknown mount option "dont_hash" [ 954.217860] binder: BINDER_SET_CONTEXT_MGR already set [ 954.263893] binder: 4460:4461 ioctl 40046207 0 returned -16 17:20:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm-monitor\x00', 0x80000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xffffffffffffffff) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$VIDIOC_TRY_DECODER_CMD(r0, 0xc0485661, &(0x7f0000000300)={0x6, 0x1000001, @start={0x1, 0x1}}) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000380)={{{@in, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@local}}, &(0x7f0000000480)=0xe8) connect$can_bcm(r1, &(0x7f0000000500)={0x1d, r4}, 0x10) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) r5 = dup3(r0, r2, 0x80000) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e22, 0x0, @local, 0x78a}}, 0x4eb6, 0xfffffffffffffffb, 0x7, 0x3, 0x9}, &(0x7f00000001c0)=0x98) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r5, 0x84, 0x77, &(0x7f0000000240)=ANY=[@ANYRES32=r6, @ANYBLOB="0000060001040000030009000f11c08e"], &(0x7f0000000280)=0x14) 17:20:31 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x300000000000000) [ 954.372999] binder: 4460:4465 got reply transaction with bad transaction stack, transaction 921 has target 26829:0 [ 954.441531] binder: 4460:4465 transaction failed 29201/-71, size 0-0 line 2816 17:20:31 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x1100000000000000) 17:20:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000100)=0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x3d, &(0x7f0000000040)=0x6, 0x1d4) [ 954.972408] binder_alloc: binder_alloc_mmap_handler: 4460 20001000-20004000 already mapped failed -16 [ 954.994993] binder: BINDER_SET_CONTEXT_MGR already set [ 955.000293] binder: 4460:4465 ioctl 40046207 0 returned -16 [ 955.013047] binder: 4460:4497 got reply transaction with no transaction stack 17:20:31 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x8800000000000000) 17:20:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x7400, 0x0, 0x0, 0x0) 17:20:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x0, 0x880) ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f0000000100)={0x7f}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:31 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x491]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:31 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 17:20:31 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x6000000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 955.021931] binder: 4460:4497 transaction failed 29201/-71, size 0-0 line 2801 [ 955.037322] binder: release 4460:4474 transaction 923 out, still active [ 955.044120] binder: undelivered TRANSACTION_COMPLETE [ 955.053581] binder: undelivered TRANSACTION_ERROR: 29201 [ 955.105396] binder: release 4460:4465 transaction 921 out, still active [ 955.112169] binder: undelivered TRANSACTION_COMPLETE [ 955.144302] binder: undelivered TRANSACTION_ERROR: 29201 17:20:32 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x1a5402, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_WINDOW(r3, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x5004046}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x68, r4, 0x400, 0x70bd26, 0x25dfdbfb, {{}, 0x0, 0x4109, 0x0, {0x4c, 0x18, {0x800, @link='syz0\x00'}}}, ["", "", "", "", ""]}, 0x68}}, 0x4) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, &(0x7f0000000040)=0x4, 0x4) 17:20:32 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0xa4ffffff00000000) [ 955.232828] binder: BINDER_SET_CONTEXT_MGR already set [ 955.290973] binder: 4507:4516 got reply transaction with bad transaction stack, transaction 925 has target 26829:0 17:20:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x9400, 0x0, 0x0, 0x0) [ 955.357762] binder: 4507:4514 ioctl 40046207 0 returned -16 [ 955.413723] binder_alloc: binder_alloc_mmap_handler: 4507 20001000-20004000 already mapped failed -16 17:20:32 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x480]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:32 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x897b, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 955.485035] binder: BINDER_SET_CONTEXT_MGR already set [ 955.518495] binder: 4507:4514 ioctl 40046207 0 returned -16 17:20:32 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x6800000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 955.565786] binder: 4507:4535 got reply transaction with no transaction stack 17:20:32 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) mbind(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, &(0x7f00000000c0)=0x80000000, 0x7, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='bridge0\x00', 0x10) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x1, 0x0, 0xfffffdff) [ 955.817479] binder: BINDER_SET_CONTEXT_MGR already set 17:20:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x200000, 0x0, 0x0, 0x0) 17:20:32 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000240)={{{@in6=@mcast2, @in=@broadcast}}, {{@in=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f0000000040)=0xe8) [ 955.859692] binder: 4542:4543 ioctl 40046207 0 returned -16 [ 955.880189] binder: 4542:4550 got reply transaction with bad transaction stack, transaction 929 has target 26829:0 [ 955.971825] binder_alloc: binder_alloc_mmap_handler: 4542 20001000-20004000 already mapped failed -16 [ 956.067166] binder: BINDER_SET_CONTEXT_MGR already set [ 956.080275] binder: 4542:4543 ioctl 40046207 0 returned -16 17:20:33 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x6c00000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:33 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x4d0]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:33 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 17:20:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x307100, 0x0, 0x0, 0x0) 17:20:33 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) r3 = getegid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000240)={{{@in6=@loopback, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast2}}, &(0x7f0000000140)=0xe8) mount$9p_virtio(&(0x7f0000000040)='bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x1001, &(0x7f0000000340)={'trans=virtio,', {[{@afid={'afid', 0x3d, 0xffffffff}}, {@dfltgid={'dfltgid', 0x3d, r3}}, {@aname={'aname', 0x3d, '\x86-\x89md5sum'}}, {@msize={'msize', 0x3d, 0xfff}}, {@access_user='access=user'}], [{@obj_user={'obj_user', 0x3d, 'keyring[keyringsecurityuser'}}, {@fowner_eq={'fowner', 0x3d, r4}}, {@permit_directio='permit_directio'}]}}) [ 956.459918] binder: 4576:4580 got reply transaction with bad transaction stack, transaction 932 has target 26829:0 17:20:33 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) getresuid(&(0x7f0000000840), &(0x7f0000000880)=0x0, &(0x7f00000008c0)) syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f00000001c0)='./file0\x00', 0xffffffffffffff96, 0x8, &(0x7f0000000780)=[{&(0x7f0000000200)="e009a32345f9c9946a0b153463f7738b029dcf2a65b78a05bb6f8b24acb7c37416f06a6dd77c9bb93bc6b6b6717af1ea6303e4cac1970b7d666baf09d1aa4bd9e0aee1271e83f5b3f46e6cfb0989f297d1e2a02a7239cd401c55c8d4f730798b57371158bdc1dbb8671b8c11413ba4cf1767fefc9cf30219e680de1d2c89089dfb0a5cd9e0c919cf0bc91fb41f15edc95eaff758", 0x94}, {&(0x7f00000002c0)="82182c703805aa9e2f448566d21114a7dfa07b3aabc95300ca0ed78ca6eb3c12a76ebfd60c58c42495319de5adb9dccf0b4bb417b1fe93d90a38d35905e9b7", 0x3f, 0x9}, {&(0x7f0000000300)="f6b3499825541825d8d342113ca2109a79a48c2771e593942268c382970f03fde0cf365f645efc4f44917b0184a08b9a0a77616482c92eff7315a270a9e33e5054c305b069bdbd80f3d1201e47ded4d67313dc8f89bb5b785e2088460121d7d28472c759d660024f7317e120db9a646fe2053ddac184c2a54c479a04f32cbfe51e1ecf605cd60a402b32bb14680a152caf3815fe636a880bebcc2ed42c5a1e5af786", 0xa2, 0x3}, {&(0x7f00000003c0)="cca3fd1841d8c54182e2a7d47a560881151fa1fd09712db09e709f192698d1e26f54851c4d638b9990ebe490187dd02f6c1b7acfa1171519247975307c72d45e3bf13bea4d81e3433a336e143d3b5d9b320892d71db316d8aebb94a0d2c104124643a9353c189a703e590b2b7c184ef2f975bf63c182202ba7e9687d72d976e5918406a85c617688314f94f9c41d46ce32e05a51a73491634a784a758d92e162ddfaf6a5c595dfb56919203df4049c2c41b4efc2a26b38437f5fe4af39ef09748424b1b3d93dd092e75bcac89daa5cf23de82cd270", 0xd5, 0x4}, {&(0x7f0000000500)="56efcebb81ab91787e2f5cb4498486ea629279cb50df73d8dc2005971d0f919a1da64fc1a13da9c517be223ec1487a2384fab0f6df9e4e49f22186a769a0659d886ec4747d1ea89494da54cedb11a96d5942ee99b66785fea7a49a9df14eacbf487f985d41ae561f9eb97f1315c16c784a63f2b37b677b4488488c401d1bfd88e349057c50521e80a07b630e30eae3e912c76a44945e6f196e42c238a082de72fd8e2cf5", 0xa4, 0x1f}, {&(0x7f00000005c0)="b5c0f4245e16888c0043ddb5b5259a1d62ed79a77df915d97e957203a6c86b6e824ca47b774950681773d418678b92ff023e745519dc6f6f53f191d23ce4ddcfa6d1ca42cd12723806bbc0b6d61ea0c846c028c5edefed6e3f6ccc5d0a86e4736bcd00d25563e35df25475b6cf8320baf9ed44a8e2854aec6e2652adb3941973ac994df595046f4ae73fca9ce94394051b1fdb26d46ec7d8ff7ae8ad61048ce54362ea5f2ebb0b0e8112d45479f9739d3b6d80779a6e2055cbcf8f14d454d2b2efb21648536b658c15dab03ef8b005f72dc701bd9239bf567980bc1c4e8a0e22c4f078deebcb1a9bf24f27f1ce2b027ed0030a82e3a9", 0xf6, 0x8000}, {&(0x7f00000006c0)="238413f7efcdbe98104c69931123a4fb996be63d67f8bc517ac8eb915e98f860ce8c762ab504192c1d6b55b2261a7e762602231f6680899093124db0edb2d8caeb0a2dbb8ca40bd5e52eb6b214f2688bc63724", 0x53, 0x4}, {&(0x7f0000000740)="af18222c5f4fef5c4084450bbb22cec8901401ef6ed05dbee15b93b3b740dd5498190a9585ec39da36e248440ec6ffdb30c9bde5f61379585cd33dff0a89", 0x3e, 0x8}], 0x8000, &(0x7f0000000900)={[{@utf8='utf8=1'}, {@shortname_win95='shortname=win95'}, {@shortname_lower='shortname=lower'}, {@utf8no='utf8=0'}, {@rodir='rodir'}, {@numtail='nonumtail=0'}, {@fat=@nfs='nfs'}], [{@euid_lt={'euid<', r3}}, {@obj_role={'obj_role', 0x3d, 'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00'}}, {@hash='hash'}, {@audit='audit'}, {@obj_user={'obj_user', 0x3d, 'cgroup'}}, {@pcr={'pcr', 0x3d, 0x27}}, {@smackfsdef={'smackfsdef', 0x3d, 'lo!'}}]}) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000040)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x12) ioctl$EVIOCGABS20(r4, 0x80184560, &(0x7f0000000100)=""/32) [ 956.543423] binder_transaction: 3 callbacks suppressed [ 956.543437] binder: 4576:4580 transaction failed 29201/-71, size 0-0 line 2816 17:20:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x480]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x400000, 0x0, 0x0, 0x0) 17:20:33 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x7400000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:33 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x8080) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x10000, 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x1, 0x0) ioctl$UDMABUF_CREATE_LIST(r3, 0x40087543, &(0x7f0000000140)=ANY=[@ANYBLOB="0000000002000000", @ANYRES32=r4, @ANYBLOB="0008000005ff", @ANYRES32=r5, @ANYBLOB="00000000000001000000000000f0ffff00000000"]) ioctl$GIO_UNIMAP(r4, 0x4b66, &(0x7f0000000240)={0x2, &(0x7f00000001c0)=[{}, {}]}) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 956.900883] binder: BINDER_SET_CONTEXT_MGR already set [ 956.943408] binder: 4595:4597 got reply transaction with bad transaction stack, transaction 934 has target 26829:0 17:20:33 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0xfffffffffffffffc, @remote}, 0x10) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuset.effective_mems\x00', 0x0, 0x0) write$FUSE_BMAP(r3, &(0x7f0000000140)={0x18, 0x0, 0x8, {0x7fff}}, 0x18) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x80800, 0x0) fsetxattr$trusted_overlay_nlink(r0, &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000240)={'U-', 0x1620}, 0x28, 0x2) ioctl$SCSI_IOCTL_SYNC(r4, 0x4) setsockopt$inet6_tcp_TLS_RX(r4, 0x6, 0x2, &(0x7f00000000c0), 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 957.041119] binder: 4595:4596 ioctl 40046207 0 returned -16 17:20:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x50a000, 0x0, 0x0, 0x0) [ 957.100433] binder: 4595:4597 transaction failed 29201/-71, size 0-0 line 2816 17:20:34 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x7a00000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 957.203014] binder_alloc: binder_alloc_mmap_handler: 4595 20001000-20004000 already mapped failed -16 [ 957.207662] QAT: Invalid ioctl [ 957.323539] QAT: Invalid ioctl [ 957.360326] binder: BINDER_SET_CONTEXT_MGR already set [ 957.396529] binder: 4620:4625 got reply transaction with bad transaction stack, transaction 936 has target 26829:0 [ 957.427858] binder: 4620:4623 ioctl 40046207 0 returned -16 17:20:34 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x560]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:34 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 17:20:34 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000040)={r1, 0x0, 0xc11, 0x4, 0x7}) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) r5 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000100)={0xffffffffffffffff}, 0x111, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r5, &(0x7f00000001c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000240), r6, 0x3}}, 0x18) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, 0x0, 0x0) 17:20:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x70a000, 0x0, 0x0, 0x0) [ 957.469178] binder: 4620:4625 transaction failed 29201/-71, size 0-0 line 2816 [ 957.517964] binder_alloc: binder_alloc_mmap_handler: 4620 20001000-20004000 already mapped failed -16 [ 957.582351] binder: BINDER_SET_CONTEXT_MGR already set 17:20:34 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0xfdfdffff00000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 957.612718] binder: 4620:4623 ioctl 40046207 0 returned -16 [ 957.841236] binder: 4646:4647 got reply transaction with bad transaction stack, transaction 938 has target 26829:0 [ 957.904112] binder: 4646:4647 transaction failed 29201/-71, size 0-0 line 2816 [ 957.972275] binder: 4646:4651 got reply transaction with no transaction stack [ 957.999435] binder: 4646:4651 transaction failed 29201/-71, size 0-0 line 2801 [ 958.019435] binder: release 4646:4647 transaction 938 out, still active [ 958.035684] binder: undelivered TRANSACTION_COMPLETE [ 958.061576] binder: undelivered TRANSACTION_ERROR: 29201 17:20:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x480]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:34 executing program 4: socket$inet(0x2, 0x80a, 0xfffffffffffffffd) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x713000, 0x0, 0x0, 0x0) 17:20:34 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0c630000e3de3be7e1ebfca19b0fde203639b2fa7e7b2a99d0ef8a514fe4d1255216c6eaa010d89409d00463c608857724e3292ff25f00b6b75b4b99d2ae04e9ba484d5a2ef8f4f2d86e3190ced95b612bef56067f2c722073363bc8c4c5a690c7c1510820d022cbbf2142f654d8008c65062d69aedfb8e0e80cd19d8085d0fad5b29d9a07eeddebdc3f50557509171f90e2a12e59a0cc8010b7e98a8af4308fa989796d3af3efad0b8439d3a2c9a2f90ab3661fc1f7"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x80080, 0x0) ioctl$VIDIOC_LOG_STATUS(r3, 0x5646, 0x0) [ 958.097208] binder: undelivered TRANSACTION_ERROR: 29201 [ 958.109880] binder: release 4646:4654 transaction 940 out, still active [ 958.127141] binder: undelivered TRANSACTION_COMPLETE [ 958.144175] syz-executor4 uses obsolete (PF_INET,SOCK_PACKET) [ 958.182956] binder: BINDER_SET_CONTEXT_MGR already set [ 958.231992] binder: 4659:4660 ioctl 40046207 0 returned -16 [ 958.308060] binder: 4659:4668 got reply transaction with bad transaction stack, transaction 942 has target 26829:0 17:20:35 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 17:20:35 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r1) ioctl$VIDIOC_G_ENC_INDEX(r2, 0x8818564c, &(0x7f0000000500)) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCDELRT(r3, 0x890c, &(0x7f0000000100)={0x0, {0x2, 0x4e20, @broadcast}, {0x2, 0x4e23, @empty}, {0x2, 0x4e24, @multicast2}, 0x110, 0x0, 0x0, 0x0, 0xfffffffffffffd41, &(0x7f0000000080)='veth0\x00', 0x4, 0x40, 0x3}) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r5 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x1, 0x2) write$UHID_DESTROY(r5, &(0x7f00000000c0), 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$VIDIOC_QUERYSTD(r5, 0x8008563f, &(0x7f00000001c0)) ioctl$sock_ifreq(r3, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, 0x0, 0x0) [ 958.364781] binder: 4659:4668 transaction failed 29201/-71, size 0-0 line 2816 17:20:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x740000, 0x0, 0x0, 0x0) 17:20:35 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x561]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:35 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x6, 0x20000) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x0, 0x7, 0x81, 0x8, 0x2, 0xc3bc, 0x9}, 0x1c) 17:20:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x80ffff, 0x0, 0x0, 0x0) 17:20:35 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x1, 0x2) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r3, 0x8, 0x70bd2d, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x40840) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x4e22, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, 0x0, 0x0) [ 958.956239] binder_alloc: binder_alloc_mmap_handler: 4659 20001000-20004000 already mapped failed -16 [ 959.008364] binder: 4659:4671 got reply transaction with bad transaction stack, transaction 944 has target 26829:0 [ 959.044632] binder: BINDER_SET_CONTEXT_MGR already set 17:20:35 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x820) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 959.060672] binder: 4659:4698 ioctl 40046207 0 returned -16 [ 959.074224] binder: 4659:4671 transaction failed 29201/-71, size 0-0 line 2816 [ 959.193189] binder: release 4659:4668 transaction 942 out, still active [ 959.227438] binder: undelivered TRANSACTION_COMPLETE [ 959.255051] binder: undelivered TRANSACTION_ERROR: 29201 [ 959.266235] binder: release 4659:4671 transaction 944 out, still active [ 959.284480] binder: undelivered TRANSACTION_COMPLETE [ 959.289605] binder: undelivered TRANSACTION_ERROR: 29201 17:20:36 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x3f00000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:36 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x940000, 0x0, 0x0, 0x0) 17:20:36 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0c630000c9b57074cfa3af4ca4c1a784e91552fdbf0faecf1d70e0a77ecd8ad4f877f40afceadedfff770b81528e7c1e714e3ed8922c9d2895d2ef28bc76427d9708ee74d5e547be5cb9dc4c03c088d3fe8005c787f8dbc97777be27fe7ee579db6acd72ae26e99d21a5fa315f579cc0ea58b6599c9513840d618cf644ade48982c9a4e5c129d910c1e24df6dca9b7ca3f629e63040c2fd3f30278216f204201f7148c10400262cd724bcbdadcf580fef06dce7bba73886e1b2356efa5aa9f7067b5962422d09e3208fb174283eb4fdefb0e0cb01235c7e8a96d4080fb171f3c0cbc93b8170e547701fc0232a901558e8fd732ddb7264f4995bced4065d2842e7b000000c9cf14aa5114f4889c41e348"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280), 0x10) 17:20:36 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:36 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 959.585791] binder: BINDER_SET_CONTEXT_MGR already set [ 959.591120] binder: 4712:4713 ioctl 40046207 0 returned -16 [ 959.616014] binder: BINDER_SET_CONTEXT_MGR already set 17:20:36 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000940)='/dev/hwrng\x00', 0x8c040, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f0000000980)=0xd6, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) ioctl$LOOP_SET_CAPACITY(r2, 0x4c07) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000840)=0x3, 0x4) syz_mount_image$f2fs(&(0x7f0000000200)='f2fs\x00', &(0x7f0000000240)='./file0\x00', 0x7f, 0x4, &(0x7f0000000780)=[{&(0x7f0000000380)="304b206c92266b1a7634d012d613f8bcca5b9c1c7472e26fe637b024f711f93857913c723dc0a2552d6878759f6f73178cc34c09c6277303128c2c00165020bc2cf0bdb1c8616e950196487105ce5e8b887c395316aaf3ca74e4a5951e3160d62b1e4c6482ba295558ca4b9c9a20c89830f3f6471eac489ded007b6a3d2699ae6012c8abd4a65a205afdfbdcaf38d47c5d834ba11a5beaf2e2a939eadd4dbb6c9e61c04df2d84f4199388a1393e365406cc0513051578fbd2537d870c657a7694ee4ed63779767dc2ad4be61d7dc8954941d180e8a3ac3f56a5f1f2249a5eb14f998f5c4807bee041629fa9727bcf609d97bfd574111f1452ed3ac", 0xfb, 0x7ff}, {&(0x7f0000000280)="7db0b3f887c9afff818fd49fd4c28dbd9527f95a4232aa128f6e1be7309f40e4db", 0x21, 0xfffffffffffffffa}, {&(0x7f0000000680)="f692ff00de89173cb537607d2ce65def7bd941893be936a6e7cc6e3472e3c8c100a8d715c885d135d6c2fb8b46432dfb8798027049a51264d88c41c0508e5d605e93ff3a302a7b3776bca177c7eb8d9d913555a971f5581590f71377c9f6fb682d9367291b855119dd43ea3b7e54ea825ad844e3131970c4eaf91cfbddc07b6dc99c9968ad6d716027a038ea06790b0faa02a24d295409485f9a06bf22390a1ac7ad35f82616cb1b9de6b071e7c2ffc6aa60b8cf40196cdfa5096f51f788c1ab26996e3d8505f4b9494b02af673eef1fc3fdd9523e8786eec4b03257da10a7dd7559b6544ef1d36e950c939c9c2534bb40415b0e05a2af", 0xf7, 0x2}, {&(0x7f0000000580)="a9d303f9ea2784aaed2f2f9bb0f8ab8dcb18aed24eeda9517e98a13c8c3fdc64173de7d26fa8ccd99b7193ec438fb8d5014e22fcd922353517f7a1f039305c591a40f344625e0d661a84464772787074866f5a97ea9076a2683bdacbea0aef3d8afc11a8c218f57abc7f88940aa0a3c90c4b89eabf58e7cc4db28872458084f059b8e0e560c11c66301ab8b56d01a073dfaccea0c7b7b411f02b897df80335a2132cd8433395", 0xa6, 0x5}], 0x6, &(0x7f00000009c0)=ANY=[@ANYBLOB="666c7573685f6d657267652c6e6f646973636172642c6163746976655f6c6f67733d322c696e6c696e655f78617474722c6e6f626172726965722c71756f74612c6673757569643d62003b007f621e332d7677613d2d653177372d66327f652d73373466003730772c6673757569643d00773966626336322d7b3833652d31777d732d3c3364772d17766332003b73002c7375626a5f726f6c653d2e2c7063723d30303030303030303030303030303030303031392c646f6e745f6d6561737572652c0070ef5740bb3e467193a3e6994b2983f2cd5bed"]) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r3 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$media(&(0x7f00000002c0)='/dev/media#\x00', 0x7, 0x8000) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0x5, &(0x7f0000000900)=0x6b58, 0x4) setsockopt$netrom_NETROM_N2(r1, 0x103, 0x3, &(0x7f0000000800)=0x9, 0x4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 959.655174] binder: 4715:4721 ioctl 40046207 0 returned -16 17:20:36 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x80000, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x286042}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x60, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x38, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x400}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x31400}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8001}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xffffffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xf3f}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = socket$inet_udp(0x2, 0x2, 0x0) timerfd_create(0x6, 0x80000) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r4 = shmat(0x0, &(0x7f0000ffa000/0x3000)=nil, 0x2000) shmdt(r4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x22000, 0x0) r6 = shmget(0x2, 0x2000, 0x78000040, &(0x7f0000ffa000/0x2000)=nil) shmat(r6, &(0x7f0000ff0000/0x10000)=nil, 0x0) ioctl$IMADDTIMER(r5, 0x80044940, &(0x7f00000000c0)=0xffffffffffffffff) ioctl$sock_ifreq(r0, 0x893e, &(0x7f0000000140)={'boZd\x00', @ifru_flags}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) ioctl$KVM_GET_XCRS(r5, 0x8188aea6, &(0x7f0000000340)={0x3, 0x100, [{0x1ff, 0x0, 0x62}, {0xe737}, {0x6, 0x0, 0x5}]}) [ 959.707213] binder: 4715:4723 got reply transaction with bad transaction stack, transaction 947 has target 26829:0 [ 959.777730] binder: 4715:4723 transaction failed 29201/-71, size 0-0 line 2816 [ 959.834735] binder: release 4715:4723 transaction 947 out, still active [ 959.846570] binder: undelivered TRANSACTION_COMPLETE [ 959.858776] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 959.870922] binder: BINDER_SET_CONTEXT_MGR already set [ 959.881604] binder: undelivered TRANSACTION_ERROR: 29201 [ 959.912680] binder: 4736:4742 got reply transaction with bad transaction stack, transaction 949 has target 26829:0 [ 959.913919] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 959.943019] binder: 4736:4742 transaction failed 29201/-71, size 0-0 line 2816 [ 959.947587] binder: 4736:4743 ioctl 40046207 0 returned -16 [ 959.953286] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 959.964529] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 959.981876] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 959.989687] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 960.005440] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) 17:20:36 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x3f00000000000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:36 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xa05000, 0x0, 0x0, 0x0) 17:20:36 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x570]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:36 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000880)='/dev/rtc0\x00', 0x200, 0x0) ioctl$PPPIOCGIDLE(r1, 0x8010743f, &(0x7f00000008c0)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) socket$inet(0x2, 0x4, 0x44) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r4 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) getegid() ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x55, 0x0, 0x10003, 0x100}) syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f00000001c0)='./file0\x00', 0x100, 0x2, &(0x7f0000000300)=[{&(0x7f0000000240)="2447f0baf7be6267327e99bea8f60c80650656f377d5a771", 0x18, 0xa71e}, {&(0x7f0000000280)="28c502185f30317d045580c661616f3b0dc8da6c648d8084a72193db9e5ef66747f03ca857295009b02d177e78d9f53ef3d55d4befdad390e6180084940e7d86ea34816b33ab59a476da39a128d0", 0x4e, 0xcb71}], 0x953000, &(0x7f0000000340)=ANY=[@ANYBLOB="756e9305bcfb085b6d5f786c6174653d302c7574e6383d312c0ce0ae35400100cb653d6c6f7765722c726f6f74636f6e746578743d756e636f6e66696e65645f752c726f6f74636f6e746578743d756e630000000000"]) ioctl$DRM_IOCTL_SG_ALLOC(r4, 0xc0106438, &(0x7f0000000100)={0x9, r5}) timer_create(0x7, &(0x7f0000000940)={0x0, 0x3c, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000980)=0x0) timer_delete(r6) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r4, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)={0x354, r7, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0x2c, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'irlan0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'veth0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_BEARER={0x98, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x6, @ipv4={[], [], @empty}, 0x958a}}, {0x14, 0x2, @in={0x2, 0x4e21, @multicast2}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x8dee, @ipv4={[], [], @loopback}, 0xc45}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x5, @mcast2, 0x1}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'tunl0\x00'}}]}, @TIPC_NLA_BEARER={0x9c, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x0, @empty, 0x174e00}}, {0x14, 0x2, @in={0x2, 0x4e21, @broadcast}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x10001, @mcast2, 0x940b}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x9, @mcast2, 0x9}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe745}]}]}, @TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x10000}]}, @TIPC_NLA_LINK={0x50, 0x4, [@TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc71d}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5dd7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}]}, @TIPC_NLA_LINK={0x2c, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x92f}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0xfffffffffffffff8, @remote, 0x200}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @loopback}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x78, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x10000}}}}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xb}}}, {0x14, 0x2, @in={0x2, 0x4e21, @rand_addr=0x7f}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}}, {0x14, 0x2, @in={0x2, 0x4e21, @broadcast}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x40}]}]}, 0x354}, 0x1, 0x0, 0x0, 0x40}, 0x8000) setsockopt$inet_int(r3, 0x0, 0x1d, 0x0, 0xffffffffffffff46) ioctl$VIDIOC_G_FREQUENCY(r1, 0xc02c5638, &(0x7f0000000900)={0x100000000, 0x5, 0x1}) [ 960.012564] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock 17:20:37 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) socket$key(0xf, 0x3, 0x2) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 960.108570] binder_alloc: binder_alloc_mmap_handler: 4736 20001000-20004000 already mapped failed -16 [ 960.140659] binder: BINDER_SET_CONTEXT_MGR already set [ 960.176000] binder: 4748:4749 ioctl 40046207 0 returned -16 [ 960.176212] binder: BINDER_SET_CONTEXT_MGR already set [ 960.195435] binder: 4736:4756 ioctl 40046207 0 returned -16 [ 960.205611] binder: 4736:4737 got reply transaction with bad transaction stack, transaction 952 has target 26829:0 17:20:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xa07000, 0x0, 0x0, 0x0) [ 960.243386] binder: 4748:4763 got reply transaction with no transaction stack [ 960.256916] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 960.265325] binder: 4736:4737 transaction failed 29201/-71, size 0-0 line 2816 [ 960.320539] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 960.367203] binder: release 4736:4742 transaction 949 out, still active [ 960.378953] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 960.396127] binder: undelivered TRANSACTION_COMPLETE 17:20:37 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 960.414871] binder: undelivered TRANSACTION_ERROR: 29201 [ 960.443556] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 960.453475] binder: release 4736:4737 transaction 952 out, still active [ 960.478931] binder: undelivered TRANSACTION_COMPLETE 17:20:37 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x800, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfe78) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 960.499011] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 960.509818] binder: undelivered TRANSACTION_ERROR: 29201 [ 960.561711] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock 17:20:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x1000000, 0x0, 0x0, 0x0) [ 960.610314] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 960.634946] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock 17:20:37 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = fcntl$dupfd(r0, 0x406, r1) mknodat(r4, &(0x7f0000000040)='./file0\x00', 0x8002, 0x3) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r5 = gettid() ptrace$getregs(0xc, r5, 0x6, &(0x7f0000000500)=""/4096) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) 17:20:37 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm-control\x00', 0x800, 0x0) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000280)={r4, 0x100000000, 0x9, r5}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='A\x00\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:37 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) r4 = getpgid(0xffffffffffffffff) getpgid(r4) [ 960.874793] binder: release 4748:4749 transaction 951 out, still active [ 960.881584] binder: undelivered TRANSACTION_COMPLETE [ 960.915538] binder: BINDER_SET_CONTEXT_MGR already set 17:20:37 executing program 1: 17:20:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x1000040, 0x0, 0x0, 0x0) [ 960.940172] binder: undelivered TRANSACTION_ERROR: 29201 [ 960.954643] binder: 4795:4796 ioctl 40046207 0 returned -16 [ 960.976174] binder: 4795:4796 unknown command 65 [ 961.002302] binder: 4795:4796 ioctl c0306201 20000140 returned -22 [ 961.037965] binder: 4795:4806 got reply transaction with no transaction stack [ 961.066873] binder_alloc: binder_alloc_mmap_handler: 4795 20001000-20004000 already mapped failed -16 [ 961.098185] binder: BINDER_SET_CONTEXT_MGR already set [ 961.110212] binder: 4795:4806 ioctl 40046207 0 returned -16 [ 961.131800] binder: 4795:4806 unknown command 65 [ 961.142592] binder: 4795:4806 ioctl c0306201 20000140 returned -22 [ 961.153635] binder: 4795:4796 got reply transaction with bad transaction stack, transaction 957 has target 26829:0 [ 961.212958] binder: release 4795:4796 transaction 955 out, still active [ 961.229924] binder: undelivered TRANSACTION_COMPLETE [ 961.257149] binder: undelivered TRANSACTION_ERROR: 29201 [ 961.270498] binder: release 4795:4796 transaction 957 out, still active [ 961.281869] binder: undelivered TRANSACTION_COMPLETE [ 961.298941] binder: undelivered TRANSACTION_ERROR: 29201 17:20:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x571]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:38 executing program 1: 17:20:38 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x4, 0x49c080) bind$bt_sco(r3, &(0x7f00000000c0)={0x1f, {0x7, 0x4, 0x0, 0x7, 0x2, 0xe6b}}, 0x8) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r0, 0x4080aebf, &(0x7f0000000500)={0xc71a42f0ca84a434, 0x0, 0x2080, {0x10000, 0xf000, 0x3}, [], "dea7e90e96112b26e3805621b52c42a1cba8e38494c01ffdf226f55aff4afa7afd872e1b3d97667bcb304e30d5f7b3aa32f484bbf66fc94d047fa624d2830619c4410f692e28c8776b607ea380ffdf73036c61f8487c546dcb82c4b7f8ad171c41e8d2720bfc965640ea0034e5186ac374422eb011bcb0172b808d77234e24379c7409ab7a808b3ca3af9f1bcbc30efb9917b7c42383dc23cce17113e1bab8233430655931722d4579838f0c1e0171e2344cb78c3bf2f6704692228f5127f5e22a21a9afd1211ff0ae33fd81ae85eb15dbf9c487d7d4d259e4e9699207deb915884a0ef8e82d96033d911e3c9e2b3b0ce99b4d60f0aa7930a9dcd4571bd74af8019e2cdebf8f56533d9efe3d6bfd8523608aa1fbf41dca6f587dde2333c8db37dcf6cb63a9e9397ffa13adacb2f68990c1c2dfb715ec3ac843f96f2fe7c6996ed1fb310363838e8651028d4aaebe80b8eee21015f3adcab8ee6dc2153a7313998073c0cb7790c57daa90ca87de38bf700294c585bc274159dc0dbc3ae0da40051414cd189cc3aa4ec3dca4e39c0c1b0049901a4fd26dec300f36d30d9db9d1cabebbbe23b8f10736ab28e83d799a8520b254db862fdb193b58411dba8679d76f65e88ba5bf3f7ace58e241f04866c3e781f939467e40d2c488bfd03f4396c3fa5dbec8463095406eb0c67078e319e23cc6926faa189ae63dd23b16c560d00abdaf559e6beb77d8a9b4e18932c54995dcf460dabb06d34844bdb991881f2541f6ebec1e35f3a51ddb1b5d0e0fceab6f3abb61b836f8173f2f178c717080aa32277a6cd55aa8beaa355cb8c833ed73168dd1b4cc67b11da3c5df68be4fc65fdc5e60d7f1a7261ed3ad38448f77427d15de4264f7558b978eb8a49feacad1d9b2bcf831b0031c23a20d8a2b3e9131948472fa99cfc4886511aecd6a007667a326df4159f948779be458918dda530c7c2cd53620b3079f0c5ed2b86fe0e0ea90b7c70984c7e683c5325925597602d2f13d4bb293999d616f57a64ee55a653e6d9d605c8ba4b3c60a7d767427da9b0352915c111583ecca0db80d5022d951329b3d166c2beca11d46df60c1614734c6d1b33f0966e1d95ee2e81f3cd671db5aba2cc0fd9e0fabdd26c3f678ba3b3f0d0a3b1cefaf73f60ac5fe02c585f015ed88c1f884c959a0638f1a7cc036c8109cbbb71cc3c8cdc60521ef54123010e30a386b182bfe938bf70870e164dea62a4c4b833de901d3e5c4f08e2c2b1768c33f1eb4f2d40dc7a03fc51688cc514b9dc15b69747ed7e9c6ef57ebe507fa5b2557ca03556d2b9d334817ec62b05bb4af35e75b14c2526eecf64154d3c653a315c71f16ad48f7eb2b98658a086383f6bf19aa01ba5cce0a830ec51f0f67e29357dc12f6526080ac35610cbe1b82f3c9f6715a6de7f076da7720b33a8dad47347755d51c5018d0383bddd2436436385f52ecb8bbef6b48b21b7d368138a1df1cceae9e411828950ba119d9b140017ec6ba411ea2aeb936e48eecb0ea4bb548fa7ed6d10598dbb7f6a38b4b34afc835fdd32fcfc4878af474723b4acdedb7d7fc28e1a77866716234b93ddecaa3369b63d52da014607806b9995f3f4c2d9af567c54f8e416e290837c68ae2ccaa8a3926376eaf586f538c43c0b87ef42e143dc2cb48f483e4e0533291859a8d489ecf2d48996e58d50a39934e50ebdccbcb6faa7a0e1245bbecb3f9950bcaee8c1855cae592ddfe5811404c77c2261d2ea74e4ec899cb66f9ec0dd126a7b0d3aa3ba574c4eb6084f0ec2f44359b72bb8c8583693099983aaf41eabf5113050ccb1a879a41f481ab5270ccd7d8483ba4fcd416184ae3a380c474322e36e1af8fa79117e1efbfece9f3acc1326d11718000265be30527df7eff395eeaab986a265e738fe4fdd0672d17ad5ea4c0b1445885d1a187306e6ce530b3779691b91baa8f4fff0cc2fa94e782cc533b929c25fe0779a876bd90596012fe88b197bf2236c5e8d53475d08baa301e9cfe428c89e4922f7a4f14bf30a7dd39ad2da750d2fab564dc4e5f87ff1047acae1938b274ef9f78afb33880058684d39dc58b56c1cc40aa7199f7c5914f2fbdbf99be869af61aa481180a0346cfd365d9e18b3cd9aee980f3ec0f24023fe5d1d5d4c17e9396daa496cbcc8fefb5f21c8a638c4c87d56ce739329f17f4adfd02b0d7b59367d9d21fbe9d62610a2ef3495bf7703dd2440880cbd631f4e45edd937eb63dfb00bef78a256ebe02b63f497359f79379d08c03f3ef52555f95c66f7513d60a5fd3f7d3a6a70739d3edb845e8e59a8192f4a98ebd31f473e92a5c5079659213c83b534b6e6bcdba603bac0f18d8f5556c4d66ff854062b8dc33071a49e3169e47a96eeb0de2540a46d62386e81440898dc139adc72d4e7ee383b732d2ad2068f11dc0b18c60052f07006582a9e06857177d18253bdb85e0d89565ff8a8c3624caa3ee67361137e98507ff7937f48624a152448153cab887b95cb62260a99a99093107c22743bf3404a8e620390466595c0bdb35aad1de653ae8c4bf2cb0d8b4782853a0db92b441b15db09ab0fc45e38082f4f127eaa42f3f6063403496d3b9965a00ec57cf946ffd5bde4aea65a55dedcfaaf99dfeea5a1f87a72b79b88e9206355c11865d1febed9a4407593564ea106b9f125b40e9fcbb7e3f2811c0bee2bd37f17da5d67cd71769eed183a89c73c257e2e5634f5b8da74a2f59d14a4507c6ec4e8c5b68458a975b324079338faf086e08e17bf1e0257273edd1e48dd4f1cee5460b4f4f5ebdebc9b46aa9683fd9839bac0fb0982300c4ee8332d6e573047d158591cdb299153939a864873c24f5470068d63d6a86087430371d16353613ae86e474fba2de77b7613aefd08e50ea6c04e76c9f75a2463314ef93cf533d19ce4bab53e45d0a5f6ac16c975cf13b2f754569fe1275897ad2018c6d5a4abbcb7d779c987240f4a7760e33c81915210f92454381df43deb8723d41b01fbe2624f084aa4f9068ca7a49d479c3b5dd45da1adba1444bb9fc37e09a9747b731ebf851e93ebed0f8a34b06e97289840930fbb4013f72487b0871bc7646825039e59874814f6c0bd20e5d43e694a3b2c8debfd853ef417baebea51f5ecaa8534f3def830042ae89832bb3122ab9d6b77e0e67e67774033d43c347e7481a2dd03b7b0714d7e71a7b7e53843b71fe9b0acb3adf52e3140ad1306a75494054f1489eda6c9fb6ec76b99175ccde98b6203157bfc4d5e733aca14921c2fb6f930c9df0f742082cb673cda5a5a9479996987437aa5497e671e62f6a3de2f5cfc0f624931606d364ac9f0f4a5e0f81d27ac462e16e5c1ec2f8ef632bc8ae042c319471b4af2b419a086bc49e77e261585e7ab58618832fccba54216fcd05620d94a5748e91bd036d7c7cd600fbae9491344843fd146b7a46da66a87428e2ab692aa62057c2c756b5ee9741dceb05cc9bc031e7f597d2671f7bec6bf52c2de4ea120d5b405be5f43465769e9b99ab3f636624ddb8394d5b23129eef737fe6325153cb967561cc9ed8f419dab91bdbb1d6199dd56caf3e5ff7bd4b6ad70bfbcf6bcacfe650d301cca070707317ba02d07b81cd24d74ee3daa897676899b6e840cc6a9bad06488daa1cf382fbff070c8bb0d93c74dcca7bdeb43c670cf1a56998cacb6c7ee73c28691c783f98c87f771c9d34483248885e073c3aea0a9652d340b9f091f999f41ce20336f39242a380103e1c0122c29e1b2f2806a8e066e5abf750ec2dcdf29fe6cedb1f9fb12bcf38c7cea5f197b0be06026d6b8ef1607aceaf21fe8e92fec992e217de4da69d1c9ff0df3244bc4167550c9a36ceda20955d430d4ce0f00e198857116e0b55356f76015eaec8eaa01b75c09678b0309bd27a46d6aa1d55c8b18b3799e2e29792be86d0a4dbd7d4c67115cede4a3d95e22ad751f85869d7ba0423c0ae63c81d78344ee1630e7d98c510ab54bbe2ec1e31bcd9609b23d51d61c6d2e31d5721ea934dc813faa2211abc6d2f051e2030c5be47ee54a6dea978f0e4de52c5cfb8e56075e1db9665d638b8c78f0c7e274a6f033ec9b8708f7ce70db42714f3b2f37b8063316cf6d922e8b95dca0416b0d83db3049fefa34ab9f21904a648e59cd44d86102d448de96065784736cd40c14f09ef0ec40788c4c984aeb7916aaf0c7bd8506ffba12ae5616f015be855da0742796f4c21cc2273a4f86b6ca9ef1505fa6d5202f6b6a18802660891495411658f7a233bd184960323567c5e1ee33c124fb02b49670b7a1fee1b6a342bd112ff8b57bf7569f0fa4bfb2f978dc7cabc758b1a80e8f77312293f5f6e8d6b433b9bcfbd4aa51939f4716abdf3aa05e0b9328087b8ddfc3dc6bf008e57af22f5f5bb469469797f1a66c638977b880b07fa38fae9e19af8c46d43b416282f43d60f113a8ff15b444da5664c260cba93307cee9a6129050f44393eb35435f08fcfac5b1a8d3268a4fdd6928729314708e6f798acd844c0904fc8e0bf96bd94e25b854ca9c5f3efa9f710f96747a1a0b053467f5a1789662a623cd0f7110d0cbecea59917112b24afb491bbdffa641d3dec8cce99841cef5c5fe824966697879cd1f5bde66153fdfa47a2ce56f506ef5f2474b117ba4a5b029f29889ad31583618b4fcb04af2bf9f8890a09b2ece5fc1643b05fa628745f6548223f073d96ec9a62018a4fabafdd2b04c0f2194d79f7e57db147f0042dc1a777e7bc5b0bd8696a9b596a621b5a3223d3e8e415c93fe3e7bbd7d852d953ef4a23f63e9bff099057ea5137cedc13b8ebf01cd71b6f1a4ceff23ad82eb3c33f3da85c22fe1137b80e4f12680dcc1e0365ab680e5b151b07d3ac26ce45aedafb7b9ea0f8ac4496604c2706275e6b1f3314372d7259b07a9be7a82b3d32093bd5cb3f5de632200f31ac2e7a90ee5e56521e9bf1b8b804c63421b280991597755c90a68eb4a498582e22549c640c4d89bbdf00aaa216b06b3ed0816ec90b6c72804287300234ce3c3dbd9fe6c3ba07c80f638a64f20d488aa7ee1098caa4551f269a236e6b79b347cd51f14af2d91675952b88bcc63773aa3fdbaf67fcf8a2aea693cd8dc25922dec34cf7e341c21440fe453e7a0a13d869f74ca7aea81b8e65c23e9ef2d6ff7ffd6bb4f9bb622f124ebcdf456ff26d328cd15b135fdc514fc50a2cfd195b3689fc868f2b8d09967958dc793119c6e0f1bb3c98c78293f0c5aa1a402c6a699cb3c53dfdc9686d63af285a16e265d88f28cda267465f00113f0517f7827ae18882dfbd71f7ba65cc2365802270a5aa0c3edaa261291c15f21863669758d9a50ceef45504cd0d9b264800195a663916ddd5e0601519ec493c510d1a0ba7e16a38d3454d9955ce178ffe5c1b785281984ad66fec90031f41db436ef3719f5b5b041a55497594aab0dccf79cedb2cdf4e66ded085b9debfe477f505d2f513ac522ccffb4611d16d4d5d4b9fa8ed369be3b85f113ee7c0a8fafb0c70429e6fc715de285bca839b72b35746885d4b48a7a4c3e47c14ae6559628ba471b40502847730031e27335d9eaf87012cf10fecf033a9af81e20440737e0ec33a005460ed75d1b95b26d8f132e5ae4bf8cded29108032db96acf9d5a1ba46b69f727e0d2000d899b8248cb97d2edd24f8f00814599550a3cecfb0abcfe8189063a2287e93a4bb43f6e9f273922ae2111cc911ff6734ba28f5c8022b9c534901437cb8fa5ee55a73352c871b414bb45c842251381a3a1ab26f2cf6c4920021cad4275ad638b3b9", "1a0a930e9f31968d8e63581360ca4f76fbf52dc047522c09756ae083e7be0cf3da5642cc3101b1e4d29fb5c203970dcbc87f9b78b9cfcbe12f1e38d0b1f49ccfdece836302c41bd3cd0362d45e69cf4adb1b661608766d2381bab421570bb2ce05f858327801399c3cc1c8bceada43fad79a59965136a7c0be9caf49558772cdd9e78135934ec2803ece6b014d3bb0a7cd869a4d73140d376ce0ff10ff30464aa5b437d1cd95727fb7edff8d32646a1438ec95cf7da32f25ee2270901f4d2a5dfa3db56562716ddcd34144749677808fb1740683f08c2b5df57c6803e87f65f3916a98ff03715c5a5e1dd3ee0e27169d72e71c528aba737ba5cc1aa3bcf96fe124b02a5f23864af698008045f294fc6845371f862603982de5670864015420544409915408486b876faf80bd58c71f220cc6a07f1d3f1cbc8cb309ed9648e5a62097972a7716eb4333b1b783a621e12dd2fd0f5fa670b78d72285f66efb3b245de86cc43e68145484f60081aff28916cacc5dccf277ed32eb0e814f58be52154cc44e8b6e2f1de95f65a8067a967c65a8d82e27d42039060f006e44a29a90633434039f193fb7258801484c3f57b44f5affe16c3753e4978823c642f91518c9d71d69c1dd1aa943f11de551940a1302f9e6dbcc3299d71c13dc1b6162df19d5881e359b5cfe95a198606fc9bdf7e2b5ec83225dfb5a3e3da677e1dab87c74ba256f015f97783aa7c90ff626b478bc91f8df49943ef862872742ba43b89e97defdcd862029743cca92c4c9cc28df71d237fe05cda564cc42381ce95db318ef4a63d4e1254dba1616ef5a7ee24a00675dc6bb397b8f44b3d461a6c6570ddad3dfb37660baf903dfd46f1ca3bbf313f2aad3b0c461395128bbbb330e3f0d90c1b6bc3ee910ed1d963a5cd66ab178d99b0e9d367bda286add30eb42f2a325c4636a42911e5e4425ed65e6452db43b3f9f3e24faa564268001ef3123435dccea7494aed07318fc4aedb863a4bf84f0ad44c6338cb6dee53796a52dcc128aba1b26e09161fa34f11eb1eb090a8c20452dd996bdf1b30cdc9dc20c6f98616fbcb26c9d1130004f27428239bc7670c4f10f1db838febc0939ca7a8999e008f82b972e8c35d425afbb45c63fcb4b99f3bb209782e63e25b528ec3a0c22695508442f2eaae8e17e0604bb2a6224155bda302472b678e59a19d0e4f1d063a0f4aab1e0fe89a8c9612bb3e3e41d5479ab15705d916833357ec32b2296ae3aef92f3d1452936fb7cc604e5c0099fa6a33ee3cb8f82e2832636eaf4dee95ef59d75442607340d1816b9135b872f107bf6bb3d0533d7309a239708c55faec4986c3b9cbf6653ed2681bed3cc3ad496e531b4f34055f13f610cad7590d98dd8c6f4e4084342b2818a820824fe0310e61ad5c29d113680dfc8bf89de653a24c0eb674f3ecae5911dcab180cc4c93b35a0db7e490b77101b79d029c47931bea1a5d72c979da19d8f4d5a2c09913d31e6ba78f319cf23e9a186311a058399261da0bd6bcfcd2c5062fa12bd982a3be9dc26c822302f036d51b3e1b3f796032f8c0ea15e01446a4eea8158a4531920b9cbae059d7b9136e72f758e26d9014267b1b601ebd63a4182c8f25b965984757fd3972f4bbcbd343176125013a6b79a20241bc9ff0e1fcaac9f6c7744b84a51ae5c8a9748fcf449d54fab8418238580f5b80b7324dc907e9039ab6faee801c95240dd14c283eb0a211379deae2f824f4e68fc9e370c284020cad7e4a1d8a932703eabf31b66ce1de515fc7f65c308fdb340c391d78e85174a0c360d71dddf452a00b06192b7a6e5a13b6186015a74c4e82f48d4105a17b2c15a098101b888280d45dbf0d07ba172ed00c719c81b5d0aa883c37ba09fbb8292f3b7a6d56a176eb7d6ae49806f22abc5bb4115438b62075bb0d6acde1efc56cc3f64b3e5a66bbe26ca5475aeae113645d17a6d1837f0c0c8536aae952034031faa8db8e8228d5da563656fa0278943bab12cd5b7e8e8471641f92c80cffeaf1fe0042a3074f2694142667186a21167f5132ec618e1c79a6fb5979ae1f41a04316fdc4296d462c4c2cbffa6247ce16994146d025ce19a2a3436eed744ff983e9e90ca463ffd8b83e949d3308c73c4216f49fc3a53512597c7609782475dc6425db79667109a7b7beebaff2e44a8e1c28b53af707efd32d9317487741b5dae0b2474a47d743e1e220e56826424455f77c6b76ad3585ac6210599b4293154afcc9a05a8e89b18fb8e190a301fa471b223908e7fb044bcbdb9bac58d223c6c1d7bbca2675a2207549e3dfc8b54f6ea950c71450f8e775fd82a5fcba2800c4b4faec5932ca677aa7421a783cb5dc864431ea5a6dca7be6cbbb37b4521d03f6e53d9a6b4c4ea6ee224d2243c0a1b5dafd36c01d3c1b821c67821f64fe4c572cb0c5f51776bd219310281651dba3415732a0134a6fe031b9816c97579cceb7c5ebd6432876f035ce0571afdcb6539930134c9b4b0e0deecf698aca80512d23fac3d70c1dbc141f29da2d4f351f7e07f3ca69c92093baf8b961b7133fa2d240bd42672fc36c35e587fc6851a0f8949f70667d01e9e5353adf68e6d8b0bf5b9704d8680429d9c0cac028d365fb08ccf8fff7295e297840eaba415aecedc9b08ae2a89fc30c79cf08d2301e8ba6b2720dae251bfb71e2969b597cb3ccd85d09baf0e9c56677bc610470087e66f3bbc72fbaebe3daf8dacf4c1d4b51da56afe6bfd83e7d6115c4cb112d5da728a298fa14061191995e7ca0775d0ea7f82fbe9e93959069fac6686a75f8d859eec4ac5927383015231cce584090af2cad4d0cb50544a774aacc15fe625a9f6bb2cdbe86d1205a278165f5c27eb45286d5cf6f8e50992b154aab9db1152df60d9ef0e76997550133384efa1d922ba3711898becd8d49940d70c6e4cd283ed5ade3c33a052a1ed3eba8669381f3ff3aafbbb09e6cd498f450661e9e49250397a78b65e3b812c346ff5ca3ed8ef5ed1995596f733d42d5642d04c79ff95a8271f0469ce0be0b090ed1450e0371bedc0fd335c41df427d89ee76335b9c9da7d3b9da924feaf4e10f85630dd24e1f6b0d218c7f2464edc7ab7b59425875470cbc62ce27d68aa3ddafa77765900c916dcf8f9538184ccb0d5dddd6bbfc41ec0eca6e277b0e4fdfd3ce6678e5bbf4fe0637b8e56a8ecbd2dec332c7e65d725c2e7e2c994e9f2d94b498691cf089691d53e15d71014eab27db66df482cda49ca090f184da966125695dcffb2276b71fcd7ca005629d3d3e86482b065aaefc2bb0b243b9d2f44bf014cff9b747e0a72676b99b6d057091e1cb05f517141f66c9500960da8c621427acf7e59f9b641c7d189e8e5227dc9317b2e6aa530d18b80ca8d00a68da78dd7b210d3f2d4da88288a2bc49852fe97f216b5d602e94a133e8f9bb4461742e58bd649e5590c1486ae4a93364045e588095a42678fc701a9defa22f944803d0cf4f4ed39405df0c76620eb226b31abc2df38ce67acd83e02819ab56fb749005f3827ae5e1c94f4e465f684da063cad4caaffed7025cef3abcc3cfe8d1d28202600c7809c00e15592523430e39bd1044c0b2a189b6f7a793c3b7bf32d53e89b91efec89f47f7530f6e2bf9bf48f9a4893504bb09b7cab18ae12d08a5d69eda1ee66476c66d4e1318f73ccc5fdef0f6dfb94144cc4494836def197116155e3ab3f76302253d767d09e1d57db29036a9fbf074c0d81d303b2925219b0e9c2d430f362a7cc419d29207265a285c4122f189366ac4c51abfe42265aab7786a2d5859fe99403f491895283337d8345af022129b3d4668eebbaf5f919ff830daef7a42009368fb15d5a06d9993cccbb4eda7870e1214a2f0a8dd6f05d0f480b26d500b6a38fc9bb7cfcb8751d6f5bb2a2148bdfa1b6b09cd450f091810dca3eb4998c97418b0e73d432a041cb3849201a9d4c8514c872fbf5433acada5ff193b2c2a88ef0e9dabf13d40b86cea94b83c38c01e85dfc4967ca3a7172e3f0890a1b0ba99873241a161461670dac19084242d47b6dc0440a9e2eba3fa4eba24af1973daf9b8f49adb5e139d19ffb44786fd3573157675297019c034219692767f376add1b1159d290d34fa6f248e2ae4b140eba804dcc7297ca64819e22d70c7c0624274d895b3abe7c52a08b58ec5452e56f9dfa4bc9af35565d37fbe19331491ee762363a48353bf88a2fcbdcaa2e869302bc0d59c37a135e12ee586a4263d7249f5684f23f1f53d03e415fe7a88d3e05e256cf3cd5866cba4c610f605b824a1cae5f916b6eb9b0aa9e9d79fdb15430b839a2195f283f29e3bd5dc7e3ced318da158aa40790101b358e60ba0ebc6815dc45d8587c7bf50869751d68d21831803ccc3eb390f0b5b66fbbf1ed76967cb9046c858539761953fe4070d3349aba7266a63fb7c3440e10b80834d91d81b86e6c39b8abbc6a7e51c305a760d1aef72cc576ee82143f1461676cdfa24d9041bf78ebf4121fdc539a6b84da982f518874d9ee2da0e4b482dfd5ed8d88daef36eb7d0d03d09ede177f430fb08fa4c9f279a12023955d5deedcabd35729d16f55c18fb8d352bb0b10426c33b344fd77a8caa3e601f237d68793e5f02a04b2929eb50a26288cefc6f42a13c460a6faaf20f76b6e4c45587d14df855f74a437488fdd3a3eb0facea1c7987c59fe2f19e5e23f10227bb2bcc813450f841ae76bb09a97f6819c88b62c4310b402fd668b033d1a732c5142917907acc8350c7f3fc7c35bb1758a38defc0a730b7ec50a0e534a5802ad2609adea6d469728549d86b93ccc2c4b6e80f44a73bd74fba4e27f0caaf38a86b2a7ba4a167f8f03ce144b6657235585856451e8d581150e83fde15630f37033757b44618dc4d07205a559bfd5aca2219509a5355e75cb89d7cc430f9e505f5806bcc529a97592d029a043ec50efaf24459a0a86ce08aceff4fdbc57ee8d3c5cc3f4bc9dabe3820325fc37abb2ccd96e664fbeaa6e4208778e5cebbf0e94d92163b1e82a75708cb45fb9935ef21656f958881ef7a26b2ccd5b564768819eb4ac74fb3303edc0129c25cac9387c8531dc2fd57636db7167edec8539cf97cf375d069ec7d570234ef552e51f1841430cd9eb8e2827d5c1f939346cdab201d00a1116e5a788bca51198f8b2cb5283f291a4b68521dd145103f4f0386c69c216d1a6ef76211465a94be5a5b39ee722773962ef3f13af527ff4ac7c902c7ce683ff94492665179f354d16fc0a946e0f355ff5b8bef15db58c1541553a4014224c52d1d9684db346168e0052f55e0b6dfa8a1803b327437b7c8b3a40fb5f3b0916668da659d92ef825757c92428e0e175779307ed3c1102807785c9b554dc0209caaf70f4b04418a442f85f0694c22aa8ba1dcf1f28fffa9b8704d43f48385c8a3367a9eb5d60dd45e4e73e73cc59d3a0147980f3006434649f3c5e123327203106b33de67bbfddac16191f29f17c87491e55fe9f655bc0f83e7afac5d84400faca1492f33fb3cf76b116ded6bb55a9f4c1ecb0be5976f21290f0fc802a8bd81a4151d57735d452213e51eec5bf8f6f1c8987e3fa592642519ac395c30b6dc0195939ab570a82b5c2ab4f11bac67efd8a80979dd28226f8aaab40220fa5ddec601d2860f56996ea45cb469eeebe37cd04e87b152cda2b170cb0232e2d201f8fef8814cbfce0d3db30a80594e8c51b66e6eabfbf20832aea00d34097a7398bef1878aeebbb3355ee508897e01f505237cc2be4ff0b48062c745ce07523368d"}) 17:20:38 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x1000080, 0x0, 0x0, 0x0) 17:20:38 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) [ 961.516216] binder: BINDER_SET_CONTEXT_MGR already set 17:20:38 executing program 1: 17:20:38 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) fremovexattr(r1, &(0x7f00000001c0)=@known='trusted.overlay.origin\x00') openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) pread64(r2, &(0x7f0000000100)=""/156, 0x9c, 0x0) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 961.546506] binder: 4824:4829 got reply transaction with bad transaction stack, transaction 959 has target 26829:0 [ 961.574867] binder: 4824:4825 ioctl 40046207 0 returned -16 [ 961.615942] binder_transaction: 3 callbacks suppressed [ 961.615957] binder: 4824:4829 transaction failed 29201/-71, size 0-0 line 2816 17:20:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x10000c0, 0x0, 0x0, 0x0) 17:20:38 executing program 1: [ 961.703920] binder_alloc: binder_alloc_mmap_handler: 4824 20001000-20004000 already mapped failed -16 [ 961.769405] binder: BINDER_SET_CONTEXT_MGR already set 17:20:38 executing program 4: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x1, 0x800) setsockopt$inet_sctp_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f00000000c0)={0x1, 0x7, 0x4, 0x4, 0x7, 0x3, 0x7e70, 0x80000000, 0x3f, 0xfffffffffffffffc, 0x7}, 0xb) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000100)=0x7, 0x4) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r4, &(0x7f0000000500)="f0f1e7b48f81f0e7f7f18dda88ded4553e96de66e69cfd2b9105f74b0df04ac43acc4ec5ce1c157a6991b2133bdbfa841a4a24b45b583b1f5773773d2085acca0b7e681c92460385b608bd36d6fbda7a6fcf96af9484a5df2f512571fd1e3ed1420041ed1a7f4518d43adad10fadafa59deb84209376fcfa487a84e77c6794546210ca03ec6d50d11e76bb0fa97b60076d9a54cc2e9faebf56dd5edc834c98c0dc0860fa19bfb93a6ecef5ddbf5a9bf24f87f0fe8ef81e9d39e2c87de9c5e6f6939593b0108a20f3aa55b91c1ba83acd98c3becc575199cd134cfa73c1ffbe6980fa989b20e4840ebe7c3cc922fbf3309a6580d034e35ae075eacaebb74ea182bf460bbdea012ab88ff9572a38a967f13cb6ca2bb48a4c0479eb3141a9ff90eb3315513410db5de9dc4f5e6d3e20813ac0baf6d99ee85d6750e0c686665d194c72e00ab32478e2c20251cd9e807220705fce8ad5dcaca03c310e133fec98a62a8c2a9515ad1e043d7c02d34b6aa7c97ff352a61ed97a9c6d78caa371bc5478f6438baabbee985e780f7554affe8918b8838f30ea93dcf5649d1a578febda23659b5660703214896d7f776088c6831fd9588442ebe93138672529024acb10e233d26ed842355b24029c442acfaa5e22c76bb7cc215840285b7d46c87db36f72c56d7041cb14aece118e5de0c4b42913a2a19a32e2ddc74b65c78a3916ec8f80c5cdbcf16f2421ab47f8aebbeb8fb5823181ad2ced23c0dd6049ac1b64dd016eeb67d0b191911af5ada18ccfeb1b2b4117b7756295a4a519e725403df6c0325cd48769cea72cca2162b67cba6811cffd3666b343c2bf860a3cb3d1c97ec7f6b4116246821a57cd93982dbee99b1ec0eee5c06b917cb1aa4a9642744de13cb46b034b4218743beff506ff2adedf4cb7d89341673f051429b7b5eb87b37535ab532336ebacc3319662ac6c5b512d8ac55493353205f4f4d8f4b9bea5e85ea7055562da99725c6b2e490da100fb11f77bb5801e568f6cb931556d7c212ca7363fb384d736bbb98ea81246d2395672f81476e05fc23c706ac26e24eeec3a63104de9efab01944ca29602b934bc67f9718881cf4dbdba806842bee529c12ca4b176ab15c7145e3c7744b388b602c8370c18cf06af259c09e32be709fa9b0090eada95c2125011837a29b4d863620960f1b362f7390839028b87aa964c806872b7b352bd7d71712dc4ea3f9a360afc02282fe8f0c72c7237a4a4d10d845f00929baeac21fa12a0a1580f9426e5a1e18b02beef2cbe411bb65d995645e6c5b0443d66034b744b1b637ef6ecb907b92633e7561bb3f2c0c18870d1d293bb7f9b3dc631f0e0becb48b313f91571bb92f05205708449b580b84bd6079cc2d84571b7667071f90bc8127d0418aa65e2d1d12b304ff7361408204e95840db06129c8414c1c7a1236bf326f84f430ee9b4f7500e730264274eded7e7edbfe27e33706320954bb543e2600efdc8c445b2a5390d602d33d17cc9335b67da09f31ce7e7f7ba67fdd3c76f0f1b1b8b13c7667da5fb4b9fd7d365c4532ee4bc68f7b639d79f6ef71792fb32b775d2337cea345076cf8273ae4d46aaa5e94eea14a8846516fd904961b50c078be045199517399534a1bbedcc663975da7444671f6ba662397a2bd5f9277958ce948817efb0cc1a12ec2143b9d69ffb70edbea88339f8bd137ee2a9c677df974da1856046a0052a41bb9fdb416b04c4f47f95d5d8f58e508742d067174cf8bcdf4f33bcb0d9cecb625be6e3e04b3614bce27a7bcce96ed964606d683722d21c0cc51e4f7317a0bb2575307a0afaf443cb4264879adef9384ad1c053c9300dbe64a58acc8e8a028de49feadbed4d9abcd92ba2131f9c07c56fac716b557154d884cc45f8fe7716a25f078901c5f3dfeb3605c7426d62b62a13e7002a3ed2837f191d4844d7fc437ca96eb7e7141c7ed6dabdf9fe21cf86571ab1d6fd34fabe8c9e7d6d9a129008b0e897bf1d49dca765d82a22f38a34c0e9ae335f6539fd8b3a9e0226efa4a5a1c708389562056cb7fce8f74cf2b15488d2a14e67567f81bda70e5d2c5292269aa87d3601d138c2fa96cab7fbd2811ee5f5237b768aad611c3ecf09f09f28475f9c79476ebf69d3210a684528c9111f4619dfb6325728a78fe7caf4c1e9375d54f13ca2e5df13665eee3493d22b78aecfaa7ef1e84f7816d7a8defc8205dea688184d6b28d8985488193322160498ac0e59a96af6f1fb8e0a2be4b96d2cc97dc914d812b160deb6b1d6dd6e2486c40489b32663c940a2e95fd3123e550a414727ad8a225a128e56216256f0faf827563fb3efd9f3f39c67fedee5d876ce33e464bf648adf1acea1c3f1e7f647678d2f87f0b8a2ffbcf1113bb670e3a536cae0a266d4e9d33738afc1de6972be8fd75adf7966673fad05009f7f72cb3ab9ecf5a4ff9233b205a3b63c53905d3740fb268bb1961d8f638634da76870fd190f9bab41aa6ef5932f0e6e6e6a30371100adea98916a52d57e6d32bff9ee05d0889ed295905f109ec3db89300c579ad4513301a78601f5cac56f30dac9fc9f418cb7dd911561edd29aa8cebdc2864d26afb5d071f6b1dd240159101675876ded6ee576770b5905ee73d2192b70e5f352a0628573d85458ae893b0d2beabfbad979e64bfaf3856edd44b973d1b2576b5ffe93a8f627f5a7613429c149617d1cd898229d42443dab5e1413714d7fa87fb965a4ba9c46be5e6348c237a48ce3dff45dea3d1e6f831a4c5a0c0fc71cc382612a9711ab64de5141219cc1edafbb1b7968c1ad788d81e5e53c973e77a2d6cb95c79634ccfb17920f7005242cac0fde759e103d76449553ac9303d9aa290aa036bc5ba94525df64483307c2174f8c9f325c5aca5b1c1ac1732c4aec014e6ebe31e6d02bfda977d47896deb6f916df1cc4f6bade897be61f0857f4199d8648b9c7537b172fc8ccc997a9ab6bbaad62903faa24af97066d9dd3c13469b79ac814fffe624714736e7e7778ecd195dabc0386c876b1983d06b24ae5ee2af17527e1716466e0f3e91209665fb13300c07a78c94966152ccdda8331e77daa547b82dd6562590838d8f4accb16f4b53099167a4b514236081e71d46c4eb4e0a57b6e2b4b34a5866f84ac17247bf00a41eb021427769d12ea4d8a7f7a2683b3e75cbf6b9eeecbbdeb762cc01fabbb852cd42a43afd30ee12b14a9093ff98d4543ac1185564897904800739022bda7be40b9645e0de4c6811794c213d7d22f25a8af7b749ca80a5260c1901591c33541e32d011a5c01411f2520e5972eb3faa3effeea532c765e76f8ea53dd576ba49b810d8361c863febdc19dbd60f8a5181ad6ebe57490ec94bd410258431c41f4f363a6a0999c9dd1f8d873830c4152011ddeed749155b9c91d389a33d177b916c8f3ed14686e2942f7f654d6e4a40f2d6ff6870ea0277e1ad80cdeabfe858bf89420dbe96f4b4bd9d01391dde2209d2f1f26158c681badd6b50e5d76205ea75ce0ca643548a53280a07af5f38a5bdeefc1bc99576112ba1e9439e0f5ebb4a3e7cc1464799703c18c0d0129218bd5321d0904d554e4a8548eaa28e9730c51013132d2268b06e34185b500cb1bc0eb2fcd6fda043bc588a5f672e6f6e5033473941cd463cbf4dc5e5583dfe1a775512902ade4baf996e1f2360d1b3db2f40834d82650fedc5ff13db3d5ba8d3e00715b454fc58baeb91e240c44e2a102069400672f69638a17d0ebb6efda5bc3cb6f662ef541d264d27f6cc8cea14f48fba31f08fa34bd0a3887109753981eba3b286bd2b34f3ba6dcbcea4071bfc31d6e8e4f7ae81c58184d4a4c2eb2de797b7ebfb9f4af2ee8efe86dad92ed44820f545a0d6fc5fae2191231915e6ff3150fc0064dd14d55f246a7ad0b1373898cff59ea0d12f082361120ab79d04a62136327d3324e3c479641def95dc9c4e6f6d6eca1c9e84da21a4f9f36eb8a97c89abedf5b06e1d7ad4151d73a88c8f539ace33f3bdb390e5bdd18623b26b7e1bf7075602ab7267b7993cf69e3a81b41f90ca2c6200dae2e810ffda86aefd46121c446f1ee967a1bd2628433a888cdfbd52d1e61bd1919850829e9bb9ee4a624d9a5b4dad9c32610dee4d826bfdb3d16b16a71558fa5a8112243ecc0d3c08ceeef87e776af9dc3f8f91e1136afe6868f3debfc11a7cd0753c1d29d6f3fbba7020f7d241613a66951d302cca83adf0a6fb436bc97c0b3ad5855cf818c853ea56b61c78f51a75c2b4db26f736eccfbae960a26e6867a1c16c53a6a5bb5d1ef030ac76071a368187d087790d6389ec551dc280d11e8b2cbc66f1831058c2ad32edd55c3d8f78ad0e90e632e836a4c0da198f53fbb1c87b7e7ac3be389f709bb2942ea2d373f1e2a9df5a7b23e2b1d5abbf1c1b55c2a0412833be0f22bd22a70b51d6a1a9777f93e16b304d6f4a6fdf89afd4a94d098f320c84c415e6867752d3dcdc7f1ed0a908b89f48a44ef726195578c1abfa8e84e6ee0fa73aad8b584155e1cf858dfc37f91528ccc1bd9ceb309cda72ba17cefab87c414f6d67e027462bb401d7cec6e6cec1cccdf6f8bbb934cff89a41284b8177bd6d3b45d199d93f1cfe4cb77022cfeeea8ef2abaa101f94e0d47baa9c33271b0575f0bbca8fb7f634e46b5c4620ff24cd06500e146179f1261c3cee5cffff3e30099618fde2185cd772f55a48bd1a2a77af5580819733abdc0725f65183304fa96e4f17c40b4fcab7c94ad0400c16a58053c9e828b37031d2eb2cee987214d301a1f2cb8d2e9a4eda41d0424dc305c524ecbd121d12430f4349b1341073840e18bb9ce54752a918790639708742c9ed4f7768d9335a3f03d22777aab3129e5ca9ae4d1a3a72b99187616fd901fd3a075ea5a8e4213bc5da05657299a1e00d12ec0d49bcac444be876bef6c71936a8625a397767a0a268b415e916e3cdda988867225f6c82b2aa03970d82e59ec5d7c3d8bb5b78c84d878d108804e3ccd92d1a600cb32167a75c2853cfccfa22072d035a8507e1cf357e205f38c32b2d609dcf9a091379e5086d246157141f2fce3a65d35d39c2d3818008f3c2b66123c4c8550ffd0c4d9949eb2e0282139efb6bf8f3048485365eb0cafaa4286bb948b7ade801e40a7f9385c270628f6133f8cef3aca3992b003f171aef5c9cd2a160d8ffb22c166fdd7aefcf75ed18a5feb3891092af0eee751bfc237332085a35325fbe485803359178b3f5e197f0da5b1ea4f5382c0419710cec485540a37cc5abb23e524b0ca4dba153e2c13bdc171c011183ee7e1c4aa9070c13d5884b5843d09868a4e72e5f5dfe17f54c90f26825c466d35117bfc69e63b8cbff7c68b97d7413acb5c38ff5f8f4209eed6ee00d92e004c242333cce60ce42d7f8f2d679d4b92cbfa94499e27fc1f67ba9d4611081e2043f5f9c67f01c35ae4d2d2d0b984c5ab135e7c30ea30b5cbcc0acf7308a3683e3b3a2e3f2a8a66db8dedbf28e3cafd22286fe68f5305fc616a70fef1f74b1da37dc6aee61f21ee10d76e89caf6dce33f80d33a649a228f24763e26251f72b6e8b0367618196f164be8b9b8d031f0781e3c8b9f0ee26b2706bb6db4c7ce8aa3148f54e9c21fb6e44f8e5d8dcc4ef62cd3387f6ea2ecfa69f973b22a710e5ca88a177533f081eb1fde453261afd00279f952facaa1af181fba0249cdbc1cbef869a85b82c4ff792b82d2bc774089d1b3852c38cff64c9f1011d4a5350ec31cb7aae2afb5b6c742724b9fa9452d179af82fd17ae4f7cf", 0x1000, 0x4000000, 0x0, 0x0) ioctl$RTC_PIE_ON(r2, 0x7005) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r3, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, 0x0, 0x0) [ 961.818063] binder: 4824:4825 ioctl 40046207 0 returned -16 17:20:38 executing program 1: 17:20:39 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x572]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:39 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x10d680, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x400000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:39 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x1010000, 0x0, 0x0, 0x0) 17:20:39 executing program 1: 17:20:39 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0) ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f00000000c0)=0x1) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:39 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) [ 962.495770] binder: BINDER_SET_CONTEXT_MGR already set [ 962.506655] binder: 4864:4875 got reply transaction with bad transaction stack, transaction 961 has target 26829:0 [ 962.535130] binder: 4864:4866 ioctl 40046207 0 returned -16 17:20:39 executing program 1: [ 962.551724] binder: 4864:4875 transaction failed 29201/-71, size 0-0 line 2816 17:20:39 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 962.640489] binder_alloc: binder_alloc_mmap_handler: 4864 20001000-20004000 already mapped failed -16 17:20:39 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffff9c, 0xc008640a, &(0x7f0000000040)={0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x80000}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000100)={r3, r4, 0x5}) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:39 executing program 1: [ 962.722690] binder: 4864:4866 got reply transaction with no transaction stack [ 962.745855] binder: 4864:4866 transaction failed 29201/-71, size 0-0 line 2801 17:20:39 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000400)={'syzkaller1\x00', @local}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r2 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) socket$xdp(0x2c, 0x3, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000200)={0x0, 0xd3, "fb193142ad28b066c66165eaec481fe80d45f4ec2fe9c241049cc538aa16dc70da6932288a35a19f461a8fc9cd664eba9ab4e154516c63175476e3909f936f876bf478e07968df5f7ae9272f2a7f96a48023470e41ec67066035c883a61774df8f0c5240f83f39f83a85a32e9a3d5f0b07190855038e4c5949ee783310f6f4eaaa6a9ae1419382e89027336fce6dd490acad49308b6510edaa5188b07cbe2f35b4e3d0aa8c6435a1be5236a62b68a140d7028c0a9ee51da3ffa90baccb016862a6073ac17f9e4b4d75850f631f68890fcc8371"}, &(0x7f0000000180)=0xdb) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000380)={r3, 0x3}, &(0x7f00000003c0)=0x8) r4 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r5 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r6 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) getsockopt$inet_sctp_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000440), &(0x7f0000000580)=0xb) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000600000000000000000000000000000000000000000000000007000000000000000000000000000000fff80001000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='@I\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r7 = openat$full(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/full\x00', 0x80000, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r7, 0x4010ae67, &(0x7f0000000600)={0x3000, 0x4000}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:39 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x2000000, 0x0, 0x0, 0x0) [ 962.934540] binder: BINDER_SET_CONTEXT_MGR already set [ 962.962567] binder_alloc: 26829: binder_alloc_buf size 30064771072 failed, no address space [ 962.997577] binder: 4894:4897 ioctl 40046207 0 returned -16 [ 963.045673] binder_alloc: allocated: 2752 (num: 344 largest: 8), free: 9536 (num: 1 largest: 9536) [ 963.076257] binder: 4894:4904 unknown command 18752 [ 963.089997] binder: 4894:4897 got reply transaction with no transaction stack [ 963.124662] binder: 4894:4904 ioctl c0306201 20000140 returned -22 [ 963.145338] binder: 4894:4897 transaction failed 29201/-71, size 0-0 line 2801 [ 963.183555] binder: 4894:4899 transaction failed 29201/-28, size 30064771072-0 line 3035 [ 963.239683] binder_release_work: 2 callbacks suppressed [ 963.239691] binder: undelivered TRANSACTION_ERROR: 29201 [ 963.251181] binder: undelivered TRANSACTION_ERROR: 29201 17:20:40 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x580]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:40 executing program 1: 17:20:40 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x4000000, 0x0, 0x0, 0x0) 17:20:40 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:40 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) 17:20:40 executing program 1: [ 963.559434] binder: BINDER_SET_CONTEXT_MGR already set 17:20:40 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f00000000c0)=ANY=[@ANYBLOB="66696c74657200000000000000000000000000000000000000000000000000005c000000a9a15f076b8dfb3a9f03d6e3b841666383219ffbb07773b73fb2119453fdba446487a384b9adf3e4cf43d654aaee848ae99077b9be7c1a8b1229f045bd1e321407df7e25335b2d412b594317b66a87a6b65e0a8f5f0de0b6759242cb"], &(0x7f0000000040)=0x80) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 963.589977] binder: 4917:4921 ioctl 40046207 0 returned -16 17:20:40 executing program 1: 17:20:40 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8004002}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r2, 0x2, 0x70bd26, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4) socketpair(0x1, 0x80a, 0x2, &(0x7f0000000640)={0xffffffffffffffff}) setsockopt$inet_tcp_int(r3, 0x6, 0x22, &(0x7f0000000680)=0x2, 0xfffffffffffffdb7) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(0xffffffffffffffff, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r5 = syz_open_dev$mice(&(0x7f0000000240)='/dev/input/mice\x00', 0x0, 0x103381) setsockopt$inet_tcp_int(r5, 0x6, 0xc, &(0x7f0000000280)=0x9, 0x4) setsockopt$inet_int(r4, 0x0, 0x4, 0x0, 0x0) [ 963.661004] binder: 4917:4930 got reply transaction with bad transaction stack, transaction 967 has target 26829:0 [ 963.693650] binder: 4917:4930 transaction failed 29201/-71, size 0-0 line 2816 17:20:40 executing program 1: 17:20:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x5000000, 0x0, 0x0, 0x0) [ 964.371747] binder_thread_release: 2 callbacks suppressed [ 964.371757] binder: release 4917:4930 transaction 967 out, still active [ 964.393757] binder_release_work: 2 callbacks suppressed [ 964.393762] binder: undelivered TRANSACTION_COMPLETE [ 964.405676] binder: undelivered TRANSACTION_ERROR: 29201 17:20:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x587]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:41 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setxattr$security_ima(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='security.ima\x00', &(0x7f0000000100)=@sha1={0x1, "b366cf8f2d3a0826106bc3780a742e8498fa306d"}, 0x15, 0x2) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:41 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x571]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:41 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x6000000, 0x0, 0x0, 0x0) 17:20:41 executing program 5: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000940)='/dev/hwrng\x00', 0x8c040, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f0000000980)=0xd6, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) ioctl$LOOP_SET_CAPACITY(r2, 0x4c07) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000840)=0x3, 0x4) syz_mount_image$f2fs(&(0x7f0000000200)='f2fs\x00', &(0x7f0000000240)='./file0\x00', 0x7f, 0x4, &(0x7f0000000780)=[{&(0x7f0000000380)="304b206c92266b1a7634d012d613f8bcca5b9c1c7472e26fe637b024f711f93857913c723dc0a2552d6878759f6f73178cc34c09c6277303128c2c00165020bc2cf0bdb1c8616e950196487105ce5e8b887c395316aaf3ca74e4a5951e3160d62b1e4c6482ba295558ca4b9c9a20c89830f3f6471eac489ded007b6a3d2699ae6012c8abd4a65a205afdfbdcaf38d47c5d834ba11a5beaf2e2a939eadd4dbb6c9e61c04df2d84f4199388a1393e365406cc0513051578fbd2537d870c657a7694ee4ed63779767dc2ad4be61d7dc8954941d180e8a3ac3f56a5f1f2249a5eb14f998f5c4807bee041629fa9727bcf609d97bfd574111f1452ed3ac", 0xfb, 0x7ff}, {&(0x7f0000000280)="7db0b3f887c9afff818fd49fd4c28dbd9527f95a4232aa128f6e1be7309f40e4db", 0x21, 0xfffffffffffffffa}, {&(0x7f0000000680)="f692ff00de89173cb537607d2ce65def7bd941893be936a6e7cc6e3472e3c8c100a8d715c885d135d6c2fb8b46432dfb8798027049a51264d88c41c0508e5d605e93ff3a302a7b3776bca177c7eb8d9d913555a971f5581590f71377c9f6fb682d9367291b855119dd43ea3b7e54ea825ad844e3131970c4eaf91cfbddc07b6dc99c9968ad6d716027a038ea06790b0faa02a24d295409485f9a06bf22390a1ac7ad35f82616cb1b9de6b071e7c2ffc6aa60b8cf40196cdfa5096f51f788c1ab26996e3d8505f4b9494b02af673eef1fc3fdd9523e8786eec4b03257da10a7dd7559b6544ef1d36e950c939c9c2534bb40415b0e05a2af", 0xf7, 0x2}, {&(0x7f0000000580)="a9d303f9ea2784aaed2f2f9bb0f8ab8dcb18aed24eeda9517e98a13c8c3fdc64173de7d26fa8ccd99b7193ec438fb8d5014e22fcd922353517f7a1f039305c591a40f344625e0d661a84464772787074866f5a97ea9076a2683bdacbea0aef3d8afc11a8c218f57abc7f88940aa0a3c90c4b89eabf58e7cc4db28872458084f059b8e0e560c11c66301ab8b56d01a073dfaccea0c7b7b411f02b897df80335a2132cd8433395", 0xa6, 0x5}], 0x6, &(0x7f00000009c0)=ANY=[@ANYBLOB="666c7573685f6d657267652c6e6f646973636172642c6163746976655f6c6f67733d322c696e6c696e655f78617474722c6e6f626172726965722c71756f74612c6673757569643d62003b007f621e332d7677613d2d653177372d66327f652d73373466003730772c6673757569643d00773966626336322d7b3833652d31777d732d3c3364772d17766332003b73002c7375626a5f726f6c653d2e2c7063723d30303030303030303030303030303030303031392c646f6e745f6d6561737572652c0070ef5740bb3e467193a3e6994b2983f2cd5bed"]) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r3 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$media(&(0x7f00000002c0)='/dev/media#\x00', 0x7, 0x8000) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0x5, &(0x7f0000000900)=0x6b58, 0x4) setsockopt$netrom_NETROM_N2(r1, 0x103, 0x3, &(0x7f0000000800)=0x9, 0x4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:41 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0xedd) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rfkill\x00', 0x80000, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000200)=0x3, 0x4) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000280)={0x0, 0x0, 0x9ba2, &(0x7f0000000240)=0xff}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 964.569916] binder: BINDER_SET_CONTEXT_MGR already set 17:20:41 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @multicast2}, 0xfffffffffffffe5b) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000000, 0x10, r0, 0x0) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 964.601533] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 964.614682] binder: 4961:4967 ioctl 40046207 0 returned -16 [ 964.636257] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 964.636550] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 964.697041] binder: 4961:4976 got reply transaction with bad transaction stack, transaction 969 has target 26829:0 [ 964.717323] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 964.745769] binder: 4961:4976 transaction failed 29201/-71, size 0-0 line 2816 [ 964.790021] binder: BINDER_SET_CONTEXT_MGR already set 17:20:41 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x7000000, 0x0, 0x0, 0x0) [ 964.819303] binder: 4959:4977 ioctl 40046207 0 returned -16 [ 964.847455] binder: 4959:4979 got reply transaction with bad transaction stack, transaction 971 has target 26829:0 17:20:41 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x40, 0x0) getpeername$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) socket$nl_generic(0x10, 0x3, 0x10) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r1, 0x0, 0x400000007, 0x0, 0xfffffeb8) [ 964.937803] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 964.982513] binder: 4959:4979 transaction failed 29201/-71, size 0-0 line 2816 [ 965.030154] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 965.073018] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) 17:20:42 executing program 5: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000940)='/dev/hwrng\x00', 0x8c040, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f0000000980)=0xd6, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) ioctl$LOOP_SET_CAPACITY(r2, 0x4c07) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000840)=0x3, 0x4) syz_mount_image$f2fs(&(0x7f0000000200)='f2fs\x00', &(0x7f0000000240)='./file0\x00', 0x7f, 0x4, &(0x7f0000000780)=[{&(0x7f0000000380)="304b206c92266b1a7634d012d613f8bcca5b9c1c7472e26fe637b024f711f93857913c723dc0a2552d6878759f6f73178cc34c09c6277303128c2c00165020bc2cf0bdb1c8616e950196487105ce5e8b887c395316aaf3ca74e4a5951e3160d62b1e4c6482ba295558ca4b9c9a20c89830f3f6471eac489ded007b6a3d2699ae6012c8abd4a65a205afdfbdcaf38d47c5d834ba11a5beaf2e2a939eadd4dbb6c9e61c04df2d84f4199388a1393e365406cc0513051578fbd2537d870c657a7694ee4ed63779767dc2ad4be61d7dc8954941d180e8a3ac3f56a5f1f2249a5eb14f998f5c4807bee041629fa9727bcf609d97bfd574111f1452ed3ac", 0xfb, 0x7ff}, {&(0x7f0000000280)="7db0b3f887c9afff818fd49fd4c28dbd9527f95a4232aa128f6e1be7309f40e4db", 0x21, 0xfffffffffffffffa}, {&(0x7f0000000680)="f692ff00de89173cb537607d2ce65def7bd941893be936a6e7cc6e3472e3c8c100a8d715c885d135d6c2fb8b46432dfb8798027049a51264d88c41c0508e5d605e93ff3a302a7b3776bca177c7eb8d9d913555a971f5581590f71377c9f6fb682d9367291b855119dd43ea3b7e54ea825ad844e3131970c4eaf91cfbddc07b6dc99c9968ad6d716027a038ea06790b0faa02a24d295409485f9a06bf22390a1ac7ad35f82616cb1b9de6b071e7c2ffc6aa60b8cf40196cdfa5096f51f788c1ab26996e3d8505f4b9494b02af673eef1fc3fdd9523e8786eec4b03257da10a7dd7559b6544ef1d36e950c939c9c2534bb40415b0e05a2af", 0xf7, 0x2}, {&(0x7f0000000580)="a9d303f9ea2784aaed2f2f9bb0f8ab8dcb18aed24eeda9517e98a13c8c3fdc64173de7d26fa8ccd99b7193ec438fb8d5014e22fcd922353517f7a1f039305c591a40f344625e0d661a84464772787074866f5a97ea9076a2683bdacbea0aef3d8afc11a8c218f57abc7f88940aa0a3c90c4b89eabf58e7cc4db28872458084f059b8e0e560c11c66301ab8b56d01a073dfaccea0c7b7b411f02b897df80335a2132cd8433395", 0xa6, 0x5}], 0x6, &(0x7f00000009c0)=ANY=[@ANYBLOB="666c7573685f6d657267652c6e6f646973636172642c6163746976655f6c6f67733d322c696e6c696e655f78617474722c6e6f626172726965722c71756f74612c6673757569643d62003b007f621e332d7677613d2d653177372d66327f652d73373466003730772c6673757569643d00773966626336322d7b3833652d31777d732d3c3364772d17766332003b73002c7375626a5f726f6c653d2e2c7063723d30303030303030303030303030303030303031392c646f6e745f6d6561737572652c0070ef5740bb3e467193a3e6994b2983f2cd5bed"]) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r3 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$media(&(0x7f00000002c0)='/dev/media#\x00', 0x7, 0x8000) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0x5, &(0x7f0000000900)=0x6b58, 0x4) setsockopt$netrom_NETROM_N2(r1, 0x103, 0x3, &(0x7f0000000800)=0x9, 0x4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 965.124252] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock 17:20:42 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$usbmon(&(0x7f0000000380)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$RTC_UIE_ON(r1, 0x7003) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x460001, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f00000001c0)=0x10) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000240)={r3}, 0x8) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = getpgid(0xffffffffffffffff) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f00000002c0)=0x0) kcmp(r5, r6, 0x2, r2, r2) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x0, @local}, 0xa3) getsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000300), &(0x7f0000000340)=0x8) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r7, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) chdir(&(0x7f0000000280)='./file0\x00') r8 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x101800, 0x0) setsockopt$TIPC_MCAST_BROADCAST(r8, 0x10f, 0x85) ioctl$sock_ifreq(r4, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r7, 0x0, 0x400000007, 0x0, 0x0) 17:20:42 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x7000080, 0x0, 0x0, 0x0) [ 965.338758] binder_alloc: binder_alloc_mmap_handler: 4961 20001000-20004000 already mapped failed -16 [ 965.427630] binder: BINDER_SET_CONTEXT_MGR already set [ 965.432945] binder: 5000:5001 ioctl 40046207 0 returned -16 [ 965.516045] binder: release 4961:4982 transaction 973 out, still active [ 965.522858] binder: undelivered TRANSACTION_COMPLETE [ 965.556717] binder: release 4961:4976 transaction 969 out, still active [ 965.563485] binder: undelivered TRANSACTION_COMPLETE [ 965.596803] binder: 5000:5012 got reply transaction with no transaction stack [ 965.604113] binder: 5000:5012 transaction failed 29201/-71, size 0-0 line 2801 [ 965.620022] binder: undelivered TRANSACTION_ERROR: 29201 17:20:42 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x6e0]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:42 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) kexec_load(0x3, 0x7, &(0x7f0000000600)=[{&(0x7f00000000c0)="e2bcd3752a152745becde87ed1bc1d0be400483221f6671613c1d3707a3bf925ae15eeec941daea43c2fe218160e3e0391165904147215a05c5e3d7c0f879952661de1917949bd", 0x47, 0x50000000, 0x5}, {&(0x7f0000000240)="adb33c1ff3dd88c9515be6021d655d8f6b88eb5beccedaa02288f14c2a2b7cd968e8df8813c6b71ca1f7cebcba7905c21692142df3b23d568c184ab536c5abebe54be1947f6f7035eeac8c", 0x4b, 0x10001, 0x77c}, {&(0x7f00000002c0)="b224d4349b8f61332297146c06d2014e583cc629a0708c5dafabb77b7943abf2d956fec16f89212798ae9463017528131857d4e004edb8510c865f0901449e45dbf4867b1924262e7c1a8239f384904c235c11dcc51cfefe8ff2bf47c1c75b2591efeb703a45b942624de5dd53424a", 0x6f}, {&(0x7f0000000040)="c1c0692eb563bda8e2568862856901751de17dfdbece08aa0ba5eb92824527d526c7", 0x22, 0x6, 0x2}, {&(0x7f0000000340)="7093b0c9f90ee926934ef88e9a6c80480426d8f32e8ae499e316bbc5aae81225c481eff46e3bdc6c67ce6eab1f76a181d4ca30377324b657a22405f1d79277d126f293bef07f38c239f02707fe408fbfbccc60084eeddaa9b728006640e20844a0fbc450b24c1d9edbac3318d6959f6a647ed9ddf9162524d232b80bad0a3069eec9669240859a809346780aea8ad829515807fd7e42918387dcb21ef260269d8d95afe6c707725618", 0xa9, 0xfff}, {&(0x7f0000000500)="c3daf2f1bfa808c1f45a5415a4f673149e6027fb77444011fae8110d4a9fd09915cec0ac52b8df17b54281e3f6c685640410f52bb6cb4e7a3a2375b9d8e449eea10b71af871e3a6cf40d1c2b84a65229e7e18b539c130151a4ba76591282861619cd27db811a840182930ad797532e27af93afd2024fe3598d4f55a6990503ad3e6e82c0d3831e3417fddf124640bf0c771d7583b67f3b94d00142759afbdf90073bdab33cd4ba3b5f829d4595b26334f0f80e15b76cef2c3df4127a9be6d9a39948ca57869b00b61db3301c9b7ad4c8d3df9ed8f4cf9ec138231c2c20f2", 0xde, 0x3f, 0x6}, {&(0x7f0000000400)="c28ef5aa0a027d3b49469c5437b51da9a963c84737b9962b4c4a3a1b1fca717df4ef1d22bd3600a01c922f3565709f12d08fe7a265edf55fe86b006667a9a87c740fc0c8e3b26da3a0b0407031243ba28be43b64cb3ff9977045dbf27cf655a6afac5d759512fe1d4e74a31c39fce7cd63ed4b0277bad6ccfc8de1cd44b3f29f54ad54cc4da85336bf1ee5a84a7c0d302c9857bd5ddd1351", 0x98, 0xff, 0x3}], 0x1e0001) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:42 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) r2 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r3 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) pread64(r1, &(0x7f0000000180)=""/33, 0x21, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000200)=""/232) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:42 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x8000000, 0x0, 0x0, 0x0) 17:20:42 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x571]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 965.908445] binder: BINDER_SET_CONTEXT_MGR already set [ 965.914872] binder: 5020:5028 got reply transaction with bad transaction stack, transaction 976 has target 26829:0 [ 965.925979] binder: 5020:5025 ioctl 40046207 0 returned -16 [ 965.942780] binder: 5020:5028 transaction failed 29201/-71, size 0-0 line 2816 [ 965.954693] binder_alloc: binder_alloc_mmap_handler: 5020 20001000-20004000 already mapped failed -16 [ 965.965020] binder: BINDER_SET_CONTEXT_MGR already set [ 965.970576] binder: 5020:5031 ioctl 40046207 0 returned -16 17:20:42 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x3fe203e570f7590) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x21}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000225bd7000ffdbdf2501000000000000000c4100000014001462726f6164636173742d6c696e6b0000"], 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x4) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, 0x0, 0x0) 17:20:43 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) syz_mount_image$bfs(&(0x7f0000000180)='bfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2, &(0x7f0000000280)=[{&(0x7f0000000240)="fa45271eeb9293e66e34a328ec11b751e99baa1ecc253495200cc3de2bad38cf0c524c44b8a7e640893d90373b8b4095f0", 0x31, 0xfffffffffffffffa}, {&(0x7f0000000380)="b599244f7dc593fb7a7bd29bed24fdbf637092523a9b14dd838fcb6e1e542ee80cbf5d5edad73963b2682a0008f7ffe3228eddd800efbd39b8608a403e885278d9266421936c2ace6e3882955219336419c4fbaa95ed567d923b99023c5e38e86f33fdc72ebe7bf56d2c33ddb0bfc02310c53615c0dd7e4d2dc43f3f45a3502bc5c43b1c1e9c0e7db3a0", 0x8a, 0x1ff}], 0x20000, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0100000066f7bb54d37c46b43940fbc4699e98c590e245aa13d44015911338cc484417034712a14246addcb5df3e9630e7e6712139bf4f0f747b2a791c5636073faac8d8d10096896e6ae6656fb76d58a0c2"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 966.127033] binder: release 5000:5001 transaction 974 out, still active 17:20:43 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x1d9]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 966.187258] binder: undelivered TRANSACTION_COMPLETE 17:20:43 executing program 4: mlock2(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f00000000c0)={0x0, 0x51c}, 0x8) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0xffffffffffffffd4) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000040)) pipe(&(0x7f0000000100)={0xffffffffffffffff}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f00000001c0)={0x1, 0x0, &(0x7f0000000240)=""/214, &(0x7f0000000340)=""/168, &(0x7f0000000140)=""/49, 0x5000}) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 966.229539] binder: undelivered TRANSACTION_ERROR: 29201 [ 966.263666] binder: release 5020:5025 transaction 978 out, still active [ 966.318725] binder: undelivered TRANSACTION_COMPLETE [ 966.327332] binder: BINDER_SET_CONTEXT_MGR already set [ 966.376647] binder: release 5020:5028 transaction 976 out, still active [ 966.386541] binder: 5043:5044 ioctl 40046207 0 returned -16 [ 966.413160] binder: undelivered TRANSACTION_COMPLETE 17:20:43 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x8000080, 0x0, 0x0, 0x0) [ 966.437313] binder: 5043:5055 unknown command 1 [ 966.447278] binder: undelivered TRANSACTION_ERROR: 29201 [ 966.475814] binder: 5043:5055 ioctl c0306201 20000140 returned -22 [ 966.526563] binder: 5043:5044 got reply transaction with no transaction stack 17:20:43 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0xa87, 0x101000) connect$pppoe(r2, &(0x7f00000000c0)={0x18, 0x0, {0x1, @broadcast, 'bcsf0\x00'}}, 0x1e) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) ioctl$TIOCSLCKTRMIOS(r2, 0x5457, &(0x7f0000000100)) ioctl$TUNSETVNETLE(r2, 0x400454dc, &(0x7f0000000140)=0x1) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 966.624697] binder_alloc: binder_alloc_mmap_handler: 5043 20001000-20004000 already mapped failed -16 17:20:43 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={r1}) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f00000000c0)={0x0, 0x10000}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000001c0)={r5, 0x2c, &(0x7f0000000140)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1a}}, @in6={0xa, 0x4e20, 0x8, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x9}]}, &(0x7f0000000240)=0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 966.855746] binder: 5043:5055 unknown command 1 [ 966.859242] binder: BINDER_SET_CONTEXT_MGR already set [ 966.860466] binder: 5043:5055 ioctl c0306201 20000140 returned -22 [ 966.938003] binder: undelivered TRANSACTION_ERROR: 29201 [ 966.943495] binder: release 5043:5051 transaction 979 out, still active [ 966.964627] binder: 5043:5044 ioctl 40046207 0 returned -16 [ 966.994481] binder: undelivered TRANSACTION_COMPLETE [ 966.999680] binder: release 5043:5051 transaction 981 out, still active [ 967.044517] binder: undelivered TRANSACTION_COMPLETE 17:20:44 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x803]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:44 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x9000000, 0x0, 0x0, 0x0) 17:20:44 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000180)='/dev/vbi#\x00', 0x0, 0x2) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80001) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f0000000200)={'nat\x00'}, &(0x7f0000000280)=0x78) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:44 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0xec9c52f394c21397) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x1, @dev={0xac, 0x14, 0x14, 0xb}}, 0xfd38) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x571]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 967.498628] binder: BINDER_SET_CONTEXT_MGR already set 17:20:44 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) msync(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r3 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x0, 0x2) read$alg(r3, &(0x7f00000001c0)=""/139, 0x8b) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8934, &(0x7f0000000040)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_map={0x1, 0x5, 0x2, 0x7, 0x3, 0x9}}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 967.530218] binder: 5088:5096 got reply transaction with bad transaction stack, transaction 982 has target 26829:0 [ 967.641922] binder: 5088:5093 ioctl 40046207 0 returned -16 [ 967.676582] binder_transaction: 1 callbacks suppressed [ 967.679148] binder: 5088:5096 transaction failed 29201/-71, size 0-0 line 2816 [ 967.681761] binder_alloc: binder_alloc_mmap_handler: 5088 20001000-20004000 already mapped failed -16 17:20:44 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x284) 17:20:44 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x185]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:44 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xa000000, 0x0, 0x0, 0x0) [ 967.834820] binder: BINDER_SET_CONTEXT_MGR already set [ 967.840398] binder: 5088:5104 got reply transaction with no transaction stack 17:20:44 executing program 2: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000240), 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r1 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0x8, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r3 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x5, 0x8002) ioctl$UI_SET_PROPBIT(r4, 0x4004556e, 0x1e) r5 = syz_open_dev$binder(0x0, 0x0, 0x1) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000004a00000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080), 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad772816094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) setsockopt$IP_VS_SO_SET_EDIT(r1, 0x0, 0x483, &(0x7f0000000140)={0xff, @broadcast, 0x4e20, 0x1, 'sh\x00', 0x20, 0xcbb6, 0x52}, 0x2c) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) fallocate(r2, 0x60, 0x1, 0x81) ioctl$UI_SET_MSCBIT(r6, 0x40045568, 0x2e) ioctl$VIDIOC_ENCODER_CMD(r4, 0xc028564d, &(0x7f00000002c0)={0x0, 0x1, [0x3, 0x1e2, 0xc3a9, 0x7, 0x7, 0xffffffffffffffc0, 0x1f, 0x5]}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040), 0x10) ioctl$EXT4_IOC_RESIZE_FS(r3, 0x40086610, &(0x7f0000000280)=0x1) [ 967.925390] binder: 5088:5101 ioctl 40046207 0 returned -16 [ 967.934698] binder: 5088:5104 transaction failed 29201/-71, size 0-0 line 2801 17:20:44 executing program 4: socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f00000001c0)=0x8edc, 0x4) connect$inet(0xffffffffffffffff, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r2 = accept4(0xffffffffffffffff, &(0x7f00000000c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000040)=0x80, 0x800) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000140)=[@timestamp], 0x1) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) sendmsg$kcm(r2, &(0x7f0000000340)={&(0x7f0000000240)=@generic={0x1b, "49301eb992b0aa09144b01db7e2ebb4316433bbb7c6b6949c14792b234191d845cc63aadcfd30fbd93cfe6c698722dab9cae16c7da9816c9546a80fdd36983fb83a62d0a5263476fb666e26747a501d378c25e1281120821af067ad33347fc91d65600dbd36fb1a4a5b406e3aa757afdc4ea232ebc76561692eef39f53c3"}, 0x80, &(0x7f0000000080)=[{&(0x7f00000002c0)="329c3e35f85f3f036ced88cc237af4ae80ff2a9a0b94498d90640e7028ca0949715e57ca64dccd852b540e543edaf0d72a388bb6e831ad470b7e9d5268c068d4535c4d9ea5687cdf", 0x48}], 0x1, &(0x7f0000000500)=[{0x28, 0x114, 0x4, "4937a827e4b0beb3b688d96577e847af54"}, {0xe0, 0x11f, 0x2, "45d1da090bd396d8a674cfb77c2f1d0d8fdc88d3cc30c1e57e81382801decc597f7aa56fed377096caba8ee9c74b633c5d939110c3ba1b9dc0a28792b76f49d990424605b6797cf05602a7c734b4ee6a5e2809dd30c035752f9d9fb466a49b56f756c3b507b520cbb9d310c652349723a293144d92db2a7955d3568e9da497139dadf64bdb50768ce38426b9258a72eec6271ffec20f8dcfdc9a8a05d94e0238e0c2180ee0096a7cf0e452491d70d0ab295c3c74d42cd71b9b846687cdfbe7dec22f8ba392b2fabb5d565080ec434ef7"}, {0x20, 0x117, 0xa0, "966c16b79522d45f20"}, {0xf8, 0x10e, 0x2, "dabd6ef423833f85ad95c557e2834aeaf331a334bb95fbd5946abacaafa65d46fb36a878fff1b82e5bd6a9993a9d8574d2ef8875be40afb1ca8d903270e9b278fd175cb26a54ff1a98ca906008871bed588cba38363c64845f8b1b7298e11b3465fe3713df6e04687f746d4a92407c4f886d025a84e7cfd320374c01016b0eb6e3334f87fcea54020eb0038cec555cdf440f4396d92f1dc94a746b225a40c631a1e9e8ba8e20d4d0ed650a04907b897fbfe3f653d81d3133e4a1667f4f797ef14751107dc45d15a830f1e3b34b0c42eea85f1e182c5bbd87a9ce569066d53fa9755c7036"}, {0x1010, 0x117, 0x400, "71e255dc32e7613d37b7ce13b52a084999d9033f61464e53cfa8996ee424905b4c753eccde1ded8d89f70bed8fbcbe50cf164740f8739585d3ffcdf670b3e154a4517ad3fae1bf5a8d81b824473ea21a656781575d0b72b7855f24fc3fc78132e92025fc0d711d0a87f4fd4178a8b8dbd9e3c4330a7f7877ba9530d0ec4ca1edefcb3ea4abe396ea34858d044ad2650cac116eeb8493ade9ae9f7ab6c6a67158462679fd0915e6b19f654a0e971efc1916fae1cfe51e6ce78c122405ae6960f63fae913feb61565488bf57c3320e6eab4ab4351294f28c84d5ce3a99bc4205803311130be38d8bb0493f539476c8989e1d1821b5f26fbbf8621fbd6b0486b2b090200240f45d1440c51609c6eb6dec74a5ffb23276bcec3b8c3aefafd5cd38e8530455f424b48f6cc3a054c3cb209864872390d95045a5ba8870d5cd1d1b5f5103cad2a49649f382c921f7a41618312457bd5cb344e4d0438c6102e9cd51d50f301cfda32cbd2c9951c9a93ef85187660ca68e1a1f90b1a2b71db95524fcf2a2ce0a86f8efa07a4d0c254ffa8093aae8e92573b7a49d9bc5460b2f273ee758dade9c99e3aac5425eb33c30ad26b058e9555d832c675d15004a6af5ab171e39e972a3b51a062183f047182e969d9084945c3ee5a51e5966bed4fd2ca155728bbd34b8b78f967bc260a40c1b3c9a2750bb6366609a08cde18dbffa43e080cc2478e22d5bb88e218c8443d78adfc6444ce3527909bccf1431e52d2b200e5767f76b3488f5050a93ee201f2ea06eff4f4c292fa414d3b882ca379cb583080ed863870ce742a906ab032d6456c76534f35b09c6603a08ffb184979ec9e64591c9afa307ac9a8e9ba52208fa5b74b714d59b6ee8335c5ee97b10fb42ea388d6388add3db4b726d380c1e3a9ac30b4911e24dc2b9164b7e6c85254e4dd91bc0ae62e84f3963f86e9863f82847fe2f7766e001bd4160f4f6ef1c7dc7bed8386f75a8e242097a59909d85689df447ab6e54d0f913cc36d7c0997e993d8577e91be33f7d73609be39188b5449a4462017674bb7e38cea2a33c22436470001fc3e2e30b7f96e2dd646ab0ee7f81f20a09dafe7ce63b73c4fc41d7fa09199768dc3848263b8c92e3b9f41e2569baa485ee531dc513421f699b8af89718c4ee5ac75cb104cf7f3b42b0f86143331377f04afad0a776809f2e9c3418c2a4664c21c2cbece6a3eb29c9a12f6514f149ada890d2b27d3e55a2badf114b88e1af42e90b4a854dbeee723e27811379e7d49b96ad04adfced34f76c25c3b3ddc7a6aa6f9029647133508d8bbae1c75f08ee70447e31d9df873f0d96173c5369a7858949e8fcc83bef32da3e0420b31cb6ce91671730c1fc0fefe8989579214e2820bbae9cd06a4772c81d532fc66014cca662d5726aaf8e286699d352872f237b8aa573893f5ecc955dd567854e0164a218ac30ccea923cf5d4f4650acbc8c5eec9ebe8b521f9386658de28df03635aeb5032c6fe7ac8cdbb98ca7888d84d84e43eb7d12744c5a88247fad7f93106baf7bdd10997628401bf33e69cddb8c543d0f20ebbd0cac6f51f59aefbe62b56a547e83dd701881038caf5653386704497f91f74ceb7e73aaae973de98c0e9a539a800dde3580a99d176ee938611e004ddb084891f9ebcdc1083fa1c39152b6eb70a2bfd71d5c51cbf7afab1c893ba934bf7a6b856890ffb88828eeba825b2e27671a1e1fe01fcd264a9d865369dee9cc417f9b9caf47ab96ecfea3b5b06cd853f89c2e3c6f7aeb2b7092bde68d19b4c856219807d9520cc97de61ca9242eaea284cc289d5eaef1f608ad7bec95e756b7f2c61f0e5a04193757efe4f4ef5a7503063e31197560af1f24b338fb5e87881fd9770c71ce1e2ba46411b33ad0a118e911f28a0b8489b0044e150e99e131b756b2bf7dc95eb7a6e0398a2114a068ea745c5c3fc1896ce47ad30921eab3cbd265fbfde501a0f4aae4bc45cd91e27a496ae519da46321d4ad4dec09dd7923b881bdfe965ba540090e6951b231437f732337f12874d3196f6353912328b86e2eee131d574dc03cc1abc0aba4c352f7f9ce8595a44f49293b8d39de2449cbb9703ac325b48bec49874991521c168db8b1678398b38f67cea176a7a3c756601ebaaa4ce6333274f05b20e60896b6994a99fa5474d25dfeaf6fff53d6ebf8e1cf955391aed60c71d2b32a0f926416c2ea1191224ebdc80716613ea2656797e5c716f679511e91ae67c15164ba6886be7c488d4ea3fa4539869170e2addaee85343934091cc49b2af8a66895a2b6b86fec157f1883d828a97f7eb663d88c071b16ce53960fb1acb2398f06ae050fbbfdaea01811aff1a54e95d81769e38ed462f775297aec096fcca8e77d2f95e7e0d6ab2972787acfa0f308c40bce9d384f0efc44b6f42900e3449edf6483ad3f1e0fe4c5d335fb5b2e4f484cfa75b510d84ac23b91c7a40a72063064e676acbcbd09b45eaae2c40397e4f6e259c07fe5a3286dbc8f180822d22e24abb2faa1bf016b8c8d71b578e3a508390c1b9ae0b95f4a53dde5f1fb2d29e60daaf882e2c2931d93b10cc4338fd40e6ea517d4e8f89ab4b086d6a91b0887bc82cfcf0e8ca0c29db24c56803b35e4895c1a785a9099d15859c9cef0672378db5953284e44776c31701f6281cca59a86191807f26d607f16e45894ab7974bdc8eb12f3346228dafdc367ffb779204902bc2a8251e194c5a376309db081760e8731501f5885173cdf73850748a38dc2b768a92b5e807f85f3f120959d7057648c6d76c8a370ae82559ca38a7bb726187912e68d9515cbea5bcd0a2593134b763e99f798bed28e2fffee59e9e365496e94daddb1d37f8935e0c1351ba87920a9d8ed054caa73b029229b91f381417cf6eb9d87ff441dca776f9a7aa08f0cc6a4e2c9e5ccc63fa40b564422627b964b7653229be3d6a62b8d4d8dcd753179bf7b1d96b73669f0ff865365180a6e5caa6f565ef97772d5e200e1575d993cb36da9d5e47c0080f147321cf2541e43c3c421274a58a7ff3a3c583cc7c3b01057d9176c3944279a5683236928757ae369417cd32929b5589cf90da113b9e050d50bceb1c40d8e3dba685342ec037e40aac7af9418a133cc33739d7119a88e230d3fb7ba5ed03ece1438ee7209713919759800e40a24daa03078c99824f039992c64d95109199492a4d1c998fbe51bd485b99a0c16b1617c4da7f0267517d4d6ecd516177b580d47ba5f5fe00933ae96781913b29cf8d4e9e2c2bf256651851d8124c195cb020bac833bd95c356eaf9cea3a15ec2ec45b82d717eece92d5ea07860951a7b708119092633542ab38b03a3510a37200ef78b54f9327f30ff43112912fd9940211f31831d64e8d6fc812121f5975e3e10017e13a509186f9d7461a70edaa2fd243da8ac1ce59ebedd388e4a02ce8851251191092f137d4f0fe1e95ebf1feffa3f93741f95e96c0ee693a1b85ba942bcb3c681ed68cc0ad0bbaf4e56322a209e840f07743a0a50d907b295bc9a7c5d1d265c3ac2e944ed2ca9e1cb28d3260ebf7fe593cc90a758cff23a7b3b97567957c8b6b76276a743fc998959d4b9340cb5c350ae693898664ac7c607763ae8c7ec0a7b68dc63f5350009ed01feddda68128649c459765185bc8f1cd3d439a9ed47b589721786e97a6665a01c3e76179aee4c7832d110717dd277cb85051f49d2c8469db9119c743f678c7e1295bdfe890784c9aeb6578b5c3850275728f881b761b015511e2a946e9080f581fd8c43b3fc9aec6578645a7d6a85c53dc65e640cdcab61981b64f1be7b9630501a31c497e3d48bb0a0f18449decfa6d7b405b475df81a6b0d24fa40ee1d87a6ed892f8f79a8ccbd5a6508a8b20129fdb7a9854aed618f3f2ab49bdc6cd1418c8034e114ff16faff1a2f51fe7648458186f40a068a14ac57f535d7ac8946e0747dbf88262ba30ac825de7bac604347d94065fb28586c8f013d5a31fb9f0c3aa06db61b69eb4fff75cbc6b4b25dc23ab746b8edc1b1a50305ccbd60fe3c4c028afaa11ceca8ed10eb3cf24107928c822f867d816d8f604643d0d5022e8cf5fc52a525670b188492b095f079a74d29265e59426e9185894c357dad249e1c150b20f797501de77827add84dbb057c57b7ab435aeeb06a0424309e6f751439ac9264d9e6b68ef8d5dc46ace5eb91c720699e3a12468e4a6eb5fe0a9d370c54921e0cfeaa19ef496eec339de47387afb73099c647ff13707ac0adf7aaf78fa28a47436ea454b41c303c1901f80e87ca3f5a252cac1c6626502f0a920c6726ee7566da6c77f309a9834ced5054cc979af380fcf93754b4f2670c289fb19e28b81b372c3d62070510995c0745deff3e8b1b35966a157cec3b5012aba46015877dfbdfed457818d9b8affe3fcfd632ecfe60f4b5446f09b26834588613a66681d02b211f7b1abd4dc9c56a2dd75a5b66da095573b654b2e5ccbf3b1f77d544caa8ecfa464b37e9f0baea2591cde2c580660de24963913624994010482647e4626cd6587b93a4d39d9531875241a587523cb564e3b5ce83e31262b16d607329e1098f0192f91afbd7079708a0638353fa915608919c86c6900b4ac3fd15472a5c8fbf0f50728a823fdc1e4118343d51cd37ffde24a955e5217fd24abecf5014f6412e445cc949f69ba36f0c3919aa500413e8e2e21bc7be5001c4ef59124a94bbb421996e8529c6ce5dbe24668ea85a5129e219efd6c2adf5669fd887bce0ba6c10cca7b5ca4b2a7b0236502cdbf65e8bd0c27d65e2507fa3ed6407f475a682bc33ded47174cc96345672fc7e648e53c7c417056184774215b959c7a8870955fb7215a9c32ad1bd9d34cb3507e52c87a18ce3a440fe39f89a95bdeff14e2de002cd6898dceb807dde11a92b4c3a684e76eeee06dff8151163fddc75572743d3144838080a081dda9c68a413475ed91b760b30ed5bd568ab806153cd854e8821700f9d76ff28eca4ad0832f89c4ad14da6b3476b52aa603bec43014fdf88a9518b79ca63b70a60e3def75b19f6a3bae2dc16aacc7f6e10d84109596d17d750b7a49631f5e08c34b708beeef78d3d86d24472e4bb5fb5853c37481e6c1c108537fddc712687942b77c926a3b9d980cb6885ab6af2d462e7b150cc3240e238421c4d01369ce9dcd55929263a525748423d1dafb3dacda8c981899b629b9c3003b60ce2fc4442c48c7c52ae16610d868747e116a7ab13d8a6bef9ee4777d967fab4059d6bd0eab91712b14a94fdbec8811ade62c11edc4cf433e6126a303ff3a1e91ea2100e81f9b662db2967094db283a9ae1d9dacbf5eba03a65ba3c48a1ca2a3c46305763892bf58656a86e49a681309887ef2e6da915f103ded197a1fe32e34b97d0cc3fff67efdd01ecb5390850ffc8d40dead19858e43f640a8c9796acc9ceb6b183dc59a69e7dfd811f9d19b2a4b48fb9ec2926753c5c25382eb0dd568e2620481352ee937c519568936a15962526efcba96cfdc7a4cf69c7061882a94c1a9b3f0c6bb1d588255c0d96b5a8d89462f36e318b8b19b265bed169465a2ddfdf13f482260f76f97df47c0c829448a54e0eefbec1b047181e3f2879e1eed40f358adbe5d765e0222c12f3e7352cfc68684c71ad0b23a39ba0016528973654b3d4ebd363293a9e32889590fe894cd4768ae36a77293f93ccc1c35f10f9156087e1cc3c661d6911b57377290aaaab6a44430a7074675718b5aee235a7833c84815d6f116ced15b0f3e22e71965b48731a5"}, {0x90, 0x119, 0x10000, "d4582344c649e8b6375f2aab9a53ef27528643a71c5873132d45ea4932a597475abc9b5ae6729eeb7e0c01cdf44c1e35df220f96a96fd4e08f2424091aa568be4aaaedcc396071a12fc0584352b56704430c70d7547f7035cbf5998bae2df042aa442edd602cc3a5ec69a4e449e5a3d2eb742170d6fba8d7e533a6"}, {0x40, 0x10b, 0x9, "52148381467c3ba886ab611ee956c69fc39f92bf5d1053eff36f21ac95eb1387bb6304ad889462e13a68a9d1b6a268ed"}], 0x1300}, 0x0) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000380)='/dev/dlm_plock\x00', 0x40001, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r3, 0x4018aee1, &(0x7f0000000400)={0x0, 0xdb, 0x3, &(0x7f00000003c0)=0x7fff}) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x400000007, 0x0, 0x0) 17:20:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xb000000, 0x0, 0x0, 0x0) [ 968.289962] binder: 5122:5123 unknown command 0 [ 968.343859] binder: 5122:5123 ioctl c0306201 20000000 returned -22 [ 968.527701] binder: release 5122:5123 transaction 986 out, still active [ 968.562633] binder: undelivered TRANSACTION_COMPLETE 17:20:45 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0xa01]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:45 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x3, 0x8000) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000500)={0x7f, {{0xa, 0x4e21, 0x1, @dev={0xfe, 0x80, [], 0x1e}, 0x7}}, 0x1, 0x4, [{{0xa, 0x4e24, 0x0, @local, 0xb0}}, {{0xa, 0x4e23, 0x81, @ipv4={[], [], @empty}, 0xffffffff}}, {{0xa, 0x4e23, 0x7, @loopback, 0xfffffffffffff266}}, {{0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x20}}}}]}, 0x290) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x3) setsockopt$RDS_CANCEL_SENT_TO(r1, 0x114, 0x1, &(0x7f00000000c0)={0x2, 0x4e23, @rand_addr=0x9}, 0x10) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bcsh0\x00', 0x0}) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000340)={'team0\x00', r4}) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0xffffffffffffffa2) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @empty}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) 17:20:45 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rfkill\x00', 0x181801, 0x0) ioctl$SIOCGETNODEID(r2, 0x89e1, &(0x7f0000000200)={0x4}) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000400), 0xffffffffffffffff) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f00000003c0)={@remote, @empty}, 0x8) r3 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) read$FUSE(r2, &(0x7f0000003540), 0x1000) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000002c0), &(0x7f0000000380)=0xc) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0xfffffffffffffd) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000005c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) connect$inet(r2, &(0x7f0000000240)={0x2, 0x4e22, @empty}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:45 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x7a000000, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xd000000, 0x0, 0x0, 0x0) [ 968.933100] binder: BINDER_SET_CONTEXT_MGR already set [ 968.969564] binder: 5141:5143 ioctl 40046207 0 returned -16 [ 968.973247] binder: BINDER_SET_CONTEXT_MGR already set [ 968.994622] binder: 5146:5147 ioctl 40046207 0 returned -16 [ 969.059866] binder: 5141:5161 got reply transaction with no transaction stack 17:20:45 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) r3 = request_key(&(0x7f0000000180)='.request_key_auth\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000240)='/dev/loop#\x00', 0xffffffffffffffff) keyctl$clear(0x7, r3) 17:20:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x14000000, 0x0, 0x0, 0x0) [ 969.103551] binder: 5141:5161 transaction failed 29201/-71, size 0-0 line 2801 [ 969.250786] binder: BINDER_SET_CONTEXT_MGR already set [ 969.284344] binder: 5168:5169 ioctl 40046207 0 returned -16 17:20:46 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x185]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:46 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) ioctl$BLKGETSIZE64(r4, 0x80081272, &(0x7f00000000c0)) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) listen(r0, 0x6) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) 17:20:46 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x4001, 0x0) getsockname(r0, &(0x7f0000000200)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000280)=0x80) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000002c0)={r2, 0x1, 0x6, @random="61eea74c55c1"}, 0x10) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r3 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0063404000000000005522203b7cd11abe00000000000000000000000000000000000000000000008000777c0e0000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x19000080, 0x0, 0x0, 0x0) 17:20:46 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x0, 0x10000) getpeername$packet(r2, &(0x7f00000000c0), &(0x7f0000000100)=0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x0, 0x2) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 969.579411] binder: BINDER_SET_CONTEXT_MGR already set [ 969.613230] binder: 5183:5184 ioctl 40046207 0 returned -16 [ 969.684926] binder: release 5141:5150 transaction 987 out, still active [ 969.691817] binder: undelivered TRANSACTION_COMPLETE [ 969.753484] binder: undelivered TRANSACTION_ERROR: 29201 17:20:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0xbff]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:47 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r3 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x191000) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000100)={0x8, &(0x7f00000000c0)=[{}, {}, {0x0}, {}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_NEW_CTX(r3, 0x40086425, &(0x7f0000000140)={r4, 0x3}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:47 executing program 1 (fault-call:1 fault-nth:0): r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 17:20:47 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x4000000002101) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:47 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x1a000080, 0x0, 0x0, 0x0) [ 970.305629] binder: BINDER_SET_CONTEXT_MGR already set 17:20:47 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000e1}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x28, 0x70bd2c, 0x25dfdbfe, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xda}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40890) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) sendto$inet(r2, &(0x7f00000000c0)="f801bf27a5b16b1440b9a174f364b97b752e7a081fed933a369ba1b9c1cf246aa3defbdd2ef1d20768628dcd6b2b1db757ca19dd6be44adf2c63ef9e429cacba36e6e04249908f04b3a69fd125ebb4aad4011a", 0x53, 0x5, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:47 executing program 5 (fault-call:2 fault-nth:0): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') [ 970.328804] binder: 5199:5205 ioctl 40046207 0 returned -16 17:20:47 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x2b, &(0x7f0000000080)=0x32, 0x258) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:47 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x1d000080, 0x0, 0x0, 0x0) 17:20:47 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) splice(r1, &(0x7f0000000180), r3, &(0x7f0000000200), 0x6, 0x5) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 970.509805] FAULT_INJECTION: forcing a failure. [ 970.509805] name failslab, interval 1, probability 0, space 0, times 0 [ 970.574705] CPU: 0 PID: 5223 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 970.581739] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 970.591119] Call Trace: [ 970.593734] dump_stack+0x1db/0x2d0 [ 970.597417] ? dump_stack_print_info.cold+0x20/0x20 [ 970.602453] ? __f_unlock_pos+0x19/0x20 [ 970.606462] should_fail.cold+0xa/0x15 [ 970.610365] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 970.615483] ? ___might_sleep+0x1e7/0x310 [ 970.619639] ? arch_local_save_flags+0x50/0x50 [ 970.624240] __should_failslab+0x121/0x190 [ 970.628512] should_failslab+0x9/0x14 [ 970.632321] kmem_cache_alloc+0x2be/0x710 [ 970.636500] ? check_preemption_disabled+0x48/0x290 [ 970.641529] getname_flags+0xd6/0x5b0 [ 970.645345] getname+0x1a/0x20 [ 970.648552] do_sys_open+0x3a5/0x7c0 [ 970.652284] ? filp_open+0x80/0x80 [ 970.655840] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 970.661214] ? trace_hardirqs_off_caller+0x300/0x300 [ 970.666329] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 970.671111] __x64_sys_open+0x7e/0xc0 [ 970.674923] do_syscall_64+0x1a3/0x800 [ 970.678845] ? syscall_return_slowpath+0x5f0/0x5f0 [ 970.683798] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 970.688820] ? __switch_to_asm+0x34/0x70 [ 970.692937] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 970.697811] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 970.703016] RIP: 0033:0x412041 [ 970.706214] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 17:20:47 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x1a1541, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x113, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r4, &(0x7f0000000240)={0x4, 0x8, 0xfa00, {r5, 0x69}}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r6 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x7, 0x600) ioctl$KDSKBMETA(r6, 0x4b63, &(0x7f00000000c0)=0x3ff) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000280)=0x3) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 970.725118] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 970.732833] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 970.740113] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 970.747387] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 970.754659] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 970.761930] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 [ 970.888392] binder: BINDER_SET_CONTEXT_MGR already set [ 970.900981] binder: 5232:5235 ioctl 40046207 0 returned -16 17:20:47 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x20000000, 0x0, 0x0, 0x0) [ 971.034372] binder: release 5232:5235 transaction 989 out, still active [ 971.048875] binder: undelivered TRANSACTION_COMPLETE [ 971.107827] FAULT_INJECTION: forcing a failure. [ 971.107827] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 971.120403] CPU: 1 PID: 5209 Comm: syz-executor1 Not tainted 5.0.0-rc4 #49 [ 971.127460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 971.136901] Call Trace: [ 971.139524] dump_stack+0x1db/0x2d0 [ 971.143151] ? dump_stack_print_info.cold+0x20/0x20 [ 971.148224] ? __unlock_page_memcg+0x53/0x100 [ 971.152736] ? find_held_lock+0x35/0x120 [ 971.156798] should_fail.cold+0xa/0x15 [ 971.160688] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 971.165792] ? lock_downgrade+0x910/0x910 [ 971.169959] ? kasan_check_read+0x11/0x20 [ 971.174107] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 971.179428] ? rcu_read_unlock_special+0x380/0x380 [ 971.184366] should_fail_alloc_page+0x50/0x60 [ 971.188855] __alloc_pages_nodemask+0x323/0xdc0 [ 971.193522] ? __alloc_pages_slowpath+0x2cc0/0x2cc0 [ 971.198561] ? add_lock_to_list.isra.0+0x450/0x450 [ 971.203510] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 971.209251] ? kasan_check_read+0x11/0x20 [ 971.213394] ? page_mapcount+0x397/0x5b0 [ 971.217470] ? fault_around_bytes_set+0xa0/0xa0 [ 971.222134] ? kasan_check_read+0x11/0x20 [ 971.226278] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 971.231816] alloc_pages_current+0x107/0x210 [ 971.236225] __get_free_pages+0xc/0x40 [ 971.240118] __tlb_remove_page_size+0x2ee/0x510 [ 971.244789] unmap_page_range+0xf45/0x25a0 [ 971.249044] ? vm_normal_page_pmd+0x400/0x400 [ 971.253819] ? add_lock_to_list.isra.0+0x450/0x450 [ 971.258772] ? pagevec_lru_move_fn+0x1df/0x2a0 [ 971.263376] ? find_held_lock+0x35/0x120 [ 971.267438] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 971.273024] ? uprobe_munmap+0x141/0x430 [ 971.277100] ? uprobe_mmap+0x1180/0x1180 [ 971.281160] ? lockdep_hardirqs_on+0x415/0x5d0 [ 971.285750] ? kasan_check_read+0x11/0x20 [ 971.289892] ? pagevec_lru_move_fn+0x1df/0x2a0 [ 971.294479] unmap_single_vma+0x19d/0x300 [ 971.298633] unmap_vmas+0x17c/0x310 [ 971.302264] ? zap_vma_ptes+0x110/0x110 [ 971.306272] ? perf_trace_mm_lru_insertion+0x1440/0x1440 [ 971.311727] ? kasan_check_write+0x14/0x20 [ 971.315965] exit_mmap+0x2d4/0x5d0 [ 971.319501] ? __ia32_sys_munmap+0x80/0x80 [ 971.323784] ? __khugepaged_exit+0x42e/0x630 [ 971.328206] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 971.333757] ? __might_sleep+0x95/0x190 [ 971.337777] mmput+0x240/0x640 [ 971.340977] ? is_current_pgrp_orphaned+0xa0/0xa0 [ 971.345845] ? set_mm_exe_file+0x200/0x200 [ 971.350571] ? do_raw_spin_unlock+0xa0/0x330 [ 971.354975] ? up_read+0x212/0x2b0 [ 971.358509] ? do_raw_spin_trylock+0x270/0x270 [ 971.363110] ? __down_interruptible+0x740/0x740 [ 971.367804] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 971.373345] do_exit+0x9e2/0x26e0 [ 971.376795] ? __lock_acquire+0x572/0x4a30 [ 971.381023] ? trace_hardirqs_on+0xbd/0x310 [ 971.385338] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 971.390614] ? mm_update_next_owner+0x970/0x970 [ 971.395293] ? mark_held_locks+0x100/0x100 [ 971.399519] ? kzfree+0x29/0x30 [ 971.402792] ? add_lock_to_list.isra.0+0x450/0x450 [ 971.407713] ? rcu_is_watching+0x30/0x30 [ 971.411787] ? kzfree+0x29/0x30 [ 971.415074] ? apparmor_file_free_security+0x12e/0x1a0 [ 971.420378] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 971.425913] ? check_preemption_disabled+0x48/0x290 [ 971.430919] ? apparmor_task_getsecid+0xd0/0xd0 [ 971.435590] ? task_work_run+0x1bb/0x2b0 [ 971.439661] ? find_held_lock+0x35/0x120 [ 971.443758] ? add_lock_to_list.isra.0+0x450/0x450 [ 971.448697] ? memset+0x32/0x40 [ 971.451980] ? __dequeue_signal+0xeb/0x730 [ 971.456209] ? lockdep_hardirqs_on+0x415/0x5d0 [ 971.460789] ? get_signal+0x963/0x19b0 [ 971.464668] ? find_held_lock+0x35/0x120 [ 971.468725] ? get_signal+0x963/0x19b0 [ 971.472608] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 971.478143] ? _raw_spin_unlock_irq+0x28/0x90 [ 971.482631] ? _raw_spin_unlock_irq+0x28/0x90 [ 971.487128] do_group_exit+0x177/0x430 [ 971.491044] ? trace_hardirqs_off_caller+0x300/0x300 [ 971.496167] ? __ia32_sys_exit+0x50/0x50 [ 971.500241] get_signal+0x8b4/0x19b0 [ 971.503960] ? ptrace_notify+0x130/0x130 [ 971.508027] ? pvclock_read_flags+0x160/0x160 [ 971.512517] ? poll_select_set_timeout+0x199/0x240 [ 971.517442] ? trace_hardirqs_off_caller+0x300/0x300 [ 971.522617] do_signal+0x91/0x1ea0 [ 971.526158] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 971.531738] ? ktime_get_ts64+0x38d/0x4f0 [ 971.535902] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 971.540931] ? timespec64_add_safe+0x1ea/0x2d0 [ 971.545513] ? nsec_to_clock_t+0x30/0x30 [ 971.549570] ? setup_sigcontext+0x7d0/0x7d0 [ 971.553895] ? exit_to_usermode_loop+0x98/0x3b0 [ 971.558570] ? exit_to_usermode_loop+0x98/0x3b0 [ 971.563241] ? lockdep_hardirqs_on+0x415/0x5d0 [ 971.567827] ? trace_hardirqs_off_caller+0x300/0x300 [ 971.572921] ? do_restart_poll+0x2e0/0x2e0 [ 971.577152] ? fput+0x128/0x1a0 [ 971.580438] ? do_syscall_64+0x8c/0x800 [ 971.584434] exit_to_usermode_loop+0x2f7/0x3b0 [ 971.589019] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 971.594404] ? syscall_trace_enter+0x12a0/0x12a0 [ 971.599174] do_syscall_64+0x696/0x800 [ 971.603095] ? syscall_return_slowpath+0x5f0/0x5f0 [ 971.608038] ? prepare_exit_to_usermode+0x232/0x3b0 [ 971.613173] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 971.618025] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 971.623206] RIP: 0033:0x458099 [ 971.626420] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 971.645322] RSP: 002b:00007f9669db9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000007 [ 971.653024] RAX: 0000000000000001 RBX: 00007f9669db9c90 RCX: 0000000000458099 [ 971.660289] RDX: 0000000000000400 RSI: 0000000000000001 RDI: 0000000020000040 [ 971.667552] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 971.674827] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9669dba6d4 [ 971.682109] R13: 00000000004c4736 R14: 00000000004d7db8 R15: 0000000000000004 17:20:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0xd90]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:48 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:48 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_mreq(r0, 0x0, 0x27, &(0x7f0000000180)={@empty, @remote}, &(0x7f0000000200)=0x8) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000010000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:48 executing program 5 (fault-call:2 fault-nth:1): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:20:48 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x40000000, 0x0, 0x0, 0x0) 17:20:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 972.080767] binder: BINDER_SET_CONTEXT_MGR already set [ 972.091703] FAULT_INJECTION: forcing a failure. [ 972.091703] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 972.103521] CPU: 0 PID: 5268 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 972.103534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 972.103539] Call Trace: [ 972.103567] dump_stack+0x1db/0x2d0 [ 972.103590] ? dump_stack_print_info.cold+0x20/0x20 [ 972.131157] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 972.131174] ? _kstrtoull+0x17d/0x250 [ 972.131199] should_fail.cold+0xa/0x15 [ 972.131220] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 972.149539] ? get_pid_task+0xd4/0x190 [ 972.149556] ? find_held_lock+0x35/0x120 [ 972.149574] ? get_pid_task+0xd4/0x190 [ 972.149604] should_fail_alloc_page+0x50/0x60 [ 972.149621] __alloc_pages_nodemask+0x323/0xdc0 [ 972.149645] ? __alloc_pages_slowpath+0x2cc0/0x2cc0 [ 972.149661] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 972.149690] ? ___might_sleep+0x1e7/0x310 [ 972.185293] ? trace_hardirqs_off+0xb8/0x310 [ 972.189721] cache_grow_begin+0x9c/0x8c0 [ 972.193794] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 972.199342] ? check_preemption_disabled+0x48/0x290 [ 972.204383] kmem_cache_alloc+0x645/0x710 [ 972.204410] getname_flags+0xd6/0x5b0 [ 972.204429] getname+0x1a/0x20 [ 972.204445] do_sys_open+0x3a5/0x7c0 [ 972.204464] ? filp_open+0x80/0x80 [ 972.204485] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 972.204503] ? trace_hardirqs_off_caller+0x300/0x300 [ 972.219840] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 972.219861] __x64_sys_open+0x7e/0xc0 [ 972.219880] do_syscall_64+0x1a3/0x800 [ 972.219900] ? syscall_return_slowpath+0x5f0/0x5f0 [ 972.219917] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 972.256282] ? __switch_to_asm+0x34/0x70 [ 972.256307] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 972.256332] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 972.256345] RIP: 0033:0x412041 [ 972.256361] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 972.256372] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 972.270468] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 972.270493] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 972.270517] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 972.270527] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 17:20:49 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0xffffffffffffffce) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) ioctl$VIDIOC_PREPARE_BUF(r3, 0xc058565d, &(0x7f00000000c0)={0x7, 0x4, 0x4, 0x60e000, {0x0, 0x7530}, {0x7, 0x1, 0x9, 0x3, 0x7fffffff, 0x100, "39b0b919"}, 0x0, 0x3, @offset=0x401, 0x4}) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 972.270536] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 [ 972.277380] binder: 5256:5263 ioctl 40046207 0 returned -16 17:20:49 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x40000001, 0x0, 0x0, 0x0) 17:20:49 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="000000001d8e07f744286cabc4cab847d17af9688bd349dec70ea3970a9d0a4ac72370d106574718dcd571ba4c00f26fe6be0ee81e70adfd8f63052b797763b5622e0f1bbc5838a3a390237590b8d91c940de24611ed78940aea211c18defe609d7cfb2ad56b682bd199fafd22f3d19c601ac6"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:49 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f00000000c0)={'ip6_vti0\x00', {0x2, 0x4e24, @multicast2}}) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 972.606630] binder: BINDER_SET_CONTEXT_MGR already set [ 972.622441] binder: 5280:5282 ioctl 40046207 0 returned -16 17:20:49 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x408002) write$P9_RUNLINKAT(r1, &(0x7f0000000100)={0x7, 0x4d, 0x1}, 0x7) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000140)={0x7ff}, 0x4) syz_open_dev$rtc(&(0x7f0000000040)='/dev/rtc#\x00', 0x4cb8, 0x2000) 17:20:49 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) rseq(&(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x2, 0x4, 0x2, 0x3}, 0x6}, 0x20, 0x1, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200), &(0x7f0000000280)=0xbc10ece97b82569a) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 973.138313] binder: release 4712:4728 transaction 946 out, still active [ 973.155927] binder: undelivered TRANSACTION_COMPLETE 17:20:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0, 0x8}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 17:20:50 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x50000000, 0x0, 0x0, 0x0) 17:20:50 executing program 5 (fault-call:2 fault-nth:2): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:20:50 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0xda0]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:50 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(0xffffffffffffffff, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x400000007, 0x0, 0x0) [ 973.202073] binder: release 4576:4580 transaction 932 out, still active [ 973.251225] binder: undelivered TRANSACTION_COMPLETE [ 973.260219] binder: undelivered TRANSACTION_ERROR: 29201 [ 973.281701] binder: release 4542:4549 transaction 931 out, still active [ 973.304647] binder: undelivered TRANSACTION_COMPLETE [ 973.319227] binder: release 4507:4523 transaction 927 out, still active 17:20:50 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r4 = dup3(r0, r3, 0x80000) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r4, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x70, r5, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x4}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x8000}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7fff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_DEST={0x18, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x67ab}]}, 0x70}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 973.347528] binder: undelivered TRANSACTION_COMPLETE [ 973.353587] FAULT_INJECTION: forcing a failure. [ 973.353587] name failslab, interval 1, probability 0, space 0, times 0 [ 973.354153] binder: undelivered TRANSACTION_ERROR: 29201 [ 973.399718] CPU: 0 PID: 5316 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 973.406748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 973.412884] binder: release 4620:4625 transaction 936 out, still active [ 973.416103] Call Trace: [ 973.416160] dump_stack+0x1db/0x2d0 [ 973.416183] ? dump_stack_print_info.cold+0x20/0x20 [ 973.416217] should_fail.cold+0xa/0x15 [ 973.416242] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 973.443249] ? ___might_sleep+0x1e7/0x310 [ 973.446260] binder: undelivered TRANSACTION_COMPLETE [ 973.447404] ? arch_local_save_flags+0x50/0x50 [ 973.447420] ? mark_held_locks+0x100/0x100 [ 973.447435] ? print_usage_bug+0xd0/0xd0 [ 973.447454] __should_failslab+0x121/0x190 [ 973.455042] binder: undelivered TRANSACTION_ERROR: 29201 [ 973.457133] should_failslab+0x9/0x14 [ 973.457150] kmem_cache_alloc+0x2be/0x710 [ 973.457166] ? __lock_acquire+0x572/0x4a30 [ 973.474771] binder: release 4507:4516 transaction 925 out, still active [ 973.475145] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 973.475169] __alloc_file+0x93/0x480 [ 973.480189] binder: undelivered TRANSACTION_COMPLETE [ 973.483097] ? file_free_rcu+0xe0/0xe0 [ 973.483120] ? mark_held_locks+0x100/0x100 [ 973.503284] binder: undelivered TRANSACTION_ERROR: 29201 [ 973.503349] alloc_empty_file+0x72/0x170 [ 973.519458] binder: release 4595:4597 transaction 934 out, still active [ 973.521959] path_openat+0x112/0x5650 [ 973.521978] ? add_lock_to_list.isra.0+0x450/0x450 [ 973.522002] ? __alloc_fd+0x549/0x700 [ 973.541696] binder: undelivered TRANSACTION_COMPLETE [ 973.545288] ? find_held_lock+0x35/0x120 [ 973.545308] ? path_lookupat.isra.0+0xba0/0xba0 [ 973.545324] ? do_dup2+0x580/0x580 [ 973.545347] ? kasan_check_read+0x11/0x20 [ 973.545364] ? do_raw_spin_unlock+0xa0/0x330 [ 973.558607] binder: undelivered TRANSACTION_ERROR: 29201 [ 973.559192] ? do_raw_spin_trylock+0x270/0x270 [ 973.573518] binder: release 4375:4383 transaction 915 out, still active [ 973.576783] ? __phys_addr_symbol+0x30/0x70 [ 973.576810] do_filp_open+0x26f/0x370 [ 973.588483] binder: undelivered TRANSACTION_COMPLETE [ 973.592444] ? may_open_dev+0x100/0x100 [ 973.592461] ? exit_files+0xb0/0xb0 [ 973.592480] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 973.613954] binder: undelivered TRANSACTION_ERROR: 29201 [ 973.614479] ? digsig_verify.cold+0x32/0x32 [ 973.614501] ? get_unused_fd_flags+0x122/0x1a0 [ 973.628857] ? __alloc_fd+0x700/0x700 [ 973.632673] ? getname_flags+0x277/0x5b0 [ 973.633358] binder: undelivered TRANSACTION_ERROR: 29201 [ 973.636763] do_sys_open+0x59a/0x7c0 [ 973.636784] ? filp_open+0x80/0x80 [ 973.636807] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 973.636825] ? trace_hardirqs_off_caller+0x300/0x300 [ 973.650872] binder: undelivered TRANSACTION_ERROR: 29201 [ 973.654838] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 973.654859] __x64_sys_open+0x7e/0xc0 [ 973.654878] do_syscall_64+0x1a3/0x800 [ 973.654897] ? syscall_return_slowpath+0x5f0/0x5f0 [ 973.654915] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 973.687761] ? __switch_to_asm+0x34/0x70 [ 973.691847] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 973.696699] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 973.701891] RIP: 0033:0x412041 [ 973.705105] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 973.724009] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 973.731721] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 973.738991] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 973.746279] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 973.753557] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 973.760831] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 17:20:50 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x80000007, 0x0, 0x0, 0x0) [ 973.866227] binder: undelivered TRANSACTION_ERROR: 29201 17:20:50 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000040)={0x0, @empty, @multicast1}, &(0x7f00000000c0)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000100)={'team0\x00', r2}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r3, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, 0x0, 0x0) r5 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x1ff, 0x20000) stat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}}}, &(0x7f0000000440)=0xe8) lstat(&(0x7f0000000480)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000580)={{{@in=@empty, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@broadcast}}, &(0x7f0000000680)=0xe8) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='9p\x00', 0x0, &(0x7f00000006c0)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@cache_none='cache=none'}], [{@fowner_gt={'fowner>', r6}}, {@euid_gt={'euid>', r7}}, {@context={'context', 0x3d, 'system_u'}}, {@uid_lt={'uid<', r8}}, {@uid_gt={'uid>', r9}}]}}) 17:20:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0, 0x8000000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 17:20:51 executing program 5 (fault-call:2 fault-nth:3): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:20:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x80000008, 0x0, 0x0, 0x0) 17:20:51 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000180)={0x7, 0x10000, 0x84, &(0x7f0000000200)="0593bc5e5352df81a1eac32b9b3a7028635c3e58ea6d121427d1e3c9377c5a05507c52d8595c07dffa63ed480195150ae4868dd033b75eaed47c864f1aed746acc2e8ccc863c5988010e7a797b0720838d60075279c3505ec90975d9b261855a4ff0b636970e3848184b7b5a6b36669cfcc76cf5c33035f482e7076df7a0c29d40b32107"}) 17:20:51 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000900)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) bind$ax25(r3, &(0x7f0000000940)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast]}, 0x48) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000280)='/dev/btrfs-control\x00', 0x40003, 0x0) mq_timedsend(r4, &(0x7f0000000100)="0ffebd0d5766ca4690e81327b973be0e284d6d9056cc27e4588313ee4f60ec8e591c2004ae1792a6adaa3cb5235868576cce", 0x32, 0x9, &(0x7f0000000140)={0x0, 0x989680}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x400000, 0xa) ioctl$KDMKTONE(r5, 0x4b30, 0x0) [ 974.378719] FAULT_INJECTION: forcing a failure. [ 974.378719] name failslab, interval 1, probability 0, space 0, times 0 [ 974.402819] CPU: 1 PID: 5346 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 974.409857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 974.419252] Call Trace: [ 974.421857] dump_stack+0x1db/0x2d0 [ 974.425516] ? dump_stack_print_info.cold+0x20/0x20 [ 974.430569] should_fail.cold+0xa/0x15 [ 974.434474] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 974.434498] ? ___might_sleep+0x1e7/0x310 [ 974.434514] ? arch_local_save_flags+0x50/0x50 [ 974.434541] __should_failslab+0x121/0x190 [ 974.434559] should_failslab+0x9/0x14 [ 974.456428] kmem_cache_alloc_trace+0x2d1/0x760 [ 974.461106] ? __might_sleep+0x95/0x190 [ 974.465106] apparmor_file_alloc_security+0x172/0xad0 [ 974.470330] ? rcu_pm_notify+0xd0/0xd0 [ 974.474259] ? apparmor_path_rename+0xcb0/0xcb0 [ 974.478934] ? __alloc_file+0x93/0x480 [ 974.482822] ? __alloc_file+0x93/0x480 [ 974.486710] ? rcu_read_lock_sched_held+0x110/0x130 [ 974.491724] ? kmem_cache_alloc+0x341/0x710 [ 974.496052] security_file_alloc+0x69/0xb0 [ 974.500300] __alloc_file+0x128/0x480 [ 974.504101] ? file_free_rcu+0xe0/0xe0 [ 974.507996] ? mark_held_locks+0x100/0x100 [ 974.512244] alloc_empty_file+0x72/0x170 [ 974.516314] path_openat+0x112/0x5650 [ 974.520123] ? add_lock_to_list.isra.0+0x450/0x450 [ 974.525118] ? __alloc_fd+0x549/0x700 [ 974.528919] ? find_held_lock+0x35/0x120 [ 974.533034] ? path_lookupat.isra.0+0xba0/0xba0 [ 974.537725] ? do_dup2+0x580/0x580 [ 974.541270] ? kasan_check_read+0x11/0x20 [ 974.545431] ? do_raw_spin_unlock+0xa0/0x330 [ 974.549845] ? do_raw_spin_trylock+0x270/0x270 [ 974.554428] ? __phys_addr_symbol+0x30/0x70 [ 974.558793] do_filp_open+0x26f/0x370 [ 974.562613] ? may_open_dev+0x100/0x100 [ 974.566593] ? exit_files+0xb0/0xb0 [ 974.570243] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 974.575792] ? digsig_verify.cold+0x32/0x32 [ 974.580132] ? get_unused_fd_flags+0x122/0x1a0 [ 974.584731] ? __alloc_fd+0x700/0x700 [ 974.588538] ? getname_flags+0x277/0x5b0 [ 974.592615] do_sys_open+0x59a/0x7c0 [ 974.596337] ? filp_open+0x80/0x80 [ 974.599887] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 974.605257] ? trace_hardirqs_off_caller+0x300/0x300 [ 974.610362] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 974.615123] __x64_sys_open+0x7e/0xc0 [ 974.618925] do_syscall_64+0x1a3/0x800 [ 974.622813] ? syscall_return_slowpath+0x5f0/0x5f0 [ 974.627743] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 974.632761] ? __switch_to_asm+0x34/0x70 [ 974.636859] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 974.641717] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 974.646901] RIP: 0033:0x412041 [ 974.650100] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 974.669020] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 17:20:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x1100]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 974.676726] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 974.684005] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 974.691270] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 974.698565] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 974.705850] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 17:20:51 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000240)=[@in={0x2, 0x4e22, @local}, @in={0x2, 0x4e23, @empty}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, @in={0x2, 0x4e24, @broadcast}, @in6={0xa, 0x4e21, 0x1ff, @dev={0xfe, 0x80, [], 0x15}, 0x4}], 0x5c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r3, 0x0, 0x48f, &(0x7f0000000540)={0x0, @rand_addr, 0x0, 0x0, 'dh\x00'}, 0x2c) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x600, 0x0) syz_open_pts(r5, 0x8000) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f0000000100)={0x2, 0x4e22, @broadcast}, 0xffffffffffffff75) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_ivalue=0xf5}) setsockopt$inet_int(r4, 0x0, 0x400000007, 0x0, 0x0) 17:20:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x80000019, 0x0, 0x0, 0x0) [ 974.765859] device bridge_slave_1 left promiscuous mode [ 974.771385] bridge0: port 2(bridge_slave_1) entered disabled state [ 974.837452] device bridge_slave_0 left promiscuous mode [ 974.849415] bridge0: port 1(bridge_slave_0) entered disabled state 17:20:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0, 0x800000000000000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 17:20:51 executing program 5 (fault-call:2 fault-nth:4): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') [ 975.115598] device hsr_slave_1 left promiscuous mode [ 975.190502] device hsr_slave_0 left promiscuous mode [ 975.230955] team0 (unregistering): Port device team_slave_1 removed [ 975.250429] team0 (unregistering): Port device team_slave_0 removed [ 975.264230] FAULT_INJECTION: forcing a failure. [ 975.264230] name failslab, interval 1, probability 0, space 0, times 0 [ 975.278780] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 975.314597] CPU: 0 PID: 5369 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 975.321627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 975.330987] Call Trace: [ 975.333588] dump_stack+0x1db/0x2d0 [ 975.337233] ? dump_stack_print_info.cold+0x20/0x20 [ 975.342268] ? print_usage_bug+0xd0/0xd0 [ 975.346347] should_fail.cold+0xa/0x15 [ 975.350246] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 975.355366] ? ___might_sleep+0x1e7/0x310 [ 975.359523] ? arch_local_save_flags+0x50/0x50 [ 975.364129] __should_failslab+0x121/0x190 [ 975.368386] should_failslab+0x9/0x14 [ 975.372206] kmem_cache_alloc+0x2be/0x710 [ 975.376363] ? print_usage_bug+0xd0/0xd0 [ 975.380458] ? print_usage_bug+0xd0/0xd0 [ 975.384540] __d_alloc+0xae/0xbe0 [ 975.387999] ? __lock_acquire+0x572/0x4a30 [ 975.392239] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 975.397259] ? print_usage_bug+0xd0/0xd0 [ 975.401326] ? print_usage_bug+0xd0/0xd0 [ 975.405401] ? print_usage_bug+0xd0/0xd0 [ 975.409488] ? print_usage_bug+0xd0/0xd0 [ 975.413563] ? print_usage_bug+0xd0/0xd0 [ 975.417634] d_alloc+0x99/0x420 [ 975.420936] ? __d_alloc+0xbe0/0xbe0 [ 975.420958] ? __lock_acquire+0x572/0x4a30 [ 975.420972] ? __lock_acquire+0x572/0x4a30 [ 975.420999] d_alloc_parallel+0x11b/0x1f10 [ 975.428985] ? mark_held_locks+0x100/0x100 [ 975.429003] ? __d_lookup+0x560/0x960 [ 975.429018] ? find_held_lock+0x35/0x120 [ 975.429039] ? __d_lookup_rcu+0x990/0x990 [ 975.441719] ? lock_downgrade+0x910/0x910 [ 975.449574] ? kasan_check_read+0x11/0x20 [ 975.449597] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 975.457850] ? lockdep_init_map+0x10c/0x5b0 [ 975.457866] ? lockdep_init_map+0x10c/0x5b0 [ 975.457884] ? __init_waitqueue_head+0x92/0x150 [ 975.481415] ? init_wait_entry+0x1c0/0x1c0 [ 975.481430] ? __d_lookup+0x587/0x960 [ 975.481456] __lookup_slow+0x1fa/0x560 [ 975.493359] ? vfs_unlink+0x500/0x500 [ 975.497164] ? lock_release+0xc40/0xc40 [ 975.497198] ? __down_interruptible+0x740/0x740 [ 975.505802] ? trailing_symlink+0x970/0x970 [ 975.505816] ? find_held_lock+0x35/0x120 [ 975.505837] lookup_slow+0x58/0x80 [ 975.517726] walk_component+0x8e5/0x26a0 [ 975.521794] ? lock_downgrade+0x910/0x910 [ 975.525946] ? kasan_check_read+0x11/0x20 [ 975.525964] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 975.535371] ? path_init+0x1ef0/0x1ef0 [ 975.535387] ? scnprintf+0x140/0x140 [ 975.535404] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 975.535424] ? generic_permission+0x121/0x4f0 [ 975.548567] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 975.558581] ? security_inode_permission+0xd5/0x110 [ 975.558602] ? inode_permission+0xb4/0x570 [ 975.558623] link_path_walk.part.0+0xa57/0x1550 [ 975.572511] ? nd_jump_root+0x1ec/0x3e0 [ 975.576511] ? walk_component+0x26a0/0x26a0 [ 975.576534] ? __this_cpu_preempt_check+0x1d/0x30 [ 975.576551] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 975.585696] ? percpu_counter_add_batch+0x13c/0x190 [ 975.585724] path_openat+0x222/0x5650 [ 975.585744] ? add_lock_to_list.isra.0+0x450/0x450 [ 975.585769] ? __alloc_fd+0x549/0x700 [ 975.585784] ? find_held_lock+0x35/0x120 [ 975.596323] ? path_lookupat.isra.0+0xba0/0xba0 [ 975.596338] ? do_dup2+0x580/0x580 [ 975.596358] ? kasan_check_read+0x11/0x20 [ 975.605051] ? do_raw_spin_unlock+0xa0/0x330 [ 975.605077] ? do_raw_spin_trylock+0x270/0x270 [ 975.605099] ? __phys_addr_symbol+0x30/0x70 [ 975.612950] do_filp_open+0x26f/0x370 [ 975.621143] ? may_open_dev+0x100/0x100 [ 975.629700] ? simple_attr_release+0x50/0x50 [ 975.638558] ? digsig_verify.cold+0x32/0x32 [ 975.638575] ? get_unused_fd_flags+0x122/0x1a0 [ 975.638595] ? __alloc_fd+0x700/0x700 [ 975.646335] ? getname_flags+0x277/0x5b0 [ 975.646364] do_sys_open+0x59a/0x7c0 [ 975.646381] ? filp_open+0x80/0x80 [ 975.671237] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 975.680106] ? trace_hardirqs_off_caller+0x300/0x300 [ 975.685234] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 975.685268] __x64_sys_open+0x7e/0xc0 [ 975.685285] do_syscall_64+0x1a3/0x800 [ 975.693828] ? syscall_return_slowpath+0x5f0/0x5f0 [ 975.702607] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 975.707642] ? __switch_to_asm+0x34/0x70 [ 975.707663] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 975.707685] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 975.716619] RIP: 0033:0x412041 [ 975.716634] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 975.716643] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 975.725049] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 975.725065] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 17:20:52 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x1200]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 975.725074] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 975.725087] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 975.725099] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 [ 975.872800] bond0 (unregistering): Releasing backup interface bond_slave_0 17:20:52 executing program 5 (fault-call:2 fault-nth:5): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') [ 976.050755] bond0 (unregistering): Released all slaves [ 976.191747] FAULT_INJECTION: forcing a failure. [ 976.191747] name failslab, interval 1, probability 0, space 0, times 0 [ 976.211185] CPU: 0 PID: 5384 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 976.218686] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 976.228121] Call Trace: [ 976.230721] dump_stack+0x1db/0x2d0 [ 976.234365] ? dump_stack_print_info.cold+0x20/0x20 [ 976.239412] ? print_usage_bug+0xd0/0xd0 [ 976.243486] should_fail.cold+0xa/0x15 [ 976.247383] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 976.252495] ? ___might_sleep+0x1e7/0x310 [ 976.256643] ? arch_local_save_flags+0x50/0x50 [ 976.261230] __should_failslab+0x121/0x190 [ 976.265462] should_failslab+0x9/0x14 [ 976.269276] kmem_cache_alloc+0x2be/0x710 [ 976.273421] ? print_usage_bug+0xd0/0xd0 [ 976.277502] ? print_usage_bug+0xd0/0xd0 [ 976.281581] __d_alloc+0xae/0xbe0 [ 976.285035] ? __lock_acquire+0x572/0x4a30 [ 976.289300] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 976.294336] ? print_usage_bug+0xd0/0xd0 [ 976.298414] ? print_usage_bug+0xd0/0xd0 [ 976.302486] ? print_usage_bug+0xd0/0xd0 [ 976.306563] ? print_usage_bug+0xd0/0xd0 [ 976.310619] ? print_usage_bug+0xd0/0xd0 [ 976.314678] d_alloc+0x99/0x420 [ 976.317958] ? __d_alloc+0xbe0/0xbe0 [ 976.321670] ? __lock_acquire+0x572/0x4a30 [ 976.325901] ? __lock_acquire+0x572/0x4a30 [ 976.330187] d_alloc_parallel+0x11b/0x1f10 [ 976.334439] ? mark_held_locks+0x100/0x100 [ 976.338691] ? __d_lookup+0x560/0x960 [ 976.342495] ? find_held_lock+0x35/0x120 [ 976.346564] ? __d_lookup_rcu+0x990/0x990 [ 976.351143] ? lock_downgrade+0x910/0x910 [ 976.355303] ? kasan_check_read+0x11/0x20 [ 976.359469] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 976.364742] ? lockdep_init_map+0x10c/0x5b0 [ 976.369074] ? lockdep_init_map+0x10c/0x5b0 [ 976.373407] ? __init_waitqueue_head+0x92/0x150 [ 976.378128] ? init_wait_entry+0x1c0/0x1c0 [ 976.382365] ? __d_lookup+0x587/0x960 [ 976.386174] __lookup_slow+0x1fa/0x560 [ 976.390098] ? vfs_unlink+0x500/0x500 [ 976.393911] ? lock_release+0xc40/0xc40 [ 976.397902] ? __down_interruptible+0x740/0x740 [ 976.402567] ? trailing_symlink+0x970/0x970 [ 976.406918] ? find_held_lock+0x35/0x120 [ 976.411037] lookup_slow+0x58/0x80 [ 976.414633] walk_component+0x8e5/0x26a0 [ 976.418717] ? lock_downgrade+0x910/0x910 [ 976.422860] ? kasan_check_read+0x11/0x20 [ 976.427003] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 976.432287] ? path_init+0x1ef0/0x1ef0 [ 976.436176] ? scnprintf+0x140/0x140 [ 976.439886] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 976.445439] ? generic_permission+0x121/0x4f0 [ 976.449950] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 976.455575] ? security_inode_permission+0xd5/0x110 [ 976.460614] ? inode_permission+0xb4/0x570 [ 976.464853] link_path_walk.part.0+0xa57/0x1550 [ 976.469527] ? nd_jump_root+0x1ec/0x3e0 [ 976.473516] ? walk_component+0x26a0/0x26a0 [ 976.477853] ? __this_cpu_preempt_check+0x1d/0x30 [ 976.482697] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 976.488260] ? percpu_counter_add_batch+0x13c/0x190 [ 976.493299] path_openat+0x222/0x5650 [ 976.497118] ? add_lock_to_list.isra.0+0x450/0x450 [ 976.502054] ? __alloc_fd+0x549/0x700 [ 976.505900] ? find_held_lock+0x35/0x120 [ 976.509965] ? path_lookupat.isra.0+0xba0/0xba0 [ 976.514655] ? do_dup2+0x580/0x580 [ 976.518202] ? kasan_check_read+0x11/0x20 [ 976.522355] ? do_raw_spin_unlock+0xa0/0x330 [ 976.526783] ? do_raw_spin_trylock+0x270/0x270 [ 976.531367] ? __phys_addr_symbol+0x30/0x70 [ 976.535716] do_filp_open+0x26f/0x370 [ 976.539527] ? may_open_dev+0x100/0x100 [ 976.543513] ? simple_attr_release+0x50/0x50 [ 976.547922] ? digsig_verify.cold+0x32/0x32 [ 976.552246] ? get_unused_fd_flags+0x122/0x1a0 [ 976.556862] ? __alloc_fd+0x700/0x700 [ 976.560678] ? getname_flags+0x277/0x5b0 [ 976.564747] do_sys_open+0x59a/0x7c0 [ 976.568463] ? filp_open+0x80/0x80 [ 976.572015] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 976.577405] ? trace_hardirqs_off_caller+0x300/0x300 [ 976.582506] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 976.587268] __x64_sys_open+0x7e/0xc0 [ 976.591091] do_syscall_64+0x1a3/0x800 [ 976.594992] ? syscall_return_slowpath+0x5f0/0x5f0 [ 976.599922] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 976.604936] ? __switch_to_asm+0x34/0x70 [ 976.609006] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 976.613858] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 976.619086] RIP: 0033:0x412041 [ 976.622282] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 976.641179] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 976.648886] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 976.656154] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 976.663421] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 976.670702] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 976.677969] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 17:20:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x8000001a, 0x0, 0x0, 0x0) [ 976.717623] IPVS: ftp: loaded support on port[0] = 21 17:20:53 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_names='vcan0\x00'}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0, 0x0, 0x8}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 977.159010] chnl_net:caif_netlink_parms(): no params data found [ 977.241420] bridge0: port 1(bridge_slave_0) entered blocking state [ 977.254330] bridge0: port 1(bridge_slave_0) entered disabled state [ 977.263450] device bridge_slave_0 entered promiscuous mode [ 977.278274] bridge0: port 2(bridge_slave_1) entered blocking state [ 977.290090] bridge0: port 2(bridge_slave_1) entered disabled state [ 977.300359] device bridge_slave_1 entered promiscuous mode [ 977.331459] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 977.343440] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 977.369242] team0: Port device team_slave_0 added [ 977.376549] team0: Port device team_slave_1 added [ 977.487649] device hsr_slave_0 entered promiscuous mode [ 977.534803] device hsr_slave_1 entered promiscuous mode [ 977.589567] bridge0: port 2(bridge_slave_1) entered blocking state [ 977.595998] bridge0: port 2(bridge_slave_1) entered forwarding state [ 977.602643] bridge0: port 1(bridge_slave_0) entered blocking state [ 977.609103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 977.697821] bridge0: port 1(bridge_slave_0) entered disabled state [ 977.710951] bridge0: port 2(bridge_slave_1) entered disabled state [ 977.752793] 8021q: adding VLAN 0 to HW filter on device bond0 [ 977.771805] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 977.787097] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 977.797303] 8021q: adding VLAN 0 to HW filter on device team0 [ 977.806720] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 977.815512] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 977.823234] bridge0: port 1(bridge_slave_0) entered blocking state [ 977.829663] bridge0: port 1(bridge_slave_0) entered forwarding state [ 977.846463] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 977.854861] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 977.862530] bridge0: port 2(bridge_slave_1) entered blocking state [ 977.868939] bridge0: port 2(bridge_slave_1) entered forwarding state [ 977.876544] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 977.884905] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 977.906302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 977.914364] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 977.922607] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 977.937505] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 977.949916] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 977.960104] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 977.972667] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 977.982837] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 977.998626] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 978.010481] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 978.047547] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 978.127978] binder: BINDER_SET_CONTEXT_MGR already set [ 978.133316] binder: 5409:5410 ioctl 40046207 0 returned -16 [ 978.140157] binder: 5409:5411 got reply transaction with bad transaction stack, transaction 990 has target 26829:0 [ 978.150730] binder: 5409:5411 transaction failed 29201/-71, size 0-0 line 2816 [ 978.152603] binder_alloc: binder_alloc_mmap_handler: 5409 20001000-20004000 already mapped failed -16 [ 978.170976] binder: BINDER_SET_CONTEXT_MGR already set [ 978.175697] binder: 5409:5414 got reply transaction with no transaction stack [ 978.180962] binder: 5409:5410 ioctl 40046207 0 returned -16 [ 978.183550] binder: 5409:5414 transaction failed 29201/-71, size 0-0 line 2801 [ 978.189659] binder_thread_release: 4 callbacks suppressed [ 978.189669] binder: release 5409:5411 transaction 990 out, still active [ 978.209426] binder_release_work: 4 callbacks suppressed [ 978.209431] binder: undelivered TRANSACTION_COMPLETE 17:20:55 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0xfffffffffffffe96, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0c6302003598b738083618b540eb89a9ba45a41f7efe3d16bbfcf63cbfeeee681c7914595dfcc33d5c43ec47272045e22c1eaed93bd74a790f5acc274e8f7d69ea0d9f8f8c33a4175f221816eeaaeef1e79facc26166ea3bcdfd4a4e3250c27affe09316391475b6765c0606c4a81ce51a82e0d3c59f067d7084f73f25237d3817f52ff7c90d0efd02257f120b01eb89c1b084275f8f1e424ccefecaf56ff3c837f89dfa6b2edab278b1d5abe53e33d0214c65ac9f504781dc8cb3c41dc9234c"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01765e40"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000380)) socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:55 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000500)='/dev/null\x00', 0x10000, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000540)='/dev/vcs#\x00', 0x4800000, 0x2002) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f00000005c0)='cgroup.threads\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x40043311, 0x0) ioctl$VHOST_GET_FEATURES(r1, 0x8008af00, &(0x7f0000000580)) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) getsockopt$ARPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x63, &(0x7f0000000340)={'NETMAP\x00'}, &(0x7f0000000380)=0x1e) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x40000, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000000c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="060800000100"], &(0x7f0000000100)=0xa) getsockopt$inet_sctp6_SCTP_MAXSEG(r5, 0x84, 0xd, &(0x7f0000000140)=@assoc_id=r6, &(0x7f00000001c0)=0x4) lsetxattr$trusted_overlay_opaque(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='trusted.overlay.opaque\x00', &(0x7f0000000480)='y\x00', 0x2, 0x1) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000240)={r6, @in={{0x2, 0x4e23, @multicast1}}, 0x10000, 0x6, 0x1, 0x7, 0x39}, &(0x7f0000000300)=0x98) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) openat$random(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/urandom\x00', 0x0, 0x0) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) 17:20:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x1b00]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:55 executing program 5 (fault-call:2 fault-nth:6): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:20:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x8000001d, 0x0, 0x0, 0x0) 17:20:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0, 0x0, 0x8000000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 978.224763] binder_release_work: 1 callbacks suppressed [ 978.224770] binder: undelivered TRANSACTION_ERROR: 29201 [ 978.288204] binder: release 5409:5412 transaction 992 out, still active [ 978.306632] binder: undelivered TRANSACTION_COMPLETE [ 978.324341] binder: undelivered TRANSACTION_ERROR: 29201 [ 978.331430] FAULT_INJECTION: forcing a failure. [ 978.331430] name failslab, interval 1, probability 0, space 0, times 0 [ 978.331449] CPU: 0 PID: 5427 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 978.331460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 978.331466] Call Trace: [ 978.331490] dump_stack+0x1db/0x2d0 [ 978.331527] ? dump_stack_print_info.cold+0x20/0x20 [ 978.331543] ? add_lock_to_list.isra.0+0x450/0x450 [ 978.331573] should_fail.cold+0xa/0x15 [ 978.331595] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 978.331619] ? ___might_sleep+0x1e7/0x310 [ 978.331645] ? arch_local_save_flags+0x50/0x50 [ 978.331663] ? kasan_check_read+0x11/0x20 [ 978.331681] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 978.331705] __should_failslab+0x121/0x190 [ 978.331724] should_failslab+0x9/0x14 [ 978.331740] kmem_cache_alloc+0x2be/0x710 [ 978.331759] ? check_preemption_disabled+0x48/0x290 [ 978.331781] ? get_pid_task+0xd4/0x190 [ 978.331801] ? proc_i_callback+0x30/0x30 [ 978.331818] proc_alloc_inode+0x1c/0x1a0 [ 978.331836] alloc_inode+0x66/0x190 [ 978.331866] new_inode_pseudo+0x71/0x1b0 [ 978.331881] ? prune_icache_sb+0x1c0/0x1c0 [ 978.331897] ? lock_downgrade+0x910/0x910 [ 978.331912] ? kasan_check_read+0x11/0x20 [ 978.331929] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 978.331949] new_inode+0x1f/0x40 [ 978.332042] proc_pid_make_inode+0x22/0x230 [ 978.332112] proc_pident_instantiate+0x82/0x2a0 [ 978.332136] proc_pident_lookup+0x1c4/0x230 [ 978.332152] ? init_wait_entry+0x1c0/0x1c0 [ 978.332167] ? __d_lookup+0x587/0x960 [ 978.332189] proc_tgid_base_lookup+0x2a/0x30 [ 978.332207] __lookup_slow+0x2cd/0x560 [ 978.332226] ? vfs_unlink+0x500/0x500 [ 978.332240] ? lock_release+0xc40/0xc40 [ 978.332273] ? __down_interruptible+0x740/0x740 [ 978.332293] ? trailing_symlink+0x970/0x970 [ 978.332321] ? find_held_lock+0x35/0x120 [ 978.332344] lookup_slow+0x58/0x80 [ 978.332366] walk_component+0x8e5/0x26a0 [ 978.332383] ? lock_downgrade+0x910/0x910 [ 978.332399] ? kasan_check_read+0x11/0x20 [ 978.332416] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 978.332439] ? path_init+0x1ef0/0x1ef0 [ 978.332454] ? scnprintf+0x140/0x140 [ 978.332472] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 978.332489] ? generic_permission+0x121/0x4f0 [ 978.332508] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 978.332526] ? security_inode_permission+0xd5/0x110 [ 978.332545] ? inode_permission+0xb4/0x570 [ 978.332566] link_path_walk.part.0+0xa57/0x1550 [ 978.332581] ? nd_jump_root+0x1ec/0x3e0 [ 978.332619] ? walk_component+0x26a0/0x26a0 [ 978.332641] ? __this_cpu_preempt_check+0x1d/0x30 [ 978.332657] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 978.332673] ? percpu_counter_add_batch+0x13c/0x190 [ 978.332704] path_openat+0x222/0x5650 [ 978.332723] ? add_lock_to_list.isra.0+0x450/0x450 [ 978.332749] ? __alloc_fd+0x549/0x700 [ 978.332766] ? find_held_lock+0x35/0x120 [ 978.332784] ? path_lookupat.isra.0+0xba0/0xba0 [ 978.332800] ? do_dup2+0x580/0x580 [ 978.332823] ? kasan_check_read+0x11/0x20 [ 978.332839] ? do_raw_spin_unlock+0xa0/0x330 [ 978.332856] ? do_raw_spin_trylock+0x270/0x270 [ 978.332874] ? __phys_addr_symbol+0x30/0x70 [ 978.332903] do_filp_open+0x26f/0x370 [ 978.332920] ? may_open_dev+0x100/0x100 [ 978.332948] ? simple_attr_release+0x50/0x50 [ 978.332968] ? digsig_verify.cold+0x32/0x32 [ 978.332990] ? get_unused_fd_flags+0x122/0x1a0 [ 978.333007] ? __alloc_fd+0x700/0x700 [ 978.333022] ? getname_flags+0x277/0x5b0 [ 978.333044] do_sys_open+0x59a/0x7c0 [ 978.333075] ? filp_open+0x80/0x80 [ 978.333104] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 978.333123] ? trace_hardirqs_off_caller+0x300/0x300 [ 978.333143] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 978.333164] __x64_sys_open+0x7e/0xc0 [ 978.333184] do_syscall_64+0x1a3/0x800 [ 978.333204] ? syscall_return_slowpath+0x5f0/0x5f0 [ 978.333224] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 978.333238] ? __switch_to_asm+0x34/0x70 [ 978.333259] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 978.333285] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 978.333298] RIP: 0033:0x412041 [ 978.333313] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 978.333322] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 978.333338] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 978.333349] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 978.333360] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 978.333370] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 978.333380] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 [ 978.407130] binder: BINDER_SET_CONTEXT_MGR already set [ 978.624372] binder: 5428:5440 unknown command 156428 [ 978.651688] binder: 5428:5431 ioctl 40046207 0 returned -16 [ 978.732014] binder: 5428:5439 unknown command 1079932417 [ 978.754101] binder: 5428:5439 ioctl c0306201 20000000 returned -22 [ 978.788730] binder: 5428:5440 ioctl c0306201 20000140 returned -22 [ 978.876274] binder_alloc: binder_alloc_mmap_handler: 5428 20001000-20004000 already mapped failed -16 [ 978.908824] binder: BINDER_SET_CONTEXT_MGR already set [ 978.914753] binder: 5428:5431 ioctl 40046207 0 returned -16 17:20:55 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = fcntl$dupfd(r0, 0x0, r0) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000140)={r3, &(0x7f00000000c0)="45ede0e797413ebada584d79d6a36270f766e81c470fc7ac1a937bdc3c2deb931ba3ecb37850380a451c1415f6365ea6e5396210f18c2c4992a12679d52e745f44d708b2e3552b500fcb5702b893b6c31f65c9dd9234da5be0f68809b4a702461279e431ad3463", &(0x7f0000000040)=""/23}, 0x18) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, 0x0, 0x0) 17:20:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xc0000000, 0x0, 0x0, 0x0) [ 978.946494] binder: 5428:5440 unknown command 1079932417 [ 978.958273] binder: 5428:5440 ioctl c0306201 20000000 returned -22 [ 978.987437] binder: 5428:5439 unknown command 156428 [ 979.022718] binder: 5428:5439 ioctl c0306201 20000140 returned -22 [ 979.026542] binder: release 5428:5439 transaction 994 out, still active [ 979.054833] binder: undelivered TRANSACTION_COMPLETE 17:20:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x1e01]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 979.098821] binder: release 5428:5439 transaction 995 out, still active 17:20:55 executing program 5 (fault-call:2 fault-nth:7): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:20:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0, 0x0, 0x800000000000000}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 979.140571] binder: undelivered TRANSACTION_COMPLETE 17:20:56 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000240)='/dev/snd/pcmC#D#p\x00', 0x3b96, 0x280200) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x800) getsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000380)=0x1, &(0x7f00000003c0)=0x4) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) r3 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x6, 0x400000) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000200)={0x20, 0x0, 0x10001, 0x324}) ioctl$DRM_IOCTL_SG_ALLOC(r3, 0xc0106438, &(0x7f00000002c0)={0x7, r4}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r5 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r6 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000280)='/dev/video37\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:56 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = fcntl$dupfd(r1, 0x406, r1) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r5, 0x0, 0x70bd2d, 0x25dfdbfe, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x9}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0xdf50ef0181e4f026}, 0x4000001) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000440)='/dev/hwrng\x00', 0x800, 0x0) stat(&(0x7f0000000480)='\x00', &(0x7f0000002500)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000400)=0x3) fanotify_mark(r4, 0x0, 0x20, r4, &(0x7f0000000280)='./file0\x00') ioctl$SIOCAX25DELUID(r6, 0x89e2, &(0x7f0000002580)={0x3, @default, r7}) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) ioctl$CAPI_GET_SERIAL(r4, 0xc0044308, &(0x7f0000000240)=0x5) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) ioctl$VHOST_SET_OWNER(r6, 0xaf01, 0x0) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0xfffffffffffffed8) setxattr$security_capability(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='security.capability\x00', &(0x7f0000000340)=@v1={0x1000000, [{0x2, 0x1}]}, 0xc, 0x1) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) getpeername$tipc(r4, &(0x7f0000000380), &(0x7f00000003c0)=0x10) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) 17:20:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xc0000001, 0x0, 0x0, 0x0) [ 979.315426] binder: BINDER_SET_CONTEXT_MGR already set [ 979.359880] FAULT_INJECTION: forcing a failure. [ 979.359880] name failslab, interval 1, probability 0, space 0, times 0 [ 979.389788] binder: 5461:5462 ioctl 40046207 0 returned -16 [ 979.390626] binder: 5461:5473 got reply transaction with bad transaction stack, transaction 996 has target 26829:0 [ 979.421833] CPU: 1 PID: 5471 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 979.428858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 979.428870] Call Trace: [ 979.428893] dump_stack+0x1db/0x2d0 [ 979.428917] ? dump_stack_print_info.cold+0x20/0x20 [ 979.428934] ? print_usage_bug+0xd0/0xd0 [ 979.428955] ? d_splice_alias+0x75b/0x1100 [ 979.428990] should_fail.cold+0xa/0x15 [ 979.439545] binder: 5461:5473 transaction failed 29201/-71, size 0-0 line 2816 [ 979.440960] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 979.440984] ? ___might_sleep+0x1e7/0x310 [ 979.441001] ? arch_local_save_flags+0x50/0x50 [ 979.441026] __should_failslab+0x121/0x190 [ 979.441048] should_failslab+0x9/0x14 [ 979.449694] kmem_cache_alloc+0x2be/0x710 [ 979.449710] ? print_usage_bug+0xd0/0xd0 [ 979.449734] __d_alloc+0xae/0xbe0 [ 979.449750] ? check_noncircular+0x20/0x20 [ 979.449768] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 979.511894] ? __lock_acquire+0x572/0x4a30 [ 979.516130] ? add_lock_to_list.isra.0+0x450/0x450 [ 979.521072] ? mark_held_locks+0x100/0x100 [ 979.525317] ? __d_lookup+0x560/0x960 [ 979.529125] d_alloc+0x99/0x420 [ 979.532404] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 979.537960] ? __d_alloc+0xbe0/0xbe0 [ 979.541675] ? lock_downgrade+0x910/0x910 [ 979.545819] ? kasan_check_read+0x11/0x20 [ 979.549969] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 979.555285] d_alloc_parallel+0x11b/0x1f10 [ 979.559533] ? d_lookup+0x163/0x360 [ 979.563168] ? __d_lookup_rcu+0x990/0x990 [ 979.567320] ? trace_hardirqs_on+0xbd/0x310 [ 979.571641] ? lookup_open+0x314/0x1b80 [ 979.575618] ? trace_hardirqs_off_caller+0x300/0x300 [ 979.580722] ? lock_downgrade+0x910/0x910 [ 979.584870] ? kasan_check_read+0x11/0x20 [ 979.589025] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 979.594049] ? d_lookup+0x23c/0x360 [ 979.597687] ? __d_lookup+0x960/0x960 [ 979.601497] lookup_open+0x57c/0x1b80 [ 979.605308] ? vfs_link+0xb60/0xb60 [ 979.608935] ? lock_release+0xc40/0xc40 [ 979.612926] ? __down_interruptible+0x740/0x740 [ 979.617614] path_openat+0x25fd/0x5650 [ 979.621506] ? add_lock_to_list.isra.0+0x450/0x450 [ 979.626494] ? path_lookupat.isra.0+0xba0/0xba0 [ 979.631167] ? do_dup2+0x580/0x580 [ 979.634714] ? kasan_check_read+0x11/0x20 [ 979.638860] ? do_raw_spin_unlock+0xa0/0x330 [ 979.643267] ? do_raw_spin_trylock+0x270/0x270 [ 979.647864] ? __phys_addr_symbol+0x30/0x70 [ 979.652193] do_filp_open+0x26f/0x370 [ 979.655990] ? may_open_dev+0x100/0x100 [ 979.659974] ? simple_attr_release+0x50/0x50 [ 979.664385] ? digsig_verify.cold+0x32/0x32 [ 979.668710] ? get_unused_fd_flags+0x122/0x1a0 [ 979.673292] ? __alloc_fd+0x700/0x700 [ 979.677107] ? getname_flags+0x277/0x5b0 [ 979.681176] do_sys_open+0x59a/0x7c0 [ 979.684894] ? filp_open+0x80/0x80 [ 979.688435] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 979.693811] ? trace_hardirqs_off_caller+0x300/0x300 [ 979.698912] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 979.703670] __x64_sys_open+0x7e/0xc0 [ 979.707471] do_syscall_64+0x1a3/0x800 [ 979.711359] ? syscall_return_slowpath+0x5f0/0x5f0 [ 979.716288] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 979.721302] ? __switch_to_asm+0x34/0x70 [ 979.725372] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 979.730241] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 979.735426] RIP: 0033:0x412041 [ 979.738621] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 979.757526] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 979.765239] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 979.772501] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 979.779767] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 979.787034] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 979.794320] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 17:20:56 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) recvfrom$unix(r0, &(0x7f00000000c0)=""/177, 0xb1, 0x40000100, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e23}, 0x6e) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x806, &(0x7f00000001c0)=0x36, 0x141) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 979.846317] binder: BINDER_SET_CONTEXT_MGR already set [ 979.877853] binder: 5461:5475 ioctl 40046207 0 returned -16 [ 979.884832] binder: 5461:5473 got reply transaction with no transaction stack [ 979.921667] binder: release 5461:5473 transaction 996 out, still active [ 979.933319] binder: undelivered TRANSACTION_COMPLETE [ 979.939217] binder: 5461:5473 transaction failed 29201/-71, size 0-0 line 2801 [ 979.962556] binder: undelivered TRANSACTION_ERROR: 29201 [ 979.988818] binder: release 5461:5462 transaction 998 out, still active 17:20:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xf6ffffff, 0x0, 0x0, 0x0) [ 980.026187] binder: undelivered TRANSACTION_COMPLETE 17:20:56 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x2, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 980.065943] binder: undelivered TRANSACTION_ERROR: 29201 17:20:57 executing program 5 (fault-call:2 fault-nth:8): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') [ 980.212118] binder: BINDER_SET_CONTEXT_MGR already set [ 980.246118] binder: 5489:5493 got reply transaction with bad transaction stack, transaction 1000 has target 26829:0 [ 980.299293] binder: 5489:5491 ioctl 40046207 0 returned -16 [ 980.329641] binder: 5489:5493 transaction failed 29201/-71, size 0-0 line 2816 17:20:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xfcfdffff, 0x0, 0x0, 0x0) [ 980.379758] binder_alloc: binder_alloc_mmap_handler: 5489 20001000-20004000 already mapped failed -16 [ 980.421084] binder: BINDER_SET_CONTEXT_MGR already set [ 980.426271] FAULT_INJECTION: forcing a failure. [ 980.426271] name failslab, interval 1, probability 0, space 0, times 0 [ 980.437701] binder: 5489:5491 ioctl 40046207 0 returned -16 [ 980.461471] CPU: 0 PID: 5501 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 980.468502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 980.477855] Call Trace: [ 980.480464] dump_stack+0x1db/0x2d0 [ 980.484118] ? dump_stack_print_info.cold+0x20/0x20 [ 980.489149] ? __lock_is_held+0xb6/0x140 [ 980.493226] should_fail.cold+0xa/0x15 [ 980.497130] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 980.502249] ? ___might_sleep+0x1e7/0x310 [ 980.502267] ? arch_local_save_flags+0x50/0x50 [ 980.502295] __should_failslab+0x121/0x190 [ 980.502314] should_failslab+0x9/0x14 [ 980.502331] kmem_cache_alloc+0x2be/0x710 [ 980.502348] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 980.502378] ? put_files_struct+0x98/0x3e0 [ 980.502393] ? lock_downgrade+0x910/0x910 [ 980.502409] ? kasan_check_read+0x11/0x20 [ 980.511116] ? proc_i_callback+0x30/0x30 [ 980.511134] proc_alloc_inode+0x1c/0x1a0 [ 980.511152] alloc_inode+0x66/0x190 [ 980.511168] new_inode_pseudo+0x71/0x1b0 [ 980.511198] ? prune_icache_sb+0x1c0/0x1c0 [ 980.511215] ? tid_fd_mode+0x349/0x550 [ 980.518762] binder: 5489:5500 got reply transaction with no transaction stack [ 980.519240] new_inode+0x1f/0x40 [ 980.519256] proc_pid_make_inode+0x22/0x230 [ 980.519274] proc_fd_instantiate+0x58/0x1f0 [ 980.523508] binder: 5489:5500 transaction failed 29201/-71, size 0-0 line 2801 [ 980.528964] proc_lookupfd_common+0x178/0x230 [ 980.528978] ? tid_fd_update_inode+0xf0/0xf0 [ 980.528996] ? tid_fd_revalidate+0x2c0/0x2c0 [ 980.529013] ? __d_lookup+0x960/0x960 [ 980.529036] proc_lookupfd+0x25/0x30 [ 980.535970] binder: release 5489:5493 transaction 1000 out, still active [ 980.537426] ? proc_lookupfd_common+0x230/0x230 [ 980.537443] lookup_open+0x726/0x1b80 [ 980.537470] ? vfs_link+0xb60/0xb60 [ 980.537483] ? lock_release+0xc40/0xc40 [ 980.537515] ? __down_interruptible+0x740/0x740 [ 980.541655] binder: undelivered TRANSACTION_COMPLETE [ 980.545720] path_openat+0x25fd/0x5650 [ 980.545743] ? add_lock_to_list.isra.0+0x450/0x450 [ 980.561267] binder: undelivered TRANSACTION_ERROR: 29201 [ 980.561714] ? path_lookupat.isra.0+0xba0/0xba0 [ 980.571335] binder: undelivered TRANSACTION_ERROR: 29201 [ 980.572834] ? do_dup2+0x580/0x580 [ 980.572861] ? kasan_check_read+0x11/0x20 [ 980.572879] ? do_raw_spin_unlock+0xa0/0x330 [ 980.572895] ? do_raw_spin_trylock+0x270/0x270 [ 980.580398] binder: release 5489:5506 transaction 1002 out, still active [ 980.580578] ? __phys_addr_symbol+0x30/0x70 [ 980.591198] binder: undelivered TRANSACTION_COMPLETE [ 980.592270] do_filp_open+0x26f/0x370 [ 980.592288] ? may_open_dev+0x100/0x100 [ 980.592319] ? simple_attr_release+0x50/0x50 [ 980.613109] ? digsig_verify.cold+0x32/0x32 [ 980.613133] ? get_unused_fd_flags+0x122/0x1a0 [ 980.613149] ? __alloc_fd+0x700/0x700 [ 980.613176] ? getname_flags+0x277/0x5b0 [ 980.645839] do_sys_open+0x59a/0x7c0 [ 980.645860] ? filp_open+0x80/0x80 [ 980.645882] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 980.645899] ? trace_hardirqs_off_caller+0x300/0x300 [ 980.670238] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 980.670261] __x64_sys_open+0x7e/0xc0 [ 980.670280] do_syscall_64+0x1a3/0x800 [ 980.670300] ? syscall_return_slowpath+0x5f0/0x5f0 [ 980.767874] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 980.767892] ? __switch_to_asm+0x34/0x70 [ 980.767913] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 980.767938] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 980.767951] RIP: 0033:0x412041 [ 980.767967] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 980.767976] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 980.767991] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 980.768000] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 980.768009] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 980.768018] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 980.768027] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 17:20:57 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x3400]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:57 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_G_AUDOUT(r2, 0x80345631, &(0x7f0000000180)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:57 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0x7, &(0x7f00000000c0)=0xdd4, 0x4) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e24, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x0, 0x0) ioctl$SIOCX25GSUBSCRIP(r3, 0x89e0, &(0x7f0000000240)={'veth0_to_bond\x00', 0x9, 0x8}) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0) 17:20:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0xf, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 981.079764] binder: 5519:5521 ioctl 80345631 20000180 returned -22 17:20:57 executing program 5 (fault-call:2 fault-nth:9): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') [ 981.122955] binder: BINDER_SET_CONTEXT_MGR already set [ 981.147741] binder: 5519:5524 ioctl 40046207 0 returned -16 17:20:58 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x80001f, 0x0, 0x0) [ 981.210660] binder: 5519:5521 got reply transaction with bad transaction stack, transaction 1004 has target 26829:0 [ 981.283571] binder: 5519:5521 transaction failed 29201/-71, size 0-0 line 2816 17:20:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xff600000, 0x0, 0x0, 0x0) [ 981.337233] binder: 5519:5544 ioctl 80345631 20000180 returned -22 [ 981.339042] FAULT_INJECTION: forcing a failure. [ 981.339042] name failslab, interval 1, probability 0, space 0, times 0 [ 981.345626] CPU: 0 PID: 5541 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 981.364144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 981.364150] Call Trace: [ 981.364173] dump_stack+0x1db/0x2d0 [ 981.364194] ? dump_stack_print_info.cold+0x20/0x20 [ 981.364216] ? add_lock_to_list.isra.0+0x450/0x450 [ 981.389686] ? mntput_no_expire+0x197/0xbd0 [ 981.394020] should_fail.cold+0xa/0x15 [ 981.397916] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 981.403035] ? ___might_sleep+0x1e7/0x310 [ 981.407206] ? arch_local_save_flags+0x50/0x50 [ 981.411801] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 981.417360] __should_failslab+0x121/0x190 [ 981.421609] should_failslab+0x9/0x14 [ 981.425424] kmem_cache_alloc_trace+0x2d1/0x760 [ 981.425963] binder: BINDER_SET_CONTEXT_MGR already set [ 981.430120] ? may_umount_tree+0x1d0/0x1d0 [ 981.430144] smaps_rollup_open+0x4d/0x160 [ 981.430163] do_dentry_open+0x48a/0x1210 [ 981.430182] ? gather_stats+0x1660/0x1660 [ 981.430203] ? chown_common+0x740/0x740 [ 981.456018] ? security_inode_permission+0xd5/0x110 [ 981.461083] ? inode_permission+0xb4/0x570 [ 981.465334] vfs_open+0xa0/0xd0 [ 981.468626] path_openat+0x144f/0x5650 [ 981.472517] ? add_lock_to_list.isra.0+0x450/0x450 [ 981.477465] ? path_lookupat.isra.0+0xba0/0xba0 [ 981.482139] ? do_dup2+0x580/0x580 [ 981.485704] ? kasan_check_read+0x11/0x20 [ 981.489865] ? do_raw_spin_unlock+0xa0/0x330 [ 981.494284] ? do_raw_spin_trylock+0x270/0x270 [ 981.498867] ? __phys_addr_symbol+0x30/0x70 [ 981.503196] do_filp_open+0x26f/0x370 [ 981.507028] ? may_open_dev+0x100/0x100 [ 981.511065] ? digsig_verify.cold+0x32/0x32 [ 981.515417] ? get_unused_fd_flags+0x122/0x1a0 [ 981.519996] ? __alloc_fd+0x700/0x700 [ 981.523800] ? getname_flags+0x277/0x5b0 [ 981.527866] do_sys_open+0x59a/0x7c0 [ 981.531580] ? filp_open+0x80/0x80 [ 981.535130] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 981.540495] ? trace_hardirqs_off_caller+0x300/0x300 [ 981.545601] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 981.550364] __x64_sys_open+0x7e/0xc0 [ 981.554181] do_syscall_64+0x1a3/0x800 [ 981.558100] ? syscall_return_slowpath+0x5f0/0x5f0 [ 981.563079] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 981.568140] ? __switch_to_asm+0x34/0x70 [ 981.572226] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 981.577106] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 981.582316] RIP: 0033:0x412041 [ 981.585523] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 981.604437] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 981.612163] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 981.619438] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 981.626709] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f 17:20:58 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) getsockname$inet(r1, &(0x7f0000000040)={0x2, 0x0, @broadcast}, &(0x7f00000000c0)=0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000500)=@security={'security\x00', 0xe, 0x4, 0x3e8, 0x290, 0x290, 0x290, 0x128, 0x128, 0x350, 0x350, 0x350, 0x350, 0x350, 0x4, &(0x7f0000000100), {[{{@uncond, 0x0, 0xc8, 0x128, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x0, 0x400}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0xae5, 0x3f, 0x0, 0x5, 0x1, 0x3a3b], 0x4, 0xe1}, {0x1ff, [0x7f, 0x3, 0x5, 0x7, 0x167, 0x7], 0xffffffffffffff00, 0x83e2}}}}, {{@ip={@empty, @multicast2, 0xffffffff, 0xffffffff, 'sit0\x00', 'lapb0\x00', {0xff}, {0xff}, 0xef, 0x1, 0x1}, 0x0, 0x108, 0x168, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x5, 0x6, 0x1}}, @common=@set={0x40, 'set\x00', 0x0, {{0x5, [0x6, 0x7f, 0x16be, 0x1, 0xfffffffffffffffe, 0x58], 0x6, 0x6}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x7f, [0x2, 0x3, 0x3, 0x2, 0x579f, 0x7], 0x1, 0x1}, {0x4, [0xbdc2, 0x0, 0x0, 0x3, 0x311, 0x5ef5], 0xaf, 0x1f}}}}, {{@ip={@loopback, @remote, 0xffffffff, 0xff000000, 'gre0\x00', 'ifb0\x00', {}, {0xff}, 0x84, 0x1, 0x9}, 0x0, 0x98, 0xc0}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x3f, 0x4, 0x3}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x448) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 981.633979] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 981.641244] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 [ 981.654774] binder: 5519:5552 got reply transaction with no transaction stack [ 981.665550] binder: 5519:5536 ioctl 40046207 0 returned -16 17:20:58 executing program 2: pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000440)='/dev/video35\x00', 0x2, 0x0) r2 = mmap$binder(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x64010, 0xffffffffffffff9c, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000840)={0xe0, 0x0, &(0x7f00000006c0)=[@reply={0x40406301, {0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, &(0x7f00000003c0), &(0x7f0000000400)=[0x40, 0x0, 0x28, 0x48, 0x38, 0x40, 0x0]}}, @transaction_sg={0x40486311, {{0x1, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x30, 0x30, &(0x7f0000000580)=[@fd={0x66642a85, 0x0, r1, 0x0, 0x4}, @flat={0x73682a85, 0xa, r2, 0x3}], &(0x7f00000005c0)=[0x40, 0x40, 0x0, 0x40, 0x20, 0x18]}, 0x3ff}}, @reply_sg={0x40486312, {{0x2, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x0, 0x10, &(0x7f0000000600), &(0x7f0000000680)=[0x40, 0x60]}, 0x1}}, @register_looper], 0x55, 0x0, &(0x7f00000007c0)="6326205adb1a7646819d1c43ba67309a3ad9cf55cffc5e2401786dde97b1205fdcda151cc33668b1bc6e4671da7b23dba517053ea185cfc435e3d097237dfa03fd20ed6eca09eb507f2c55e41ac58a9ab5c76bf8be"}) r3 = syz_open_dev$adsp(&(0x7f0000000240)='/dev/adsp#\x00', 0x7, 0x501000) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r4 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r5 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r6 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) r7 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) write$vhci(r7, &(0x7f0000000200)=@HCI_SCODATA_PKT={0x3, "bdbc8da3bcee8b870d6a9883c0d783fdbbd8995fcc58e6"}, 0x18) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r3, 0xc0745645, &(0x7f0000000280)={0x0, [0x3, 0x2, 0x0, 0xfffffffffffffff7, 0x7, 0x800, 0x4, 0x3adc, 0x6, 0x0, 0x81, 0x800, 0x6, 0x4, 0x80000000, 0x9, 0x4, 0x100, 0xffffffffffffffd8, 0x100000000, 0x1, 0x24, 0x400, 0x1, 0x3, 0x7, 0x5, 0x9, 0x9b, 0x3, 0x1, 0x100000001, 0x7, 0x36b, 0x10000, 0x0, 0x539a2e55, 0x8, 0x0, 0x1, 0x2, 0x33, 0x3f, 0x3bf67597, 0xc59, 0x72ee, 0xd1f2, 0x1], 0x9}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 981.709277] binder: 5519:5552 transaction failed 29201/-71, size 0-0 line 2801 17:20:58 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$TIOCSTI(r1, 0x5412, 0x7) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 981.856244] binder: BINDER_SET_CONTEXT_MGR already set [ 981.894214] binder: 5559:5563 got reply transaction with bad transaction stack, transaction 1008 has target 26829:0 17:20:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xffff8000, 0x0, 0x0, 0x0) [ 981.945381] binder: 5559:5561 ioctl 40046207 0 returned -16 [ 981.975304] binder: 5559:5563 transaction failed 29201/-71, size 0-0 line 2816 [ 982.059773] binder_alloc: binder_alloc_mmap_handler: 5559 20001000-20004000 already mapped failed -16 [ 982.102547] binder: BINDER_SET_CONTEXT_MGR already set [ 982.142370] binder: 5559:5567 ioctl 40046207 0 returned -16 [ 982.174007] binder: 5559:5576 got reply transaction with no transaction stack [ 982.193239] binder: 5559:5576 transaction failed 29201/-71, size 0-0 line 2801 17:20:59 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x3a00]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:20:59 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:20:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x64, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 17:20:59 executing program 5 (fault-call:2 fault-nth:10): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:20:59 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) write$input_event(r0, &(0x7f0000000280)={{r1, r2/1000+30000}, 0x1f, 0x80000001, 0x6}, 0x18) r3 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r4 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x2a201, 0x0) ioctl$GIO_FONT(r6, 0x4b60, &(0x7f0000001540)=""/4096) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="ca9dbfe477f5b3e2842648cacab9c336d47956d58a981dc44ee862265dc2b0a3c85270e6641e9ab1685014d918ff0d256a4a81a961"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xfffffdfc, 0x0, 0x0, 0x0) [ 982.528123] binder: BINDER_SET_CONTEXT_MGR already set [ 982.544890] binder: 5589:5595 unknown command -457204278 [ 982.550084] FAULT_INJECTION: forcing a failure. [ 982.550084] name failslab, interval 1, probability 0, space 0, times 0 [ 982.551753] binder: 5589:5594 ioctl 40046207 0 returned -16 [ 982.591564] binder: 5589:5595 ioctl c0306201 20000140 returned -22 [ 982.594358] CPU: 1 PID: 5599 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 982.603411] binder: 5589:5601 got reply transaction with no transaction stack [ 982.604949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 982.604955] Call Trace: [ 982.604978] dump_stack+0x1db/0x2d0 [ 982.605013] ? dump_stack_print_info.cold+0x20/0x20 [ 982.605027] ? do_sys_open+0x59a/0x7c0 [ 982.605039] ? __x64_sys_open+0x7e/0xc0 [ 982.605065] ? do_syscall_64+0x1a3/0x800 [ 982.605097] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 982.605112] ? percpu_ref_put_many+0x129/0x270 [ 982.605132] should_fail.cold+0xa/0x15 [ 982.636855] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 982.644873] ? ___might_sleep+0x1e7/0x310 [ 982.644890] ? arch_local_save_flags+0x50/0x50 [ 982.644906] ? smaps_rollup_open+0x4d/0x160 [ 982.644923] ? rcu_lockdep_current_cpu_online+0x1aa/0x220 [ 982.644942] __should_failslab+0x121/0x190 [ 982.654869] ? proc_map_release+0x100/0x100 [ 982.654888] should_failslab+0x9/0x14 [ 982.654904] kmem_cache_alloc_trace+0x2d1/0x760 [ 982.654919] ? rcu_read_lock_sched_held+0x110/0x130 [ 982.654934] ? kmem_cache_alloc_trace+0x354/0x760 [ 982.654954] ? proc_map_release+0x100/0x100 [ 982.668085] single_open+0x4e/0x1e0 [ 982.668106] smaps_rollup_open+0x70/0x160 [ 982.668125] do_dentry_open+0x48a/0x1210 [ 982.668143] ? gather_stats+0x1660/0x1660 [ 982.668160] ? chown_common+0x740/0x740 [ 982.682598] ? security_inode_permission+0xd5/0x110 [ 982.682621] ? inode_permission+0xb4/0x570 [ 982.682643] vfs_open+0xa0/0xd0 [ 982.682660] path_openat+0x144f/0x5650 [ 982.713837] ? add_lock_to_list.isra.0+0x450/0x450 [ 982.713876] ? path_lookupat.isra.0+0xba0/0xba0 [ 982.713893] ? do_dup2+0x580/0x580 [ 982.713916] ? kasan_check_read+0x11/0x20 [ 982.721695] ? do_raw_spin_unlock+0xa0/0x330 [ 982.721714] ? do_raw_spin_trylock+0x270/0x270 [ 982.721741] ? __phys_addr_symbol+0x30/0x70 [ 982.729943] do_filp_open+0x26f/0x370 [ 982.729961] ? may_open_dev+0x100/0x100 [ 982.729997] ? digsig_verify.cold+0x32/0x32 [ 982.792980] ? get_unused_fd_flags+0x122/0x1a0 [ 982.797569] ? __alloc_fd+0x700/0x700 [ 982.801374] ? getname_flags+0x277/0x5b0 [ 982.805443] do_sys_open+0x59a/0x7c0 [ 982.809179] ? filp_open+0x80/0x80 [ 982.812729] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 982.818098] ? trace_hardirqs_off_caller+0x300/0x300 [ 982.823209] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 982.827975] __x64_sys_open+0x7e/0xc0 [ 982.831779] do_syscall_64+0x1a3/0x800 [ 982.835676] ? syscall_return_slowpath+0x5f0/0x5f0 [ 982.840625] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 982.845640] ? __switch_to_asm+0x34/0x70 [ 982.849713] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 982.854568] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 982.859764] RIP: 0033:0x412041 [ 982.862963] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 982.881877] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 17:20:59 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept(r0, &(0x7f0000000200), &(0x7f0000000180)=0x80) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = fcntl$dupfd(r1, 0x0, r1) ioctl$SNDRV_TIMER_IOCTL_INFO(r3, 0x80e85411, &(0x7f0000000400)=""/47) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) r5 = msgget$private(0x0, 0x28) msgsnd(r5, &(0x7f0000000380)={0x1, "83e4718efa2dad690d83da6fcdd1a1a68138f02eb920c1e6dac838b500ceb1ebbcc1b6b3de0f5c948f0956ae58eb9b10a6797f7dd48ae09c452b525c1ba5479f"}, 0x48, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="f745536dceca4b0d88a8b25b5732c0c0624590bf97cba73414a70d60d5cd89121762750e6a80defa44ba406109509ea519aca2da8cba186f2779d240eb7ae10ae16f6fe253e7a501ca4ac1e6d67c82df1ee1fbdf"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:20:59 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r3 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x80) getdents(r3, &(0x7f0000000240)=""/214, 0xd6) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 982.889590] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 982.896859] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 982.904136] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 982.911402] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 982.918672] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 17:20:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0) [ 982.970978] binder: BINDER_SET_CONTEXT_MGR already set [ 983.003796] binder: 5604:5608 unknown command 1834173943 [ 983.021491] binder: 5604:5606 ioctl 40046207 0 returned -16 [ 983.045590] binder: 5604:5608 ioctl c0306201 20000000 returned -22 [ 983.065930] binder_alloc: binder_alloc_mmap_handler: 5604 20001000-20004000 already mapped failed -16 [ 983.077016] binder: BINDER_SET_CONTEXT_MGR already set [ 983.082650] binder: 5604:5614 ioctl 40046207 0 returned -16 17:20:59 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x400000, 0x0) r1 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x200, 0x2) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000100)={r1}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r3, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, 0x0, 0x0) [ 983.095344] binder: 5604:5606 unknown command 1834173943 [ 983.101599] binder: release 5604:5608 transaction 1014 out, still active [ 983.120486] binder: 5604:5606 ioctl c0306201 20000000 returned -22 [ 983.134530] binder: undelivered TRANSACTION_COMPLETE 17:21:00 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) r1 = socket(0xa, 0x0, 0x878) ioctl$sock_bt_hci(r1, 0x400448e4, &(0x7f0000000200)="3bc32f2ea80a06bf87b44ab977e03a3389b6d54982b787643cecb536e3d0453102c94afdc92d279ee68e7b4d0616bdb8ee37cadc5ae239cbdd26732b076187ccf0a8451df17522063bfa822d7f32d8d7c5c6d3efd271f713fc59db35ee3725d7a8cfb839874e396919fcfc2d9fa41707efdc2f03574ec51b37b6d6791563906612b7cfd0b8090716cfa57aa558b1b7611c7e15d92cebf2e2835204e45272a555") accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 983.158195] binder: release 5604:5606 transaction 1015 out, still active [ 983.187780] binder: undelivered TRANSACTION_COMPLETE 17:21:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xfffffff6, 0x0, 0x0, 0x0) [ 983.425682] binder: 5621:5624 got reply transaction with bad transaction stack, transaction 1016 has target 26829:0 [ 983.496554] binder_transaction: 1 callbacks suppressed [ 983.496572] binder: 5621:5624 transaction failed 29201/-71, size 0-0 line 2816 [ 983.553684] binder: 5621:5632 got reply transaction with no transaction stack [ 983.580589] binder: 5621:5632 transaction failed 29201/-71, size 0-0 line 2801 [ 983.595668] binder: release 5621:5624 transaction 1016 out, still active [ 983.603939] binder: undelivered TRANSACTION_COMPLETE [ 983.615736] binder: undelivered TRANSACTION_ERROR: 29201 [ 983.644575] binder: release 5621:5630 transaction 1018 out, still active [ 983.674535] binder: undelivered TRANSACTION_COMPLETE [ 983.679710] binder: undelivered TRANSACTION_ERROR: 29201 17:21:00 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x3b00]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:21:00 executing program 5 (fault-call:2 fault-nth:11): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:21:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x300, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 17:21:00 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000300)) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) rt_sigaction(0x39, &(0x7f0000000100)={&(0x7f0000000040)="0fc6172e2e64f343ddef420f01c3c421e51435c100000026660f76436745a6c4427909dfc481445652ffc48159ee141e2e420fb0ac9500000100", {0x200}, 0x0, &(0x7f00000000c0)="aac4014d6847c7660f6b3d993f0000c46212f72bc42208f289fff86d1e3644382cd8470f0283b7218e9df343a4c4619515eff2420f7d4200"}, &(0x7f00000001c0)={&(0x7f0000000240)="c403217ec6a7c4a28d28850d4e00003e0f8f287400002626db517b8f2978d6cb8f497882a24a000000c42379632963c4a1e55f94140400000066420fed4500c421a1d98c5773f40000", {}, 0x0, &(0x7f0000000140)="c462859a37c4627925d165450fae2c398f090091c945d0c0f245afc4a17c295a0ec402813d116666430f6e3ec42175756965"}, 0x8, &(0x7f00000002c0)) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:21:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x4000000000, 0x0, 0x0, 0x0) 17:21:00 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rtc0\x00', 0xa00, 0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r0, 0x81785501, &(0x7f0000000280)=""/110) r1 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r2 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) r3 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) ioctl$BLKDISCARD(r2, 0x1277, &(0x7f0000000080)=0x8) r4 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000180), &(0x7f0000000200)=0x30) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0c630000fad05d45d4b90ec42871d707000000000000000000400000000004000000"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:21:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x3cd, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 983.988104] binder: BINDER_SET_CONTEXT_MGR already set 17:21:00 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 984.010396] FAULT_INJECTION: forcing a failure. [ 984.010396] name failslab, interval 1, probability 0, space 0, times 0 [ 984.037382] binder: 5642:5647 ioctl 40046207 0 returned -16 [ 984.084686] CPU: 0 PID: 5654 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 984.091720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 984.101124] Call Trace: [ 984.101777] binder: 5642:5650 got reply transaction with bad transaction stack, transaction 1020 has target 26829:0 [ 984.103741] dump_stack+0x1db/0x2d0 [ 984.103765] ? dump_stack_print_info.cold+0x20/0x20 [ 984.103785] ? do_sys_open+0x59a/0x7c0 [ 984.126870] ? __x64_sys_open+0x7e/0xc0 [ 984.130853] ? do_syscall_64+0x1a3/0x800 [ 984.134922] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 984.140312] ? percpu_ref_put_many+0x129/0x270 [ 984.144913] should_fail.cold+0xa/0x15 [ 984.148814] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 984.148838] ? ___might_sleep+0x1e7/0x310 [ 984.148855] ? arch_local_save_flags+0x50/0x50 [ 984.148873] ? smaps_rollup_open+0x4d/0x160 [ 984.160414] binder: 5642:5650 transaction failed 29201/-71, size 0-0 line 2816 [ 984.162683] ? rcu_lockdep_current_cpu_online+0x1aa/0x220 [ 984.162705] __should_failslab+0x121/0x190 [ 984.162721] ? proc_map_release+0x100/0x100 [ 984.162738] should_failslab+0x9/0x14 [ 984.174401] kmem_cache_alloc_trace+0x2d1/0x760 [ 984.174417] ? rcu_read_lock_sched_held+0x110/0x130 [ 984.174448] ? kmem_cache_alloc_trace+0x354/0x760 [ 984.174465] ? proc_map_release+0x100/0x100 [ 984.211128] single_open+0x4e/0x1e0 [ 984.215125] smaps_rollup_open+0x70/0x160 [ 984.219293] do_dentry_open+0x48a/0x1210 [ 984.221312] binder_alloc: binder_alloc_mmap_handler: 5642 20001000-20004000 already mapped failed -16 [ 984.223382] ? gather_stats+0x1660/0x1660 [ 984.223401] ? chown_common+0x740/0x740 [ 984.223419] ? security_inode_permission+0xd5/0x110 [ 984.223438] ? inode_permission+0xb4/0x570 [ 984.250144] vfs_open+0xa0/0xd0 [ 984.253446] path_openat+0x144f/0x5650 [ 984.257333] ? add_lock_to_list.isra.0+0x450/0x450 [ 984.262283] ? path_lookupat.isra.0+0xba0/0xba0 [ 984.266958] ? do_dup2+0x580/0x580 [ 984.270504] ? kasan_check_read+0x11/0x20 [ 984.274652] ? do_raw_spin_unlock+0xa0/0x330 [ 984.279066] ? do_raw_spin_trylock+0x270/0x270 [ 984.283654] ? __phys_addr_symbol+0x30/0x70 [ 984.288007] do_filp_open+0x26f/0x370 [ 984.291815] ? may_open_dev+0x100/0x100 [ 984.295805] ? digsig_verify.cold+0x32/0x32 [ 984.300159] ? get_unused_fd_flags+0x122/0x1a0 [ 984.304786] ? __alloc_fd+0x700/0x700 [ 984.308598] ? getname_flags+0x277/0x5b0 [ 984.312692] do_sys_open+0x59a/0x7c0 [ 984.316416] ? filp_open+0x80/0x80 [ 984.319960] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 984.325325] ? trace_hardirqs_off_caller+0x300/0x300 [ 984.330429] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 984.335191] __x64_sys_open+0x7e/0xc0 [ 984.338994] do_syscall_64+0x1a3/0x800 [ 984.342911] ? syscall_return_slowpath+0x5f0/0x5f0 [ 984.348061] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 984.353091] ? __switch_to_asm+0x34/0x70 [ 984.357178] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 984.362031] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 984.367223] RIP: 0033:0x412041 17:21:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x408) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 984.370416] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 984.389312] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 984.397018] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 984.404289] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 984.411549] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 984.418810] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 984.426086] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 [ 984.479660] binder: BINDER_SET_CONTEXT_MGR already set [ 984.509152] binder: 5642:5661 ioctl 40046207 0 returned -16 [ 984.536783] binder: 5642:5669 got reply transaction with no transaction stack [ 984.544089] binder: 5642:5669 transaction failed 29201/-71, size 0-0 line 2801 17:21:01 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x200000, 0x0) r0 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x5, 0x8000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x500200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 984.568987] binder: undelivered TRANSACTION_ERROR: 29201 [ 984.580103] binder: release 5642:5647 transaction 1022 out, still active [ 984.591028] binder: undelivered TRANSACTION_COMPLETE [ 984.603614] binder: release 5642:5650 transaction 1020 out, still active 17:21:01 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 984.630164] binder: undelivered TRANSACTION_COMPLETE 17:21:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x8000000000, 0x0, 0x0, 0x0) [ 984.654559] binder: undelivered TRANSACTION_ERROR: 29201 [ 984.746309] binder: BINDER_SET_CONTEXT_MGR already set [ 984.775394] binder: 5677:5680 got reply transaction with bad transaction stack, transaction 1024 has target 26829:0 [ 984.837124] binder: 5677:5679 ioctl 40046207 0 returned -16 [ 984.864647] binder: 5677:5680 transaction failed 29201/-71, size 0-0 line 2816 17:21:02 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x4001]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:21:02 executing program 5 (fault-call:2 fault-nth:12): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:21:02 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 17:21:02 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) pipe(&(0x7f0000000180)={0xffffffffffffffff}) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x5, 0x4) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:21:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xc000000000, 0x0, 0x0, 0x0) [ 985.250750] binder: BINDER_SET_CONTEXT_MGR already set [ 985.278876] binder: 5696:5699 ioctl 40046207 0 returned -16 [ 985.300324] binder: 5696:5698 got reply transaction with bad transaction stack, transaction 1026 has target 26829:0 [ 985.311939] FAULT_INJECTION: forcing a failure. [ 985.311939] name failslab, interval 1, probability 0, space 0, times 0 17:21:02 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0xd04) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000000c0)="236a49114f2ffc5fd19f1ea77d04102a", 0x10) [ 985.332227] CPU: 1 PID: 5705 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 985.339252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 985.348606] Call Trace: [ 985.351207] dump_stack+0x1db/0x2d0 [ 985.354867] ? dump_stack_print_info.cold+0x20/0x20 [ 985.359920] ? do_sys_open+0x59a/0x7c0 17:21:02 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:21:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x0, 0x200) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)={0xb0000001}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 17:21:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x400000000000, 0x0, 0x0, 0x0) [ 985.359937] ? __x64_sys_open+0x7e/0xc0 [ 985.359955] ? do_syscall_64+0x1a3/0x800 [ 985.359974] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 985.360000] should_fail.cold+0xa/0x15 [ 985.360021] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 985.360046] ? ___might_sleep+0x1e7/0x310 [ 985.360078] ? arch_local_save_flags+0x50/0x50 [ 985.360094] ? single_open+0x4e/0x1e0 [ 985.360122] __should_failslab+0x121/0x190 [ 985.360143] should_failslab+0x9/0x14 [ 985.360160] kmem_cache_alloc+0x2be/0x710 17:21:02 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = fcntl$dupfd(r2, 0x0, r0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000340)={0x0, @in6={{0xa, 0x4e20, 0x4c273799, @mcast1, 0x101}}, [0xd4, 0x7fffffff, 0x7ff, 0x4000000000000000, 0x4, 0x20, 0x0, 0x10001, 0x7, 0x2, 0x3, 0x8, 0x0, 0x9, 0x2]}, &(0x7f0000000140)=0x100) getsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={r4, 0x7ff}, &(0x7f00000001c0)=0x8) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r5, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r5, 0x0, 0x400000007, 0x0, 0x0) ioctl$SIOCGSTAMPNS(r1, 0x8907, &(0x7f0000000100)) r6 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x400000, 0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000440)=0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000500)={0xffffffffffffffff, r3, 0x0, 0x1, &(0x7f0000000480)='\x00'}, 0x30) kcmp$KCMP_EPOLL_TFD(r7, r8, 0x7, r3, &(0x7f0000000540)={r3, r0, 0x5}) sendmsg$key(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x2, 0x9, 0x0, 0x3, 0x7, 0x0, 0x70bd25, 0x25dfdbfc, [@sadb_x_filter={0x5, 0x1a, @in=@local, @in6=@dev={0xfe, 0x80, [], 0x15}, 0x6, 0x4, 0x10}]}, 0x38}}, 0x20000000) ioctl$void(r0, 0x5450) ioctl$VIDIOC_S_HW_FREQ_SEEK(r6, 0x40305652, &(0x7f00000000c0)={0x9, 0x2, 0x6, 0x1, 0x9, 0x3a, 0x3}) [ 985.360176] ? rcu_read_lock_sched_held+0x110/0x130 [ 985.360193] ? kmem_cache_alloc_trace+0x354/0x760 [ 985.360208] ? rcu_read_lock_sched_held+0x110/0x130 [ 985.360228] seq_open+0x5c/0x1c0 [ 985.360245] ? proc_map_release+0x100/0x100 [ 985.360258] single_open+0x104/0x1e0 [ 985.360276] smaps_rollup_open+0x70/0x160 [ 985.360294] do_dentry_open+0x48a/0x1210 [ 985.360311] ? gather_stats+0x1660/0x1660 [ 985.360329] ? chown_common+0x740/0x740 [ 985.360362] ? security_inode_permission+0xd5/0x110 [ 985.360398] ? inode_permission+0xb4/0x570 [ 985.360419] vfs_open+0xa0/0xd0 [ 985.360436] path_openat+0x144f/0x5650 [ 985.360455] ? add_lock_to_list.isra.0+0x450/0x450 [ 985.360490] ? path_lookupat.isra.0+0xba0/0xba0 [ 985.360506] ? do_dup2+0x580/0x580 [ 985.360529] ? kasan_check_read+0x11/0x20 [ 985.360545] ? do_raw_spin_unlock+0xa0/0x330 [ 985.360562] ? do_raw_spin_trylock+0x270/0x270 [ 985.360587] ? __phys_addr_symbol+0x30/0x70 [ 985.360613] do_filp_open+0x26f/0x370 [ 985.360628] ? may_open_dev+0x100/0x100 [ 985.360660] ? digsig_verify.cold+0x32/0x32 [ 985.360678] ? get_unused_fd_flags+0x122/0x1a0 [ 985.360693] ? __alloc_fd+0x700/0x700 [ 985.360707] ? getname_flags+0x277/0x5b0 [ 985.360729] do_sys_open+0x59a/0x7c0 [ 985.360748] ? filp_open+0x80/0x80 [ 985.360768] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 985.360785] ? trace_hardirqs_off_caller+0x300/0x300 [ 985.360802] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 985.360836] __x64_sys_open+0x7e/0xc0 [ 985.360855] do_syscall_64+0x1a3/0x800 [ 985.360874] ? syscall_return_slowpath+0x5f0/0x5f0 [ 985.360893] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 985.360908] ? __switch_to_asm+0x34/0x70 [ 985.360929] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 985.360968] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 985.360980] RIP: 0033:0x412041 [ 985.360995] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 985.361003] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 985.361018] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 985.361027] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 985.361036] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 985.361046] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 985.361064] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 [ 985.386593] binder: 5696:5698 transaction failed 29201/-71, size 0-0 line 2816 [ 985.507135] binder: BINDER_SET_CONTEXT_MGR already set [ 985.507150] binder: 5718:5722 ioctl 40046207 0 returned -16 [ 985.584071] binder: 5718:5727 got reply transaction with no transaction stack [ 985.590150] binder: 5718:5727 transaction failed 29201/-71, size 0-0 line 2801 17:21:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x60ffffffffff, 0x0, 0x0, 0x0) 17:21:02 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x2, 0x0) recvfrom$rose(r3, &(0x7f0000000240)=""/231, 0xe7, 0x40000000, 0x0, 0x0) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:21:02 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x4800]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:21:02 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r3 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x0, 0x2) write$capi20_data(r3, &(0x7f0000000500)={{0x10, 0x8, 0x2, 0x82, 0xcd, 0x2e}, 0x1000, "74d31e887928122451fc90e6fc7291912403cadaf07afaadc301c9f52528d5adbbd26cbcbb4f81e3c877169d1f130673ba313cec63914b8e6b93464cce04269718653ac3e46aefa5722eb818ead991d5db235637e57ce7dec75406c8b0069f9f64c03c6a6913bcac26a278c84951d7ed888541535bee456c76850c952ac32bdaeceebd806d28e6c3a43652dd3da02cc8eaf417f735733b6bec7ab0c20b8d1b5384e3700b804c28360da9bcc45da58b47d1e88dc45aaab8269d6c0b42f00c2b16447bd1a8f666d3f392d358d8e30df8717024c0aca214bffe71aa8be459768693ea1d3fff1af2a4bb4e4a14b741c2c5a0af1c0091671d91efb89d1149b54192beb4290e787d61153df87e614b12ed047e077efeafb9d9ac049922265ab29eb20dbbf282351666907bf0a1afa30acea59eba431c80760990a0e3a530e7e3810f86517c0150dda3b533e0454f866e3fb8c3c821d0963ddcd795ce0b0453b90cfcbebe38aff3ddb3cf7c3d8de378e805b8bb0f50da693e1c3562645e9ba98748ac5a66519ddd6bbf778e85766df448f571a5a8df81cab0813a88365bf359c39466582888771fbe60c1b0ef96fe93f761e18b60f2edb2280ecb4daac5c8e41070855812af397ee47199b13c9e1080110734d2e54f8b4a1c71f01dba073feba3b09f12fc8b3cb0c40f8d9282215cc6a2c4d5e424655e7550b7094edc309493a103a4be50a9513e3f4d389bbb7579e6a3710e24af8a2b738a2fee33d23b2c9ddf2db8e1e47859abbffce9444b0eda03da1122def9a2ff5bcdf49b0c90457aa90f9b44bad1d763e8b979bf170a10efff60c6d2829505317823e2b1a1fc20d5b2029a262d97e6aa49be4f0129915ff200c54b9e20c18913a06dd860927e078208a1beb3748e7c0c96b9bf00fed97afbbabd8dbb678ca33d006eb74ee322cbc23bf96e8d890ae3a265359f27acb6ef74de335469427b7fbf5d9ca53f8904f55fae999601454b9d5c57c6e4baf2f0228e1235e85d0dde5403956c29dd103748333b433ce220c0a2d0f873033494540de47d8ccf798a0614837123ff7a790c33e46854bd1759c79470dfc178ee16f798f4f1382d4a76a6de6dabe9f874d507c7b86af3cf8852a0803221d95d2280062a140fabd89f2805a524fcc07ffa5aeed6f3337961a50cfb39a21a4e72b0e956a4fdbb6bd53cf3d6d168ca064a6877b41c59a441f38486aba37dafd9381fa9205e6ce7a006192dab959663236b549a4bb7b9a49e7858591344be2a06fd5351342dab8dd7465d6eb7abfd83a04960e3a30961de3ccc140ce38df41ba424ea2e287152317bb13256abdb79df420c34f5b8bb422dea3013277b2b729d106c217d16e76e47b45152119626079a73fb461e508ccc165ae243c35f7b326e55e3b86386a43d7c31b4e18b00416d807aae8c6bf04867a811f327a2127e3441d2e5b06a0f0ac7dcca3548774bb54799ed8dc698dcc07c0561be855d26df5c511d82a9b0741847c97227a16da22ccb4f93ca7bdd874616b7c04beb9cb34156e90b4d117d7c4b9d96f74f46c9715aaef2d157c08d1aea389ebf10938c9c2810a8173fe524ed2e02fd154f173411d61607dfc76cf2e44cfb4c1458e7fea6054055600cb09fa926bb94b5c15652fc129f8c1fa20ae496afd6ba281b012e451a93b6fc5f606af39209c2a50e4eaa12140617fe55c6e64efd2354cba1dec93c5524382e4335c554aabb08798950d4b08ecbdf7571fea08499f00f0667c5e08da3bcc05a73f920994c4789a41649cf669d7ca025a3c6da2f49e036ebbe3eec6fa2a6a220a25a435a64269afc7a35a221d2dcd0e6116eb45f6eb96073cb7b9414a70c0d7da77fb7bb6ad2b2edbecc63b22974c97bfb93e1f9a7538a065548620f72253f53c85ecfeb6cc4a2863ad5f2b037b37ae986c61eb060b3f1530fa80e5ee2396f6bbf6eb8250fdb71cb0a86396b0ad3f9a18c15edeba698f5cd9ea1b8b544f8f0650248731cf95ca724b381eda3cb0100d45a679e769d5935f65acd528b9e2ceefecf8c6089946a428f640fd800aee59a0165d714864d364ab52995fa4d90c3df501efee645bae4c45ae5cf8a5fd3b948a483dd817d0e4e5a80d1e263196fb8d2ddc9c233cd2f26c85663d57d8b8b265c09ba579c29fa2b8356b8232c5d5bb920c510d1ef4b817b5be81d15e9c7e882e8af549713fe9c9211ca0fa2b1cd946fed3c088e859ccdb66db2c6dc11bb1b417f08c4c6d04387802d9530822cdfe497c9ac335f19853624843fe8e048a37df3a0eddf334f175214d595addce770e478855f99f0d628773d7e269c86f3c3a57b26fd32584a79a2143d305167ad18c75cf17c4a3c890632700a1c6f0b44e480938bbae0dfd0ba32b01df20f4f352ef9b40d4ee6d8e3e9133351843c243fad3991fe45bf5ca64bc132295323f1ac001056fcd9e68ac542884b4c99cd5ea6d16498a2a7bc10e3334007f91d42e3768fa0281954542287a739a2041bd623de75b8fcd874e8ad59e3a4ea4fe357921a981f4223bc69244a2e32bdd092a56336416373b8758bf71fec6ed647fdc7e7523eec21b12ce51aecbdb9a50b9a1be4533f9974e55e3ba8131e8ddcbdd578a66ab478dc9bf302e45f1c8b112443df00e9c95b85bd6c730d8e62666d0f437ed44fea4a1f134248228eb33eec114fcb50feb94db55e97ce4e5045e2d8b149a1319b9acfb3f9ce7de913b44b5502fbfcb51ad68d91d7ec0f2c363159bd765f64d21bb709c0e75419afca3c7ed53657c701006ce2739e94140488449d0486602d4a8222e6a9fcbdb37882b52733fe33da5c5db6d40af889eed4756bdb7e19ea3b8513eac955fda4ef2f2ddc8fe82bad9e2f864191a1fd74bbf39924016f985fe928af7da2a7fba7004936ed4de77ab4f22f92c97db94389947eaa98657c73f9279fb1c60542c3d673713cdad133312ccd524625f834c6340a6798fa0c1325dd7d7efdc3f86b52ae206f764344553320aaf632f6dbd4e5554a9e0e59470f68dd670c5d44837b4acd3e625910ddc1562d58679c386d33cf68da5b212b4550b721f27c1e92293af1672653eb1dfc4f8b7726b3ecb7dc4fbcbd944d2d9b3578ea327d2894fe6e573d0b4b29b16d55defd5e40ad7598aaa9adc78868c71d51536be434af72e4e467d33885eb2d00811b2b23e7200e289d0da62f16fef125ca6463509b87752512c58742c677daa8dbe69b89f67f6a947e550fdd84bfe95f8dacda3bfdd35e80f69eefe44c9fddad5753f3d48328d5e80ea0ecba04a794f81f773b9da59e30a31f7a932a1359c133e3b2164058cd71155ea8ea80e757a57de2ca50730f43e2e74d11891a57910fd19c112ffc015cf4b6bfd0df3a5c79521b2e93398ab3c58f5238ff914f7a95cd401717a10d409d4dc1b73bf0d5c45e4fc8e625bf1e14aba688591e5fb483c619dad051ebd20545bcb7060e982d0f397178fab925031e916864937843bea1f36ab9ad5abcca3266f2f0842bc4b119da8b17da65227b338f98c0b7beecf6e9161c060a63a336343268bf9a43fea186d5300fd93365cd5483bbdddb96dc231929b33c7acc5f6005b65e02b6eab2966efca834665145ff5b1136745565a9298d4ffc6735c304a13dfd4040f4943204e8d5e37bb2deb4201f064abc910b5ea032875cbc2c1eab16fa025504ad170381ff89c59cb1fd9d51c66cb83a6a5b4dd9b0143434650d77eea3968473884b86450ef0b5114135701825b0d9965dba78e0839366a002a8472cba458f0d0c7c8925cd252e33bd8a11c9adf16452047a126447013920fb17518c705bd09fbd2052691b1bc125eef62e68510208b52258bdb89c857cb6ce2edad0fa5087433979ce8e5daf4db2c8153724d690aa766bcef9021472ea69d931927be3cfc805f38726c6510b426256c18495b352c592f98baa24f471f32c5f64aa8c80413b972d9754707147c5e8b565fedd899ab4cc59f4f5febf2069fe1363b086add1a9e11d032c3191546c4ebba0a83850b0e224a7c8cdb7ef16d66596dd019c412d2ee8ca383a749f24ac2620906e479e6f2767ca345ac9f9d931a0834c8693d0310136907a38d1989a74c1e13f4974c201177b11782fd2e4eb9d0d64340af441fb98e7364a757d87178c86173e46edcaeae8af879fa69c7f8f5812e6d4cb6a971e07c2faeefbf9bcec7e1beb4b8b60d052431eb1473ba9fb2aed5e361ef22fc545b9c88501921a32efa1aa4907b88d9689a3c043cbc848232bf065ca692278c1235161b15ca4be60633ad08f994fa7268a582223533ba98d6be512b342948adb6f09cba192b8ba5e65eaeee58468c81de8a6cf107056f564dc007242722f31437c8a39f71ea50fd84b38446335dfe3164591619f0af91648ad5b76b15ed7dc6ab9707c68a669548d1f25af98fcaa561ffd0b0a7fa75c539d526126f380f173fdfc71de517ccbc9c6a20e98f2c94ce1a507a5569c3aa3c6219501a985e5e1877202410b10447c18a8c8664feb185529fb8cb82af395eba804e4d3b8a5c35440f01fef95c68b21a526442c0a0f832592d64f59721e48c7ab0df021e329633a2ef655c5cb6a378c499ab03c2e93a73617df9fdc1682fee216ad998fa353913373d22596af3cccf1966d525eaeefdc32cf6a257655dcc3c1ecbf998435e8e026bf03f629154276bd57c54f90d409e2abe58ce4242b245e4b5540db1cb91cbf546319a52cdf48defeb3a5b28fc8877a9605c2eef2f508f120b981c3b51275f5b0c3b2de4a85e8c5d04b218a0fb23836f48a2f304c6a0812cb5ec5804c851443882b975b9538a2d317cd9b623a168cf25e7a0eb2c8cbd2477b8bea2fa021fca24ff9b24fe8c359c86b351a8ee3bd492d1d32375427e9d3ddfc6b2f7e2dfd2dedb597572a7582622d098accb00bf449130af2b01887b9ca21551b7f58e5af579517f6c3d886e9ec5619604581b1022372d8fd300ed0d7439a09713537bda0639d9c781278871361f77b692d391fa7e29a7ffe5ebbd41e4fe3697025c6644582bb47caee71e87143d8bd7dd93db570817440f6124615da5d7d20b882b2adc7f2fb11702b46acaa2db7787d44e18666c0d44ceaecbd6570ab112722de95175a32aaf258281450a452adaf811dbc9344abc59cd74d0a016ed9246f5eb6079dc3f4cdc0cff939fbedfcc0cd2ac4b06e31097d0ca6143d2ba5a9f8c97caa9bd57d89bb23a1f798ebc0e9775754d623730357db85653e44b087cd52dfb3e37605951b210a88eba7d190903d31898b552ec5fad743d4946234f429be81a7dc2dd7fe753a8708ee22f6d93695eb1bbd8ef0d778a477bcfd692e2223901d3bf5472b36e804fa4a007119e01cbfb2b2399c87a9b9b9c79704caa27aa84c9f804d01f2c56a36db701e4d519ba971898fb452d174c8a74d1e1947e306b90b83ca6dfb21ded3bba3374bd8127f11e9c7ba69bee1416f2913f10f075c2fa90fcd2616d384d9f8f4481f0f836ca23d9ca795743d430737647a5d7e9f692d6713996e1ba2f27c24d185a0ce772043e4967b34ad47dba6a59fb34db31e65204c47150d05e0698af15ee0264b411d7384a7ab6e2f3a635cf720c0e690e98df3b10a31d8178c35e9f8089f384489c9994d9e9e003ef3283ecb0fab39b83711d9a35c9bf70ad7da42098203db30299bd6c8418c1c0a174463f0d3b595bab7edc821b120d64b5db0ec7ac79d290be62c87ea8fc538c9d80475630636319f275bedbd192be230679ab4976e511ec1794d05a8b2d66c3159f63cd875298b89a607"}, 0x1012) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:21:02 executing program 5 (fault-call:2 fault-nth:13): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:21:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x740000000000, 0x0, 0x0, 0x0) [ 986.226222] FAULT_INJECTION: forcing a failure. [ 986.226222] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 986.238059] CPU: 0 PID: 5754 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 986.245094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 986.254453] Call Trace: [ 986.257060] dump_stack+0x1db/0x2d0 [ 986.260705] ? dump_stack_print_info.cold+0x20/0x20 [ 986.265744] ? lock_downgrade+0x910/0x910 [ 986.265765] ? kasan_check_read+0x11/0x20 [ 986.265792] should_fail.cold+0xa/0x15 [ 986.265815] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 986.265831] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 986.265855] ? rcu_read_unlock+0x16/0x60 [ 986.265870] ? find_held_lock+0x35/0x120 [ 986.296743] ? rcu_read_unlock+0x16/0x60 [ 986.297230] binder_alloc: binder_alloc_mmap_handler: 5718 20001000-20004000 already mapped failed -16 [ 986.300835] should_fail_alloc_page+0x50/0x60 [ 986.300851] __alloc_pages_nodemask+0x323/0xdc0 [ 986.300884] ? lock_downgrade+0x910/0x910 [ 986.323603] ? kasan_check_read+0x11/0x20 [ 986.327761] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 986.333060] ? __alloc_pages_slowpath+0x2cc0/0x2cc0 [ 986.338109] ? ___might_sleep+0x1e7/0x310 [ 986.338128] ? trace_hardirqs_off+0xb8/0x310 [ 986.346678] cache_grow_begin+0x9c/0x8c0 [ 986.346693] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 986.346708] ? check_preemption_disabled+0x48/0x290 [ 986.346726] kmem_cache_alloc+0x645/0x710 [ 986.366035] ? rcu_read_lock_sched_held+0x110/0x130 [ 986.371085] ? kmem_cache_alloc_trace+0x354/0x760 [ 986.375936] seq_open+0x5c/0x1c0 [ 986.376276] binder: BINDER_SET_CONTEXT_MGR already set [ 986.379344] ? proc_map_release+0x100/0x100 [ 986.379357] single_open+0x104/0x1e0 [ 986.379376] smaps_rollup_open+0x70/0x160 [ 986.379393] do_dentry_open+0x48a/0x1210 [ 986.379409] ? gather_stats+0x1660/0x1660 [ 986.405037] ? chown_common+0x740/0x740 [ 986.409038] ? security_inode_permission+0xd5/0x110 [ 986.414094] ? inode_permission+0xb4/0x570 [ 986.418356] vfs_open+0xa0/0xd0 [ 986.421662] path_openat+0x144f/0x5650 [ 986.425559] ? add_lock_to_list.isra.0+0x450/0x450 [ 986.430527] ? path_lookupat.isra.0+0xba0/0xba0 [ 986.435199] ? do_dup2+0x580/0x580 [ 986.435569] binder: 5718:5758 got reply transaction with no transaction stack [ 986.438744] ? kasan_check_read+0x11/0x20 [ 986.438760] ? do_raw_spin_unlock+0xa0/0x330 [ 986.438775] ? do_raw_spin_trylock+0x270/0x270 [ 986.438792] ? __phys_addr_symbol+0x30/0x70 [ 986.463584] do_filp_open+0x26f/0x370 [ 986.467419] ? may_open_dev+0x100/0x100 [ 986.471441] ? digsig_verify.cold+0x32/0x32 [ 986.475766] ? get_unused_fd_flags+0x122/0x1a0 [ 986.480353] ? __alloc_fd+0x700/0x700 [ 986.484166] ? getname_flags+0x277/0x5b0 [ 986.488243] do_sys_open+0x59a/0x7c0 [ 986.491967] ? filp_open+0x80/0x80 [ 986.495550] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 986.498022] binder: release 5718:5722 transaction 1028 out, still active [ 986.500946] ? trace_hardirqs_off_caller+0x300/0x300 [ 986.500966] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 986.501001] __x64_sys_open+0x7e/0xc0 [ 986.501018] do_syscall_64+0x1a3/0x800 [ 986.501036] ? syscall_return_slowpath+0x5f0/0x5f0 [ 986.508029] binder: 5718:5727 ioctl 40046207 0 returned -16 [ 986.513013] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 986.513029] ? __switch_to_asm+0x34/0x70 [ 986.513060] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 986.513091] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 986.530246] binder: undelivered TRANSACTION_COMPLETE [ 986.530410] RIP: 0033:0x412041 [ 986.554170] binder: undelivered TRANSACTION_ERROR: 29201 [ 986.555205] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 986.555214] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 986.555230] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 986.555239] RDX: 00007fa6fe251bdf RSI: 0000000000000002 RDI: 00007fa6fe251bd0 [ 986.555248] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 986.555257] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 17:21:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x40000, 0x0) recvmsg$kcm(r1, &(0x7f00000003c0)={&(0x7f00000000c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f0000000280)=[{&(0x7f0000000180)=""/148, 0x94}, {&(0x7f0000000240)=""/15, 0xf}], 0x2, &(0x7f00000002c0)=""/245, 0xf5}, 0x40010000) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 17:21:03 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) r4 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x3, 0x2) setsockopt$inet6_dccp_buf(r4, 0x21, 0x0, &(0x7f00000000c0)="1efe4451acb9d3451bb056191b5bfcf2275f44df0ba1266a961bbd262579fb60367a677477f3a7dae4a1bc86a60dcd5bd982c5c27e2e68ce6610ad05249073acd01274f065c897e6e3517dc1", 0x4c) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 986.555269] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 [ 986.575030] binder: 5718:5758 transaction failed 29201/-71, size 0-0 line 2801 [ 986.655150] binder: release 5718:5730 transaction 1030 out, still active [ 986.662018] binder: undelivered TRANSACTION_COMPLETE 17:21:03 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) r4 = dup3(r1, r2, 0x80000) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r4, 0x80045700, &(0x7f0000000180)) 17:21:03 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x200, 0x800000002009) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$FS_IOC_FSGETXATTR(r2, 0xc0185500, &(0x7f0000000000)={0x20c20}) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x10842, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r5, 0x5385, &(0x7f00000000c0)={0x95, ""/149}) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000007, 0x0, 0x0) 17:21:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x7f481d334000, 0x0, 0x0, 0x0) [ 986.703172] binder: undelivered TRANSACTION_ERROR: 29201 [ 986.829715] binder: BINDER_SET_CONTEXT_MGR already set [ 986.847719] binder: 5773:5774 ioctl 40046207 0 returned -16 [ 986.854178] binder: 5773:5775 got reply transaction with bad transaction stack, transaction 1032 has target 26829:0 17:21:03 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r1, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(0xffffffffffffffff, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r1, 0x0, 0x400000007, 0x0, 0x0) [ 986.875675] binder_alloc: binder_alloc_mmap_handler: 5773 20001000-20004000 already mapped failed -16 [ 986.903848] binder: 5773:5775 transaction failed 29201/-71, size 0-0 line 2816 [ 986.935521] binder: BINDER_SET_CONTEXT_MGR already set 17:21:03 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r2 = dup(r1) openat$cgroup_ro(r2, &(0x7f0000000180)='memory.swap.current\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x8000)=nil, 0x8000, 0x0, 0x10, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000ff0000000000000000000600fbffffffffffffff0000000000000000000000000000000000000000000000000000000031b80000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 986.953294] binder: 5773:5774 ioctl 40046207 0 returned -16 17:21:03 executing program 5 (fault-call:2 fault-nth:14): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') [ 987.134065] FAULT_INJECTION: forcing a failure. [ 987.134065] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 987.145892] CPU: 0 PID: 5791 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 987.152907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 987.152914] Call Trace: [ 987.152938] dump_stack+0x1db/0x2d0 [ 987.152962] ? dump_stack_print_info.cold+0x20/0x20 [ 987.152982] ? trace_hardirqs_on+0xbd/0x310 [ 987.173523] ? kasan_check_read+0x11/0x20 [ 987.181968] ? debug_object_active_state+0x33b/0x500 [ 987.187096] should_fail.cold+0xa/0x15 [ 987.190996] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 987.196115] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 987.201271] ? trace_hardirqs_on+0xbd/0x310 [ 987.205617] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 987.210919] ? call_rcu+0xb/0x10 [ 987.214293] ? trace_hardirqs_off_caller+0x300/0x300 [ 987.219912] should_fail_alloc_page+0x50/0x60 [ 987.224419] __alloc_pages_nodemask+0x323/0xdc0 [ 987.229149] ? __alloc_pages_slowpath+0x2cc0/0x2cc0 [ 987.234177] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 987.239734] ? ___might_sleep+0x1e7/0x310 [ 987.239754] ? trace_hardirqs_off+0xb8/0x310 [ 987.239776] cache_grow_begin+0x9c/0x8c0 [ 987.239791] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 987.239809] ? check_preemption_disabled+0x48/0x290 [ 987.239831] kmem_cache_alloc+0x645/0x710 [ 987.239857] getname_flags+0xd6/0x5b0 [ 987.239871] ? trace_hardirqs_off+0xb8/0x310 [ 987.239887] getname+0x1a/0x20 [ 987.248436] do_sys_open+0x3a5/0x7c0 [ 987.248456] ? filp_open+0x80/0x80 [ 987.248479] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 987.248495] ? trace_hardirqs_off_caller+0x300/0x300 [ 987.248514] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 987.248533] __x64_sys_open+0x7e/0xc0 [ 987.248553] do_syscall_64+0x1a3/0x800 [ 987.248573] ? syscall_return_slowpath+0x5f0/0x5f0 [ 987.248606] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 987.248620] ? __switch_to_asm+0x34/0x70 [ 987.248648] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 987.307186] binder: BINDER_SET_CONTEXT_MGR already set [ 987.308798] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 987.308811] RIP: 0033:0x412041 [ 987.308825] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 987.308833] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 987.308851] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 987.313914] binder: 5788:5794 ioctl 40046207 0 returned -16 [ 987.318771] RDX: fffffffffffffffd RSI: 0000000000000000 RDI: 00007fa6fe251bd0 [ 987.318781] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 987.318790] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 987.318799] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 [ 987.323309] binder: 5788:5789 got transaction to invalid handle [ 987.426719] binder: 5788:5789 transaction failed 29201/-22, size 0-0 line 2896 17:21:04 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x4900]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:21:04 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r3 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00', 0x0, 0x8}, 0x10) r4 = dup3(r0, r3, 0x80000) getsockname$netlink(r4, &(0x7f0000000100), &(0x7f0000000140)=0xc) getsockopt$bt_l2cap_L2CAP_CONNINFO(r4, 0x6, 0x2, &(0x7f0000000200), &(0x7f0000000240)=0x6) ioctl$sock_ifreq(r1, 0x8923, &(0x7f00000001c0)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:21:04 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x7fffffffefff, 0x0, 0x0, 0x0) 17:21:04 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000180)='tls\x00', 0x4) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$evdev(&(0x7f00000002c0)='/dev/input/event#\x00', 0x100000000, 0x600040) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000580)=[0x6, 0x7c3]) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r3 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f0000000240)=0xc) syz_open_procfs$namespace(r5, &(0x7f0000000280)='ns/mnt\x00') ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r3, 0x0, 0x48c, &(0x7f0000000200)={0x2, 'ipddp0\x00', 0x1}, 0x18) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="903d72222254ddbe62eabbaeaf00f208c7332b1f7026a3c00f2886fecd919ce1bc0933bc26d1c3c5f05a502ae9581d22d29977f69a93d52e58ee406d41ffef6e7872df94c64bfb47bab4ad7129bbcf03ab419190567bb40657d53b4ee9d5468fa6d55c9c7328255c2a1b5e9287ecce0727ff11a64dda8f6d38b131cdab34cf74759c346adca539acd42ec42d16320959563a8a40af8005b0ef3706687553349271140d7571356f32e1d6d6fd8613c1235cec1cc3a4abb89899ed82960022a8bb49df8c1572e5604d20cb2a47e663d5b10643dcc8877dea46b4e42ce2aadbe425e2d4376373345311c47a3dafbd4fc25958"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:21:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = accept4(r1, &(0x7f0000000080)=@ax25={{}, [@null, @rose, @rose, @remote, @remote, @netrom, @default, @netrom]}, &(0x7f0000000100)=0x80, 0x80000) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f0000000180)={0x8}, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 987.673187] binder: BINDER_SET_CONTEXT_MGR already set [ 987.684652] binder: 5801:5804 ioctl 40046207 0 returned -16 [ 987.693585] binder: 5801:5804 unknown command 577912208 [ 987.702315] binder: 5801:5804 ioctl c0306201 20000140 returned -22 17:21:04 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ftruncate(r0, 0x7) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 987.713842] binder: 5801:5804 got reply transaction with bad transaction stack, transaction 1035 has target 26829:0 17:21:04 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x940000000000, 0x0, 0x0, 0x0) [ 987.778442] binder_alloc: binder_alloc_mmap_handler: 5801 20001000-20004000 already mapped failed -16 [ 987.814258] binder: BINDER_SET_CONTEXT_MGR already set 17:21:04 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x4005) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$FUSE_INIT(r0, &(0x7f0000000300)={0x50, 0x0, 0x3, {0x7, 0x1c, 0x3, 0x40000, 0x5, 0x6, 0x40, 0x10001}}, 0x50) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @empty}, 0x10) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f0000000380)=r0) ioctl$sock_SIOCSIFBR(r2, 0x8941, &(0x7f0000000040)=@get={0x1, &(0x7f00000000c0)=""/89}) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r3 = syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x6, 0x20400) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000280)={0xe, 0x40, {0x57, 0x7, 0x4, {0xfffffffffffffffb, 0x6}, {0x8, 0x2}, @cond=[{0x7fff, 0xfe9, 0x2, 0x1, 0x7, 0x80000000}, {0xff, 0x1, 0x4, 0x7, 0x6, 0xfffffffffffffff7}]}, {0x51, 0x8, 0x7, {0x3, 0xbf0}, {0xc08, 0x40}, @period={0x5d, 0x7, 0x0, 0x1a8, 0xffffffffffffffe0, {0x4, 0x1, 0x7, 0x3}, 0x4, &(0x7f0000000240)=[0x4, 0x5422fb80, 0x400, 0x6]}}}) socket$inet_tcp(0x2, 0x1, 0x0) 17:21:04 executing program 5 (fault-call:2 fault-nth:15): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') [ 987.869533] binder: 5801:5804 unknown command 577912208 [ 987.884650] binder: 5801:5817 got reply transaction with bad transaction stack, transaction 1037 has target 26829:0 [ 987.902717] binder: 5801:5804 ioctl c0306201 20000140 returned -22 [ 987.967329] binder: 5801:5821 ioctl 40046207 0 returned -16 [ 988.013421] binder: release 5801:5804 transaction 1035 out, still active [ 988.028931] binder: undelivered TRANSACTION_COMPLETE [ 988.046366] binder: undelivered TRANSACTION_ERROR: 29201 17:21:04 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000240)={0x2}, 0x1) accept$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000200)=0x14) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 988.063422] binder: release 5801:5817 transaction 1037 out, still active [ 988.084363] binder: undelivered TRANSACTION_COMPLETE [ 988.091118] FAULT_INJECTION: forcing a failure. [ 988.091118] name failslab, interval 1, probability 0, space 0, times 0 17:21:04 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r4 = dup(r0) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r4, 0x111, 0x5, 0xffc0000000000000, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 988.117200] binder: undelivered TRANSACTION_ERROR: 29201 [ 988.154887] CPU: 1 PID: 5835 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 988.161927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 988.171300] Call Trace: [ 988.173897] dump_stack+0x1db/0x2d0 [ 988.177599] ? dump_stack_print_info.cold+0x20/0x20 [ 988.182637] should_fail.cold+0xa/0x15 [ 988.186531] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 988.191651] ? ___might_sleep+0x1e7/0x310 [ 988.195842] ? arch_local_save_flags+0x50/0x50 [ 988.200448] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 988.205556] ? print_usage_bug+0xd0/0xd0 [ 988.209727] __should_failslab+0x121/0x190 [ 988.214014] should_failslab+0x9/0x14 [ 988.218018] kmem_cache_alloc+0x2be/0x710 [ 988.222201] ? __lock_acquire+0x572/0x4a30 [ 988.226462] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 988.232023] __alloc_file+0x93/0x480 [ 988.233262] binder: BINDER_SET_CONTEXT_MGR already set [ 988.236350] ? file_free_rcu+0xe0/0xe0 [ 988.236370] ? mark_held_locks+0x100/0x100 [ 988.236398] alloc_empty_file+0x72/0x170 [ 988.236418] path_openat+0x112/0x5650 [ 988.236437] ? add_lock_to_list.isra.0+0x450/0x450 [ 988.236460] ? __alloc_fd+0x549/0x700 [ 988.262180] binder: 5840:5842 got reply transaction with bad transaction stack, transaction 1039 has target 26829:0 [ 988.262609] ? find_held_lock+0x35/0x120 [ 988.281013] ? path_lookupat.isra.0+0xba0/0xba0 [ 988.285357] binder: 5840:5841 ioctl 40046207 0 returned -16 [ 988.285706] ? do_dup2+0x580/0x580 [ 988.294940] ? kasan_check_read+0x11/0x20 [ 988.299093] ? do_raw_spin_unlock+0xa0/0x330 [ 988.303504] ? do_raw_spin_trylock+0x270/0x270 [ 988.308089] ? __phys_addr_symbol+0x30/0x70 [ 988.312435] do_filp_open+0x26f/0x370 [ 988.316239] ? may_open_dev+0x100/0x100 [ 988.320225] ? exit_files+0xb0/0xb0 [ 988.323888] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 988.329439] ? digsig_verify.cold+0x32/0x32 [ 988.333775] ? get_unused_fd_flags+0x122/0x1a0 [ 988.333801] binder_alloc: binder_alloc_mmap_handler: 5840 20001000-20004000 already mapped failed -16 [ 988.338354] ? __alloc_fd+0x700/0x700 [ 988.338367] ? getname_flags+0x277/0x5b0 [ 988.338381] ? trace_hardirqs_off+0xb8/0x310 [ 988.338400] do_sys_open+0x59a/0x7c0 [ 988.338419] ? filp_open+0x80/0x80 [ 988.338437] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 988.338452] ? trace_hardirqs_off_caller+0x300/0x300 [ 988.338469] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 988.382624] __x64_sys_open+0x7e/0xc0 [ 988.386449] do_syscall_64+0x1a3/0x800 [ 988.390395] ? syscall_return_slowpath+0x5f0/0x5f0 [ 988.395354] ? prepare_exit_to_usermode+0x232/0x3b0 [ 988.400394] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 988.405244] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 988.410433] RIP: 0033:0x412041 [ 988.413628] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 988.432526] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 988.440237] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 988.447506] RDX: fffffffffffffffd RSI: 0000000000000000 RDI: 00007fa6fe251bd0 17:21:05 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) r1 = open(&(0x7f0000000180)='./file0\x00', 0x10000, 0x6) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000200)={0x0, 0x80000}) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000240)={0x0, r2, 0x6}) r3 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r4 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) getsockname$packet(r3, &(0x7f0000000280), &(0x7f00000002c0)=0x14) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c840000"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) getsockopt$XDP_MMAP_OFFSETS(r1, 0x11b, 0x1, &(0x7f0000000380), &(0x7f0000000400)=0x60) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 988.454787] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 988.462064] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 988.469339] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 17:21:05 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000001c0), 0xfffffffffffffd5f) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r0, 0xc0605345, &(0x7f00000000c0)={0xffff, 0x3, {0xffffffffffffffff, 0x3, 0x7, 0x1, 0x2}}) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_bt_bnep_BNEPCONNDEL(r0, 0x400442c9, &(0x7f00000001c0)={0x3, @local}) poll(&(0x7f0000000040)=[{r1}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_GET_CAP(r0, 0xc010640c, &(0x7f0000000140)={0x1, 0x5}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0xffffffff7fffffff) 17:21:05 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x1000000000000, 0x0, 0x0, 0x0) 17:21:05 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="2c63ddff"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000001000/0x1000)=nil, &(0x7f0000000180)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:21:05 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x6005]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:21:05 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00000000c0)=0x8001, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 988.731208] binder: BINDER_SET_CONTEXT_MGR already set [ 988.765583] binder: 5858:5864 unknown command -2268372 17:21:05 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0xff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x100) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x20000, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x20800, 0x0) syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x3, 0x2) r1 = syz_open_dev$usb(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0x58, 0x8000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) ioctl$VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f0000000280)={0xf, @sliced={0x8, [0x3f, 0x2, 0x653, 0x6ef0881d, 0x75, 0x0, 0xff, 0x80000000, 0x1, 0x80, 0x6, 0x9, 0x1, 0x800, 0x3, 0x2, 0x3, 0x9, 0x7fffffff, 0x0, 0x5, 0x9, 0x1f, 0xfffffffffffffff9, 0x9, 0x800, 0x1f, 0x9, 0x5, 0x400, 0x3, 0x53d, 0x1000, 0x8000, 0x1, 0x1ff, 0x7f, 0x2, 0x6215, 0xffffffff00000001, 0x2, 0x20, 0x3, 0x7f, 0xd3, 0x8, 0x4, 0x2643], 0x8}}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) [ 988.783343] binder: 5858:5859 ioctl 40046207 0 returned -16 [ 988.803783] binder: 5858:5864 ioctl c0306201 20000140 returned -22 [ 988.816067] binder: 5858:5871 got reply transaction with no transaction stack 17:21:05 executing program 5 (fault-call:2 fault-nth:16): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:21:05 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x20000000000000, 0x0, 0x0, 0x0) [ 988.905502] binder_transaction: 3 callbacks suppressed [ 988.905519] binder: 5858:5871 transaction failed 29201/-71, size 0-0 line 2801 17:21:05 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0xe94, 0x8000) ioctl$BLKRESETZONE(r2, 0x40101283, &(0x7f0000000100)={0x5, 0x2}) ioctl$VT_ACTIVATE(r2, 0x5606, 0x455aa81d) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) ioctl$CAPI_GET_FLAGS(r2, 0x80044323, &(0x7f0000000140)) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x1, 0x0) ioctl$GIO_FONT(r4, 0x4b60, &(0x7f0000000240)=""/223) [ 989.023300] FAULT_INJECTION: forcing a failure. [ 989.023300] name failslab, interval 1, probability 0, space 0, times 0 [ 989.043039] binder_alloc: binder_alloc_mmap_handler: 5858 20001000-20004000 already mapped failed -16 [ 989.080248] CPU: 0 PID: 5882 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 989.087277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 989.096632] Call Trace: [ 989.099235] dump_stack+0x1db/0x2d0 [ 989.102883] ? dump_stack_print_info.cold+0x20/0x20 [ 989.107925] should_fail.cold+0xa/0x15 [ 989.107954] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 989.116987] ? ___might_sleep+0x1e7/0x310 [ 989.121144] ? arch_local_save_flags+0x50/0x50 [ 989.125790] __should_failslab+0x121/0x190 [ 989.125815] should_failslab+0x9/0x14 [ 989.133847] kmem_cache_alloc_trace+0x2d1/0x760 [ 989.138529] ? __might_sleep+0x95/0x190 [ 989.142515] apparmor_file_alloc_security+0x172/0xad0 [ 989.147709] ? rcu_pm_notify+0xd0/0xd0 [ 989.151615] ? apparmor_path_rename+0xcb0/0xcb0 [ 989.156291] ? __alloc_file+0x93/0x480 [ 989.160203] ? __alloc_file+0x93/0x480 [ 989.164115] ? rcu_read_lock_sched_held+0x110/0x130 [ 989.169140] ? kmem_cache_alloc+0x341/0x710 [ 989.173477] security_file_alloc+0x69/0xb0 [ 989.177726] __alloc_file+0x128/0x480 [ 989.181542] ? file_free_rcu+0xe0/0xe0 [ 989.185442] ? mark_held_locks+0x100/0x100 [ 989.189705] alloc_empty_file+0x72/0x170 [ 989.193794] path_openat+0x112/0x5650 [ 989.197630] ? add_lock_to_list.isra.0+0x450/0x450 [ 989.202585] ? __alloc_fd+0x549/0x700 [ 989.206403] ? find_held_lock+0x35/0x120 [ 989.210499] ? path_lookupat.isra.0+0xba0/0xba0 [ 989.215644] ? do_dup2+0x580/0x580 [ 989.215670] ? kasan_check_read+0x11/0x20 [ 989.215687] ? do_raw_spin_unlock+0xa0/0x330 [ 989.215704] ? do_raw_spin_trylock+0x270/0x270 [ 989.215724] ? __phys_addr_symbol+0x30/0x70 [ 989.236727] do_filp_open+0x26f/0x370 [ 989.236746] ? may_open_dev+0x100/0x100 [ 989.236765] ? exit_files+0xb0/0xb0 [ 989.248178] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 989.253747] ? digsig_verify.cold+0x32/0x32 [ 989.258111] ? get_unused_fd_flags+0x122/0x1a0 [ 989.262715] ? __alloc_fd+0x700/0x700 [ 989.266536] ? getname_flags+0x277/0x5b0 [ 989.270616] ? trace_hardirqs_off+0xb8/0x310 [ 989.275039] do_sys_open+0x59a/0x7c0 [ 989.275077] ? filp_open+0x80/0x80 [ 989.275100] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 989.275116] ? trace_hardirqs_off_caller+0x300/0x300 [ 989.275135] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 989.297592] __x64_sys_open+0x7e/0xc0 [ 989.297615] do_syscall_64+0x1a3/0x800 [ 989.297634] ? syscall_return_slowpath+0x5f0/0x5f0 [ 989.297652] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 989.315270] ? __switch_to_asm+0x34/0x70 [ 989.319352] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 989.324237] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 989.329440] RIP: 0033:0x412041 [ 989.332641] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 989.351560] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 989.359293] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 989.366572] RDX: fffffffffffffffd RSI: 0000000000000000 RDI: 00007fa6fe251bd0 [ 989.373850] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 989.381130] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 989.388410] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 17:21:06 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) prctl$PR_MCE_KILL_GET(0x22) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x0, 0x0) accept4$packet(r1, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 989.460350] binder: release 5858:5864 transaction 1041 out, still active [ 989.473970] binder: undelivered TRANSACTION_COMPLETE [ 989.492025] binder: undelivered TRANSACTION_ERROR: 29201 17:21:06 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x0, 0x2) ioctl$VIDIOC_ENCODER_CMD(r1, 0xc028564d, &(0x7f00000000c0)={0x0, 0x1, [0x1, 0x101, 0x5, 0x6, 0x1, 0x2, 0x200, 0x8]}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x2400000007, 0x0, 0x0) [ 989.536193] binder: BINDER_SET_CONTEXT_MGR already set [ 989.542183] binder: 5890:5891 ioctl 40046207 0 returned -16 [ 989.552385] binder: 5890:5892 got reply transaction with bad transaction stack, transaction 1043 has target 26829:0 [ 989.568020] binder_alloc: binder_alloc_mmap_handler: 5890 20001000-20004000 already mapped failed -16 [ 989.588498] binder: 5890:5892 transaction failed 29201/-71, size 0-0 line 2816 [ 989.620207] binder: BINDER_SET_CONTEXT_MGR already set 17:21:06 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x30710000000000, 0x0, 0x0, 0x0) 17:21:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup2(r1, r2) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r3, 0x111, 0x4, 0x0, 0x4) 17:21:06 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x5) openat$tun(0xffffffffffffff9c, 0x0, 0x400c2, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) clone(0x200000, 0x0, 0xfffffffffffffffe, &(0x7f00000005c0), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000240)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) accept$inet(r0, &(0x7f0000000100)={0x2, 0x0, @loopback}, &(0x7f0000000180)=0x10) [ 989.638106] binder: 5890:5891 ioctl 40046207 0 returned -16 17:21:06 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/exec\x00', 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r0, 0x89a3, &(0x7f00000000c0)={'lo\x00', @ifru_hwaddr=@link_local}) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) 17:21:06 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x6105]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:21:06 executing program 5 (fault-call:2 fault-nth:17): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:21:06 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="fb624040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:21:06 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x40331d487f0000, 0x0, 0x0, 0x0) 17:21:06 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x10000, 0x0) connect$inet(0xffffffffffffffff, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000240)={0x7fff, 0x9, 0x6, 0x8, 0x9, [{0x7, 0x9, 0x9, 0x0, 0x0, 0x4093190049ccfdb4}, {0x38c, 0x7f, 0x81, 0x0, 0x0, 0x300}, {0x9, 0x1, 0x7}, {0x8000, 0x20, 0x3a2319c5}, {0x34, 0x0, 0x9, 0x0, 0x0, 0x96f2bce315095af4}, {0x80000000, 0x9, 0x6c1}, {0x20, 0x2, 0x103940d2, 0x0, 0x0, 0x200}, {0x70e, 0x8001, 0x6, 0x0, 0x0, 0xf04}, {0x5, 0x0, 0x2, 0x0, 0x0, 0x100}]}) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x400000007, 0x0, 0x0) 17:21:06 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x400841, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x200480, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x101082, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dsp\x00', 0x8000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfffffffffffff000) r2 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000680)={{{@in, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@multicast2}}, &(0x7f0000000580)=0xe8) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x7}, 0x4c, r3}) clone(0x1100000, 0x0, 0xfffffffffffffffe, &(0x7f00000003c0), 0xffffffffffffffff) r4 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040), 0x10) [ 990.150190] FAULT_INJECTION: forcing a failure. [ 990.150190] name failslab, interval 1, probability 0, space 0, times 0 [ 990.211931] CPU: 1 PID: 5936 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 990.219108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 990.228461] Call Trace: [ 990.228490] dump_stack+0x1db/0x2d0 [ 990.228528] ? dump_stack_print_info.cold+0x20/0x20 [ 990.228546] ? trace_hardirqs_on+0xbd/0x310 [ 990.228564] ? current_time+0x6e/0x1b0 [ 990.234763] ? trace_hardirqs_off_caller+0x300/0x300 [ 990.234786] should_fail.cold+0xa/0x15 [ 990.234806] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 990.234822] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 990.234843] ? lock_downgrade+0x910/0x910 [ 990.234858] ? kasan_check_read+0x11/0x20 [ 990.234879] ? rcu_read_unlock_special+0x380/0x380 [ 990.234900] __should_failslab+0x121/0x190 [ 990.267682] should_failslab+0x9/0x14 [ 990.267700] kmem_cache_alloc_trace+0x4b/0x760 [ 990.267717] ? new_inode+0x40/0x40 [ 990.267737] ? security_inode_permission+0xd5/0x110 [ 990.276018] proc_self_get_link+0x16f/0x1d0 [ 990.276041] link_path_walk.part.0+0xf41/0x1550 [ 990.276066] ? nd_jump_root+0x1ec/0x3e0 [ 990.276092] ? proc_ns_dir_readdir+0x580/0x580 [ 990.276114] ? walk_component+0x26a0/0x26a0 [ 990.315206] ? __this_cpu_preempt_check+0x1d/0x30 [ 990.315222] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 990.315237] ? percpu_counter_add_batch+0x13c/0x190 [ 990.315265] path_openat+0x222/0x5650 [ 990.315285] ? add_lock_to_list.isra.0+0x450/0x450 [ 990.315308] ? __alloc_fd+0x549/0x700 [ 990.324215] ? find_held_lock+0x35/0x120 [ 990.324235] ? path_lookupat.isra.0+0xba0/0xba0 [ 990.324251] ? do_dup2+0x580/0x580 [ 990.324275] ? kasan_check_read+0x11/0x20 [ 990.369016] ? do_raw_spin_unlock+0xa0/0x330 [ 990.373444] ? do_raw_spin_trylock+0x270/0x270 [ 990.378059] ? __phys_addr_symbol+0x30/0x70 [ 990.382400] do_filp_open+0x26f/0x370 [ 990.386207] ? may_open_dev+0x100/0x100 [ 990.390205] ? digsig_verify.cold+0x32/0x32 [ 990.394540] ? get_unused_fd_flags+0x122/0x1a0 [ 990.399148] ? __alloc_fd+0x700/0x700 [ 990.402958] ? getname_flags+0x277/0x5b0 [ 990.407022] ? trace_hardirqs_off+0xb8/0x310 [ 990.411451] do_sys_open+0x59a/0x7c0 [ 990.415174] ? filp_open+0x80/0x80 [ 990.418740] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 990.424115] ? trace_hardirqs_off_caller+0x300/0x300 [ 990.429230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 990.434011] __x64_sys_open+0x7e/0xc0 [ 990.437859] do_syscall_64+0x1a3/0x800 [ 990.437878] ? syscall_return_slowpath+0x5f0/0x5f0 [ 990.437896] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 990.437910] ? __switch_to_asm+0x34/0x70 [ 990.437932] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 990.437973] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 990.465890] RIP: 0033:0x412041 [ 990.469108] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 990.488028] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 990.495755] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 990.503035] RDX: fffffffffffffffd RSI: 0000000000000000 RDI: 00007fa6fe251bd0 17:21:07 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = semget$private(0x0, 0x1, 0x400) semctl$IPC_STAT(r3, 0x0, 0x2, &(0x7f00000000c0)=""/181) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x800, 0x0) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:21:07 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) r2 = dup2(r0, r1) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000200)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000280)={0x7, 0x8, 0xfa00, {r3, 0x6}}, 0x10) openat$cgroup_ro(r2, &(0x7f0000000180)='io.stat\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r4 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="00634040000000000000000000000006000000000000000000000000000000000000000000a20000000000000000000000000000000000000000080000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="ea620000"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:21:07 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 990.510313] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 990.517585] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 990.524848] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 17:21:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x6000) poll(&(0x7f0000000040)=[{r0, 0x5552}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$nl_crypto(0x10, 0x3, 0x15) 17:21:07 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x80ffff00000000, 0x0, 0x0, 0x0) 17:21:07 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x4e20, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0xffffffffffffff4c) [ 991.167707] binder: release 5519:5551 transaction 1006 out, still active [ 991.175508] binder: undelivered TRANSACTION_COMPLETE [ 991.180760] binder: undelivered TRANSACTION_ERROR: 29201 [ 991.187110] binder: release 5696:5698 transaction 1026 out, still active [ 991.193969] binder: undelivered TRANSACTION_COMPLETE [ 991.199160] binder: undelivered TRANSACTION_ERROR: 29201 [ 991.204853] binder: undelivered TRANSACTION_ERROR: 29201 [ 991.210439] binder: release 5890:5892 transaction 1043 out, still active [ 991.217357] binder: undelivered TRANSACTION_COMPLETE [ 991.222505] binder: undelivered TRANSACTION_ERROR: 29201 [ 991.228154] binder: release 5519:5521 transaction 1004 out, still active [ 991.235054] binder: undelivered TRANSACTION_COMPLETE [ 991.240165] binder: undelivered TRANSACTION_ERROR: 29201 [ 991.245780] binder: release 5589:5595 transaction 1012 out, still active [ 991.252617] binder: undelivered TRANSACTION_COMPLETE [ 991.257786] binder: undelivered TRANSACTION_ERROR: 29201 17:21:08 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x7005]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:21:08 executing program 5 (fault-call:2 fault-nth:18): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:21:08 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) r4 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x2) recvmsg(r4, &(0x7f0000000880)={&(0x7f0000000240)=@in={0x2, 0x0, @remote}, 0xfffffffffffffd4f, &(0x7f0000000800), 0x7, &(0x7f0000000480), 0xee}, 0x140) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r4, 0x408c5333, &(0x7f00000000c0)={0x8, 0xfff, 0x3, 'queue1\x00', 0x400}) connect$inet(r3, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) fcntl$dupfd(r0, 0x406, r0) ioctl$sock_ifreq(r2, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) 17:21:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xa0500000000000, 0x0, 0x0, 0x0) [ 991.263336] binder: release 5840:5842 transaction 1039 out, still active [ 991.270385] binder: undelivered TRANSACTION_COMPLETE [ 991.275550] binder: undelivered TRANSACTION_ERROR: 29201 [ 991.281071] binder: release 5773:5775 transaction 1032 out, still active [ 991.288011] binder: undelivered TRANSACTION_COMPLETE [ 991.293120] binder: undelivered TRANSACTION_ERROR: 29201 [ 991.358540] binder: release 5677:5680 transaction 1024 out, still active [ 991.378793] binder: undelivered TRANSACTION_COMPLETE [ 991.393203] FAULT_INJECTION: forcing a failure. [ 991.393203] name failslab, interval 1, probability 0, space 0, times 0 [ 991.410371] binder: undelivered TRANSACTION_ERROR: 29201 [ 991.430486] binder: release 5559:5563 transaction 1008 out, still active [ 991.454362] CPU: 0 PID: 5977 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 991.461399] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 991.470748] Call Trace: [ 991.470772] dump_stack+0x1db/0x2d0 [ 991.470793] ? dump_stack_print_info.cold+0x20/0x20 [ 991.481992] ? do_sys_open+0x59a/0x7c0 [ 991.485883] ? __x64_sys_open+0x7e/0xc0 [ 991.489863] ? do_syscall_64+0x1a3/0x800 [ 991.493934] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 991.499308] should_fail.cold+0xa/0x15 [ 991.499328] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 991.499350] ? ___might_sleep+0x1e7/0x310 [ 991.512524] ? arch_local_save_flags+0x50/0x50 [ 991.517106] ? single_open+0x4e/0x1e0 [ 991.520929] __should_failslab+0x121/0x190 [ 991.525166] should_failslab+0x9/0x14 [ 991.528967] kmem_cache_alloc+0x2be/0x710 [ 991.533116] ? rcu_read_lock_sched_held+0x110/0x130 [ 991.538139] ? kmem_cache_alloc_trace+0x354/0x760 [ 991.543012] ? rcu_read_lock_sched_held+0x110/0x130 [ 991.548054] seq_open+0x5c/0x1c0 [ 991.551429] ? proc_map_release+0x100/0x100 [ 991.555768] single_open+0x104/0x1e0 [ 991.559486] smaps_rollup_open+0x70/0x160 [ 991.563638] do_dentry_open+0x48a/0x1210 [ 991.567714] ? gather_stats+0x1660/0x1660 [ 991.571863] ? chown_common+0x740/0x740 [ 991.575838] ? security_inode_permission+0xd5/0x110 [ 991.580855] ? inode_permission+0xb4/0x570 [ 991.585096] vfs_open+0xa0/0xd0 [ 991.588379] path_openat+0x144f/0x5650 [ 991.592296] ? add_lock_to_list.isra.0+0x450/0x450 [ 991.597263] ? path_lookupat.isra.0+0xba0/0xba0 [ 991.601953] ? do_dup2+0x580/0x580 [ 991.605510] ? kasan_check_read+0x11/0x20 [ 991.609660] ? do_raw_spin_unlock+0xa0/0x330 [ 991.614082] ? do_raw_spin_trylock+0x270/0x270 [ 991.618668] ? __phys_addr_symbol+0x30/0x70 [ 991.622997] do_filp_open+0x26f/0x370 [ 991.626810] ? may_open_dev+0x100/0x100 [ 991.630842] ? digsig_verify.cold+0x32/0x32 [ 991.635178] ? get_unused_fd_flags+0x122/0x1a0 [ 991.639759] ? __alloc_fd+0x700/0x700 [ 991.643569] ? getname_flags+0x277/0x5b0 [ 991.647651] ? trace_hardirqs_off+0xb8/0x310 [ 991.652077] do_sys_open+0x59a/0x7c0 [ 991.655825] ? filp_open+0x80/0x80 [ 991.659378] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 991.664772] ? trace_hardirqs_off_caller+0x300/0x300 [ 991.669882] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 991.674665] __x64_sys_open+0x7e/0xc0 [ 991.678468] do_syscall_64+0x1a3/0x800 [ 991.682365] ? syscall_return_slowpath+0x5f0/0x5f0 [ 991.687312] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 991.692335] ? __switch_to_asm+0x34/0x70 [ 991.696406] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 991.701263] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 991.706453] RIP: 0033:0x412041 [ 991.709655] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 991.728560] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 991.736262] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 991.743529] RDX: fffffffffffffffd RSI: 0000000000000000 RDI: 00007fa6fe251bd0 [ 991.750810] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f 17:21:08 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SET_TSC(0x1a, 0x2) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) [ 991.758100] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 991.765366] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 [ 991.780738] binder: undelivered TRANSACTION_COMPLETE 17:21:08 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000080)={0x10200, 0x2, 0x10f000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) 17:21:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xa0700000000000, 0x0, 0x0, 0x0) 17:21:08 executing program 4: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) getpeername$ax25(r0, &(0x7f00000000c0)={{}, [@bcast, @default, @default, @netrom, @default, @rose, @default, @netrom]}, &(0x7f0000000040)=0x48) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:21:08 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000180)={@loopback, @multicast1, 0x0}, &(0x7f0000000200)=0xc) getresuid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=0x0) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000380)={{{@in6=@loopback, @in6=@mcast1, 0x4e22, 0x3, 0x4e20, 0x5, 0x0, 0xa0, 0x80, 0x3b, r1, r2}, {0x1, 0x80, 0x9, 0x4, 0x6, 0x7ff, 0x8001, 0x7f}, {0x3, 0x3, 0x80000001, 0x6242}, 0xb40b, 0x6e6bc0, 0x0, 0x1, 0x1, 0x2}, {{@in=@local, 0x4d6, 0xff}, 0xa, @in6=@mcast2, 0x0, 0x4, 0x3, 0x10001, 0x9d7, 0xb566, 0x1}}, 0xe8) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r3 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="40000000b116d535ced34e94ff5cec0690be33d60b0000e7981ff008000000041826749d6a7a1d7dde2e2f7710c8a969dbb83b2b73ce085f92c6"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:21:09 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x406, r0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x100, 0x0) ioctl$VHOST_SET_VRING_ERR(r2, 0x4008af22, &(0x7f00000001c0)={0x3, r3}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000000c0)={0x2, 0x2000004, @broadcast}, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', 0xc00}) ioctl$sock_ifreq(r4, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r5, 0x0, 0x400000007, 0x0, 0x0) r6 = dup2(r4, r4) write$P9_RUNLINKAT(r6, &(0x7f0000000100)={0x7, 0x4d, 0x2}, 0x7) 17:21:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x100000000000000, 0x0, 0x0, 0x0) 17:21:09 executing program 5 (fault-call:2 fault-nth:19): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') [ 992.366000] device bridge_slave_1 left promiscuous mode [ 992.371729] bridge0: port 2(bridge_slave_1) entered disabled state [ 992.446324] device bridge_slave_0 left promiscuous mode [ 992.457979] bridge0: port 1(bridge_slave_0) entered disabled state [ 992.513499] FAULT_INJECTION: forcing a failure. [ 992.513499] name failslab, interval 1, probability 0, space 0, times 0 [ 992.529844] CPU: 0 PID: 6015 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 992.536907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 992.546261] Call Trace: [ 992.548877] dump_stack+0x1db/0x2d0 [ 992.552522] ? dump_stack_print_info.cold+0x20/0x20 [ 992.557560] ? do_sys_open+0x59a/0x7c0 [ 992.561466] ? __x64_sys_open+0x7e/0xc0 [ 992.565483] ? do_syscall_64+0x1a3/0x800 [ 992.569553] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 992.574957] should_fail.cold+0xa/0x15 [ 992.578877] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 992.584006] ? ___might_sleep+0x1e7/0x310 [ 992.588178] ? arch_local_save_flags+0x50/0x50 [ 992.592765] ? single_open+0x4e/0x1e0 [ 992.592791] __should_failslab+0x121/0x190 [ 992.592826] should_failslab+0x9/0x14 [ 992.592842] kmem_cache_alloc+0x2be/0x710 [ 992.592858] ? rcu_read_lock_sched_held+0x110/0x130 [ 992.592874] ? kmem_cache_alloc_trace+0x354/0x760 [ 992.592890] ? rcu_read_lock_sched_held+0x110/0x130 [ 992.592910] seq_open+0x5c/0x1c0 [ 992.592927] ? proc_map_release+0x100/0x100 [ 992.592948] single_open+0x104/0x1e0 [ 992.600969] smaps_rollup_open+0x70/0x160 [ 992.600988] do_dentry_open+0x48a/0x1210 [ 992.601006] ? gather_stats+0x1660/0x1660 [ 992.601024] ? chown_common+0x740/0x740 [ 992.601042] ? security_inode_permission+0xd5/0x110 [ 992.601078] ? inode_permission+0xb4/0x570 [ 992.601099] vfs_open+0xa0/0xd0 [ 992.601118] path_openat+0x144f/0x5650 [ 992.668120] ? add_lock_to_list.isra.0+0x450/0x450 [ 992.668155] ? path_lookupat.isra.0+0xba0/0xba0 [ 992.668171] ? do_dup2+0x580/0x580 [ 992.668209] ? kasan_check_read+0x11/0x20 [ 992.668226] ? do_raw_spin_unlock+0xa0/0x330 [ 992.668243] ? do_raw_spin_trylock+0x270/0x270 [ 992.668260] ? __phys_addr_symbol+0x30/0x70 [ 992.668286] do_filp_open+0x26f/0x370 [ 992.668303] ? may_open_dev+0x100/0x100 [ 992.668335] ? digsig_verify.cold+0x32/0x32 [ 992.668354] ? get_unused_fd_flags+0x122/0x1a0 [ 992.668370] ? __alloc_fd+0x700/0x700 [ 992.668385] ? getname_flags+0x277/0x5b0 [ 992.668399] ? trace_hardirqs_off+0xb8/0x310 [ 992.668421] do_sys_open+0x59a/0x7c0 [ 992.668442] ? filp_open+0x80/0x80 [ 992.668464] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 992.740520] ? trace_hardirqs_off_caller+0x300/0x300 [ 992.745632] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 992.750414] __x64_sys_open+0x7e/0xc0 [ 992.754226] do_syscall_64+0x1a3/0x800 [ 992.758144] ? syscall_return_slowpath+0x5f0/0x5f0 [ 992.763099] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 992.768122] ? __switch_to_asm+0x34/0x70 [ 992.772205] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 992.777101] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 992.782337] RIP: 0033:0x412041 [ 992.785534] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 992.804436] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 992.812157] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 992.812166] RDX: fffffffffffffffd RSI: 0000000000000000 RDI: 00007fa6fe251bd0 [ 992.812176] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 992.812185] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 992.812194] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 17:21:09 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x7105]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:21:09 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x200000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, &(0x7f00000000c0)={0x0, 0x7, 0x8000, 0x4, '\x00', 0x400}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 993.028291] device hsr_slave_1 left promiscuous mode [ 993.080835] device hsr_slave_0 left promiscuous mode [ 993.120614] team0 (unregistering): Port device team_slave_1 removed [ 993.162008] team0 (unregistering): Port device team_slave_0 removed [ 993.233821] bond0 (unregistering): Releasing backup interface bond_slave_1 17:21:10 executing program 5 (fault-call:2 fault-nth:20): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') [ 993.323170] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 993.449440] FAULT_INJECTION: forcing a failure. [ 993.449440] name failslab, interval 1, probability 0, space 0, times 0 [ 993.472720] CPU: 1 PID: 6039 Comm: syz-executor5 Not tainted 5.0.0-rc4 #49 [ 993.479776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 993.489125] Call Trace: [ 993.489152] dump_stack+0x1db/0x2d0 [ 993.489176] ? dump_stack_print_info.cold+0x20/0x20 [ 993.489192] ? do_sys_open+0x59a/0x7c0 [ 993.489216] ? __x64_sys_open+0x7e/0xc0 [ 993.489234] ? do_syscall_64+0x1a3/0x800 [ 993.489253] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 993.489282] should_fail.cold+0xa/0x15 [ 993.489316] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 993.489350] ? ___might_sleep+0x1e7/0x310 [ 993.500635] ? arch_local_save_flags+0x50/0x50 [ 993.500648] ? single_open+0x4e/0x1e0 [ 993.500673] __should_failslab+0x121/0x190 [ 993.500692] should_failslab+0x9/0x14 [ 993.500708] kmem_cache_alloc+0x2be/0x710 [ 993.500724] ? rcu_read_lock_sched_held+0x110/0x130 [ 993.500739] ? kmem_cache_alloc_trace+0x354/0x760 [ 993.500754] ? rcu_read_lock_sched_held+0x110/0x130 [ 993.508601] seq_open+0x5c/0x1c0 [ 993.508620] ? proc_map_release+0x100/0x100 [ 993.508634] single_open+0x104/0x1e0 [ 993.508654] smaps_rollup_open+0x70/0x160 [ 993.508673] do_dentry_open+0x48a/0x1210 [ 993.508691] ? gather_stats+0x1660/0x1660 [ 993.508708] ? chown_common+0x740/0x740 [ 993.508727] ? security_inode_permission+0xd5/0x110 [ 993.518155] ? inode_permission+0xb4/0x570 [ 993.518178] vfs_open+0xa0/0xd0 [ 993.518197] path_openat+0x144f/0x5650 [ 993.518218] ? add_lock_to_list.isra.0+0x450/0x450 [ 993.518254] ? path_lookupat.isra.0+0xba0/0xba0 [ 993.518272] ? do_dup2+0x580/0x580 [ 993.518295] ? kasan_check_read+0x11/0x20 [ 993.518312] ? do_raw_spin_unlock+0xa0/0x330 [ 993.518330] ? do_raw_spin_trylock+0x270/0x270 [ 993.518348] ? __phys_addr_symbol+0x30/0x70 [ 993.518388] do_filp_open+0x26f/0x370 [ 993.518434] ? may_open_dev+0x100/0x100 [ 993.518462] ? digsig_verify.cold+0x32/0x32 [ 993.653657] ? get_unused_fd_flags+0x122/0x1a0 [ 993.658238] ? __alloc_fd+0x700/0x700 [ 993.662079] ? getname_flags+0x277/0x5b0 [ 993.666179] ? trace_hardirqs_off+0xb8/0x310 [ 993.670615] do_sys_open+0x59a/0x7c0 [ 993.674368] ? filp_open+0x80/0x80 [ 993.677920] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 993.683300] ? trace_hardirqs_off_caller+0x300/0x300 [ 993.688477] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 993.693250] __x64_sys_open+0x7e/0xc0 [ 993.697079] do_syscall_64+0x1a3/0x800 [ 993.701019] ? syscall_return_slowpath+0x5f0/0x5f0 [ 993.705978] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 993.711015] ? __switch_to_asm+0x34/0x70 [ 993.715162] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 993.720015] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 993.725213] RIP: 0033:0x412041 [ 993.728412] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 2a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 73 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 993.747318] RSP: 002b:00007fa6fe251bb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 993.755027] RAX: ffffffffffffffda RBX: 00007fa6fe251c90 RCX: 0000000000412041 [ 993.762305] RDX: fffffffffffffffd RSI: 0000000000000000 RDI: 00007fa6fe251bd0 [ 993.769613] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 000000000000000f [ 993.776907] R10: 0000000000000004 R11: 0000000000000293 R12: 00007fa6fe2526d4 [ 993.784174] R13: 00000000004c6d0f R14: 00000000004dc1f8 R15: 0000000000000004 [ 993.871887] bond0 (unregistering): Released all slaves 17:21:10 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x7205]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:21:10 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x32f6, 0x0, 0x10002, 0x4da}) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000100)={r2, 0xffffffffffffff81}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 993.981147] IPVS: ftp: loaded support on port[0] = 21 17:21:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x100004000000000, 0x0, 0x0, 0x0) 17:21:10 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x2b, &(0x7f00000000c0)=0x3ff, 0x4) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000040)={'ipddp0\x00', 0x4}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r3, &(0x7f0000000100)={0x2, 0x4e21, @rand_addr=0x3}, 0x206) ioctl$sock_ifreq(r2, 0x8928, &(0x7f0000000200)={'_to_hsr\x00', @ifru_data=&(0x7f0000000140)="a952efeabffe9fb1ca67037d29060f2c5e9b7bc28dd70e594e57e9b45e7a0f8a"}) socket$inet6(0xa, 0x2, 0x8001) setsockopt$inet_int(r3, 0x0, 0x400000007, 0x0, 0x0) 17:21:11 executing program 5 (fault-call:2 fault-nth:21): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') [ 994.430012] chnl_net:caif_netlink_parms(): no params data found [ 994.573123] bridge0: port 1(bridge_slave_0) entered blocking state [ 994.600849] bridge0: port 1(bridge_slave_0) entered disabled state [ 994.630878] device bridge_slave_0 entered promiscuous mode [ 994.638585] bridge0: port 2(bridge_slave_1) entered blocking state [ 994.645098] bridge0: port 2(bridge_slave_1) entered disabled state [ 994.652696] device bridge_slave_1 entered promiscuous mode [ 994.694656] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 994.728774] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 994.778409] team0: Port device team_slave_0 added [ 994.795423] team0: Port device team_slave_1 added [ 994.910256] device hsr_slave_0 entered promiscuous mode [ 994.964982] device hsr_slave_1 entered promiscuous mode [ 995.146289] 8021q: adding VLAN 0 to HW filter on device bond0 [ 995.167682] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 995.175861] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 995.195321] 8021q: adding VLAN 0 to HW filter on device team0 [ 995.205715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 995.226371] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 995.249916] bridge0: port 1(bridge_slave_0) entered blocking state [ 995.256360] bridge0: port 1(bridge_slave_0) entered forwarding state [ 995.290223] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 995.297814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 995.306131] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 995.313797] bridge0: port 2(bridge_slave_1) entered blocking state [ 995.320214] bridge0: port 2(bridge_slave_1) entered forwarding state [ 995.327891] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 995.336431] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 995.356579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 995.365528] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 995.373296] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 995.383374] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 995.392105] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 995.400227] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 995.414962] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 995.422623] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 995.432531] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 995.440530] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 995.464373] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 995.548002] binder: BINDER_SET_CONTEXT_MGR already set [ 995.553368] binder: 6075:6076 ioctl 40046207 0 returned -16 [ 995.567911] binder: 6075:6077 unknown command 64 [ 995.572678] binder: 6075:6077 ioctl c0306201 20000000 returned -22 [ 995.588794] binder_alloc: binder_alloc_mmap_handler: 6075 20001000-20004000 already mapped failed -16 17:21:12 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) r1 = syz_open_dev$radio(&(0x7f0000000180)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000200)='yeah\x00', 0x5) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r2) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r3 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) ioctl$KVM_SET_XCRS(r1, 0x4188aea7, &(0x7f0000000240)={0x2, 0x23fe, [{0x6c5, 0x0, 0x2}, {0x7f, 0x0, 0x93}]}) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:21:12 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x3f, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r3 = msgget(0x1, 0x20) msgctl$MSG_STAT(r3, 0xb, &(0x7f0000000140)=""/26) sendmmsg(r0, &(0x7f0000000380)=[{{&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x4, 0x3, 0x2, 0x1}}, 0x80, &(0x7f0000000340)=[{&(0x7f00000002c0)="6bf2ecf1d16a98502fa6eee4cc5d2579de4f72f477f8e669bfe83fed804d67aa976889faacff6d56caeef5be203034be39f0e8a86864962a8a2b1e9b59271f673aee51bd3ee291acae5485bac86999f97b0d365e7e15d84a97497de66a7a7f63dad21b071bc3a1da4ce162bf6373f8f1fb183f98c51958d3dce6d6f6", 0x7c}, {&(0x7f00000001c0)="50ce2fd1b51b7cc2c884489d9e494957f5f73728f362b8ca606041af9a6b60528f6b89ae70027075f54569a97143833eeb25", 0x32}], 0x2}, 0x80}], 0x1, 0x800) ioctl$sock_ifreq(r1, 0x8935, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) r4 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x0, 0x103000) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r4, 0x40505331, &(0x7f00000000c0)={{0x200, 0x5}, {0x4, 0x7}, 0x5, 0x1, 0x8000}) setsockopt$inet_int(r2, 0x0, 0x400000007, 0x0, 0x0) 17:21:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x100008000000000, 0x0, 0x0, 0x0) 17:21:12 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000080)=0xffffffffffffffff, 0x4) r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000280)='/dev/btrfs-control\x00', 0x60002, 0x0) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm_plock\x00', 0x111200, 0x0) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000300)={r4, 0xff, 0x2, r5}) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f00000000c0)={r1, r3}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r6 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180)='/dev/cachefiles\x00', 0x0, 0x0) getsockopt$X25_QBITINCL(r6, 0x106, 0x1, &(0x7f00000001c0), &(0x7f0000000380)=0x399) syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x0, 0x2) 17:21:12 executing program 5: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') 17:21:12 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x7401]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 995.602504] binder: BINDER_SET_CONTEXT_MGR already set [ 995.610300] binder: 6075:6079 unknown command 64 [ 995.620012] binder: 6075:6078 ioctl 40046207 0 returned -16 [ 995.629104] binder: 6075:6079 ioctl c0306201 20000000 returned -22 17:21:12 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fc) [ 995.853109] binder: BINDER_SET_CONTEXT_MGR already set 17:21:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x10000c000000000, 0x0, 0x0, 0x0) 17:21:12 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x7105]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 995.884615] binder: 6088:6092 ioctl 40046207 0 returned -16 [ 995.978112] binder: 6088:6097 got reply transaction with no transaction stack [ 995.995408] binder: 6088:6097 transaction failed 29201/-71, size 0-0 line 2801 17:21:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x101000000000000, 0x0, 0x0, 0x0) 17:21:13 executing program 5: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='.d/3\x00') [ 996.523350] binder_thread_release: 1 callbacks suppressed [ 996.523362] binder: release 6088:6092 transaction 1047 out, still active [ 996.536688] binder: BINDER_SET_CONTEXT_MGR already set [ 996.542340] binder_alloc: binder_alloc_mmap_handler: 6088 20001000-20004000 already mapped failed -16 [ 996.583501] binder_release_work: 1 callbacks suppressed [ 996.583506] binder: undelivered TRANSACTION_COMPLETE [ 996.621740] binder: 6088:6108 ioctl 40046207 0 returned -16 17:21:13 executing program 2: syz_open_dev$mice(&(0x7f0000000380)='/dev/input/mice\x00', 0x0, 0x0) r0 = syz_open_dev$radio(&(0x7f0000000d00)='/dev/radio#\x00', 0x0, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x5) socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000005500)='/dev/ptmx\x00', 0x4040, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000880)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x100000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x100000000, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0xf39, 0x80, 0x0, 0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x80000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2a, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x100000000, 0x0, 0xd87e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x100, 0x0, 0xfff, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10e3], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10000, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x1, 0x40, 0x7fff, 0x0, 0x3, 0xd7b, 0x7fff, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffff801, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff]}, 0x45c) write$uinput_user_dev(r1, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r1, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') setsockopt$IP_VS_SO_SET_EDIT(r3, 0x0, 0x483, &(0x7f00000003c0)={0x3c, @remote, 0x4e24, 0x0, 'rr\x00', 0x2, 0x1, 0x39}, 0x2c) ioctl$sock_inet_SIOCGIFPFLAGS(r3, 0x8935, &(0x7f00000002c0)={'teql0\x00', 0x9}) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) mount(&(0x7f0000000d40)=ANY=[@ANYBLOB="eb211b0ef5df1b0a7eadeab0c375a3a40e25becc9ec416499d8b4e102990454cc6b61826eeb2a4055c208a803e9c8e8bf7ff0091212e4d9e4c25acf6de1e78825db21649beee91a9d1da4e1aa55dbe47c9412195d377a170c16d7d850000cf75f43ce3f1d70b9d7baa8f2467e8609efe14e3ff387733d1193d4cb8fa7d482f01e622d3623ab5cfe1f830ad600a7510b690426141f8d92d0d51745903c515374b1f26454558028ff8c07028d9bb64a78447e7b4cab96e224666e5c8a634a91f2ef0ca27d5f7004971bcc7bb816deb5f4715b884559273470e037a30f80f4e18cc10507afa3c2ee8172c72c2d60479c66d36"], 0x0, &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000001080)=ANY=[@ANYBLOB="3897c61e2344b35ce4b0e8eb675766d6275488bb0fb34f52ffa1089aff3a2dda6d16dcf001000000000500008dceea7874f6208b34717c5700000000cfd93e445671550a8131d19d47af813d1effddfa410ab50011ffc05e23ecae9d6fef37369660d49e263204e3be81e6d3060000003bb51680602313592cdde014d02bb12ec63c4ceedd3f06ea455037a69af87b942ef894b893d0761fe349b2648b"], 0x0, &(0x7f0000000ec0)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000e40)=ANY=[@ANYBLOB="7d20b18ea9d8cbd05701494859c80d65e7c09716197ba7bf93c6c1bd260fd36a5c3da4fb6ef3843547466fbd27e29ae74ebe23e123a35d260feffbb8749328ef86aced270537991bc9384cb104681b74dafff7172b9046c5a11684ba0f30195a54a4218c66c88d112ff6"], 0x0, &(0x7f0000fdb000)='ubifs\x00', 0x80010, 0x0) mount(&(0x7f0000000f40)=ANY=[@ANYBLOB="36fcf0a5c67e3fc35e8ad531e4daa7c28e92c297595bda2ed8b4cd21ddee00001ff2576af6e0e114f19f48acda31a0d49f6a7c8a080000000000000067777f1aac600ab8e87c02f62946ae174dfd7035df9917479db88f28"], 0x0, &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000f00)=ANY=[@ANYBLOB="8c77faa59e8663bc117b0d7f59d676"], 0x0, &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000e7000)) [ 996.629131] binder_release_work: 2 callbacks suppressed [ 996.629138] binder: undelivered TRANSACTION_ERROR: 29201 17:21:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x200000000000000, 0x0, 0x0, 0x0) 17:21:13 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x4) [ 996.915843] input: syz1 as /devices/virtual/input/input19 17:21:13 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x2) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x42, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040"], 0x0, 0x0, 0x0}) sigaltstack(&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000100)) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) 17:21:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x400000000000000, 0x0, 0x0, 0x0) 17:21:14 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x7501]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 17:21:14 executing program 4: syz_open_dev$mice(&(0x7f0000000380)='/dev/input/mice\x00', 0x0, 0x0) r0 = syz_open_dev$radio(&(0x7f0000000d00)='/dev/radio#\x00', 0x0, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x5) socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000005500)='/dev/ptmx\x00', 0x4040, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000880)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x100000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x100000000, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0xf39, 0x80, 0x0, 0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x80000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2a, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x100000000, 0x0, 0xd87e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x100, 0x0, 0xfff, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10e3], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10000, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x1, 0x40, 0x7fff, 0x0, 0x3, 0xd7b, 0x7fff, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffff801, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff]}, 0x45c) write$uinput_user_dev(r1, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r1, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') setsockopt$IP_VS_SO_SET_EDIT(r3, 0x0, 0x483, &(0x7f00000003c0)={0x3c, @remote, 0x4e24, 0x0, 'rr\x00', 0x2, 0x1, 0x39}, 0x2c) ioctl$sock_inet_SIOCGIFPFLAGS(r3, 0x8935, &(0x7f00000002c0)={'teql0\x00', 0x9}) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) mount(&(0x7f0000000d40)=ANY=[@ANYBLOB="eb211b0ef5df1b0a7eadeab0c375a3a40e25becc9ec416499d8b4e102990454cc6b61826eeb2a4055c208a803e9c8e8bf7ff0091212e4d9e4c25acf6de1e78825db21649beee91a9d1da4e1aa55dbe47c9412195d377a170c16d7d850000cf75f43ce3f1d70b9d7baa8f2467e8609efe14e3ff387733d1193d4cb8fa7d482f01e622d3623ab5cfe1f830ad600a7510b690426141f8d92d0d51745903c515374b1f26454558028ff8c07028d9bb64a78447e7b4cab96e224666e5c8a634a91f2ef0ca27d5f7004971bcc7bb816deb5f4715b884559273470e037a30f80f4e18cc10507afa3c2ee8172c72c2d60479c66d36"], 0x0, &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000001080)=ANY=[@ANYBLOB="3897c61e2344b35ce4b0e8eb675766d6275488bb0fb34f52ffa1089aff3a2dda6d16dcf001000000000500008dceea7874f6208b34717c5700000000cfd93e445671550a8131d19d47af813d1effddfa410ab50011ffc05e23ecae9d6fef37369660d49e263204e3be81e6d3060000003bb51680602313592cdde014d02bb12ec63c4ceedd3f06ea455037a69af87b942ef894b893d0761fe349b2648b"], 0x0, &(0x7f0000000ec0)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000e40)=ANY=[@ANYBLOB="7d20b18ea9d8cbd05701494859c80d65e7c09716197ba7bf93c6c1bd260fd36a5c3da4fb6ef3843547466fbd27e29ae74ebe23e123a35d260feffbb8749328ef86aced270537991bc9384cb104681b74dafff7172b9046c5a11684ba0f30195a54a4218c66c88d112ff6"], 0x0, &(0x7f0000fdb000)='ubifs\x00', 0x80010, 0x0) mount(&(0x7f0000000f40)=ANY=[@ANYBLOB="36fcf0a5c67e3fc35e8ad531e4daa7c28e92c297595bda2ed8b4cd21ddee00001ff2576af6e0e114f19f48acda31a0d49f6a7c8a080000000000000067777f1aac600ab8e87c02f62946ae174dfd7035df9917479db88f28"], 0x0, &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000f00)=ANY=[@ANYBLOB="8c77faa59e8663bc117b0d7f59d676"], 0x0, &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000e7000)) [ 997.394930] input: syz1 as /devices/virtual/input/input20 17:21:14 executing program 4: syz_open_dev$mice(&(0x7f0000000380)='/dev/input/mice\x00', 0x0, 0x0) r0 = syz_open_dev$radio(&(0x7f0000000d00)='/dev/radio#\x00', 0x0, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x5) socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000005500)='/dev/ptmx\x00', 0x4040, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000880)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x100000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x100000000, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0xf39, 0x80, 0x0, 0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x80000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2a, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x100000000, 0x0, 0xd87e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x100, 0x0, 0xfff, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10e3], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10000, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x1, 0x40, 0x7fff, 0x0, 0x3, 0xd7b, 0x7fff, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffff801, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff]}, 0x45c) write$uinput_user_dev(r1, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r1, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') setsockopt$IP_VS_SO_SET_EDIT(r3, 0x0, 0x483, &(0x7f00000003c0)={0x3c, @remote, 0x4e24, 0x0, 'rr\x00', 0x2, 0x1, 0x39}, 0x2c) ioctl$sock_inet_SIOCGIFPFLAGS(r3, 0x8935, &(0x7f00000002c0)={'teql0\x00', 0x9}) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) mount(&(0x7f0000000d40)=ANY=[@ANYBLOB="eb211b0ef5df1b0a7eadeab0c375a3a40e25becc9ec416499d8b4e102990454cc6b61826eeb2a4055c208a803e9c8e8bf7ff0091212e4d9e4c25acf6de1e78825db21649beee91a9d1da4e1aa55dbe47c9412195d377a170c16d7d850000cf75f43ce3f1d70b9d7baa8f2467e8609efe14e3ff387733d1193d4cb8fa7d482f01e622d3623ab5cfe1f830ad600a7510b690426141f8d92d0d51745903c515374b1f26454558028ff8c07028d9bb64a78447e7b4cab96e224666e5c8a634a91f2ef0ca27d5f7004971bcc7bb816deb5f4715b884559273470e037a30f80f4e18cc10507afa3c2ee8172c72c2d60479c66d36"], 0x0, &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000001080)=ANY=[@ANYBLOB="3897c61e2344b35ce4b0e8eb675766d6275488bb0fb34f52ffa1089aff3a2dda6d16dcf001000000000500008dceea7874f6208b34717c5700000000cfd93e445671550a8131d19d47af813d1effddfa410ab50011ffc05e23ecae9d6fef37369660d49e263204e3be81e6d3060000003bb51680602313592cdde014d02bb12ec63c4ceedd3f06ea455037a69af87b942ef894b893d0761fe349b2648b"], 0x0, &(0x7f0000000ec0)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000e40)=ANY=[@ANYBLOB="7d20b18ea9d8cbd05701494859c80d65e7c09716197ba7bf93c6c1bd260fd36a5c3da4fb6ef3843547466fbd27e29ae74ebe23e123a35d260feffbb8749328ef86aced270537991bc9384cb104681b74dafff7172b9046c5a11684ba0f30195a54a4218c66c88d112ff6"], 0x0, &(0x7f0000fdb000)='ubifs\x00', 0x80010, 0x0) mount(&(0x7f0000000f40)=ANY=[@ANYBLOB="36fcf0a5c67e3fc35e8ad531e4daa7c28e92c297595bda2ed8b4cd21ddee00001ff2576af6e0e114f19f48acda31a0d49f6a7c8a080000000000000067777f1aac600ab8e87c02f62946ae174dfd7035df9917479db88f28"], 0x0, &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000f00)=ANY=[@ANYBLOB="8c77faa59e8663bc117b0d7f59d676"], 0x0, &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000e7000)) 17:21:14 executing program 5: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000940)='smaps_rollup\x00') exit(0x0) syz_open_procfs(0x0, &(0x7f0000000080)='/d/3\x00') 17:21:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x500000000000000, 0x0, 0x0, 0x0) 17:21:14 executing program 4: syz_open_dev$mice(&(0x7f0000000380)='/dev/input/mice\x00', 0x0, 0x0) r0 = syz_open_dev$radio(&(0x7f0000000d00)='/dev/radio#\x00', 0x0, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x5) socket$inet(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xfffffffffffff3f7, 0x80003) perf_event_open(&(0x7f0000000500)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001500), &(0x7f0000001480)=0xe0cfab3e9cf9157) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000014c0), 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000005500)='/dev/ptmx\x00', 0x4040, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000880)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x100000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x100000000, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0xf39, 0x80, 0x0, 0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x80000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2a, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x100000000, 0x0, 0xd87e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x100, 0x0, 0xfff, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10e3], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10000, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x1, 0x40, 0x7fff, 0x0, 0x3, 0xd7b, 0x7fff, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffff801, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff]}, 0x45c) write$uinput_user_dev(r1, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r1, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') setsockopt$IP_VS_SO_SET_EDIT(r3, 0x0, 0x483, &(0x7f00000003c0)={0x3c, @remote, 0x4e24, 0x0, 'rr\x00', 0x2, 0x1, 0x39}, 0x2c) ioctl$sock_inet_SIOCGIFPFLAGS(r3, 0x8935, &(0x7f00000002c0)={'teql0\x00', 0x9}) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000140)) mount(&(0x7f0000000d40)=ANY=[@ANYBLOB="eb211b0ef5df1b0a7eadeab0c375a3a40e25becc9ec416499d8b4e102990454cc6b61826eeb2a4055c208a803e9c8e8bf7ff0091212e4d9e4c25acf6de1e78825db21649beee91a9d1da4e1aa55dbe47c9412195d377a170c16d7d850000cf75f43ce3f1d70b9d7baa8f2467e8609efe14e3ff387733d1193d4cb8fa7d482f01e622d3623ab5cfe1f830ad600a7510b690426141f8d92d0d51745903c515374b1f26454558028ff8c07028d9bb64a78447e7b4cab96e224666e5c8a634a91f2ef0ca27d5f7004971bcc7bb816deb5f4715b884559273470e037a30f80f4e18cc10507afa3c2ee8172c72c2d60479c66d36"], 0x0, &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000001080)=ANY=[@ANYBLOB="3897c61e2344b35ce4b0e8eb675766d6275488bb0fb34f52ffa1089aff3a2dda6d16dcf001000000000500008dceea7874f6208b34717c5700000000cfd93e445671550a8131d19d47af813d1effddfa410ab50011ffc05e23ecae9d6fef37369660d49e263204e3be81e6d3060000003bb51680602313592cdde014d02bb12ec63c4ceedd3f06ea455037a69af87b942ef894b893d0761fe349b2648b"], 0x0, &(0x7f0000000ec0)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000000e40)=ANY=[@ANYBLOB="7d20b18ea9d8cbd05701494859c80d65e7c09716197ba7bf93c6c1bd260fd36a5c3da4fb6ef3843547466fbd27e29ae74ebe23e123a35d260feffbb8749328ef86aced270537991bc9384cb104681b74dafff7172b9046c5a11684ba0f30195a54a4218c66c88d112ff6"], 0x0, &(0x7f0000fdb000)='ubifs\x00', 0x80010, 0x0) mount(&(0x7f0000000f40)=ANY=[@ANYBLOB="36fcf0a5c67e3fc35e8ad531e4daa7c28e92c297595bda2ed8b4cd21ddee00001ff2576af6e0e114f19f48acda31a0d49f6a7c8a080000000000000067777f1aac600ab8e87c02f62946ae174dfd7035df9917479db88f28"], 0x0, &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(&(0x7f0000000f00)=ANY=[@ANYBLOB="8c77faa59e8663bc117b0d7f59d676"], 0x0, &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000e7000)) 17:21:14 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3, &(0x7f0000000080)=0x0) io_cancel(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2, 0xfffffffffffff63c, r1, &(0x7f0000000180)="a3c28fb19232b0d58fb097304eba4adbb26a294f420c8c636ca229235bd46848bd097f88e770cbc663fb7649c3ac626bf645a18f62f8c4405ae1ecc4d0a6e8f89606d47d06e78d5736dfda2c9f920e2d8b95741f35362f46bd6f4d079ff2681d9d8075514524a4f51602bb52491f3b94f70b03b8da050bd0559cca368f2e1645287f627b10031892eee21aabc6fcb6035a54cea035a1a562c46f28b2f05a856d5a6010cf7a2f7685d5c68b6eb7ccc780bc0a6dedc7c49fc5099a51dcd888731748c4b07dddb3f834e6d381027f47dd8d6659a50ceb46e0ac5b271f1aa2fad4c938abad3090bc353e831fc81bb7570ab8f47612ac82", 0xf5, 0xfbd7, 0x0, 0x6e697a838439b008, r1}, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 17:21:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x600000000000000, 0x0, 0x0, 0x0) [ 997.927178] input: syz1 as /devices/virtual/input/input21 17:21:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x700000000000000, 0x0, 0x0, 0x0) 17:21:15 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x4000, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x7b, 0x0, [0x4b564d01, 0x3400]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 1142.424679] INFO: task syz-executor2:6014 blocked for more than 140 seconds. [ 1142.432023] Not tainted 5.0.0-rc4 #49 [ 1142.436865] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1142.444878] syz-executor2 D20440 6014 1 0x00000004 [ 1142.450506] Call Trace: [ 1142.453118] __schedule+0x897/0x1e60 [ 1142.456903] ? pci_mmcfg_check_reserved+0x170/0x170 [ 1142.461957] ? __mutex_lock+0xa36/0x1670 [ 1142.466059] ? find_held_lock+0x35/0x120 [ 1142.470112] schedule+0xfe/0x350 [ 1142.473461] ? __schedule+0x1e60/0x1e60 [ 1142.477463] ? __mutex_add_waiter+0x1e3/0x290 [ 1142.481963] ? do_raw_spin_trylock+0x270/0x270 [ 1142.486572] ? mutex_destroy+0x200/0x200 [ 1142.490678] schedule_preempt_disabled+0x13/0x20 [ 1142.495495] __mutex_lock+0xa3b/0x1670 [ 1142.499417] ? fuse_lock_inode+0xba/0xf0 [ 1142.503526] ? mutex_trylock+0x2d0/0x2d0 [ 1142.508295] ? find_held_lock+0x35/0x120 [ 1142.512368] ? d_alloc_parallel+0x8d3/0x1f10 [ 1142.517426] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1142.522955] ? lock_downgrade+0x910/0x910 [ 1142.527139] ? kasan_check_read+0x11/0x20 [ 1142.531280] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1142.536588] ? rcu_read_unlock_special+0x380/0x380 [ 1142.541506] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1142.547154] ? d_alloc_parallel+0xb68/0x1f10 [ 1142.551571] ? __d_lookup+0x560/0x960 [ 1142.555434] mutex_lock_nested+0x16/0x20 [ 1142.559482] ? mutex_lock_nested+0x16/0x20 [ 1142.563696] fuse_lock_inode+0xba/0xf0 [ 1142.568096] fuse_lookup+0x8e/0x380 [ 1142.571720] ? lock_downgrade+0x910/0x910 [ 1142.575984] ? fuse_lookup_name+0x860/0x860 [ 1142.580302] ? lockdep_init_map+0x10c/0x5b0 [ 1142.584794] ? __init_waitqueue_head+0x92/0x150 [ 1142.589454] ? init_wait_entry+0x1c0/0x1c0 [ 1142.593683] ? __d_lookup+0x587/0x960 [ 1142.597537] __lookup_slow+0x2cd/0x560 [ 1142.601413] ? vfs_unlink+0x500/0x500 [ 1142.605244] ? lock_release+0xc40/0xc40 [ 1142.609214] ? __down_interruptible+0x740/0x740 [ 1142.613867] ? trailing_symlink+0x970/0x970 [ 1142.618218] lookup_slow+0x58/0x80 [ 1142.621753] walk_component+0x8e5/0x26a0 [ 1142.625846] ? mntput_no_expire+0x197/0xbd0 [ 1142.630160] ? find_held_lock+0x35/0x120 [ 1142.634207] ? path_init+0x1ef0/0x1ef0 [ 1142.638133] ? fuse_permission+0x2cd/0x5d0 [ 1142.642358] ? fuse_getattr+0x450/0x450 [ 1142.646360] ? lock_downgrade+0x910/0x910 [ 1142.650497] ? kasan_check_read+0x11/0x20 [ 1142.654689] ? lockref_get+0x46/0x60 [ 1142.658389] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1142.663908] ? security_inode_permission+0xd5/0x110 [ 1142.669105] ? inode_permission+0xb4/0x570 [ 1142.673335] link_path_walk.part.0+0xa57/0x1550 [ 1142.678054] ? walk_component+0x26a0/0x26a0 [ 1142.682370] ? _raw_spin_unlock+0x2d/0x50 [ 1142.686562] ? lockref_get+0x46/0x60 [ 1142.690264] ? path_get+0x66/0x80 [ 1142.693697] ? nd_jump_root+0x1ec/0x3e0 [ 1142.698185] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1142.703725] ? trailing_symlink+0x2b5/0x970 [ 1142.708244] path_mountpoint+0xf0/0x21a0 [ 1142.712302] ? kasan_slab_alloc+0xf/0x20 [ 1142.716413] ? kmem_cache_alloc+0x12d/0x710 [ 1142.720726] ? getname_flags+0xd6/0x5b0 [ 1142.724746] ? user_path_mountpoint_at+0x29/0x50 [ 1142.729487] ? ksys_umount+0x198/0x1340 [ 1142.733441] ? __x64_sys_umount+0x54/0x80 [ 1142.737693] ? do_syscall_64+0x1a3/0x800 [ 1142.741821] ? path_openat+0x5650/0x5650 [ 1142.745936] ? check_stack_object+0x114/0x160 [ 1142.750421] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1142.755995] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1142.761551] ? __phys_addr_symbol+0x30/0x70 [ 1142.765914] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 1142.770938] ? __check_object_size+0xa3/0x790 [ 1142.775472] filename_mountpoint+0x258/0x490 [ 1142.779870] ? user_path_at_empty+0x50/0x50 [ 1142.784182] ? digsig_verify.cold+0x32/0x32 [ 1142.788551] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1142.794070] ? getname_flags+0x277/0x5b0 [ 1142.798160] user_path_mountpoint_at+0x3a/0x50 [ 1142.802730] ksys_umount+0x198/0x1340 [ 1142.806560] ? lock_downgrade+0x910/0x910 [ 1142.810716] ? __detach_mounts+0x4d0/0x4d0 [ 1142.815004] ? __might_fault+0x1a3/0x1e0 [ 1142.819055] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1142.825104] ? do_syscall_64+0x8c/0x800 [ 1142.829139] ? do_syscall_64+0x8c/0x800 [ 1142.833103] ? lockdep_hardirqs_on+0x415/0x5d0 [ 1142.837727] ? trace_hardirqs_on+0xbd/0x310 [ 1142.842044] ? fillonedir+0x300/0x300 [ 1142.845880] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1142.851229] ? trace_hardirqs_off_caller+0x300/0x300 [ 1142.856371] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1142.861116] __x64_sys_umount+0x54/0x80 [ 1142.865122] do_syscall_64+0x1a3/0x800 [ 1142.869002] ? syscall_return_slowpath+0x5f0/0x5f0 [ 1142.873915] ? prepare_exit_to_usermode+0x232/0x3b0 [ 1142.878991] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1142.883830] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1142.889051] RIP: 0033:0x45aae7 [ 1142.892235] Code: 39 3b 75 8c 48 89 23 eb 87 cc cc cc cc cc cc cc cc cc cc 64 48 8b 0c 25 f8 ff ff ff 48 8b 71 10 48 81 fe de fa ff ff 0f 84 90 <00> 00 00 48 8d 84 24 70 03 00 00 48 29 f0 48 3d f8 02 04 00 76 7d [ 1142.911175] RSP: 002b:00007ffc5703eca8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 1142.918909] RAX: ffffffffffffffda RBX: 00000000000f36f7 RCX: 000000000045aae7 [ 1142.926354] RDX: 0000000000402eb0 RSI: 0000000000000002 RDI: 00007ffc5703ed50 [ 1142.933640] RBP: 000000000000000f R08: 0000000000000000 R09: 000000000000000a [ 1142.940946] R10: 0000000000000006 R11: 0000000000000202 R12: 00007ffc5703fde0 [ 1142.948253] R13: 0000000001431940 R14: 0000000000000000 R15: 0000000000000002 [ 1142.956052] [ 1142.956052] Showing all locks held in the system: [ 1142.962381] 1 lock held by khungtaskd/1040: [ 1142.966722] #0: 00000000c0e2bff1 (rcu_read_lock){....}, at: debug_show_all_locks+0xc6/0x41d [ 1142.975416] 1 lock held by rsyslogd/7896: [ 1142.979542] #0: 0000000047c8a126 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1b3/0x1f0 [ 1142.987593] 2 locks held by getty/7986: [ 1142.991574] #0: 00000000943708be (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1142.999872] #1: 00000000cf035cf6 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 [ 1143.008843] 2 locks held by getty/7987: [ 1143.012793] #0: 0000000013b0395d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1143.021055] #1: 00000000e148326a (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 [ 1143.029932] 2 locks held by getty/7988: [ 1143.033883] #0: 000000006f130e9b (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1143.042148] #1: 00000000f9868900 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 [ 1143.051177] 2 locks held by getty/7989: [ 1143.055184] #0: 000000001fe628fd (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1143.063417] #1: 0000000064256a28 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 [ 1143.072366] 2 locks held by getty/7990: [ 1143.076408] #0: 00000000f3999472 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1143.085133] #1: 000000003fe24d21 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 [ 1143.093981] 2 locks held by getty/7991: [ 1143.097979] #0: 000000002a1b9dfd (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1143.106230] #1: 00000000cd859f0d (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 [ 1143.115118] 2 locks held by getty/7992: [ 1143.119070] #0: 00000000d25b11bd (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1143.127330] #1: 00000000c76765df (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x30a/0x1eb0 [ 1143.136213] 2 locks held by syz-executor2/6014: [ 1143.140860] #0: 00000000f2c693b3 (&type->i_mutex_dir_key#9){++++}, at: lookup_slow+0x4a/0x80 [ 1143.149556] #1: 000000007a1d5151 (&fi->mutex){+.+.}, at: fuse_lock_inode+0xba/0xf0 [ 1143.157627] 2 locks held by syz-executor2/6129: [ 1143.162270] #0: 00000000f2c693b3 (&type->i_mutex_dir_key#9){++++}, at: lookup_slow+0x4a/0x80 [ 1143.170968] #1: 000000007a1d5151 (&fi->mutex){+.+.}, at: fuse_lock_inode+0xba/0xf0 [ 1143.178779] [ 1143.180383] ============================================= [ 1143.180383] [ 1143.187410] NMI backtrace for cpu 1 [ 1143.191118] CPU: 1 PID: 1040 Comm: khungtaskd Not tainted 5.0.0-rc4 #49 [ 1143.197852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1143.207181] Call Trace: [ 1143.209768] dump_stack+0x1db/0x2d0 [ 1143.213410] ? dump_stack_print_info.cold+0x20/0x20 [ 1143.218423] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1143.223955] nmi_cpu_backtrace.cold+0x63/0xa4 [ 1143.228522] ? lapic_can_unplug_cpu.cold+0x38/0x38 [ 1143.233469] nmi_trigger_cpumask_backtrace+0x1be/0x236 [ 1143.238746] arch_trigger_cpumask_backtrace+0x14/0x20 [ 1143.243914] watchdog+0xbbb/0x1170 [ 1143.247444] ? reset_hung_task_detector+0xd0/0xd0 [ 1143.252418] ? lockdep_hardirqs_on+0x415/0x5d0 [ 1143.256978] ? trace_hardirqs_on+0xbd/0x310 [ 1143.261275] ? kasan_check_read+0x11/0x20 [ 1143.265418] ? __kthread_parkme+0xc3/0x1b0 [ 1143.269645] ? trace_hardirqs_off_caller+0x300/0x300 [ 1143.274722] ? do_raw_spin_trylock+0x270/0x270 [ 1143.279279] ? schedule+0x108/0x350 [ 1143.282884] ? do_raw_spin_trylock+0x270/0x270 [ 1143.287462] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 1143.292556] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1143.298068] ? __kthread_parkme+0xfb/0x1b0 [ 1143.302280] kthread+0x357/0x430 [ 1143.305622] ? reset_hung_task_detector+0xd0/0xd0 [ 1143.310442] ? kthread_stop+0x920/0x920 [ 1143.314411] ret_from_fork+0x3a/0x50 [ 1143.318253] Sending NMI from CPU 1 to CPUs 0: [ 1143.322890] NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0x2/0x10 [ 1143.324346] Kernel panic - not syncing: hung_task: blocked tasks [ 1143.336590] CPU: 1 PID: 1040 Comm: khungtaskd Not tainted 5.0.0-rc4 #49 [ 1143.343322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1143.352651] Call Trace: [ 1143.355223] dump_stack+0x1db/0x2d0 [ 1143.358836] ? dump_stack_print_info.cold+0x20/0x20 [ 1143.363850] panic+0x2cb/0x65c [ 1143.367026] ? add_taint.cold+0x16/0x16 [ 1143.370979] ? lapic_can_unplug_cpu.cold+0x38/0x38 [ 1143.375892] ? ___preempt_schedule+0x16/0x18 [ 1143.380281] ? nmi_trigger_cpumask_backtrace+0x19e/0x236 [ 1143.385710] ? nmi_trigger_cpumask_backtrace+0x1fa/0x236 [ 1143.391141] ? nmi_trigger_cpumask_backtrace+0x204/0x236 [ 1143.396571] ? nmi_trigger_cpumask_backtrace+0x19e/0x236 [ 1143.402132] watchdog+0xbcc/0x1170 [ 1143.405667] ? reset_hung_task_detector+0xd0/0xd0 [ 1143.410484] ? lockdep_hardirqs_on+0x415/0x5d0 [ 1143.415053] ? trace_hardirqs_on+0xbd/0x310 [ 1143.419353] ? kasan_check_read+0x11/0x20 [ 1143.423474] ? __kthread_parkme+0xc3/0x1b0 [ 1143.427699] ? trace_hardirqs_off_caller+0x300/0x300 [ 1143.432780] ? do_raw_spin_trylock+0x270/0x270 [ 1143.437344] ? schedule+0x108/0x350 [ 1143.440981] ? do_raw_spin_trylock+0x270/0x270 [ 1143.445719] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 1143.450822] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1143.456352] ? __kthread_parkme+0xfb/0x1b0 [ 1143.460604] kthread+0x357/0x430 [ 1143.463969] ? reset_hung_task_detector+0xd0/0xd0 [ 1143.468789] ? kthread_stop+0x920/0x920 [ 1143.472743] ret_from_fork+0x3a/0x50 [ 1143.477990] Kernel Offset: disabled [ 1143.481616] Rebooting in 86400 seconds..