611f3810fbd75a2968540683f174f4ad95b865e477a65cc1d860bf0e6cfa425fcc8e5d4aedb1325645636338d2f0a2d31b997a020fddda5e15b04f3e9b356ec0d051b1c9e53fa042e5fc8c1a44396cee5f147c0479924c957cef57699df3eec7a88e3b2159c4268525e741c5277b804854f30f219e5c8e29ae79233c49f5d7e50e3837244970c78beedfb6648460329e0896ca334fdca75a70ec1cc1d75c6e90ee952458cf3f2c60787f65264ad453c945d6e81e74d38748d484097d1c83b310e86d4ad845c2b753c4ece089df5c4af069da4657bd5eead75e0de972df52962cd5763b9e9a66e9954f8772684cafa8019e0e5369da582acf309f835e9c0d8880a5c517a3c133d95fcbd4fc9a3a2d7618baf161db742f962018865cb0297958ce7d55ab4d8e80a6f82bfef2347f512ef1cc6fa3da1f2aa437f8d6a181353c0676344bf69dfdbabd7f8fd222cf724a68f39a919f8a61ee3c3032e7d98e0c58d3b9ae9d14e98aeba8ad96f3be7da050e7dcd7134926007cce1c491ed1e61b77cd53d74550c42e4f15f30e44ee2685b6917315ca8a7f13bbd1a2c5a26109d15d73e53e9bfd8bda7d48db86cbf9c8d227cb0df960548d99ab569834caebd7214f551334e97248067f63eda1f087fa3311c79cc09272c37d33516d2055a65aae1cd5ffd1438ad748a0eb861700643d21529614a09ee1ad6c301a7ce04b6dc34a720bb7aba738bf53c2401c7eb39548814badfc25d450db61bfa4cd431aeb36c57213b6fc758a730f2e637fbd801edea13e5609adc859b165f6a2ce58dc3d650cae5b8a8713b4cfb9b7dac800e84807b97295c804b7a9162e6ff9f00de2b80eec3ac4da12c2b29b61bc179494396bcb0300f6696204819c8fd7bd810e55f21b77f2b0a45b346e26d732d3137fac57b4d6be5ad8fd415760a208ad3ba35d73895bf47761c4d7847fbec3feb79f51bcb5433e4bc2f9aaa0772e1702c5caee2597bcc0ff738c3491be51c0308c8f76800352b187aa16341b009494a91256c52cc1f00af6c5c507c6cc4434cf304ce6ba3acae0aaee96ab76dab3effb5c6223c23b999fe384b9c4e7a0dc989092ec5571b8a79e4b519e93c5bd92eb0b24a07830b1dc445c965970bca69e291369aa33a4ba8300728d9142cd37c1f9f5b18da702ee31475b2b8fe956e4284f9bf255cb348a04a4afe988ea7d9f27d4771b679436e40542033b9d1c5b6a49f7cfc5c4fa8ce23c52537fcb74ae26baf7dc301ae0f995345bdf73cf0d52001d36dfd97ff09a717ca6f47d040f0e7d517b6acbea213d9ce0dd249f24e3ef551b5f882d0dd61cf5c3c4f802036461e65deb0421af68dfc90e16f7ea601e942b62c6c4a9b9796bd5f8a49dd696d55a922b1fdc79ab515cab8b10156eff6708395faa97b75734fbb278817e1c805f76da7815d784d2bde08b883ec5e97a84375147fccb82286beca463649decf50e52815c3330c55dd82c92f7fca1704b00dbcc2d06c8ad15287263c393d11d38cc4429e9ef8633bf509e42c7690043c11c1a05e8ad800cc1e1e43430d76bfbba7186c31442cc8c4db39e8efc106c5b80b1a9d15167f0e5defcdcc82fb33e391ffde7cd29fec502d0b021426450195fe555f7bd452e6799b039cfaac38a657d3c18ceb806c00528b5bd55971fc8217b90c8cec8352c437ba43238e70f86a52946ce0a0db5155f861fb5d4f930889f0ad4b5ffc3a2658f986b0b23e2ca047059fef1ab24031057c30fbb94e3d8a948f90af50c21d4fe235c1603062359d5e902b056d7ba41fcd63b04dabe57b6ffe332e414cf25ae76dd76d68f6333c9d401cf941b0b55785ab286605df3996552d82a1186bca4418cbfc03beddb8f548fa6b7b456016060d6192f7241fa627eba69a614ff88885ea92fd31a798b5923724796ff47e6cdf5e409f230842d7dc4245c15c0a222636bb4d5b8d1bf7c361d3771faef466f3ccc6c8c916e0faea91c8c5987a9cc9485e63d586f36856ab452d6ddaa92b29db9a74aefe540b327f0e21eb5f566930cf707a2b25af3fa376a4bcfa1ba660e57f69cac47bb0feb263e2912c24245a238440584db14709ca8015b83f86a8f72dcbabb8ea5aa8954a0683e99883f5740f1c85ad2f9d7c39a2d018acd265cf819725dad4fca0d8d539ff7008e650df69fbbe309ca29e40121c0821caef1e6a7460b1d10a2a87cdfb658714ab1be61de28366e2c3cf46bffdc23fc3e03397eff7c28e7b42e066b218889669f69eea62ecc9f610af89d60646e0472e3ecd6f9f59bda00ae362df2810af51397f96bb22b26a93ecac166225e1d2880d26201512423237e969c7a2380fe526432ceb7bcfbbb129c438519a1c9d073724cfd999253fde67e757c7107cfd4d8321d632aaec6bcc876673747a1d724e768c84e1a7066fd662139d42ef01e8279238ab82b327c0fefa95e8d9216a7ecb345f1674bd2303d6f5232ca87bbc4a1ef1c6174d3edc0772021e9232855e4490f63e2a416c45826090888600baf8519314cc9bc48b715c6d1b789f0cb6e3fb63aaf7da5b7bbdbf09d60f8595039a9e61af10abbb9c6aca719ad82903b038803992285cb0bad53794c397e73f0041784bffc95870c4473fb9e0de5e78a2c6e37bbe33c887c9f0cf676d16de133923b22b5bb62d72fbb0eb4b178778bacf481f44ecee7a9b8ffcd368c11897d47d67051b69de3ba8c12d7e0d7750b566cb6116c8da6e3e9867c030d1b83725cb48bf3b442e23ca693be91ec764527954f9b815b2dfbb4650a29f6bd8ace5a71298835f492bb8d2463eb128950c1d60f8cf0bf8ac8966afcb30a78db4cac15eb2f00265685dfc25aeee5aed4b3559f9b39ce313f6631f33f2f76a05e30d76cc90869190c39e182a8998d57651d10ab3abaffa9bc837d1c6b76aec56dcd7e53c1abcb5955f463b23fe7fd6e044492f5d37dd0d641e77685032639498951d53c284ac468286bd7cc0e0a62fe5531a71c684bb39e44864ac9cbe4045df6594b4dafe507700e2ebc61a196632eb8e980ab87c534b40ba4d26a64cdc70109d1d22b10088cbaea658970960b87180394a84e8de947a2a45df4911d298b8f00c89ba301c18e4e9ac31d00d28fb538927e268c0fcd28fa083736df03a0994a7bed247b4587c0a6766ec5f5101725509fec458fc09387956e75651d8e75881e4607f76e50331dff01fefb6522a9aec59b7780312f9cf8e099d8d2cd6bfd32e3855328c210a2f993097183952dede63368d4a81eb47adf8e0075023fad19007acd8646f4da3ad98222d00e35379de2beb5172c0bf5e853a81cabf5cafe12282add66875d7d8f4272b56e48eb58f0e6b069ab3af8548e2f1d679c5e7be2c26299076dba071817d0dccf9150070282f9cb3fadd33c091e24cdbaadac62196d7263cc29e1d9fbc16f1adefcbf9e143b6a6e2ab7647266238090440cfb548c436f00544d032c4e8200dc62a0f37b9d61ad872d0ebe732d2e3fb5fa7e0fa57d718cabbf73dc07bfa2084bbfb39a0e0eceaf5e0bf454b0184a19c4e545566fae0fe45bdca165b2d79703e95bfc691fa9a15d68e5bb135ddb16447a7ca8e2d4eb9ebcbbe12ee9dce5bb90ad238c0589612a8f2f59ca7abe01bc2444c10525e8af47d493be273f19483ca0d420bbf22693882b89db9f6c5671daea544ab94afae84216cdfb512d073b061eaa3dec7e50b9e3b10cee230612874bc071e8f751880adf9144f141180400cd973b57591ef7156029c7a61818f4c217b18d504cadbb7db1586798be01a4e7d4678ab21e5fec5a16db86b85f1fc557cca7b1025571c2b45d74e3cfffe39cbd2a8bb90", 0x570, 0xae1b, 0x0, 0x1, r0}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0xf, 0x200, r2, &(0x7f00000001c0)="0922e0edbd5cfa92fde1f74b8a4f4f43a7eb5ec7b3527f7f084ffe3ac1f49b837409d864925205e31716e151f5954ef4d99b9b56490d75f2a17aaf9aa0ea59", 0x3f, 0x0, 0x0, 0x2, r0}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x7, 0x100000000, r1, &(0x7f0000000280)="3b70faccfd20f5995d9809c2b966191d30dcc898fc9ec43461e6da48717b2458b825ca423f6b87300a9ea4dfcc7465006e526c580ded9e36c9c8f75f102fa29995fcc7ee05ba7a05998cc1015eae74dfd1ce33f9b99d46d6e71e55960700d8eb4ba078d3b7c7426a7e95dfe8241a8fd3fbc8d449a4f5d1f5b30dab3ab0dee9f0ae8481aec37f3455a87abcbb1884921fc02719348eeefe6b2b47d32596cff31a3b4556c8cf258db7129092eae546c5f870a0b353c1f34f0a020423a3643fa6094507598393538f125c3423fda458c4503a13e65acebac592acc3ae7e6ac5d5ceff49b434f0f5f6d5d3f2736f14c86c3061f5a9ba25a655c7e7859d7c95870f", 0xff, 0x800}, &(0x7f0000001500)={0x0, 0x0, 0x0, 0x5, 0x0, r0, &(0x7f00000003c0)="bb2a57321f9948c2ca520d8d2de0a4695362b0a0c6142f8d13f58780834d12a34889a1b04dd1c2100dac4f6e2e9d59fef19453bc75a94b12158b298092fb47c53a2703c543bafb676ba538ebe19ffd49da8595a37702e6b5ebbcbf50dabe5ba60a4f89331af8f2fcc035243c9151c285470e34bba54e00f3fa71ee905b2278f5c64519d1be5793e613af0d48954c64f3c947e323e8ac0f5ad43489c29d407b4773b6d831ffa250ccb7f4c51d7dced118a7272d49fbf2a03ea44211da023f23154ca1f123171ae8787ae8f294085f24e59c3ea2bcca78a7cc5a94e5ccfe18cd41", 0xe0, 0x9, 0x0, 0x2}, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x2, r1, &(0x7f0000001540)="2784f0ed5e6f30f53c1c6a5f671ed7dec20fa15d9629de068f07e9948fe984247d60d9aca402227bd47d04eeb8faad3b07d007c290286bdcdb5848f91b41569d818bf469b0ad955849936e95f45006fcf14b4d8586f67db3f0e023d231c57faad31897476dd1e8806431abc160de14f2273e6e1086028f", 0xffffffffffffffb3, 0x4c, 0x0, 0x2, r0}, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x2, 0x1, r2, &(0x7f0000001600)="dd95159c7e8e52061b2f6ccc72b7e2e2070233923adbe89c792ae984fba674ad5c7a6583e6c50895c055193124c77fc90fc173a0c7ccb5d2", 0x38, 0x6, 0x0, 0x1, 0xffffffffffffff9c}, &(0x7f0000001700)={0x0, 0x0, 0x0, 0x7, 0x6, r2, &(0x7f0000001680)="8f10e312c853996cc1079feaae9c24a68553f462d196c338668c0edaf185e26a6fb17bcb77a6391d30caf846e20384854f799e8365c22fa2124ab544f0f798cc22b3ac420d544afa4b5f2261d9f21871a951f761270f75a83732fd6b4a4d", 0x5e, 0x9, 0x0, 0x3, r0}]) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) ppoll(&(0x7f0000000000)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) 22:52:47 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="6b6b6b0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:47 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6b6b6b, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:47 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:47 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x700, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:47 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000002d80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:47 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x300, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:48 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='B'], 0x1) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000000c0)=0x1) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) 22:52:48 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x22000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:48 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6b6b6b, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:48 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0003000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:48 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x74, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:48 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00'], 0x1) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$inet6_dccp_int(r2, 0x21, 0xb, &(0x7f0000000180)=0x80000000, 0x4) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) [ 1456.361130] EXT4-fs: 61 callbacks suppressed [ 1456.361141] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1456.399398] EXT4-fs (sda1): re-mounted. Opts: 22:52:48 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6c00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:48 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="002d000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1456.421499] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1456.432677] EXT4-fs (sda1): re-mounted. Opts: [ 1456.456793] EXT4-fs (sda1): re-mounted. Opts: 22:52:48 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x8cffffff, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1456.518837] EXT4-fs (sda1): re-mounted. Opts: 22:52:48 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xffffff8c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:48 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x74, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1456.625737] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1456.653959] EXT4-fs (sda1): re-mounted. Opts: [ 1456.679379] EXT4-fs (sda1): re-mounted. Opts: [ 1456.684602] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:52:48 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="7400000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:49 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[], 0xad7dab45782b367) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) 22:52:49 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x1f000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:49 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfffffff6, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:49 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x10000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:49 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fcfdffff80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:49 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dsp\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf32(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="2b256174e68ff05a1200fd4a7a4ce32740a99af7f232551ef0ad3dde4df891177d409a648875dc27464a0fa7f716870aeea64c560f62fa1587fcc51ffbe62bfa31883093afdfbb4d94d4516816286437eb7681c9beffa8d75696f5a8436c7f85c2b6450b31282f204fa007a34f0d803d6854cc61620000000000000000000000"], 0x1) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000500)=""/4096) 22:52:49 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f00000000c0)=0x3) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00'], 0x1) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000180)={0x0, 0x6f, "876fdf23fe021edef0ff547e68f5cf1ada24d7ce5024b40e46d44732db3ead0206196efb2e2d98d61042030a8259ef6e8862bb51a45f7cc39de22863688b4a9362494509edf3e88958e90206cb9d9f688b5dce750f3ac924c758d1e3e5e956fd34e6b78276aacd55d037be791b1b7d"}, &(0x7f0000000200)=0x77) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000240)={r1, 0x6b5}, 0x8) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) 22:52:49 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0200000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:49 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00'], 0x1) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x216200, 0x10) setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000180)=0x3, 0x4) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) 22:52:49 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4c00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:49 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:49 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:49 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000007a80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:49 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x22, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:49 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6b6b6b00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:49 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1000000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:49 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0022000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:49 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2c, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:50 executing program 0: 22:52:50 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6c000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:50 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00'], 0x1) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140)={0x20000000000000}, 0x8) 22:52:50 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3f00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:50 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0900000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:50 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x7400000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:50 executing program 0: 22:52:50 executing program 0: 22:52:50 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="1000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:50 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x5000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:50 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfcfdffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:50 executing program 0: 22:52:50 executing program 0: 22:52:50 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x300000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:51 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00'], 0x1) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) fsetxattr$trusted_overlay_origin(r1, &(0x7f0000000340)='trusted.overlay.origin\x00', &(0x7f0000000380)='y\x00', 0x2, 0x1) openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0x400000, 0x0) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) r3 = add_key(&(0x7f00000000c0)='encrypted\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000280)="8c33ec6f1ea70f20feae6ac491d585e1c6800aeafc9dab061175c979ac28b55e6346ae10542074432fc2c584914742e587dd84041047b7f6b4ef780e8f6cf1fedf81dc3d86cb84ab563209e8c357d35334aeb8084506912d10553b96a410c8f25d09592a705ef4ec467380369b87eb42836915017a2a08b3f9ff33805e81a5c4919864442c7ec172c348f5c837", 0x8d, 0xfffffffffffffffa) keyctl$clear(0x7, r3) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x4040aea0, &(0x7f00000001c0)={0x7, 0x2, 0x123c, 0x0, 0x3, 0x0, 0x5, 0xfffffffffffffffb, 0x2, 0x7, 0xd2, 0x8, 0x0, 0x8, 0x401, 0x5, 0xd, 0x8, 0xafbc}) 22:52:51 executing program 0: 22:52:51 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="8cffffff80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:51 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x300, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:51 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x600, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:51 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4800000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x3000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:51 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="002c000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:51 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3f00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:51 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1f00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x3000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:51 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x40000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:52 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00'], 0x1) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000001, 0x1013, r0, 0x0) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f0000000240)={0x6, 0x0, 0x7, 0x0, 0x0, [{r0, 0x0, 0x1}, {r0}, {r0}, {r2, 0x0, 0x7}, {r2, 0x0, 0x5f9}, {r1, 0x0, 0x8}, {r0, 0x0, 0x79}]}) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) 22:52:52 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x3000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:52 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="2d00000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:52 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2c00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:52 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x5, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:52 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfdfdffff, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:52 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000001f80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:52 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6000000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:52 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4c00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x5, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:52 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfdfdffff, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:53 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="00d767f02a98e9b999f4f3473f58359e9285aa05bc8308dbffb62d47c9"], 0x1) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x74, &(0x7f0000000240)=[@in={0x2, 0x4e21, @broadcast}, @in6={0xa, 0x4e21, 0x100, @remote}, @in6={0xa, 0x4e24, 0x4, @empty, 0x80000001}, @in6={0xa, 0x4e22, 0x9, @dev={0xfe, 0x80, [], 0xb}, 0x69d}, @in={0x2, 0x4e23, @broadcast}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000300)={r2, 0x2}, &(0x7f0000000340)=0x8) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) timerfd_settime(r0, 0x1, &(0x7f00000000c0)={{0x0, 0x1c9c380}}, &(0x7f0000000180)) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) 22:52:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfdfdffff, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:53 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fffffdfc80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:53 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2000000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:53 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x48, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:53 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xf6ffffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1462.021783] EXT4-fs: 74 callbacks suppressed [ 1462.021794] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:52:53 executing program 0 (fault-call:1 fault-nth:0): r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1462.068226] EXT4-fs (sda1): re-mounted. Opts: [ 1462.087143] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value [ 1462.095961] EXT4-fs (sda1): re-mounted. Opts: [ 1462.117307] EXT4-fs (sda1): re-mounted. Opts: [ 1462.123146] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1462.142393] FAULT_INJECTION: forcing a failure. [ 1462.142393] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1462.198027] CPU: 1 PID: 8611 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #51 [ 1462.205250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1462.214692] Call Trace: [ 1462.217289] dump_stack+0x1c4/0x2b4 [ 1462.220922] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1462.226131] ? perf_trace_lock+0x14d/0x7a0 [ 1462.230367] ? inode_init_always+0x68f/0xd80 [ 1462.234785] should_fail.cold.4+0xa/0x17 [ 1462.238850] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1462.243957] ? debug_smp_processor_id+0x1c/0x20 [ 1462.248631] ? zap_class+0x640/0x640 [ 1462.252347] ? lock_acquire+0x1ed/0x520 [ 1462.256320] ? usbdev_do_ioctl+0x28d/0x3b50 [ 1462.260643] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1462.266183] ? check_preemption_disabled+0x48/0x200 [ 1462.272117] ? zap_class+0x640/0x640 [ 1462.275833] ? fs_reclaim_acquire+0x20/0x20 [ 1462.280155] ? lock_downgrade+0x900/0x900 [ 1462.284310] ? ___might_sleep+0x1ed/0x300 [ 1462.288453] ? lock_release+0x970/0x970 [ 1462.292446] ? arch_local_save_flags+0x40/0x40 [ 1462.297032] ? __mutex_lock+0x85e/0x1700 [ 1462.301098] ? __might_sleep+0x95/0x190 [ 1462.305077] __alloc_pages_nodemask+0x34b/0xde0 [ 1462.309751] ? __alloc_pages_slowpath+0x2d80/0x2d80 [ 1462.314773] ? zap_class+0x640/0x640 [ 1462.318493] ? __might_fault+0x12b/0x1e0 [ 1462.322553] ? lock_downgrade+0x900/0x900 [ 1462.326699] ? lock_release+0x970/0x970 [ 1462.330670] ? arch_local_save_flags+0x40/0x40 [ 1462.335260] ? debug_smp_processor_id+0x1c/0x20 [ 1462.339933] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 1462.344947] ? usbfs_increase_memory_usage+0xf7/0x1d0 [ 1462.350139] ? usbfs_decrease_memory_usage+0x30/0x30 [ 1462.355242] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 1462.360782] alloc_pages_current+0x10c/0x210 [ 1462.365190] ? check_ctrlrecip+0xa9/0x320 [ 1462.370309] __get_free_pages+0xc/0x40 [ 1462.374215] proc_control+0x227/0xef0 [ 1462.378025] ? mark_held_locks+0x130/0x130 [ 1462.382266] ? proc_bulk+0xa70/0xa70 [ 1462.385990] usbdev_do_ioctl+0x1eb8/0x3b50 [ 1462.390232] ? processcompl_compat+0x680/0x680 [ 1462.394815] ? zap_class+0x640/0x640 [ 1462.398529] ? mark_held_locks+0x130/0x130 [ 1462.402762] ? zap_class+0x640/0x640 [ 1462.406492] ? zap_class+0x640/0x640 [ 1462.410208] ? dput.part.26+0x26d/0x790 [ 1462.414179] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1462.419720] ? check_preemption_disabled+0x48/0x200 [ 1462.424737] ? shrink_dcache_sb+0x350/0x350 [ 1462.429063] ? check_preemption_disabled+0x48/0x200 [ 1462.434085] ? debug_smp_processor_id+0x1c/0x20 [ 1462.438782] ? perf_trace_lock+0x14d/0x7a0 [ 1462.443017] ? zap_class+0x640/0x640 [ 1462.446731] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1462.451663] ? lock_downgrade+0x900/0x900 [ 1462.455815] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1462.461614] ? _parse_integer+0x180/0x180 [ 1462.465770] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1462.472045] ? avc_has_extended_perms+0xab2/0x15a0 [ 1462.476989] ? avc_ss_reset+0x190/0x190 [ 1462.480967] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1462.486766] ? zap_class+0x640/0x640 [ 1462.490491] ? __f_unlock_pos+0x19/0x20 [ 1462.494486] ? __fget+0x4d1/0x740 [ 1462.497958] ? ___might_sleep+0x1ed/0x300 [ 1462.502111] ? arch_local_save_flags+0x40/0x40 [ 1462.506701] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 1462.511640] usbdev_ioctl+0x25/0x30 [ 1462.515267] ? usbdev_compat_ioctl+0x30/0x30 [ 1462.519671] do_vfs_ioctl+0x1de/0x1720 [ 1462.523576] ? ioctl_preallocate+0x300/0x300 [ 1462.527993] ? selinux_file_mprotect+0x620/0x620 [ 1462.532753] ? __sb_end_write+0xd9/0x110 [ 1462.536819] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1462.542353] ? fput+0x130/0x1a0 [ 1462.545636] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1462.551170] ? security_file_ioctl+0x94/0xc0 [ 1462.555578] ksys_ioctl+0xa9/0xd0 [ 1462.559035] __x64_sys_ioctl+0x73/0xb0 [ 1462.562925] do_syscall_64+0x1b9/0x820 [ 1462.567780] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1462.573147] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1462.578074] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1462.582917] ? trace_hardirqs_on_caller+0x310/0x310 [ 1462.587934] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1462.592949] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1462.597980] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1462.602826] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1462.608015] RIP: 0033:0x457579 [ 1462.611211] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1462.630106] RSP: 002b:00007f8a115e7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1462.637818] RAX: ffffffffffffffda RBX: 00007f8a115e7c90 RCX: 0000000000457579 22:52:54 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:54 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="ffffff8c80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:54 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfffffff6, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:54 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x790c000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1462.645084] RDX: 0000000020000240 RSI: 00000000c0185500 RDI: 0000000000000003 [ 1462.652353] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1462.659620] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8a115e86d4 [ 1462.667673] R13: 00000000004bf6c0 R14: 00000000004cf598 R15: 0000000000000004 22:52:54 executing program 0 (fault-call:1 fault-nth:1): r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1462.742121] FAULT_INJECTION: forcing a failure. [ 1462.742121] name failslab, interval 1, probability 0, space 0, times 0 [ 1462.753590] CPU: 1 PID: 8616 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #51 [ 1462.760777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1462.771054] Call Trace: [ 1462.773646] dump_stack+0x1c4/0x2b4 [ 1462.777276] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1462.782475] ? perf_trace_lock+0x14d/0x7a0 [ 1462.786714] should_fail.cold.4+0xa/0x17 [ 1462.790779] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1462.795884] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1462.801425] ? check_preemption_disabled+0x48/0x200 [ 1462.806455] ? zap_class+0x640/0x640 [ 1462.810170] ? lock_downgrade+0x900/0x900 [ 1462.814322] ? ___might_sleep+0x1ed/0x300 [ 1462.818476] ? lock_release+0x970/0x970 [ 1462.822457] ? zap_class+0x640/0x640 [ 1462.826171] ? proc_control+0x473/0xef0 [ 1462.830145] ? lock_downgrade+0x900/0x900 [ 1462.834292] ? __might_sleep+0x95/0x190 [ 1462.838268] ? ___might_sleep+0x1ed/0x300 [ 1462.842418] ? arch_local_save_flags+0x40/0x40 [ 1462.847005] ? __alloc_pages_slowpath+0x2d80/0x2d80 [ 1462.852030] __should_failslab+0x124/0x180 [ 1462.856262] should_failslab+0x9/0x14 [ 1462.860061] kmem_cache_alloc_trace+0x2d7/0x750 [ 1462.864727] ? lock_release+0x970/0x970 [ 1462.869673] ? arch_local_save_flags+0x40/0x40 [ 1462.874254] ? debug_smp_processor_id+0x1c/0x20 [ 1462.878931] usb_control_msg+0xc4/0x4e0 [ 1462.882916] ? usb_start_wait_urb+0x370/0x370 [ 1462.887408] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 1462.892958] proc_control+0x5c5/0xef0 [ 1462.896764] ? proc_bulk+0xa70/0xa70 [ 1462.900489] usbdev_do_ioctl+0x1eb8/0x3b50 [ 1462.904725] ? processcompl_compat+0x680/0x680 [ 1462.909308] ? zap_class+0x640/0x640 [ 1462.913026] ? mark_held_locks+0x130/0x130 [ 1462.917265] ? zap_class+0x640/0x640 [ 1462.920988] ? zap_class+0x640/0x640 [ 1462.924699] ? dput.part.26+0x26d/0x790 [ 1462.928672] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1462.934208] ? check_preemption_disabled+0x48/0x200 [ 1462.939223] ? shrink_dcache_sb+0x350/0x350 [ 1462.943545] ? check_preemption_disabled+0x48/0x200 [ 1462.948574] ? debug_smp_processor_id+0x1c/0x20 [ 1462.953237] ? perf_trace_lock+0x14d/0x7a0 [ 1462.957476] ? zap_class+0x640/0x640 [ 1462.961192] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1462.966120] ? lock_downgrade+0x900/0x900 [ 1462.971057] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1462.976857] ? _parse_integer+0x180/0x180 [ 1462.981016] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1462.986554] ? avc_has_extended_perms+0xab2/0x15a0 [ 1462.991506] ? avc_ss_reset+0x190/0x190 [ 1462.995486] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1463.001694] ? zap_class+0x640/0x640 [ 1463.005408] ? __f_unlock_pos+0x19/0x20 [ 1463.009394] ? __fget+0x4d1/0x740 [ 1463.012860] ? ___might_sleep+0x1ed/0x300 [ 1463.017007] ? arch_local_save_flags+0x40/0x40 [ 1463.021595] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 1463.026525] usbdev_ioctl+0x25/0x30 [ 1463.030155] ? usbdev_compat_ioctl+0x30/0x30 [ 1463.034563] do_vfs_ioctl+0x1de/0x1720 [ 1463.038457] ? ioctl_preallocate+0x300/0x300 [ 1463.042866] ? selinux_file_mprotect+0x620/0x620 [ 1463.047621] ? __sb_end_write+0xd9/0x110 [ 1463.051683] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1463.057216] ? fput+0x130/0x1a0 [ 1463.060501] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1463.066034] ? security_file_ioctl+0x94/0xc0 [ 1463.070804] ksys_ioctl+0xa9/0xd0 [ 1463.074259] __x64_sys_ioctl+0x73/0xb0 [ 1463.078145] do_syscall_64+0x1b9/0x820 [ 1463.082031] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1463.087395] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1463.092334] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1463.097172] ? trace_hardirqs_on_caller+0x310/0x310 [ 1463.102186] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1463.107203] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1463.112138] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1463.117327] RIP: 0033:0x457579 [ 1463.120531] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 22:52:55 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf32(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="5f0859822cbdf379883d5136217207b9d2bee390729f1628889dce89e3c83446cbdc8c00454240e732d9c87c03961dc144c90698c526e81e8505af44f8fa77a5de44675b1f75a0305bf0e8b9380c96080eb90c133ca6515cbf2ca80471864226b47042944259901847b22ae697710bcdd8e138e274d5b5bdf3974d0800000000000e005436015b4296cfb589ab3ca39968b7e420166d1696fa9a21c6ac598e"], 0x1) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000180)='tls\x00', 0x4) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x20000, 0x0) [ 1463.139446] RSP: 002b:00007f8a115e7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1463.147151] RAX: ffffffffffffffda RBX: 00007f8a115e7c90 RCX: 0000000000457579 [ 1463.154426] RDX: 0000000020000240 RSI: 00000000c0185500 RDI: 0000000000000003 [ 1463.161734] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1463.169721] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8a115e86d4 [ 1463.176995] R13: 00000000004bf6c0 R14: 00000000004cf598 R15: 0000000000000004 22:52:55 executing program 0 (fault-call:1 fault-nth:2): r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1463.233020] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1463.288620] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1463.309976] EXT4-fs (sda1): re-mounted. Opts: [ 1463.314924] EXT4-fs (sda1): re-mounted. Opts: [ 1463.315383] FAULT_INJECTION: forcing a failure. [ 1463.315383] name failslab, interval 1, probability 0, space 0, times 0 [ 1463.332721] CPU: 1 PID: 8635 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #51 [ 1463.339929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1463.349278] Call Trace: [ 1463.351872] dump_stack+0x1c4/0x2b4 [ 1463.355505] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1463.360702] ? kernel_text_address+0x79/0xf0 [ 1463.365123] should_fail.cold.4+0xa/0x17 [ 1463.370189] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1463.375299] ? save_stack+0xa9/0xd0 [ 1463.378928] ? save_stack+0x43/0xd0 [ 1463.382556] ? kmem_cache_alloc_trace+0x152/0x750 [ 1463.387410] ? usb_control_msg+0xc4/0x4e0 [ 1463.391559] ? proc_control+0x5c5/0xef0 [ 1463.395535] ? usbdev_do_ioctl+0x1eb8/0x3b50 [ 1463.399948] ? usbdev_ioctl+0x25/0x30 [ 1463.403745] ? do_vfs_ioctl+0x1de/0x1720 [ 1463.407804] ? ksys_ioctl+0xa9/0xd0 [ 1463.411437] ? __x64_sys_ioctl+0x73/0xb0 [ 1463.415501] ? do_syscall_64+0x1b9/0x820 [ 1463.419566] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1463.424938] ? ___might_sleep+0x1ed/0x300 [ 1463.429084] ? lock_release+0x970/0x970 [ 1463.433062] ? zap_class+0x640/0x640 [ 1463.436779] ? proc_control+0x473/0xef0 [ 1463.440755] ? lock_downgrade+0x900/0x900 [ 1463.444904] ? __might_sleep+0x95/0x190 [ 1463.448886] ? ___might_sleep+0x1ed/0x300 [ 1463.453039] ? arch_local_save_flags+0x40/0x40 [ 1463.457630] ? ___might_sleep+0x1ed/0x300 [ 1463.461784] ? trace_hardirqs_on+0xbd/0x310 [ 1463.466105] ? __alloc_pages_slowpath+0x2d80/0x2d80 [ 1463.471894] __should_failslab+0x124/0x180 [ 1463.476140] should_failslab+0x9/0x14 [ 1463.479943] __kmalloc+0x2d4/0x760 [ 1463.483485] ? kmem_cache_alloc_trace+0x31f/0x750 [ 1463.488328] ? usb_alloc_urb+0x24/0x50 [ 1463.492216] ? arch_local_save_flags+0x40/0x40 [ 1463.496804] usb_alloc_urb+0x24/0x50 [ 1463.500521] usb_control_msg+0x1dd/0x4e0 [ 1463.504582] ? usb_start_wait_urb+0x370/0x370 [ 1463.509077] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 1463.514620] proc_control+0x5c5/0xef0 [ 1463.518430] ? proc_bulk+0xa70/0xa70 [ 1463.522155] usbdev_do_ioctl+0x1eb8/0x3b50 [ 1463.526400] ? processcompl_compat+0x680/0x680 [ 1463.530986] ? zap_class+0x640/0x640 [ 1463.534699] ? mark_held_locks+0x130/0x130 [ 1463.538936] ? zap_class+0x640/0x640 [ 1463.542649] ? zap_class+0x640/0x640 [ 1463.546366] ? dput.part.26+0x26d/0x790 [ 1463.550345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1463.555882] ? check_preemption_disabled+0x48/0x200 [ 1463.560902] ? shrink_dcache_sb+0x350/0x350 [ 1463.565233] ? check_preemption_disabled+0x48/0x200 [ 1463.571202] ? debug_smp_processor_id+0x1c/0x20 [ 1463.575868] ? perf_trace_lock+0x14d/0x7a0 [ 1463.580103] ? zap_class+0x640/0x640 [ 1463.583817] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1463.588746] ? lock_downgrade+0x900/0x900 [ 1463.592897] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1463.598717] ? _parse_integer+0x180/0x180 [ 1463.602874] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1463.608423] ? avc_has_extended_perms+0xab2/0x15a0 [ 1463.613360] ? avc_ss_reset+0x190/0x190 [ 1463.617344] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1463.623147] ? zap_class+0x640/0x640 [ 1463.626863] ? __f_unlock_pos+0x19/0x20 [ 1463.630844] ? __fget+0x4d1/0x740 [ 1463.634306] ? ___might_sleep+0x1ed/0x300 [ 1463.638456] ? arch_local_save_flags+0x40/0x40 [ 1463.643044] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 1463.647981] usbdev_ioctl+0x25/0x30 [ 1463.651608] ? usbdev_compat_ioctl+0x30/0x30 [ 1463.656032] do_vfs_ioctl+0x1de/0x1720 [ 1463.659925] ? ioctl_preallocate+0x300/0x300 [ 1463.664335] ? selinux_file_mprotect+0x620/0x620 [ 1463.670080] ? __sb_end_write+0xd9/0x110 [ 1463.674143] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1463.679676] ? fput+0x130/0x1a0 [ 1463.682959] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1463.688498] ? security_file_ioctl+0x94/0xc0 [ 1463.692915] ksys_ioctl+0xa9/0xd0 [ 1463.696389] __x64_sys_ioctl+0x73/0xb0 [ 1463.700278] do_syscall_64+0x1b9/0x820 [ 1463.704165] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1463.709528] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1463.714456] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1463.719300] ? trace_hardirqs_on_caller+0x310/0x310 [ 1463.724319] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1463.729335] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1463.734354] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1463.739218] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1463.744406] RIP: 0033:0x457579 [ 1463.747602] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1463.767162] RSP: 002b:00007f8a115e7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1463.774874] RAX: ffffffffffffffda RBX: 00007f8a115e7c90 RCX: 0000000000457579 [ 1463.782149] RDX: 0000000020000240 RSI: 00000000c0185500 RDI: 0000000000000003 [ 1463.789417] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1463.796684] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8a115e86d4 [ 1463.803951] R13: 00000000004bf6c0 R14: 00000000004cf598 R15: 0000000000000004 22:52:55 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0c79000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:55 executing program 0 (fault-call:1 fault-nth:3): r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:52:55 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x60000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:55 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4c00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:55 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6c00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1463.916265] FAULT_INJECTION: forcing a failure. [ 1463.916265] name failslab, interval 1, probability 0, space 0, times 0 [ 1463.927970] CPU: 0 PID: 8643 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #51 [ 1463.935158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1463.944511] Call Trace: [ 1463.947107] dump_stack+0x1c4/0x2b4 [ 1463.950736] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1463.950761] should_fail.cold.4+0xa/0x17 [ 1463.950778] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1463.950793] ? debug_smp_processor_id+0x1c/0x20 [ 1463.950810] ? perf_trace_lock+0x14d/0x7a0 [ 1463.974351] ? mark_held_locks+0x130/0x130 [ 1463.978613] ? zap_class+0x640/0x640 [ 1463.982342] ? bpf_prog_kallsyms_find+0xde/0x4a0 [ 1463.987200] ? zap_class+0x640/0x640 [ 1463.990916] ? usb_hcd_link_urb_to_ep+0x3e5/0x500 [ 1463.995759] ? zap_class+0x640/0x640 [ 1463.999474] ? fs_reclaim_acquire+0x20/0x20 [ 1464.003795] ? lock_downgrade+0x900/0x900 [ 1464.008041] ? ___might_sleep+0x1ed/0x300 [ 1464.012191] ? zap_class+0x640/0x640 [ 1464.015914] ? arch_local_save_flags+0x40/0x40 [ 1464.020522] ? usb_hcd_submit_urb+0x460/0x20a0 [ 1464.025103] ? _raw_spin_unlock+0x2c/0x50 [ 1464.029262] __should_failslab+0x124/0x180 [ 1464.033495] should_failslab+0x9/0x14 [ 1464.037292] __kmalloc+0x2d4/0x760 [ 1464.040831] ? kasan_check_write+0x14/0x20 [ 1464.045066] ? do_raw_spin_lock+0xc1/0x200 [ 1464.049299] ? usb_hcd_submit_urb+0x6fc/0x20a0 [ 1464.053909] usb_hcd_submit_urb+0x6fc/0x20a0 [ 1464.058323] ? usb_create_hcd+0x40/0x40 [ 1464.062307] ? do_syscall_64+0x1b9/0x820 [ 1464.066412] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1464.072124] ? __x64_sys_ioctl+0x73/0xb0 [ 1464.076206] ? do_syscall_64+0x1b9/0x820 [ 1464.080280] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1464.085646] ? ___might_sleep+0x1ed/0x300 [ 1464.089801] ? lock_release+0x970/0x970 [ 1464.093775] ? zap_class+0x640/0x640 [ 1464.097490] ? __lockdep_init_map+0x105/0x590 [ 1464.101995] ? __lockdep_init_map+0x105/0x590 [ 1464.106530] usb_submit_urb+0x893/0x14e0 [ 1464.110599] usb_start_wait_urb+0x13d/0x370 [ 1464.114922] ? sg_clean+0x240/0x240 [ 1464.118570] usb_control_msg+0x332/0x4e0 [ 1464.122637] ? usb_start_wait_urb+0x370/0x370 [ 1464.127132] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 1464.132676] proc_control+0x5c5/0xef0 [ 1464.136571] ? proc_bulk+0xa70/0xa70 [ 1464.140296] usbdev_do_ioctl+0x1eb8/0x3b50 [ 1464.144534] ? processcompl_compat+0x680/0x680 [ 1464.149115] ? zap_class+0x640/0x640 [ 1464.152825] ? mark_held_locks+0x130/0x130 [ 1464.157060] ? zap_class+0x640/0x640 [ 1464.160780] ? zap_class+0x640/0x640 [ 1464.164500] ? dput.part.26+0x26d/0x790 [ 1464.169248] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1464.174788] ? check_preemption_disabled+0x48/0x200 [ 1464.179802] ? shrink_dcache_sb+0x350/0x350 [ 1464.184126] ? check_preemption_disabled+0x48/0x200 [ 1464.189150] ? debug_smp_processor_id+0x1c/0x20 [ 1464.193815] ? perf_trace_lock+0x14d/0x7a0 [ 1464.198051] ? zap_class+0x640/0x640 [ 1464.201765] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1464.206692] ? lock_downgrade+0x900/0x900 [ 1464.210844] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1464.216646] ? _parse_integer+0x180/0x180 [ 1464.220805] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1464.226340] ? avc_has_extended_perms+0xab2/0x15a0 [ 1464.231287] ? avc_ss_reset+0x190/0x190 [ 1464.231309] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1464.241044] ? zap_class+0x640/0x640 [ 1464.241060] ? __f_unlock_pos+0x19/0x20 [ 1464.241078] ? __fget+0x4d1/0x740 [ 1464.241099] ? ___might_sleep+0x1ed/0x300 [ 1464.256425] ? arch_local_save_flags+0x40/0x40 [ 1464.261036] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 1464.265973] usbdev_ioctl+0x25/0x30 [ 1464.269918] ? usbdev_compat_ioctl+0x30/0x30 [ 1464.274326] do_vfs_ioctl+0x1de/0x1720 [ 1464.278225] ? ioctl_preallocate+0x300/0x300 [ 1464.282634] ? selinux_file_mprotect+0x620/0x620 [ 1464.287395] ? __sb_end_write+0xd9/0x110 [ 1464.291470] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1464.297003] ? fput+0x130/0x1a0 [ 1464.300286] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1464.305826] ? security_file_ioctl+0x94/0xc0 [ 1464.310240] ksys_ioctl+0xa9/0xd0 [ 1464.313695] __x64_sys_ioctl+0x73/0xb0 [ 1464.317584] do_syscall_64+0x1b9/0x820 [ 1464.321470] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1464.326836] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1464.331765] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1464.336611] ? trace_hardirqs_on_caller+0x310/0x310 [ 1464.341628] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1464.346643] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1464.351665] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1464.356514] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1464.361701] RIP: 0033:0x457579 [ 1464.364895] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1464.384167] RSP: 002b:00007f8a115e7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1464.391878] RAX: ffffffffffffffda RBX: 00007f8a115e7c90 RCX: 0000000000457579 [ 1464.399143] RDX: 0000000020000240 RSI: 00000000c0185500 RDI: 0000000000000003 [ 1464.406413] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 22:52:56 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00'], 0x1) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f00000004c0)=0x8) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) 22:52:56 executing program 0 (fault-call:1 fault-nth:4): r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1464.413678] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8a115e86d4 [ 1464.420947] R13: 00000000004bf6c0 R14: 00000000004cf598 R15: 0000000000000004 [ 1464.474166] FAULT_INJECTION: forcing a failure. [ 1464.474166] name failslab, interval 1, probability 0, space 0, times 0 [ 1464.485572] CPU: 0 PID: 8654 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #51 [ 1464.492762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1464.502109] Call Trace: [ 1464.502136] dump_stack+0x1c4/0x2b4 [ 1464.502159] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1464.513550] should_fail.cold.4+0xa/0x17 [ 1464.517618] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1464.517634] ? __save_stack_trace+0x8d/0xf0 [ 1464.517659] ? save_stack+0x43/0xd0 [ 1464.517674] ? kasan_kmalloc+0xc7/0xe0 [ 1464.527069] ? __kmalloc+0x14e/0x760 [ 1464.527084] ? usb_hcd_submit_urb+0x6fc/0x20a0 [ 1464.527103] ? usb_start_wait_urb+0x13d/0x370 [ 1464.534583] ? usb_control_msg+0x332/0x4e0 [ 1464.534598] ? proc_control+0x5c5/0xef0 [ 1464.534615] ? usbdev_do_ioctl+0x1eb8/0x3b50 [ 1464.547361] ? usbdev_ioctl+0x25/0x30 [ 1464.547376] ? do_vfs_ioctl+0x1de/0x1720 [ 1464.547394] ? zap_class+0x640/0x640 [ 1464.555741] ? fs_reclaim_acquire+0x20/0x20 [ 1464.555755] ? lock_downgrade+0x900/0x900 [ 1464.555774] ? ___might_sleep+0x1ed/0x300 [ 1464.584642] ? arch_local_save_flags+0x40/0x40 [ 1464.589236] ? lock_downgrade+0x900/0x900 [ 1464.593396] __should_failslab+0x124/0x180 [ 1464.597629] should_failslab+0x9/0x14 [ 1464.601434] kmem_cache_alloc_trace+0x2d7/0x750 [ 1464.606101] ? kasan_unpoison_shadow+0x35/0x50 [ 1464.610683] ? kasan_kmalloc+0xc7/0xe0 [ 1464.614583] wakeup_source_create+0x43/0x90 [ 1464.618910] device_wakeup_enable+0xb4/0x270 [ 1464.623326] device_set_wakeup_enable+0x2b/0x60 [ 1464.628007] usb_hcd_submit_urb+0xe85/0x20a0 [ 1464.632428] ? usb_create_hcd+0x40/0x40 [ 1464.636408] ? do_syscall_64+0x1b9/0x820 [ 1464.640468] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1464.645829] ? __x64_sys_ioctl+0x73/0xb0 [ 1464.645846] ? do_syscall_64+0x1b9/0x820 [ 1464.645859] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1464.645878] ? ___might_sleep+0x1ed/0x300 [ 1464.653966] ? lock_release+0x970/0x970 [ 1464.654002] ? zap_class+0x640/0x640 [ 1464.654019] ? __lockdep_init_map+0x105/0x590 [ 1464.663494] ? __lockdep_init_map+0x105/0x590 [ 1464.663518] usb_submit_urb+0x893/0x14e0 [ 1464.663540] usb_start_wait_urb+0x13d/0x370 [ 1464.689510] ? sg_clean+0x240/0x240 [ 1464.693158] usb_control_msg+0x332/0x4e0 [ 1464.697220] ? usb_start_wait_urb+0x370/0x370 [ 1464.701716] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 1464.701737] proc_control+0x5c5/0xef0 [ 1464.701756] ? proc_bulk+0xa70/0xa70 [ 1464.711063] usbdev_do_ioctl+0x1eb8/0x3b50 [ 1464.711081] ? processcompl_compat+0x680/0x680 [ 1464.711100] ? zap_class+0x640/0x640 [ 1464.727286] ? mark_held_locks+0x130/0x130 [ 1464.731533] ? zap_class+0x640/0x640 [ 1464.735250] ? zap_class+0x640/0x640 [ 1464.738966] ? dput.part.26+0x26d/0x790 [ 1464.742942] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1464.748482] ? check_preemption_disabled+0x48/0x200 [ 1464.753498] ? shrink_dcache_sb+0x350/0x350 [ 1464.757826] ? check_preemption_disabled+0x48/0x200 [ 1464.762846] ? debug_smp_processor_id+0x1c/0x20 [ 1464.767898] ? perf_trace_lock+0x14d/0x7a0 [ 1464.772135] ? zap_class+0x640/0x640 [ 1464.775848] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1464.780778] ? lock_downgrade+0x900/0x900 [ 1464.784931] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1464.790731] ? _parse_integer+0x180/0x180 [ 1464.794892] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1464.800432] ? avc_has_extended_perms+0xab2/0x15a0 [ 1464.805375] ? avc_ss_reset+0x190/0x190 [ 1464.809359] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1464.815157] ? zap_class+0x640/0x640 [ 1464.818873] ? __f_unlock_pos+0x19/0x20 22:52:56 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0074000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1464.822860] ? __fget+0x4d1/0x740 [ 1464.826336] ? ___might_sleep+0x1ed/0x300 [ 1464.830484] ? arch_local_save_flags+0x40/0x40 [ 1464.835069] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 1464.840014] usbdev_ioctl+0x25/0x30 [ 1464.843653] ? usbdev_compat_ioctl+0x30/0x30 [ 1464.848066] do_vfs_ioctl+0x1de/0x1720 [ 1464.851957] ? ioctl_preallocate+0x300/0x300 [ 1464.856372] ? selinux_file_mprotect+0x620/0x620 [ 1464.861135] ? __sb_end_write+0xd9/0x110 [ 1464.865203] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1464.871058] ? fput+0x130/0x1a0 [ 1464.874357] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1464.879898] ? security_file_ioctl+0x94/0xc0 [ 1464.884326] ksys_ioctl+0xa9/0xd0 [ 1464.887783] __x64_sys_ioctl+0x73/0xb0 [ 1464.891676] do_syscall_64+0x1b9/0x820 [ 1464.895563] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1464.900933] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1464.905866] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1464.910713] ? trace_hardirqs_on_caller+0x310/0x310 [ 1464.915730] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1464.920749] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1464.925768] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1464.930628] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1464.935814] RIP: 0033:0x457579 [ 1464.939015] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1464.957911] RSP: 002b:00007f8a115e7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1464.965623] RAX: ffffffffffffffda RBX: 00007f8a115e7c90 RCX: 0000000000457579 22:52:56 executing program 0 (fault-call:1 fault-nth:5): r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1464.973254] RDX: 0000000020000240 RSI: 00000000c0185500 RDI: 0000000000000003 [ 1464.980521] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1464.987791] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8a115e86d4 [ 1464.995061] R13: 00000000004bf6c0 R14: 00000000004cf598 R15: 0000000000000004 22:52:56 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x20000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:56 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2d00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1465.082763] FAULT_INJECTION: forcing a failure. [ 1465.082763] name failslab, interval 1, probability 0, space 0, times 0 [ 1465.094836] CPU: 0 PID: 8673 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #51 [ 1465.102036] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1465.111388] Call Trace: [ 1465.113985] dump_stack+0x1c4/0x2b4 [ 1465.117628] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1465.122838] should_fail.cold.4+0xa/0x17 [ 1465.126906] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1465.132022] ? save_stack+0xa9/0xd0 [ 1465.135650] ? save_stack+0x43/0xd0 [ 1465.139275] ? kasan_kmalloc+0xc7/0xe0 [ 1465.143178] ? kmem_cache_alloc_trace+0x152/0x750 [ 1465.148018] ? wakeup_source_create+0x43/0x90 [ 1465.152513] ? device_wakeup_enable+0xb4/0x270 [ 1465.157092] ? device_set_wakeup_enable+0x2b/0x60 [ 1465.161936] ? usb_hcd_submit_urb+0xe85/0x20a0 [ 1465.166887] ? usb_start_wait_urb+0x13d/0x370 [ 1465.171380] ? usb_control_msg+0x332/0x4e0 [ 1465.175616] ? proc_control+0x5c5/0xef0 [ 1465.179591] ? usbdev_do_ioctl+0x1eb8/0x3b50 [ 1465.183996] ? usbdev_ioctl+0x25/0x30 [ 1465.187799] ? do_vfs_ioctl+0x1de/0x1720 [ 1465.191859] ? zap_class+0x640/0x640 [ 1465.195576] ? fs_reclaim_acquire+0x20/0x20 [ 1465.199897] ? lock_downgrade+0x900/0x900 [ 1465.204057] ? ___might_sleep+0x1ed/0x300 [ 1465.208210] ? arch_local_save_flags+0x40/0x40 [ 1465.212798] ? ___might_sleep+0x1ed/0x300 [ 1465.216950] __should_failslab+0x124/0x180 [ 1465.221188] should_failslab+0x9/0x14 [ 1465.224987] __kmalloc_track_caller+0x2d0/0x750 [ 1465.229654] ? kasan_kmalloc+0xc7/0xe0 [ 1465.233547] ? kstrdup_const+0x66/0x80 [ 1465.237438] kstrdup+0x39/0x70 [ 1465.240638] kstrdup_const+0x66/0x80 [ 1465.244354] wakeup_source_create+0x67/0x90 [ 1465.248675] device_wakeup_enable+0xb4/0x270 [ 1465.253084] device_set_wakeup_enable+0x2b/0x60 [ 1465.257754] usb_hcd_submit_urb+0xe85/0x20a0 [ 1465.262171] ? usb_create_hcd+0x40/0x40 [ 1465.266145] ? do_syscall_64+0x1b9/0x820 [ 1465.270557] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1465.275921] ? __x64_sys_ioctl+0x73/0xb0 [ 1465.279982] ? do_syscall_64+0x1b9/0x820 [ 1465.284051] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1465.289416] ? ___might_sleep+0x1ed/0x300 [ 1465.293563] ? lock_release+0x970/0x970 [ 1465.297542] ? zap_class+0x640/0x640 [ 1465.301256] ? __lockdep_init_map+0x105/0x590 [ 1465.305765] ? __lockdep_init_map+0x105/0x590 [ 1465.310277] usb_submit_urb+0x893/0x14e0 [ 1465.314352] usb_start_wait_urb+0x13d/0x370 [ 1465.318676] ? sg_clean+0x240/0x240 [ 1465.322318] usb_control_msg+0x332/0x4e0 [ 1465.326383] ? usb_start_wait_urb+0x370/0x370 [ 1465.330876] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 1465.336421] proc_control+0x5c5/0xef0 [ 1465.340227] ? proc_bulk+0xa70/0xa70 [ 1465.343952] usbdev_do_ioctl+0x1eb8/0x3b50 [ 1465.348192] ? processcompl_compat+0x680/0x680 [ 1465.352781] ? zap_class+0x640/0x640 [ 1465.356508] ? mark_held_locks+0x130/0x130 [ 1465.360742] ? zap_class+0x640/0x640 [ 1465.364453] ? retint_kernel+0x2d/0x2d [ 1465.368653] ? trace_hardirqs_on_caller+0xc0/0x310 [ 1465.373583] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1465.378338] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1465.383880] ? check_preemption_disabled+0x48/0x200 [ 1465.388905] ? check_preemption_disabled+0x48/0x200 [ 1465.393924] ? debug_smp_processor_id+0x1c/0x20 [ 1465.398593] ? perf_trace_lock+0x14d/0x7a0 [ 1465.402830] ? zap_class+0x640/0x640 [ 1465.406550] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1465.411482] ? lock_downgrade+0x900/0x900 [ 1465.415635] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1465.421432] ? _parse_integer+0x180/0x180 [ 1465.425591] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1465.431126] ? avc_has_extended_perms+0xab2/0x15a0 [ 1465.436062] ? avc_ss_reset+0x190/0x190 [ 1465.440040] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1465.445839] ? zap_class+0x640/0x640 [ 1465.449557] ? __f_unlock_pos+0x19/0x20 [ 1465.453535] ? __fget+0x4d1/0x740 [ 1465.456992] ? ___might_sleep+0x1ed/0x300 [ 1465.461142] ? arch_local_save_flags+0x40/0x40 [ 1465.465730] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 1465.470990] usbdev_ioctl+0x25/0x30 [ 1465.474628] ? usbdev_compat_ioctl+0x30/0x30 [ 1465.479038] do_vfs_ioctl+0x1de/0x1720 [ 1465.482928] ? ioctl_preallocate+0x300/0x300 [ 1465.487341] ? selinux_file_mprotect+0x620/0x620 [ 1465.492104] ? __sb_end_write+0xd9/0x110 [ 1465.496169] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1465.501708] ? fput+0x130/0x1a0 [ 1465.504997] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1465.510535] ? security_file_ioctl+0x94/0xc0 [ 1465.514946] ksys_ioctl+0xa9/0xd0 [ 1465.518405] __x64_sys_ioctl+0x73/0xb0 [ 1465.522302] do_syscall_64+0x1b9/0x820 [ 1465.526193] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1465.531560] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1465.536499] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1465.541345] ? trace_hardirqs_on_caller+0x310/0x310 [ 1465.546365] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1465.551382] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1465.556404] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1465.561261] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1465.566457] RIP: 0033:0x457579 22:52:57 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400201) signalfd4(r0, &(0x7f0000000400)={0x4}, 0x8, 0x800) write$binfmt_elf32(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="00000000962630605bf57d9439a5a0296c8524543339b0b041cae173b91b8249c397436ad12f0000010000000000fca4e81568504a5bf1083cf674b58482412446da6a75"], 0x1) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x200, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e24, 0x505c, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1a}}, 0x6}}, 0x5, 0x6, 0x9, 0x400, 0x9}, &(0x7f0000000440)=0x98) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000005c0)={r1, @in6={{0xa, 0x4e24, 0x0, @local, 0x9}}, 0x5, 0x2}, &(0x7f0000000480)=0x90) ioctl$DRM_IOCTL_VERSION(r0, 0xc0406400, &(0x7f00000001c0)={0x3, 0x6e8, 0x442c, 0x86, &(0x7f0000000240)=""/134, 0x21, &(0x7f0000000180)=""/33, 0xc7, &(0x7f0000000300)=""/199}) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x8) [ 1465.570025] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1465.588935] RSP: 002b:00007f8a115e7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1465.596642] RAX: ffffffffffffffda RBX: 00007f8a115e7c90 RCX: 0000000000457579 [ 1465.603906] RDX: 0000000020000240 RSI: 00000000c0185500 RDI: 0000000000000003 [ 1465.611174] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1465.618438] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8a115e86d4 [ 1465.625703] R13: 00000000004bf6c0 R14: 00000000004cf598 R15: 0000000000000004 22:52:57 executing program 0 (fault-call:1 fault-nth:6): r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:52:57 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x7a00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:57 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:52:57 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000380", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:57 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x5460, &(0x7f0000000240)={0x10300}) 22:52:57 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x5450, &(0x7f0000000240)={0x10300}) 22:52:57 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3f00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:57 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185502, &(0x7f0000000240)={0x10300}) 22:52:57 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x100000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:57 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x10, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:57 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000400080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:58 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000480)='/dev/dsp\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, &(0x7f00000000c0)={0x9, 0x3, 0x7, 0x1, 'syz1\x00', 0x4}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x84140, 0x0) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[], 0x0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000080)) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x0, 0x3, 0x3ff, 0x0, 0x8, 0x13, 0x7, 0x5, 0x3ce0, 0x3}) ioctl$DRM_IOCTL_MARK_BUFS(r0, 0x40206417, &(0x7f0000000400)={0xbe65, 0xaf3c, 0x8, 0x80000000, 0x1, 0x1}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000240)={{{@in=@rand_addr, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @broadcast}}}, &(0x7f00000001c0)=0xe8) getresgid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)=0x0) fchownat(r2, &(0x7f0000000180)='./file0\x00', r3, r4, 0x1800) ioctl$int_in(r0, 0x80000000005008, &(0x7f00000004c0)) ppoll(&(0x7f00000000c0), 0x0, &(0x7f0000000100), &(0x7f0000000140), 0x8) 22:52:58 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x8008551c, &(0x7f0000000240)={0x10300}) 22:52:58 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:58 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2200, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:58 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x500000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:58 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fffffff680", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:58 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0105502, &(0x7f0000000240)={0x10300}) 22:52:58 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfffffff6, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:58 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x551f, &(0x7f0000000240)={0x10300}) 22:52:58 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0068000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:58 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2200000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:58 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:58 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:58 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc020660b, &(0x7f0000000240)={0x10300}) 22:52:58 executing program 4 (fault-call:6 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:52:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x4020940d, &(0x7f0000000240)={0x10300}) [ 1467.136134] EXT4-fs: 28 callbacks suppressed [ 1467.136162] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1467.164544] binder: 8773:8777 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1467.176693] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value [ 1467.220721] EXT4-fs (sda1): re-mounted. Opts: 22:52:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:52:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x4b49, &(0x7f0000000240)={0x10300}) [ 1467.242587] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1467.262021] binder: send failed reply for transaction 97 to 8773:8777 [ 1467.269457] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value [ 1467.279602] binder: undelivered TRANSACTION_COMPLETE [ 1467.288353] EXT4-fs (sda1): re-mounted. Opts: 22:52:59 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="004c000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:52:59 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfffffdfd, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1467.301669] binder: undelivered TRANSACTION_ERROR: 29189 [ 1467.310269] binder: 8791:8792 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1467.342416] EXT4-fs (sda1): re-mounted. Opts: 22:52:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x5452, &(0x7f0000000240)={0x10300}) 22:52:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:52:59 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x1000000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1467.389541] binder: send failed reply for transaction 99 to 8791:8792 [ 1467.396438] binder: undelivered TRANSACTION_COMPLETE [ 1467.411719] binder: undelivered TRANSACTION_ERROR: 29189 [ 1467.431842] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:52:59 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2c000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80087601, &(0x7f0000000240)={0x10300}) [ 1467.449719] binder_alloc: binder_alloc_mmap_handler: 8799 20001000-20004000 already mapped failed -16 [ 1467.460507] binder: BINDER_SET_CONTEXT_MGR already set [ 1467.465877] binder: 8799:8801 ioctl 40046207 0 returned -16 [ 1467.473806] binder_alloc: 8799: binder_alloc_buf, no vma [ 1467.481303] binder: 8799:8805 transaction failed 29189/-3, size 0-0 line 2970 [ 1467.492031] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1467.502927] binder: send failed reply for transaction 101 to 8799:8801 [ 1467.513998] binder: undelivered TRANSACTION_COMPLETE 22:52:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x550b, &(0x7f0000000240)={0x10300}) 22:52:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0189436, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:52:59 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0005000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1467.547533] binder: undelivered TRANSACTION_ERROR: 29189 [ 1467.572972] binder: undelivered TRANSACTION_ERROR: 29189 [ 1467.575037] EXT4-fs (sda1): re-mounted. Opts: [ 1467.602982] binder_alloc: binder_alloc_mmap_handler: 8818 20001000-20004000 already mapped failed -16 [ 1467.622686] binder: BINDER_SET_CONTEXT_MGR already set [ 1467.628708] binder: 8818:8821 ioctl 40046207 0 returned -16 [ 1467.634732] binder_alloc: 8818: binder_alloc_buf, no vma 22:52:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x4004551e, &(0x7f0000000240)={0x10300}) [ 1467.651599] binder: 8818:8822 transaction failed 29189/-3, size 0-0 line 2970 [ 1467.670913] binder: send failed reply for transaction 104 to 8818:8821 [ 1467.683156] binder: undelivered TRANSACTION_COMPLETE 22:52:59 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x5000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5452, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:52:59 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x48, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:52:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045510, &(0x7f0000000240)={0x10300}) 22:52:59 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x68000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1467.716263] binder: undelivered TRANSACTION_ERROR: 29189 [ 1467.740789] binder: undelivered TRANSACTION_ERROR: 29189 22:52:59 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="006c000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1467.774242] binder_alloc: binder_alloc_mmap_handler: 8836 20001000-20004000 already mapped failed -16 [ 1467.785087] binder: BINDER_SET_CONTEXT_MGR already set [ 1467.792373] binder: 8836:8838 ioctl 40046207 0 returned -16 [ 1467.808338] binder_alloc: 8836: binder_alloc_buf, no vma [ 1467.814972] binder: 8836:8839 transaction failed 29189/-3, size 0-0 line 2970 22:52:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x4004550d, &(0x7f0000000240)={0x10300}) [ 1467.824998] binder: send failed reply for transaction 107 to 8836:8838 [ 1467.834177] binder: undelivered TRANSACTION_COMPLETE [ 1467.858988] binder: undelivered TRANSACTION_ERROR: 29189 22:52:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5450, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1467.876675] binder: undelivered TRANSACTION_ERROR: 29189 [ 1467.904126] binder_alloc: binder_alloc_mmap_handler: 8851 20001000-20004000 already mapped failed -16 22:52:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc00c5512, &(0x7f0000000240)={0x10300}) [ 1467.927863] binder: BINDER_SET_CONTEXT_MGR already set [ 1467.933900] binder: 8851:8853 ioctl 40046207 0 returned -16 [ 1467.942449] binder_alloc: 8851: binder_alloc_buf, no vma [ 1467.954731] binder: 8851:8855 transaction failed 29189/-3, size 0-0 line 2970 22:52:59 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x600000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1467.976027] binder: send failed reply for transaction 110 to 8851:8853 22:52:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185503, &(0x7f0000000240)={0x10300}) 22:52:59 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0020000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1468.010183] binder: undelivered TRANSACTION_COMPLETE 22:52:59 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x3f000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:52:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc030620a, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:52:59 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x200000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:52:59 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045505, &(0x7f0000000240)={0x10300}) [ 1468.037693] binder: undelivered TRANSACTION_ERROR: 29189 [ 1468.050734] binder: undelivered TRANSACTION_ERROR: 29189 22:53:00 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x8008550e, &(0x7f0000000240)={0x10300}) [ 1468.112154] usb usb8: usbfs: interface 0 claimed by hub while 'syz-executor0' sets config #66304 [ 1468.128530] binder: 8875:8876 ioctl c030620a 20000480 returned -22 [ 1468.141469] usb usb8: usbfs: interface 0 claimed by hub while 'syz-executor0' sets config #66304 [ 1468.145158] binder_alloc: binder_alloc_mmap_handler: 8875 20001000-20004000 already mapped failed -16 [ 1468.188178] binder: BINDER_SET_CONTEXT_MGR already set [ 1468.193513] binder: 8875:8876 ioctl 40046207 0 returned -16 [ 1468.199824] binder_alloc: 8875: binder_alloc_buf, no vma [ 1468.215564] binder: 8875:8879 transaction failed 29189/-3, size 0-0 line 2970 22:53:00 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045503, &(0x7f0000000240)={0x10300}) 22:53:00 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000003f80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1468.239797] binder: 8875:8892 ioctl c030620a 20000480 returned -22 [ 1468.275624] binder: send failed reply for transaction 113 to 8875:8876 22:53:00 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x200000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc020660b, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1468.296249] binder: undelivered TRANSACTION_COMPLETE 22:53:00 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80085504, &(0x7f0000000240)={0x10300}) 22:53:00 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2200, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:00 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x5421, &(0x7f0000000240)={0x10300}) 22:53:00 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4000000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:00 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x41045508, &(0x7f0000000240)={0x10300}) [ 1468.404448] binder_alloc: binder_alloc_mmap_handler: 8902 20001000-20004000 already mapped failed -16 [ 1468.434936] binder: BINDER_SET_CONTEXT_MGR already set [ 1468.440640] binder: 8902:8906 ioctl 40046207 0 returned -16 [ 1468.445267] binder_alloc: 8902: binder_alloc_buf, no vma 22:53:00 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000002080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1468.461673] binder: 8902:8909 transaction failed 29189/-3, size 0-0 line 2970 [ 1468.492748] binder: send failed reply for transaction 116 to 8902:8906 22:53:00 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045518, &(0x7f0000000240)={0x10300}) [ 1468.508955] binder: undelivered TRANSACTION_COMPLETE 22:53:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x4b49, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:00 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xffffffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:00 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x790c, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1468.593145] binder: 8931:8934 ioctl 4b49 20000480 returned -22 [ 1468.602316] binder_alloc: binder_alloc_mmap_handler: 8931 20001000-20004000 already mapped failed -16 [ 1468.612332] binder: BINDER_SET_CONTEXT_MGR already set [ 1468.619135] binder: 8931:8934 ioctl 40046207 0 returned -16 [ 1468.625034] binder_alloc: 8931: binder_alloc_buf, no vma [ 1468.633796] binder: 8931:8936 transaction failed 29189/-3, size 0-0 line 2970 22:53:00 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x8008551d, &(0x7f0000000240)={0x10300}) [ 1468.641386] binder: 8931:8936 ioctl 4b49 20000480 returned -22 [ 1468.661592] binder: send failed reply for transaction 119 to 8931:8934 [ 1468.672429] binder: undelivered TRANSACTION_COMPLETE 22:53:00 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc01855a1, &(0x7f0000000240)={0x10300}) 22:53:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:00 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:00 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fffffdfd80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:00 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045515, &(0x7f0000000240)={0x10300}) [ 1468.775886] binder_alloc: binder_alloc_mmap_handler: 8948 20001000-20004000 already mapped failed -16 [ 1468.799128] binder: BINDER_SET_CONTEXT_MGR already set [ 1468.815125] binder: 8948:8950 ioctl 40046207 0 returned -16 22:53:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306225, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:00 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x4b47, &(0x7f0000000240)={0x10300}) [ 1468.821067] binder_alloc: 8948: binder_alloc_buf, no vma [ 1468.829400] binder: 8948:8952 transaction failed 29189/-3, size 0-0 line 2970 [ 1468.837330] binder: send failed reply for transaction 122 to 8948:8950 [ 1468.855035] binder: undelivered TRANSACTION_COMPLETE 22:53:00 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xc79, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:00 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4000000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:00 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000004080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:00 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0105500, &(0x7f0000000240)={0x10300}) [ 1468.942044] binder: 8966:8971 ioctl c0306225 20000480 returned -22 [ 1468.972841] binder_alloc: binder_alloc_mmap_handler: 8966 20001000-20004000 already mapped failed -16 [ 1469.006004] binder: BINDER_SET_CONTEXT_MGR already set [ 1469.012121] binder: 8966:8971 ioctl 40046207 0 returned -16 [ 1469.018271] binder_alloc: 8966: binder_alloc_buf, no vma 22:53:00 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:00 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x8010550e, &(0x7f0000000240)={0x10300}) [ 1469.047869] binder: 8966:8972 transaction failed 29189/-3, size 0-0 line 2970 [ 1469.063116] binder: 8966:8980 ioctl c0306225 20000480 returned -22 22:53:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x80086601, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:01 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x5514, &(0x7f0000000240)={0x10300}) 22:53:01 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x48000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:01 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000280", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1469.160823] binder: 8993:8995 ioctl 80086601 20000480 returned -22 22:53:01 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:01 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x40086602, &(0x7f0000000240)={0x10300}) [ 1469.211125] binder_alloc: binder_alloc_mmap_handler: 8993 20001000-20004000 already mapped failed -16 [ 1469.229403] binder: BINDER_SET_CONTEXT_MGR already set [ 1469.235034] binder: 8993:8995 ioctl 40046207 0 returned -16 [ 1469.237338] binder_alloc: 8993: binder_alloc_buf, no vma [ 1469.249772] binder: 8993:9001 transaction failed 29189/-3, size 0-0 line 2970 22:53:01 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x8004551a, &(0x7f0000000240)={0x10300}) [ 1469.260667] binder: 8993:9001 ioctl 80086601 20000480 returned -22 22:53:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:01 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x2, &(0x7f0000000240)={0x10300}) 22:53:01 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x22, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1469.366113] binder: BINDER_SET_CONTEXT_MGR already set [ 1469.374629] binder: 9015:9016 ioctl 40046207 20000480 returned -16 [ 1469.396844] binder: BINDER_SET_CONTEXT_MGR already set [ 1469.403626] binder: 9015:9016 ioctl 40046207 0 returned -16 22:53:01 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fdfdffff80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:01 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x40049409, &(0x7f0000000240)={0x10300}) [ 1469.427593] binder: BINDER_SET_CONTEXT_MGR already set [ 1469.443788] binder: 9015:9024 ioctl 40046207 20000480 returned -16 22:53:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x80087601, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:01 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xffffffff00000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:01 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2d, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:01 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0189436, &(0x7f0000000240)={0x10300}) [ 1469.511376] binder: 9033:9035 ioctl 80087601 20000480 returned -22 [ 1469.542913] binder: BINDER_SET_CONTEXT_MGR already set [ 1469.554740] binder: 9033:9035 ioctl 40046207 0 returned -16 22:53:01 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x4004550c, &(0x7f0000000240)={0x10300}) 22:53:01 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6b6b6b00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1469.565296] binder: 9033:9043 ioctl 80087601 20000480 returned -22 22:53:01 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0500000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc030625c, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1469.641334] binder: BINDER_SET_CONTEXT_MGR already set [ 1469.646769] binder: 9052:9055 ioctl 40046207 0 returned -16 22:53:01 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:01 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4800, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1469.725721] binder: 9067:9069 ioctl c030625c 20000480 returned -22 [ 1469.762820] binder: BINDER_SET_CONTEXT_MGR already set [ 1469.769148] binder: 9067:9069 ioctl 40046207 0 returned -16 22:53:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306209, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1469.780604] binder: 9067:9075 ioctl c030625c 20000480 returned -22 22:53:01 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="6c00000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:01 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7400000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40049409, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1469.862600] binder: 9080:9081 ioctl c0306209 20000480 returned -22 [ 1469.875960] binder: BINDER_SET_CONTEXT_MGR already set [ 1469.882428] binder: 9080:9081 ioctl 40046207 0 returned -16 [ 1469.889574] binder: 9080:9087 ioctl c0306209 20000480 returned -22 22:53:01 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x8cffffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1469.986391] binder: BINDER_SET_CONTEXT_MGR already set [ 1469.994802] binder: 9096:9100 ioctl 40046207 0 returned -16 22:53:02 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0045878, &(0x7f0000000240)={0x10300}) 22:53:02 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x300, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:02 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0300000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x4b47, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:02 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xffffffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:02 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfdfdffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1470.487689] binder: 9117:9119 ioctl 4b47 20000480 returned -22 [ 1470.513043] binder: 9117:9128 ioctl 4b47 20000480 returned -22 [ 1470.522778] binder: BINDER_SET_CONTEXT_MGR already set 22:53:02 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x4008550d, &(0x7f0000000240)={0x10300}) 22:53:02 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000180", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1470.544617] binder: 9117:9119 ioctl 40046207 0 returned -16 22:53:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:02 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x8038550a, &(0x7f0000000240)={0x10300}) 22:53:02 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6800, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:02 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2c000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:02 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6c00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:02 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x5451, &(0x7f0000000240)={0x10300}) [ 1470.665664] binder: BINDER_SET_CONTEXT_MGR already set [ 1470.682445] binder: 9141:9143 ioctl 40046207 0 returned -16 22:53:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:02 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x40085511, &(0x7f0000000240)={0x10300}) [ 1470.774571] binder: BINDER_SET_CONTEXT_MGR already set [ 1470.783754] binder: 9152:9155 ioctl 40046207 0 returned -16 22:53:02 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="4c00000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40087602, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:02 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x8004550f, &(0x7f0000000240)={0x10300}) 22:53:02 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x9000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:02 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6800000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:02 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80086601, &(0x7f0000000240)={0x10300}) [ 1470.904125] binder: 9174:9177 ioctl 40087602 20000480 returned -22 [ 1470.916390] binder: BINDER_SET_CONTEXT_MGR already set [ 1470.921844] binder: 9174:9177 ioctl 40046207 0 returned -16 [ 1470.934966] binder: 9174:9181 ioctl 40087602 20000480 returned -22 22:53:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40046205, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:02 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6b6b6b, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:02 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x40087602, &(0x7f0000000240)={0x10300}) 22:53:02 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000780", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1471.038187] binder: BINDER_SET_CONTEXT_MGR already set [ 1471.045987] binder: 9191:9193 ioctl 40046207 0 returned -16 22:53:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40086602, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:02 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x541b, &(0x7f0000000240)={0x10300}) 22:53:03 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4c000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:03 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xffffff7f, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:03 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0045878, &(0x7f0000000240)={0x10300}) 22:53:03 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4800, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1471.187766] binder: 9208:9212 ioctl 40086602 20000480 returned -22 [ 1471.208407] binder: BINDER_SET_CONTEXT_MGR already set [ 1471.210346] binder: 9208:9216 ioctl 40086602 20000480 returned -22 [ 1471.216197] binder: 9208:9212 ioctl 40046207 0 returned -16 22:53:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:03 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x802c550a, &(0x7f0000000240)={0x10300}) 22:53:03 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00000c7980", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:03 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0105512, &(0x7f0000000240)={0x10300}) [ 1471.309145] binder: BINDER_SET_CONTEXT_MGR already set [ 1471.331788] binder: 9222:9223 ioctl 40046207 0 returned -16 22:53:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x4020940d, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:03 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045519, &(0x7f0000000240)={0x10300}) 22:53:03 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2c000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5460, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1471.454800] binder: BINDER_SET_CONTEXT_MGR already set [ 1471.463419] binder: 9240:9242 ioctl 40046207 0 returned -16 22:53:03 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x8108551b, &(0x7f0000000240)={0x10300}) 22:53:03 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x300, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:03 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1f00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:03 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="007a000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x541b, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1471.556007] binder: BINDER_SET_CONTEXT_MGR already set [ 1471.570033] binder: 9252:9254 ioctl 40046207 0 returned -16 22:53:03 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x4008550c, &(0x7f0000000240)={0x10300}) [ 1471.641725] binder: 9261:9262 ioctl 541b 20000480 returned -22 [ 1471.660273] binder: BINDER_SET_CONTEXT_MGR already set [ 1471.673265] binder: 9261:9262 ioctl 40046207 0 returned -16 [ 1471.682894] binder: 9261:9274 ioctl 541b 20000480 returned -22 22:53:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:03 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfdfdffff00000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:03 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x700, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc018620b, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1471.744843] binder: BINDER_SET_CONTEXT_MGR already set [ 1471.753240] binder: 9282:9284 ioctl 40046207 0 returned -16 22:53:03 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000050080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:03 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x600, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1471.817027] binder: BINDER_SET_CONTEXT_MGR already set [ 1471.822562] binder: 9290:9291 ioctl 40046207 0 returned -16 22:53:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0x5c, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:03 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1471.950820] binder: 9302:9306 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1471.966869] binder: 9302:9306 unknown command 0 [ 1471.978120] binder: 9302:9306 ioctl c0306201 20000480 returned -22 22:53:03 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="002c000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1472.000816] binder: BINDER_SET_CONTEXT_MGR already set [ 1472.006771] binder: 9302:9306 ioctl 40046207 0 returned -16 [ 1472.015398] binder: 9302:9317 BC_FREE_BUFFER u0000000020001000 no match [ 1472.024730] binder: 9302:9317 unknown command 0 22:53:03 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x400000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:03 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7400, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1472.060644] binder: 9302:9317 ioctl c0306201 20000480 returned -22 [ 1472.188507] EXT4-fs: 107 callbacks suppressed [ 1472.188516] EXT4-fs (sda1): re-mounted. Opts: [ 1472.215580] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1472.259755] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1472.278347] EXT4-fs (sda1): re-mounted. Opts: [ 1472.285006] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value [ 1472.344794] EXT4-fs (sda1): re-mounted. Opts: [ 1472.362971] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value 22:53:04 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x103a1}) 22:53:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x100000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:04 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x74, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:04 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000090080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:04 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:04 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1f00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1472.522212] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1472.524621] binder_alloc_mmap_handler: 19 callbacks suppressed [ 1472.524635] binder_alloc: binder_alloc_mmap_handler: 9344 20001000-20004000 already mapped failed -16 [ 1472.550594] usb usb8: usbfs: process 9355 (syz-executor0) did not claim interface 0 before use [ 1472.570073] binder: BINDER_SET_CONTEXT_MGR already set [ 1472.584439] EXT4-fs (sda1): re-mounted. Opts: [ 1472.589341] binder: 9344:9346 ioctl 40046207 0 returned -16 [ 1472.605686] EXT4-fs (sda1): re-mounted. Opts: 22:53:04 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10303}) [ 1472.618020] binder_alloc_new_buf_locked: 19 callbacks suppressed [ 1472.618027] binder_alloc: 9344: binder_alloc_buf, no vma [ 1472.633241] binder_transaction: 19 callbacks suppressed [ 1472.633257] binder: 9344:9362 transaction failed 29189/-3, size 0-0 line 2970 [ 1472.645974] binder_send_failed_reply: 21 callbacks suppressed [ 1472.645982] binder: send failed reply for transaction 188 to 9344:9346 [ 1472.664812] binder_release_work: 21 callbacks suppressed 22:53:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x5, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:04 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000200080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1472.664816] binder: undelivered TRANSACTION_COMPLETE [ 1472.689211] binder_release_work: 50 callbacks suppressed [ 1472.689217] binder: undelivered TRANSACTION_ERROR: 29189 [ 1472.707722] binder: undelivered TRANSACTION_ERROR: 29189 22:53:04 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10102}) [ 1472.735689] vhci_hcd: default hub control req: 0303 v0001 i0000 l0 [ 1472.744348] binder: 9369:9370 unknown command 2097168 [ 1472.752237] vhci_hcd: default hub control req: 0303 v0001 i0000 l0 [ 1472.759180] binder: 9369:9370 ioctl c0306201 20000480 returned -22 [ 1472.776564] binder_alloc: binder_alloc_mmap_handler: 9369 20001000-20004000 already mapped failed -16 22:53:04 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x10000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:04 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x40000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:04 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x60, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1472.815168] binder: BINDER_SET_CONTEXT_MGR already set [ 1472.820786] binder: 9369:9370 ioctl 40046207 0 returned -16 [ 1472.826618] binder_alloc: 9369: binder_alloc_buf, no vma [ 1472.833068] binder: 9369:9373 transaction failed 29189/-3, size 0-0 line 2970 [ 1472.841848] binder: 9369:9373 unknown command 2097168 [ 1472.858946] binder: 9369:9373 ioctl c0306201 20000480 returned -22 22:53:04 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10302}) [ 1472.867244] binder: send failed reply for transaction 191 to 9369:9370 [ 1472.877753] binder: undelivered TRANSACTION_COMPLETE [ 1472.889239] binder: undelivered TRANSACTION_ERROR: 29189 22:53:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x4c, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:04 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0068000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1472.914268] binder: undelivered TRANSACTION_ERROR: 29189 22:53:04 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10500}) 22:53:04 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10900}) [ 1472.976264] binder_alloc: binder_alloc_mmap_handler: 9386 20001000-20004000 already mapped failed -16 [ 1473.009963] binder: BINDER_SET_CONTEXT_MGR already set [ 1473.015360] binder: 9386:9389 ioctl 40046207 0 returned -16 22:53:04 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10b00}) [ 1473.033337] binder_alloc: 9386: binder_alloc_buf, no vma [ 1473.046115] binder: 9386:9405 transaction failed 29189/-3, size 0-0 line 2970 [ 1473.065067] binder: send failed reply for transaction 194 to 9386:9389 22:53:04 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xc79, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:04 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:04 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x1f00000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x400000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x300000000000000}) [ 1473.091464] binder: undelivered TRANSACTION_COMPLETE [ 1473.110314] binder: undelivered TRANSACTION_ERROR: 29189 [ 1473.124877] binder: undelivered TRANSACTION_ERROR: 29189 22:53:05 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000030080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1473.189519] binder_alloc: binder_alloc_mmap_handler: 9413 20001000-20004000 already mapped failed -16 [ 1473.223081] binder: BINDER_SET_CONTEXT_MGR already set [ 1473.229238] binder: 9413:9414 ioctl 40046207 0 returned -16 22:53:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x200000000000000}) [ 1473.229267] binder_alloc: 9413: binder_alloc_buf, no vma 22:53:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x3000000}) [ 1473.273585] binder: send failed reply for transaction 197 to 9413:9414 [ 1473.281905] binder: undelivered TRANSACTION_COMPLETE [ 1473.293050] binder: 9413:9416 transaction failed 29189/-3, size 0-0 line 2970 [ 1473.308557] binder: undelivered TRANSACTION_ERROR: 29189 22:53:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x6c000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:05 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x500, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:05 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6800000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1473.350884] binder: undelivered TRANSACTION_ERROR: 29189 22:53:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x100000}) 22:53:05 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:05 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00790c0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0xa1000000}) [ 1473.437845] binder_alloc: binder_alloc_mmap_handler: 9442 20001000-20004000 already mapped failed -16 [ 1473.447399] binder: BINDER_SET_CONTEXT_MGR already set [ 1473.452925] binder: 9442:9443 ioctl 40046207 0 returned -16 [ 1473.465045] binder_alloc: 9442: binder_alloc_buf, no vma [ 1473.470612] binder: 9442:9445 transaction failed 29189/-3, size 0-0 line 2970 22:53:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x2}) [ 1473.491571] binder: undelivered TRANSACTION_ERROR: 29189 [ 1473.497090] binder: send failed reply for transaction 200 to 9442:9443 22:53:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0xfffffdfd, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1473.538296] binder: undelivered TRANSACTION_COMPLETE [ 1473.547807] binder: undelivered TRANSACTION_ERROR: 29189 22:53:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0xfdfdffff}) [ 1473.606359] binder_alloc: binder_alloc_mmap_handler: 9459 20001000-20004000 already mapped failed -16 [ 1473.620756] binder: BINDER_SET_CONTEXT_MGR already set [ 1473.626247] binder: 9459:9461 ioctl 40046207 0 returned -16 [ 1473.632999] binder_alloc: 9459: binder_alloc_buf, no vma 22:53:05 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="007a000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1473.651838] binder: 9459:9462 transaction failed 29189/-3, size 0-0 line 2970 [ 1473.674186] binder: send failed reply for transaction 203 to 9459:9461 [ 1473.683908] binder: undelivered TRANSACTION_COMPLETE 22:53:05 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x900, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:05 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfdfdffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:05 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2c00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0xffffff7f}) 22:53:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0xfdfdffff00000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0xffffff7f00000000}) 22:53:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x3}) [ 1473.886742] binder_alloc: binder_alloc_mmap_handler: 9485 20001000-20004000 already mapped failed -16 [ 1473.897205] binder: BINDER_SET_CONTEXT_MGR already set [ 1473.904789] binder: 9485:9487 ioctl 40046207 0 returned -16 [ 1473.911508] binder_alloc: 9485: binder_alloc_buf, no vma [ 1473.925904] binder: 9485:9488 transaction failed 29189/-3, size 0-0 line 2970 22:53:05 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00001f0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:05 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:05 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2200000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x68000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0xffffffff00000000}) [ 1473.967284] binder: send failed reply for transaction 206 to 9485:9487 [ 1473.989233] binder: undelivered TRANSACTION_COMPLETE 22:53:05 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0xfffffdfd}) [ 1474.116226] binder_alloc: binder_alloc_mmap_handler: 9504 20001000-20004000 already mapped failed -16 [ 1474.145008] binder: BINDER_SET_CONTEXT_MGR already set [ 1474.150860] binder: 9504:9508 ioctl 40046207 0 returned -16 22:53:06 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x4000000000000000}) [ 1474.180004] binder_alloc: 9504: binder_alloc_buf, no vma [ 1474.207451] binder: send failed reply for transaction 209 to 9504:9508 [ 1474.209024] binder: 9504:9520 transaction failed 29189/-3, size 0-0 line 2970 [ 1474.223964] binder: undelivered TRANSACTION_COMPLETE 22:53:06 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x2000000}) 22:53:06 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6b6b6b00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:06 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="000c790080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:06 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2d00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:06 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x790c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x74, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1474.509471] binder_alloc: binder_alloc_mmap_handler: 9535 20001000-20004000 already mapped failed -16 [ 1474.542243] binder: BINDER_SET_CONTEXT_MGR already set 22:53:06 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x40000000}) [ 1474.556139] binder: 9535:9537 ioctl 40046207 0 returned -16 [ 1474.562981] binder_alloc: 9535: binder_alloc_buf, no vma [ 1474.581738] binder: 9535:9541 transaction failed 29189/-3, size 0-0 line 2970 [ 1474.591853] binder: send failed reply for transaction 212 to 9535:9537 [ 1474.600187] binder: undelivered TRANSACTION_COMPLETE 22:53:06 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0007000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:06 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x300}) 22:53:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x5000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:06 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xffffff8c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:06 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:06 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0xa1}) [ 1474.708474] binder_alloc: binder_alloc_mmap_handler: 9556 20001000-20004000 already mapped failed -16 [ 1474.751021] binder: BINDER_SET_CONTEXT_MGR already set [ 1474.756452] binder: 9556:9558 ioctl 40046207 0 returned -16 [ 1474.768221] binder_alloc: 9556: binder_alloc_buf, no vma [ 1474.792830] binder: 9556:9563 transaction failed 29189/-3, size 0-0 line 2970 [ 1474.801006] binder: send failed reply for transaction 215 to 9556:9558 [ 1474.810549] binder: undelivered TRANSACTION_COMPLETE 22:53:07 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x48, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x6000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:07 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x10}) 22:53:07 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0003000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:07 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6b6b6b00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:07 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:07 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x100000000000000}) [ 1475.244628] binder: BINDER_SET_CONTEXT_MGR already set [ 1475.256792] binder: 9580:9582 ioctl 40046207 0 returned -16 22:53:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x60000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:07 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x3f00000000000000}) 22:53:07 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:07 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00006c0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:07 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x22000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1475.399281] binder: BINDER_SET_CONTEXT_MGR already set [ 1475.414868] binder: 9603:9607 ioctl 40046207 0 returned -16 [ 1475.414875] binder: release 9603:9607 transaction 221 out, still active [ 1475.414938] binder: send failed reply for transaction 221, target dead 22:53:07 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2c00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:07 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0xa100}) 22:53:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x7400, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:07 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x10000000000000}) [ 1475.555262] binder: BINDER_SET_CONTEXT_MGR already set [ 1475.562902] binder: 9620:9623 ioctl 40046207 0 returned -16 22:53:07 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000060080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:07 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1000000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x4c00, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:07 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x1000000000000}) 22:53:07 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1475.699244] binder: BINDER_SET_CONTEXT_MGR already set [ 1475.709007] binder: 9636:9639 ioctl 40046207 0 returned -16 22:53:07 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0xfdfdffff00000000}) 22:53:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x2, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:07 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x3f000000}) [ 1475.893942] binder: 9655:9657 unknown command 268451848 [ 1475.913358] binder: 9655:9657 ioctl c0306201 20000480 returned -22 [ 1475.940670] binder: BINDER_SET_CONTEXT_MGR already set [ 1475.953341] binder: 9655:9657 ioctl 40046207 0 returned -16 [ 1475.961537] binder: 9655:9663 unknown command 268451848 [ 1475.976861] binder: 9655:9663 ioctl c0306201 20000480 returned -22 22:53:08 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:08 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000480080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:08 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x1000000}) 22:53:08 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2c00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x6c00000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:08 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfcfdffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:08 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x4000}) 22:53:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x3f00000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1476.249583] binder: BINDER_SET_CONTEXT_MGR already set [ 1476.254973] binder: 9668:9675 ioctl 40046207 0 returned -16 22:53:08 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000740080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:08 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x3f00}) [ 1476.385808] binder: BINDER_SET_CONTEXT_MGR already set [ 1476.394984] binder: 9688:9691 ioctl 40046207 0 returned -16 22:53:08 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:08 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:08 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4c00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x3f000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:08 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0xa100000000000000}) 22:53:08 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000220080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:08 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x10, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:08 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfdfdffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:08 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x10}) 22:53:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x300, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1476.798499] binder: BINDER_SET_CONTEXT_MGR already set [ 1476.806054] binder: 9716:9718 ioctl 40046207 0 returned -16 22:53:08 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x3}) 22:53:08 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0005000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1476.885885] binder: BINDER_SET_CONTEXT_MGR already set [ 1476.900934] binder: 9726:9727 ioctl 40046207 0 returned -16 22:53:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x3f00, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:08 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x100000000000000}) [ 1477.042120] binder: BINDER_SET_CONTEXT_MGR already set [ 1477.047546] binder: 9745:9747 ioctl 40046207 0 returned -16 [ 1477.284945] EXT4-fs: 81 callbacks suppressed [ 1477.284995] EXT4-fs (sda1): re-mounted. Opts: [ 1477.358307] EXT4-fs (sda1): re-mounted. Opts: 22:53:09 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x790c0000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:09 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:09 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x68, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:09 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x2000000}) 22:53:09 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00004c0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:09 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x100000}) [ 1477.599960] binder_alloc_mmap_handler: 10 callbacks suppressed [ 1477.599975] binder_alloc: binder_alloc_mmap_handler: 9764 20001000-20004000 already mapped failed -16 [ 1477.625637] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1477.639039] binder: BINDER_SET_CONTEXT_MGR already set [ 1477.644480] binder: 9764:9767 ioctl 40046207 0 returned -16 [ 1477.658645] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value [ 1477.673207] binder_alloc_new_buf_locked: 10 callbacks suppressed [ 1477.673213] binder_alloc: 9764: binder_alloc_buf, no vma [ 1477.680050] EXT4-fs (sda1): re-mounted. Opts: [ 1477.690220] binder_transaction: 10 callbacks suppressed [ 1477.690235] binder: 9764:9778 transaction failed 29189/-3, size 0-0 line 2970 22:53:09 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0xffffffff00000000}) [ 1477.704563] binder_send_failed_reply: 9 callbacks suppressed [ 1477.704571] binder: send failed reply for transaction 248 to 9764:9767 [ 1477.733666] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:53:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x4, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:09 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="006c000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:09 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x74000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:09 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4800, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1477.791327] binder_release_work: 29 callbacks suppressed [ 1477.791333] binder: undelivered TRANSACTION_ERROR: 29189 [ 1477.848267] binder: 9786:9787 unknown command 536875008 [ 1477.857004] binder: 9786:9787 ioctl c0306201 20000480 returned -22 [ 1477.859080] binder_release_work: 10 callbacks suppressed [ 1477.859084] binder: undelivered TRANSACTION_COMPLETE [ 1477.874623] binder_alloc: binder_alloc_mmap_handler: 9786 20001000-20004000 already mapped failed -16 [ 1477.895072] binder: BINDER_SET_CONTEXT_MGR already set [ 1477.907869] binder: 9786:9787 ioctl 40046207 0 returned -16 [ 1477.914066] binder_alloc: 9786: binder_alloc_buf, no vma [ 1477.928496] binder: 9786:9788 transaction failed 29189/-3, size 0-0 line 2970 [ 1477.933047] binder: undelivered TRANSACTION_ERROR: 29189 [ 1477.952597] binder: 9786:9792 unknown command 536875008 [ 1477.961230] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1477.976042] binder: 9786:9792 ioctl c0306201 20000480 returned -22 [ 1477.987266] binder: send failed reply for transaction 251 to 9786:9787 [ 1477.997210] binder: undelivered TRANSACTION_COMPLETE [ 1478.019427] binder: undelivered TRANSACTION_ERROR: 29189 [ 1478.053370] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1478.075084] binder: undelivered TRANSACTION_ERROR: 29189 [ 1478.089860] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value [ 1478.128667] EXT4-fs (sda1): re-mounted. Opts: 22:53:10 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:10 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x4000000000000000}) 22:53:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x200000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:10 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0006000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:10 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6c000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:10 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:10 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0xa1000000}) [ 1478.314383] binder_alloc: binder_alloc_mmap_handler: 9810 20001000-20004000 already mapped failed -16 [ 1478.335314] binder: BINDER_SET_CONTEXT_MGR already set [ 1478.341246] binder: 9810:9812 ioctl 40046207 0 returned -16 [ 1478.343950] binder_alloc: 9810: binder_alloc_buf, no vma 22:53:10 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0074000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1478.379764] binder: 9810:9817 transaction failed 29189/-3, size 0-0 line 2970 [ 1478.404992] binder: send failed reply for transaction 254 to 9810:9812 [ 1478.420224] binder: undelivered TRANSACTION_COMPLETE 22:53:10 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x10000000000000}) 22:53:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x6800000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:10 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1f000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1478.444615] binder: undelivered TRANSACTION_ERROR: 29189 [ 1478.472022] binder: undelivered TRANSACTION_ERROR: 29189 22:53:10 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1478.553049] binder_alloc: binder_alloc_mmap_handler: 9835 20001000-20004000 already mapped failed -16 [ 1478.579172] binder: BINDER_SET_CONTEXT_MGR already set [ 1478.584580] binder: 9835:9837 ioctl 40046207 0 returned -16 [ 1478.591254] binder_alloc: 9835: binder_alloc_buf, no vma [ 1478.605233] binder: 9835:9840 transaction failed 29189/-3, size 0-0 line 2970 [ 1478.623500] binder: send failed reply for transaction 257 to 9835:9837 [ 1478.642178] binder: undelivered TRANSACTION_COMPLETE [ 1478.670858] binder: undelivered TRANSACTION_ERROR: 29189 [ 1478.700607] binder: undelivered TRANSACTION_ERROR: 29189 22:53:10 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x22, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:10 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0xa100}) 22:53:10 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="002d000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x4c00000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:10 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x9, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:10 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfcfdffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1479.072074] binder_alloc: binder_alloc_mmap_handler: 9857 20001000-20004000 already mapped failed -16 [ 1479.103422] binder: BINDER_SET_CONTEXT_MGR already set [ 1479.109607] binder: 9857:9859 ioctl 40046207 0 returned -16 [ 1479.109863] binder_alloc: 9857: binder_alloc_buf, no vma 22:53:10 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x40000000}) 22:53:11 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00007a0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1479.131352] binder: 9857:9866 transaction failed 29189/-3, size 0-0 line 2970 [ 1479.154748] binder: send failed reply for transaction 260 to 9857:9859 [ 1479.162242] binder: undelivered TRANSACTION_COMPLETE [ 1479.174709] binder: undelivered TRANSACTION_ERROR: 29189 22:53:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x3000000}) 22:53:11 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6b6b6b00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x300000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1479.196700] binder: undelivered TRANSACTION_ERROR: 29189 22:53:11 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6c00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:11 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x300000000000000}) [ 1479.287211] binder_alloc: binder_alloc_mmap_handler: 9885 20001000-20004000 already mapped failed -16 [ 1479.302090] binder: BINDER_SET_CONTEXT_MGR already set [ 1479.307501] binder: 9885:9890 ioctl 40046207 0 returned -16 [ 1479.314462] binder_alloc: 9885: binder_alloc_buf, no vma [ 1479.327596] binder: 9885:9891 transaction failed 29189/-3, size 0-0 line 2970 22:53:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0xfdfdffff00000000}) 22:53:11 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00002d0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1479.346091] binder: send failed reply for transaction 263 to 9885:9890 [ 1479.355748] binder: undelivered TRANSACTION_COMPLETE 22:53:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x20000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x1000000}) [ 1479.452033] binder_alloc: binder_alloc_mmap_handler: 9905 20001000-20004000 already mapped failed -16 [ 1479.472760] binder: BINDER_SET_CONTEXT_MGR already set [ 1479.478230] binder: 9905:9906 ioctl 40046207 0 returned -16 [ 1479.486479] binder_alloc: 9905: binder_alloc_buf, no vma 22:53:11 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xf6ffffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0xffffff7f00000000}) [ 1479.503731] binder: 9905:9907 transaction failed 29189/-3, size 0-0 line 2970 [ 1479.527262] binder: send failed reply for transaction 266 to 9905:9906 [ 1479.545092] binder: undelivered TRANSACTION_COMPLETE 22:53:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x2000000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:11 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0002000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x1000000000000}) 22:53:11 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x10, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:11 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x74, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1479.604517] binder_alloc: binder_alloc_mmap_handler: 9925 20001000-20004000 already mapped failed -16 [ 1479.623788] binder: BINDER_SET_CONTEXT_MGR already set [ 1479.639294] binder: 9925:9927 ioctl 40046207 0 returned -16 [ 1479.647058] binder_alloc: 9925: binder_alloc_buf, no vma 22:53:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0xfffffdfd}) [ 1479.669192] binder: 9925:9928 transaction failed 29189/-3, size 0-0 line 2970 [ 1479.681447] binder: send failed reply for transaction 269 to 9925:9927 [ 1479.694340] binder: undelivered TRANSACTION_COMPLETE 22:53:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x3f00000000000000}) 22:53:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x4800, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x3f00}) 22:53:11 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x68000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1479.833928] binder_alloc: binder_alloc_mmap_handler: 9948 20001000-20004000 already mapped failed -16 [ 1479.849604] binder: BINDER_SET_CONTEXT_MGR already set [ 1479.855696] binder: 9948:9952 ioctl 40046207 0 returned -16 [ 1479.873114] binder_alloc: 9948: binder_alloc_buf, no vma 22:53:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x300}) 22:53:11 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfffffdfc, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:11 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0048000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:11 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x100000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1479.888108] binder: 9948:9955 transaction failed 29189/-3, size 0-0 line 2970 [ 1479.918789] binder: send failed reply for transaction 272 to 9948:9952 [ 1479.925743] binder: undelivered TRANSACTION_COMPLETE 22:53:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x500, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x200000000000000}) [ 1480.045438] binder_alloc: binder_alloc_mmap_handler: 9970 20001000-20004000 already mapped failed -16 [ 1480.063085] binder: BINDER_SET_CONTEXT_MGR already set [ 1480.078036] binder: 9970:9976 ioctl 40046207 0 returned -16 [ 1480.083974] binder_alloc: 9970: binder_alloc_buf, no vma 22:53:11 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0022000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:11 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0xfdfdffff}) 22:53:12 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1480.095980] binder: 9970:9982 transaction failed 29189/-3, size 0-0 line 2970 [ 1480.113396] binder: send failed reply for transaction 275 to 9970:9976 [ 1480.120575] binder: undelivered TRANSACTION_COMPLETE 22:53:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0xffffff7f, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:12 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:12 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x3f000000}) [ 1480.228847] binder: BINDER_SET_CONTEXT_MGR already set [ 1480.244765] binder: 9991:9993 ioctl 40046207 0 returned -16 22:53:12 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00003f0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x7000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:12 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0xffffff7f}) [ 1480.434910] binder: BINDER_SET_CONTEXT_MGR already set [ 1480.450667] binder: 10006:10009 ioctl 40046207 0 returned -16 22:53:12 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x700000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:12 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xffffff7f00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:12 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:12 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x4000}) 22:53:12 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0009000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x6c00, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:12 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x2}) 22:53:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x3, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1480.616552] binder: BINDER_SET_CONTEXT_MGR already set [ 1480.624892] binder: 10028:10031 ioctl 40046207 0 returned -16 [ 1480.634343] binder: release 10028:10031 transaction 284 out, still active [ 1480.652007] binder: send failed reply for transaction 284, target dead 22:53:12 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:12 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3f00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:12 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0xa1}) 22:53:12 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0010000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1480.743827] binder: 10044:10047 unknown command 1048640 [ 1480.771851] binder: 10044:10047 ioctl c0306201 20000480 returned -22 [ 1480.821509] binder: BINDER_SET_CONTEXT_MGR already set [ 1480.825655] binder: 10044:10057 unknown command 1048640 [ 1480.826827] binder: 10044:10047 ioctl 40046207 0 returned -16 [ 1480.854434] binder: 10044:10057 ioctl c0306201 20000480 returned -22 22:53:13 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x22000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:13 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0xa100000000000000}) 22:53:13 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4800000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0xffffff7f00000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:13 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0004000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:13 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfcfdffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:13 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0xa1000000}) [ 1481.252337] binder: BINDER_SET_CONTEXT_MGR already set [ 1481.269638] binder: 10074:10079 ioctl 40046207 0 returned -16 22:53:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x1000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:13 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000070080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:13 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x3f00}) 22:53:13 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6800000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:13 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x600000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1481.438408] binder: BINDER_SET_CONTEXT_MGR already set [ 1481.447168] binder: 10096:10097 ioctl 40046207 0 returned -16 22:53:13 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4c00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:13 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x3}) 22:53:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x700, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:13 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00002c0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:13 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6c00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:13 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1f000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:13 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x1000000000000}) [ 1481.863714] binder: BINDER_SET_CONTEXT_MGR already set [ 1481.871525] binder: 10120:10128 ioctl 40046207 0 returned -16 22:53:13 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x200000000000000}) 22:53:13 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000680080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x2000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:13 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfdfdffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:13 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0xa100000000000000}) [ 1482.008272] binder: BINDER_SET_CONTEXT_MGR already set [ 1482.024638] binder: 10144:10147 ioctl 40046207 0 returned -16 [ 1482.289274] EXT4-fs: 82 callbacks suppressed [ 1482.289302] EXT4-fs (sda1): re-mounted. Opts: [ 1482.362907] EXT4-fs (sda1): re-mounted. Opts: 22:53:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x6, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:14 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1f00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:14 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x500, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:14 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0xfdfdffff00000000}) 22:53:14 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="004c000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:14 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1482.439178] binder: 10165:10172 unknown command 8192 [ 1482.448538] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1482.456738] binder: 10165:10172 ioctl c0306201 20000480 returned -22 [ 1482.474309] EXT4-fs (sda1): re-mounted. Opts: [ 1482.479369] binder: BINDER_SET_CONTEXT_MGR already set 22:53:14 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x2000000}) [ 1482.484761] binder: 10165:10172 ioctl 40046207 0 returned -16 [ 1482.497508] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value [ 1482.499338] binder: 10165:10177 unknown command 8192 [ 1482.526761] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1482.532714] binder: 10165:10177 ioctl c0306201 20000480 returned -22 22:53:14 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0xa100}) 22:53:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x6c, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:14 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2c00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:14 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x100000}) 22:53:14 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x8cffffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:14 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000400080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1482.670640] binder_alloc_mmap_handler: 9 callbacks suppressed [ 1482.670656] binder_alloc: binder_alloc_mmap_handler: 10191 20001000-20004000 already mapped failed -16 [ 1482.708476] binder: BINDER_SET_CONTEXT_MGR already set [ 1482.713887] binder: 10191:10192 ioctl 40046207 0 returned -16 [ 1482.720670] binder_alloc_new_buf_locked: 9 callbacks suppressed [ 1482.720678] binder_alloc: 10191: binder_alloc_buf, no vma [ 1482.762444] binder_send_failed_reply: 8 callbacks suppressed [ 1482.762453] binder: send failed reply for transaction 305 to 10191:10192 [ 1482.788426] binder_transaction: 9 callbacks suppressed [ 1482.788442] binder: 10191:10193 transaction failed 29189/-3, size 0-0 line 2970 [ 1482.825886] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1482.865088] EXT4-fs (sda1): re-mounted. Opts: [ 1482.879797] binder_release_work: 28 callbacks suppressed [ 1482.879804] binder: undelivered TRANSACTION_ERROR: 29189 [ 1482.902393] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value [ 1482.919982] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:53:14 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x400000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:14 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0xffffff7f}) 22:53:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x700000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:14 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x48, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:14 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00002d0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:14 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2c00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1483.078532] binder_alloc: binder_alloc_mmap_handler: 10214 20001000-20004000 already mapped failed -16 [ 1483.099693] binder: BINDER_SET_CONTEXT_MGR already set [ 1483.105099] binder: 10214:10216 ioctl 40046207 0 returned -16 [ 1483.105759] binder_alloc: 10214: binder_alloc_buf, no vma 22:53:14 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x300}) [ 1483.130341] binder: 10214:10217 transaction failed 29189/-3, size 0-0 line 2970 [ 1483.150111] binder: send failed reply for transaction 308 to 10214:10216 [ 1483.168737] binder_release_work: 10 callbacks suppressed [ 1483.168742] binder: undelivered TRANSACTION_COMPLETE 22:53:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x4800000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:15 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000100080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:15 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0xa1}) 22:53:15 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1483.240119] binder: undelivered TRANSACTION_ERROR: 29189 [ 1483.270817] binder: undelivered TRANSACTION_ERROR: 29189 22:53:15 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0xfffffdfd}) [ 1483.288546] binder_alloc: binder_alloc_mmap_handler: 10236 20001000-20004000 already mapped failed -16 [ 1483.327066] binder: BINDER_SET_CONTEXT_MGR already set [ 1483.333131] binder: 10236:10237 ioctl 40046207 0 returned -16 [ 1483.367955] binder_alloc: 10236: binder_alloc_buf, no vma [ 1483.373556] binder: 10236:10245 transaction failed 29189/-3, size 0-0 line 2970 [ 1483.385828] binder: send failed reply for transaction 311 to 10236:10237 [ 1483.396328] binder: undelivered TRANSACTION_COMPLETE [ 1483.419665] binder: undelivered TRANSACTION_ERROR: 29189 [ 1483.444374] binder: undelivered TRANSACTION_ERROR: 29189 22:53:15 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x790c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:15 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:15 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x4000000000000000}) 22:53:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x7a00, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:15 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x790c000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:15 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000580", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:15 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0xffffff7f00000000}) [ 1483.735116] binder_alloc: binder_alloc_mmap_handler: 10263 20001000-20004000 already mapped failed -16 [ 1483.759972] binder: BINDER_SET_CONTEXT_MGR already set [ 1483.766353] binder: 10263:10267 ioctl 40046207 0 returned -16 [ 1483.772927] binder_alloc: 10263: binder_alloc_buf, no vma [ 1483.782747] binder: 10263:10269 transaction failed 29189/-3, size 0-0 line 2970 22:53:15 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0xfdfdffff}) 22:53:15 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000001f80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1483.813018] binder: send failed reply for transaction 314 to 10263:10267 [ 1483.823119] binder: undelivered TRANSACTION_COMPLETE [ 1483.852399] binder: undelivered TRANSACTION_ERROR: 29189 22:53:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x7a, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:15 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4c000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:15 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1483.879218] binder: undelivered TRANSACTION_ERROR: 29189 22:53:15 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x10}) 22:53:15 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6b6b6b00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1483.942926] binder_alloc: binder_alloc_mmap_handler: 10287 20001000-20004000 already mapped failed -16 [ 1483.975707] binder: BINDER_SET_CONTEXT_MGR already set [ 1483.981123] binder: 10287:10289 ioctl 40046207 0 returned -16 [ 1483.987110] binder_alloc: 10287: binder_alloc_buf, no vma [ 1483.993318] binder: 10287:10290 transaction failed 29189/-3, size 0-0 line 2970 [ 1484.012659] binder: send failed reply for transaction 317 to 10287:10289 [ 1484.024171] binder: undelivered TRANSACTION_COMPLETE 22:53:15 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x1000000}) 22:53:15 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000006c80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1484.044478] binder: undelivered TRANSACTION_ERROR: 29189 22:53:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x7a00000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:16 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfffffdfc, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1484.100329] binder: undelivered TRANSACTION_ERROR: 29189 22:53:16 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x2}) 22:53:16 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2200, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1484.188522] binder_alloc: binder_alloc_mmap_handler: 10312 20001000-20004000 already mapped failed -16 [ 1484.219005] binder: BINDER_SET_CONTEXT_MGR already set [ 1484.224359] binder: 10312:10313 ioctl 40046207 0 returned -16 [ 1484.234384] binder_alloc: 10312: binder_alloc_buf, no vma [ 1484.252842] binder: 10312:10319 transaction failed 29189/-3, size 0-0 line 2970 [ 1484.271048] binder: send failed reply for transaction 320 to 10312:10313 [ 1484.281453] binder: undelivered TRANSACTION_COMPLETE 22:53:16 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x100000000000000}) 22:53:16 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x300000000000000}) [ 1484.301155] binder: undelivered TRANSACTION_ERROR: 29189 22:53:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x6000000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:16 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000680080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:16 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x10000000000000}) [ 1484.425505] binder_alloc: binder_alloc_mmap_handler: 10331 20001000-20004000 already mapped failed -16 [ 1484.456996] binder: BINDER_SET_CONTEXT_MGR already set [ 1484.463010] binder: 10331:10334 ioctl 40046207 0 returned -16 [ 1484.497786] binder_alloc: 10331: binder_alloc_buf, no vma [ 1484.513361] binder: 10331:10340 transaction failed 29189/-3, size 0-0 line 2970 [ 1484.532306] binder: send failed reply for transaction 323 to 10331:10334 [ 1484.552406] binder: undelivered TRANSACTION_COMPLETE 22:53:16 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1000000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:16 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2c00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:16 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0xffffffff00000000}) 22:53:16 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfffffff6, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x7400000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:16 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000220080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1484.675808] binder_alloc: binder_alloc_mmap_handler: 10352 20001000-20004000 already mapped failed -16 [ 1484.706256] binder: BINDER_SET_CONTEXT_MGR already set 22:53:16 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x3f000000}) [ 1484.724355] binder: 10352:10355 ioctl 40046207 0 returned -16 [ 1484.732757] binder_alloc: 10352: binder_alloc_buf, no vma [ 1484.757601] binder: send failed reply for transaction 326 to 10352:10355 [ 1484.765402] binder: 10352:10356 transaction failed 29189/-3, size 0-0 line 2970 22:53:16 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x500000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1484.777408] binder: undelivered TRANSACTION_COMPLETE 22:53:16 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x3f00000000000000}) 22:53:16 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000070080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x2000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:16 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x500000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1484.974772] binder_alloc: binder_alloc_mmap_handler: 10376 20001000-20004000 already mapped failed -16 [ 1484.997802] binder_alloc: 10376: binder_alloc_buf, no vma [ 1484.998411] binder: BINDER_SET_CONTEXT_MGR already set [ 1485.014181] binder: 10376:10380 transaction failed 29189/-3, size 0-0 line 2970 [ 1485.036150] binder: 10376:10379 ioctl 40046207 0 returned -16 [ 1485.049446] binder: send failed reply for transaction 329 to 10376:10379 [ 1485.059995] binder: undelivered TRANSACTION_COMPLETE 22:53:17 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:17 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x3000000}) 22:53:17 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1f00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x4c000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:17 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000740080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:17 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x790c0000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:17 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x40000000}) [ 1485.510490] binder_alloc: binder_alloc_mmap_handler: 10398 20001000-20004000 already mapped failed -16 [ 1485.531443] binder: BINDER_SET_CONTEXT_MGR already set [ 1485.536752] binder: 10398:10405 ioctl 40046207 0 returned -16 22:53:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x7a000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1485.564559] binder_alloc: 10398: binder_alloc_buf, no vma [ 1485.574736] binder: 10398:10408 transaction failed 29189/-3, size 0-0 line 2970 [ 1485.585869] binder: send failed reply for transaction 332 to 10398:10405 [ 1485.593505] binder: undelivered TRANSACTION_COMPLETE 22:53:17 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00002c0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:17 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x8cffffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:17 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x5, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x74000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1485.670654] binder: BINDER_SET_CONTEXT_MGR already set [ 1485.676181] binder: 10421:10423 ioctl 40046207 0 returned -16 [ 1485.686444] binder: undelivered TRANSACTION_COMPLETE [ 1485.792070] binder: BINDER_SET_CONTEXT_MGR already set [ 1485.799797] binder: 10426:10427 ioctl 40046207 0 returned -16 22:53:17 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:17 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x4000}) 22:53:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x48000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:17 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000007a80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:17 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:17 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4c00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1486.044214] binder: BINDER_SET_CONTEXT_MGR already set 22:53:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x48, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:17 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x300000000000000}) [ 1486.072910] binder: 10447:10449 ioctl 40046207 0 returned -16 22:53:18 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000002080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:18 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x10000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:18 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x1000000}) [ 1486.193809] binder: BINDER_SET_CONTEXT_MGR already set [ 1486.203669] binder: 10464:10469 ioctl 40046207 0 returned -16 22:53:18 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x300}) 22:53:18 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6b6b6b, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x500000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:18 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6800, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:18 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x4000000000000000}) 22:53:18 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000060080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:18 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x900000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:18 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x3f000000}) [ 1486.753843] binder: BINDER_SET_CONTEXT_MGR already set [ 1486.763691] binder: 10497:10503 ioctl 40046207 0 returned -16 22:53:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x6800, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:18 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000030080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:18 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x10}) 22:53:18 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:18 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7400000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1486.910512] binder: BINDER_SET_CONTEXT_MGR already set [ 1486.921041] binder: 10516:10518 ioctl 40046207 0 returned -16 22:53:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x6000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:19 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x8cffffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:19 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0xa1}) 22:53:19 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00004c0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:19 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x10fff1, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:19 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x400000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:19 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0xfdfdffff00000000}) [ 1487.349072] EXT4-fs: 74 callbacks suppressed [ 1487.349083] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1487.362315] binder: BINDER_SET_CONTEXT_MGR already set [ 1487.367697] binder: 10545:10547 ioctl 40046207 0 returned -16 22:53:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x7, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:19 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100025, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:19 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0xffffff7f}) [ 1487.410622] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1487.428918] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value 22:53:19 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00006c0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1487.480800] binder: 10562:10564 unknown command 32 [ 1487.485871] binder: 10562:10564 ioctl c0306201 20000480 returned -22 22:53:19 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3f000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1487.524905] binder: BINDER_SET_CONTEXT_MGR already set [ 1487.536188] binder: 10562:10564 ioctl 40046207 0 returned -16 [ 1487.548211] binder: 10562:10572 unknown command 32 [ 1487.566624] binder: 10562:10572 ioctl c0306201 20000480 returned -22 22:53:19 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x3f00000000000000}) [ 1487.637825] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1487.676745] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1487.701850] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value [ 1487.841947] EXT4-fs (sda1): re-mounted. Opts: [ 1487.896263] EXT4-fs (sda1): re-mounted. Opts: 22:53:19 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfffffdfc, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x60, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:19 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x100000000000000}) 22:53:19 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100032, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:19 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000980", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:19 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4c000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:19 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x10000000000000}) [ 1487.973075] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1487.985522] binder_alloc_mmap_handler: 8 callbacks suppressed [ 1487.985549] binder_alloc: binder_alloc_mmap_handler: 10590 20001000-20004000 already mapped failed -16 [ 1487.989187] EXT4-fs (sda1): re-mounted. Opts: [ 1488.008433] binder_alloc_new_buf_locked: 8 callbacks suppressed [ 1488.008441] binder_alloc: 10590: binder_alloc_buf, no vma [ 1488.009255] binder: BINDER_SET_CONTEXT_MGR already set [ 1488.019078] binder_transaction: 8 callbacks suppressed [ 1488.019092] binder: 10590:10602 transaction failed 29189/-3, size 0-0 line 2970 [ 1488.042341] binder: 10590:10597 ioctl 40046207 0 returned -16 [ 1488.062466] binder_send_failed_reply: 8 callbacks suppressed 22:53:19 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x2000000}) 22:53:19 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000790c80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1488.062476] binder: send failed reply for transaction 359 to 10590:10597 [ 1488.076567] binder_release_work: 25 callbacks suppressed [ 1488.076574] binder: undelivered TRANSACTION_ERROR: 29189 22:53:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x600000000000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:20 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x10002f, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1488.147488] binder: undelivered TRANSACTION_ERROR: 29189 22:53:20 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7400, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1488.287324] binder_alloc: binder_alloc_mmap_handler: 10616 20001000-20004000 already mapped failed -16 [ 1488.324030] binder: BINDER_SET_CONTEXT_MGR already set [ 1488.334948] binder: 10616:10618 ioctl 40046207 0 returned -16 [ 1488.347932] binder_alloc: 10616: binder_alloc_buf, no vma [ 1488.362991] binder: 10616:10620 transaction failed 29189/-3, size 0-0 line 2970 [ 1488.376002] binder: send failed reply for transaction 362 to 10616:10618 [ 1488.386049] binder_release_work: 8 callbacks suppressed [ 1488.386053] binder: undelivered TRANSACTION_COMPLETE [ 1488.426374] binder: undelivered TRANSACTION_ERROR: 29189 [ 1488.441943] binder: undelivered TRANSACTION_ERROR: 29189 22:53:20 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:20 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0xfdfdffff}) 22:53:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0xfdfdffff, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:20 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000040080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:20 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x10000a, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:20 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0xa100}) 22:53:20 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1488.560549] binder_alloc: binder_alloc_mmap_handler: 10638 20001000-20004000 already mapped failed -16 [ 1488.581713] binder: BINDER_SET_CONTEXT_MGR already set [ 1488.590291] binder: 10638:10640 ioctl 40046207 0 returned -16 [ 1488.590437] binder_alloc: 10638: binder_alloc_buf, no vma 22:53:20 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x3}) [ 1488.609482] binder: 10638:10642 transaction failed 29189/-3, size 0-0 line 2970 [ 1488.626047] binder: send failed reply for transaction 365 to 10638:10640 [ 1488.634347] binder: undelivered TRANSACTION_COMPLETE [ 1488.654631] binder: undelivered TRANSACTION_ERROR: 29189 22:53:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x3000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1488.676996] binder: undelivered TRANSACTION_ERROR: 29189 22:53:20 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0xffffff7f00000000}) 22:53:20 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000480080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:20 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100060, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1488.773770] binder_alloc: binder_alloc_mmap_handler: 10656 20001000-20004000 already mapped failed -16 [ 1488.783800] binder: BINDER_SET_CONTEXT_MGR already set [ 1488.790346] binder: 10656:10660 ioctl 40046207 0 returned -16 [ 1488.833001] binder_alloc: 10656: binder_alloc_buf, no vma [ 1488.851306] binder: 10656:10670 transaction failed 29189/-3, size 0-0 line 2970 [ 1488.868704] binder: send failed reply for transaction 368 to 10656:10660 [ 1488.910882] binder: undelivered TRANSACTION_COMPLETE [ 1488.935485] binder: undelivered TRANSACTION_ERROR: 29189 [ 1488.959208] binder: undelivered TRANSACTION_ERROR: 29189 22:53:21 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x10000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:21 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xffffffffffffffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:21 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x200000000000000}) 22:53:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x4000000, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:21 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000002c80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:21 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x10fff0, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:21 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0xa100000000000000}) [ 1489.231554] binder_alloc: binder_alloc_mmap_handler: 10689 20001000-20004000 already mapped failed -16 [ 1489.257781] binder: BINDER_SET_CONTEXT_MGR already set [ 1489.263401] binder: 10689:10694 ioctl 40046207 0 returned -16 [ 1489.270801] binder_alloc: 10689: binder_alloc_buf, no vma [ 1489.279918] binder: 10689:10696 transaction failed 29189/-3, size 0-0 line 2970 [ 1489.304893] binder: send failed reply for transaction 371 to 10689:10694 [ 1489.315116] binder: undelivered TRANSACTION_COMPLETE 22:53:21 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00000c7980", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1489.326830] binder: undelivered TRANSACTION_ERROR: 29189 22:53:21 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x3000000}) 22:53:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x600, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:21 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x1000f0, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1489.400521] binder: undelivered TRANSACTION_ERROR: 29189 22:53:21 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x3f00}) [ 1489.458458] binder_alloc: binder_alloc_mmap_handler: 10709 20001000-20004000 already mapped failed -16 [ 1489.490022] binder: BINDER_SET_CONTEXT_MGR already set [ 1489.495813] binder: 10709:10712 ioctl 40046207 0 returned -16 [ 1489.504278] binder_alloc: 10709: binder_alloc_buf, no vma [ 1489.520573] binder: 10709:10714 transaction failed 29189/-3, size 0-0 line 2970 [ 1489.540480] binder: send failed reply for transaction 374 to 10709:10712 [ 1489.550973] binder: undelivered TRANSACTION_COMPLETE 22:53:21 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6c00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:21 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:21 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000007480", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:21 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0xfffffdfd}) 22:53:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40046307, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:21 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x1000f1, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:22 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x2}) [ 1490.100430] binder: 10732:10736 DecRefs 0 refcount change on invalid ref 536875008 ret -22 [ 1490.113091] binder: 10732:10736 unknown command 0 [ 1490.119656] binder: 10732:10736 ioctl c0306201 20000480 returned -22 [ 1490.128579] binder_alloc: binder_alloc_mmap_handler: 10732 20001000-20004000 already mapped failed -16 [ 1490.150962] binder: BINDER_SET_CONTEXT_MGR already set [ 1490.156764] binder: 10732:10736 ioctl 40046207 0 returned -16 [ 1490.163706] binder_alloc: 10732: binder_alloc_buf, no vma [ 1490.181337] binder: 10732:10741 transaction failed 29189/-3, size 0-0 line 2970 [ 1490.193127] binder: 10732:10741 DecRefs 0 refcount change on invalid ref 536875008 ret -22 [ 1490.202693] binder: 10732:10741 unknown command 0 [ 1490.208407] binder: 10732:10741 ioctl c0306201 20000480 returned -22 [ 1490.215461] binder: send failed reply for transaction 377 to 10732:10736 22:53:22 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000010000000}) 22:53:22 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x1000000000000}) 22:53:22 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000004880", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1490.245589] binder: undelivered TRANSACTION_COMPLETE 22:53:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40486312, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:22 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x40000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1490.352712] binder: 10756:10758 got reply transaction with no transaction stack [ 1490.364402] binder: 10756:10758 transaction failed 29201/-71, size 0-0 line 2762 [ 1490.378226] binder_alloc: binder_alloc_mmap_handler: 10756 20001000-20004000 already mapped failed -16 [ 1490.388463] binder: BINDER_SET_CONTEXT_MGR already set [ 1490.393875] binder: 10756:10758 ioctl 40046207 0 returned -16 [ 1490.412234] binder_alloc: 10756: binder_alloc_buf, no vma [ 1490.427492] binder: 10756:10763 transaction failed 29189/-3, size 0-0 line 2970 [ 1490.440819] binder: 10756:10769 got reply transaction with no transaction stack [ 1490.462593] binder: 10756:10769 transaction failed 29201/-71, size 0-0 line 2762 [ 1490.482280] binder: send failed reply for transaction 380 to 10756:10758 [ 1490.491904] binder: undelivered TRANSACTION_COMPLETE 22:53:22 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:22 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0xffffffff00000000}) 22:53:22 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000001000000}) 22:53:22 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000006880", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x400c630f, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:22 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x20000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:22 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x100000}) [ 1490.742216] binder: 10781:10784 BC_CLEAR_DEATH_NOTIFICATION invalid ref 536875008 [ 1490.767909] binder_alloc: binder_alloc_mmap_handler: 10781 20001000-20004000 already mapped failed -16 [ 1490.785750] binder: BINDER_SET_CONTEXT_MGR already set [ 1490.791793] binder: 10781:10784 ioctl 40046207 0 returned -16 [ 1490.791817] binder_alloc: 10781: binder_alloc_buf, no vma [ 1490.814389] binder: 10781:10791 BC_CLEAR_DEATH_NOTIFICATION invalid ref 536875008 22:53:22 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0xa1000000}) 22:53:22 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000006800}) 22:53:22 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000004080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1490.836722] binder: send failed reply for transaction 385 to 10781:10784 [ 1490.862701] binder: undelivered TRANSACTION_COMPLETE 22:53:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40106308, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:22 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6800, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1490.970096] binder: 10803:10805 BC_INCREFS_DONE u0000000020001000 no match [ 1491.015385] binder_alloc: binder_alloc_mmap_handler: 10803 20001000-20004000 already mapped failed -16 [ 1491.053013] binder: BINDER_SET_CONTEXT_MGR already set [ 1491.059012] binder: 10803:10805 ioctl 40046207 0 returned -16 [ 1491.075809] binder_alloc: 10803: binder_alloc_buf, no vma [ 1491.105046] binder: 10803:10811 BC_INCREFS_DONE u0000000020001000 no match [ 1491.119330] binder: send failed reply for transaction 388 to 10803:10805 [ 1491.137709] binder: undelivered TRANSACTION_COMPLETE 22:53:23 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x500000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:23 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x40000000}) 22:53:23 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00007a0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:23 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000003f00}) 22:53:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086304, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:23 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xc79, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:23 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x4000}) [ 1491.388093] binder: 10827:10833 unknown command 1074291460 [ 1491.393766] binder: 10827:10833 ioctl c0306201 20000480 returned -22 [ 1491.406896] binder: BINDER_SET_CONTEXT_MGR already set [ 1491.412634] binder: 10827:10833 ioctl 40046207 0 returned -16 [ 1491.420094] binder: 10827:10836 unknown command 1074291460 [ 1491.428849] binder: 10827:10836 ioctl c0306201 20000480 returned -22 [ 1491.441804] binder: undelivered TRANSACTION_COMPLETE 22:53:23 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) 22:53:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x4008630a, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:23 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000780", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:23 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000007a000000}) 22:53:23 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1491.598343] binder: BC_ATTEMPT_ACQUIRE not supported [ 1491.616733] binder: 10851:10853 ioctl c0306201 20000480 returned -22 [ 1491.651787] binder: BINDER_SET_CONTEXT_MGR already set [ 1491.670497] binder: 10851:10853 ioctl 40046207 0 returned -16 [ 1491.686912] binder: BC_ATTEMPT_ACQUIRE not supported [ 1491.709040] binder: 10851:10862 ioctl c0306201 20000480 returned -22 22:53:23 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6800000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:23 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) 22:53:23 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x700000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40406300, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:23 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000074000000}) 22:53:23 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000004c80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:23 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1492.047379] binder: 10872:10877 got transaction to invalid handle [ 1492.073832] binder: BINDER_SET_CONTEXT_MGR already set [ 1492.079745] binder: 10872:10877 ioctl 40046207 0 returned -16 22:53:23 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) 22:53:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40106309, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1492.099996] binder: 10872:10884 got transaction to invalid handle 22:53:24 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000003}) 22:53:24 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000003f80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:24 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1492.218720] binder: 10894:10898 BC_ACQUIRE_DONE u0000000020001000 no match [ 1492.236054] binder: BINDER_SET_CONTEXT_MGR already set [ 1492.247303] binder: 10894:10898 ioctl 40046207 0 returned -16 [ 1492.268170] binder: 10894:10903 BC_ACQUIRE_DONE u0000000020001000 no match [ 1492.359681] EXT4-fs: 68 callbacks suppressed [ 1492.359691] EXT4-fs (sda1): Unrecognized mount option "" or missing value [ 1492.390135] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1492.495986] EXT4-fs (sda1): re-mounted. Opts: [ 1492.557077] EXT4-fs (sda1): re-mounted. Opts: 22:53:24 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfcfdffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:24 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2200000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:24 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) 22:53:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086312, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:24 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000007}) 22:53:24 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000050080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:24 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1492.637960] binder: 10920:10922 unknown command 1074291474 [ 1492.646894] EXT4-fs (sda1): Unrecognized mount option "" or missing value [ 1492.650306] binder: 10920:10922 ioctl c0306201 20000480 returned -22 [ 1492.666856] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1492.685596] binder: BINDER_SET_CONTEXT_MGR already set [ 1492.687731] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value [ 1492.702229] binder: 10920:10922 ioctl 40046207 0 returned -16 [ 1492.705501] binder: 10920:10934 unknown command 1074291474 [ 1492.724054] binder: 10920:10934 ioctl c0306201 20000480 returned -22 22:53:24 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) 22:53:24 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x300000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1492.740812] EXT4-fs (sda1): Unrecognized mount option "" or missing value [ 1492.755813] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:53:24 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000048000000}) 22:53:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40046302, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:24 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000090080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1492.893783] binder: BC_ACQUIRE_RESULT not supported [ 1492.910465] binder: 10944:10945 ioctl c0306201 20000480 returned -22 [ 1492.947723] binder: BINDER_SET_CONTEXT_MGR already set [ 1492.961044] binder: 10944:10945 ioctl 40046207 0 returned -16 [ 1492.966519] binder: BC_ACQUIRE_RESULT not supported [ 1492.974102] EXT4-fs (sda1): re-mounted. Opts: [ 1492.994193] binder: 10944:10952 ioctl c0306201 20000480 returned -22 22:53:25 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xf6ffffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:25 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) 22:53:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40046304, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:25 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000006000}) 22:53:25 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xf6ffffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:25 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000002280", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:25 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1493.284727] binder: 10971:10975 IncRefs 0 refcount change on invalid ref 536875008 ret -22 [ 1493.327281] binder: 10971:10975 unknown command 0 [ 1493.341656] binder: 10971:10975 ioctl c0306201 20000480 returned -22 [ 1493.364693] binder_alloc_mmap_handler: 6 callbacks suppressed 22:53:25 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000500}) 22:53:25 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000020080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:25 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1493.364709] binder_alloc: binder_alloc_mmap_handler: 10971 20001000-20004000 already mapped failed -16 [ 1493.405797] binder: BINDER_SET_CONTEXT_MGR already set [ 1493.414571] binder: 10971:10975 ioctl 40046207 0 returned -16 [ 1493.435907] binder_alloc_new_buf_locked: 6 callbacks suppressed [ 1493.436126] binder_alloc: 10971: binder_alloc_buf, no vma 22:53:25 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x500, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1493.457716] binder_transaction: 10 callbacks suppressed [ 1493.457730] binder: 10971:10989 transaction failed 29189/-3, size 0-0 line 2970 [ 1493.474055] binder: 10971:10985 IncRefs 0 refcount change on invalid ref 536875008 ret -22 22:53:25 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1493.505994] binder: 10971:10985 unknown command 0 [ 1493.517764] binder: 10971:10985 ioctl c0306201 20000480 returned -22 [ 1493.524697] binder_send_failed_reply: 6 callbacks suppressed [ 1493.524707] binder: send failed reply for transaction 411 to 10971:10975 [ 1493.558247] binder_release_work: 5 callbacks suppressed [ 1493.558251] binder: undelivered TRANSACTION_COMPLETE [ 1493.590033] binder_release_work: 26 callbacks suppressed [ 1493.590039] binder: undelivered TRANSACTION_ERROR: 29189 [ 1493.665109] binder: undelivered TRANSACTION_ERROR: 29189 22:53:25 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x630b, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:25 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) 22:53:25 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000380", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:25 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000007a00}) 22:53:25 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x700, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:25 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1494.129335] binder: 11017:11023 ERROR: BC_REGISTER_LOOPER called without request [ 1494.146641] binder: 11017:11023 unknown command 536875008 [ 1494.153165] binder: 11017:11023 ioctl c0306201 20000480 returned -22 22:53:26 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1494.191450] binder_alloc: binder_alloc_mmap_handler: 11017 20001000-20004000 already mapped failed -16 [ 1494.225373] binder: BINDER_SET_CONTEXT_MGR already set [ 1494.231401] binder: 11017:11023 ioctl 40046207 0 returned -16 22:53:26 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:26 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x1f00000000000000}) 22:53:26 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000680", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:26 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1494.254566] binder_alloc: 11017: binder_alloc_buf, no vma [ 1494.287805] binder: 11017:11039 transaction failed 29189/-3, size 0-0 line 2970 [ 1494.295720] binder: 11017:11035 ERROR: BC_REGISTER_LOOPER called without request [ 1494.318663] binder: 11017:11035 unknown command 536875008 [ 1494.330971] binder: 11017:11035 ioctl c0306201 20000480 returned -22 [ 1494.356572] binder: send failed reply for transaction 414 to 11017:11023 [ 1494.375180] binder: undelivered TRANSACTION_COMPLETE [ 1494.401666] binder: undelivered TRANSACTION_ERROR: 29189 [ 1494.471775] binder: undelivered TRANSACTION_ERROR: 29189 22:53:26 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x8cffffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:26 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) 22:53:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40486311, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:26 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000002d80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:26 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x4000000fffffdfc}) 22:53:26 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6b6b6b, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1494.675163] binder: 11065:11069 got transaction to invalid handle [ 1494.688648] binder: 11065:11069 transaction failed 29201/-22, size 0-0 line 2855 22:53:26 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1494.725216] binder_alloc: binder_alloc_mmap_handler: 11065 20001000-20004000 already mapped failed -16 [ 1494.760214] binder: BINDER_SET_CONTEXT_MGR already set [ 1494.765981] binder: 11065:11069 ioctl 40046207 0 returned -16 22:53:26 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000700}) [ 1494.772958] binder_alloc: 11065: binder_alloc_buf, no vma [ 1494.792297] binder: 11065:11078 transaction failed 29189/-3, size 0-0 line 2970 [ 1494.803121] binder: 11065:11078 got transaction to invalid handle [ 1494.810683] binder: 11065:11078 transaction failed 29201/-22, size 0-0 line 2855 [ 1494.818731] binder: undelivered TRANSACTION_ERROR: 29201 22:53:26 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000780", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:26 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1494.824505] binder: undelivered TRANSACTION_ERROR: 29201 22:53:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x4008635c, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1494.847143] binder: send failed reply for transaction 417 to 11065:11069 [ 1494.883990] binder: undelivered TRANSACTION_COMPLETE 22:53:26 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1494.914518] binder: undelivered TRANSACTION_ERROR: 29189 [ 1494.933302] binder: undelivered TRANSACTION_ERROR: 29189 [ 1494.946002] binder: 11093:11094 unknown command 1074291548 [ 1494.953272] binder: 11093:11094 ioctl c0306201 20000480 returned -22 [ 1494.976966] binder_alloc: binder_alloc_mmap_handler: 11093 20001000-20004000 already mapped failed -16 [ 1494.987486] binder: BINDER_SET_CONTEXT_MGR already set [ 1495.003395] binder: 11093:11094 ioctl 40046207 0 returned -16 [ 1495.017021] binder_alloc: 11093: binder_alloc_buf, no vma [ 1495.034899] binder: 11093:11103 unknown command 1074291548 [ 1495.039995] binder: 11093:11098 transaction failed 29189/-3, size 0-0 line 2970 [ 1495.072520] binder: 11093:11103 ioctl c0306201 20000480 returned -22 [ 1495.080527] binder: send failed reply for transaction 422 to 11093:11094 [ 1495.087443] binder: undelivered TRANSACTION_COMPLETE [ 1495.115342] binder: undelivered TRANSACTION_ERROR: 29189 [ 1495.141072] binder: undelivered TRANSACTION_ERROR: 29189 22:53:27 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2c000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:27 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) 22:53:27 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000004c00}) 22:53:27 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000002c80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086310, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:27 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x5000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:27 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1495.285330] binder: 11114:11117 BC_DEAD_BINDER_DONE 0000000020001000 not found [ 1495.314263] binder_alloc: binder_alloc_mmap_handler: 11114 20001000-20004000 already mapped failed -16 22:53:27 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1495.341432] binder: BINDER_SET_CONTEXT_MGR already set [ 1495.346850] binder: 11114:11117 ioctl 40046207 0 returned -16 [ 1495.353502] binder_alloc: 11114: binder_alloc_buf, no vma 22:53:27 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000002280", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:27 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000068}) [ 1495.384965] binder: 11114:11121 transaction failed 29189/-3, size 0-0 line 2970 [ 1495.397284] binder: 11114:11132 BC_DEAD_BINDER_DONE 0000000020001000 not found [ 1495.437224] binder: send failed reply for transaction 425 to 11114:11117 [ 1495.450291] binder: undelivered TRANSACTION_COMPLETE 22:53:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40406301, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:27 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1495.549700] binder: 11141:11145 got reply transaction with no transaction stack [ 1495.575729] binder: 11141:11145 transaction failed 29201/-71, size 0-0 line 2762 [ 1495.614675] binder_alloc: binder_alloc_mmap_handler: 11141 20001000-20004000 already mapped failed -16 [ 1495.636148] binder: BINDER_SET_CONTEXT_MGR already set [ 1495.642134] binder: 11141:11145 ioctl 40046207 0 returned -16 [ 1495.652234] binder_alloc: 11141: binder_alloc_buf, no vma [ 1495.663384] binder: 11141:11151 transaction failed 29189/-3, size 0-0 line 2970 [ 1495.680097] binder: 11141:11151 got reply transaction with no transaction stack [ 1495.697506] binder: 11141:11151 transaction failed 29201/-71, size 0-0 line 2762 [ 1495.714679] binder: send failed reply for transaction 428 to 11141:11145 [ 1495.728034] binder: undelivered TRANSACTION_COMPLETE 22:53:28 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:28 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x68, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:28 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) 22:53:28 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000004c80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:28 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000002}) 22:53:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x400c630e, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:28 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1496.214007] binder: 11156:11163 BC_REQUEST_DEATH_NOTIFICATION invalid ref 536875008 [ 1496.229841] binder_alloc: binder_alloc_mmap_handler: 11156 20001000-20004000 already mapped failed -16 [ 1496.250831] binder: BINDER_SET_CONTEXT_MGR already set [ 1496.256256] binder: 11156:11163 ioctl 40046207 0 returned -16 22:53:28 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) [ 1496.263279] binder_alloc: 11156: binder_alloc_buf, no vma [ 1496.271069] binder: 11156:11169 BC_REQUEST_DEATH_NOTIFICATION invalid ref 536875008 [ 1496.293095] binder: send failed reply for transaction 433 to 11156:11163 22:53:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x630d, r2}], 0x0, 0x0, &(0x7f0000000080)}) [ 1496.310908] binder: undelivered TRANSACTION_COMPLETE 22:53:28 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) 22:53:28 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000480", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:28 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1496.383610] binder: 11182:11184 unknown command 536875008 [ 1496.398684] binder: 11182:11184 ioctl c0306201 20000480 returned -22 [ 1496.417386] binder_alloc: binder_alloc_mmap_handler: 11182 20001000-20004000 already mapped failed -16 [ 1496.432409] binder: BINDER_SET_CONTEXT_MGR already set [ 1496.452267] binder: 11182:11184 ioctl 40046207 0 returned -16 [ 1496.454101] binder_alloc: 11182: binder_alloc_buf, no vma [ 1496.472184] binder: 11182:11186 unknown command 536875008 [ 1496.483826] binder: 11182:11186 ioctl c0306201 20000480 returned -22 [ 1496.493471] binder: send failed reply for transaction 436 to 11182:11184 [ 1496.503584] binder: undelivered TRANSACTION_COMPLETE 22:53:28 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0}) 22:53:28 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x1000000000000000}) 22:53:28 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x630c, r2}], 0x0, 0x0, &(0x7f0000000080)}) 22:53:28 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x22, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:28 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000680", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:28 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}) [ 1497.002295] binder: 11202:11210 unknown command 536875008 [ 1497.021272] binder: 11202:11210 ioctl c0306201 20000480 returned -22 [ 1497.030649] binder_alloc: binder_alloc_mmap_handler: 11202 20001000-20004000 already mapped failed -16 [ 1497.040777] binder: BINDER_SET_CONTEXT_MGR already set [ 1497.061264] binder: 11202:11210 ioctl 40046207 0 returned -16 [ 1497.068722] binder_alloc: 11202: binder_alloc_buf, no vma [ 1497.078835] binder: 11202:11214 unknown command 536875008 [ 1497.085461] binder: 11202:11214 ioctl c0306201 20000480 returned -22 [ 1497.096029] binder: send failed reply for transaction 439 to 11202:11210 [ 1497.112310] binder: undelivered TRANSACTION_COMPLETE 22:53:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x3, 0x0, &(0x7f0000000080)}) 22:53:29 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2d000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:29 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x200000000000000}) 22:53:29 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0xffffff7f}) 22:53:29 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000002d80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:29 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x3000000}) [ 1497.187328] binder: 11227:11229 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:29 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xffffff8c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:29 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x3f00}) 22:53:29 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) 22:53:29 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000002000000}) 22:53:29 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000}) 22:53:29 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000380", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1497.478594] EXT4-fs: 80 callbacks suppressed [ 1497.478604] EXT4-fs (sda1): re-mounted. Opts: [ 1497.501487] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1497.539075] EXT4-fs (sda1): re-mounted. Opts: [ 1497.550337] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1497.713065] EXT4-fs (sda1): re-mounted. Opts: [ 1497.778164] EXT4-fs (sda1): re-mounted. Opts: [ 1497.987925] binder_alloc: binder_alloc_mmap_handler: 11227 20001000-20004000 already mapped failed -16 [ 1497.997535] binder: BINDER_SET_CONTEXT_MGR already set [ 1498.003261] binder: 11227:11272 ioctl 40046207 0 returned -16 [ 1498.009734] binder_alloc: 11227: binder_alloc_buf, no vma [ 1498.015570] binder: 11227:11273 BC_FREE_BUFFER u0000000020001000 no match [ 1498.023891] binder: release 11227:11229 transaction 442 out, still active [ 1498.033218] binder: undelivered TRANSACTION_COMPLETE 22:53:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x300000000000000, 0x0, &(0x7f0000000080)}) 22:53:29 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6c00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:29 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0xa100000000000000}) 22:53:29 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000006c000000}) 22:53:29 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000006c80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:29 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1498.044732] binder: send failed reply for transaction 442, target dead [ 1498.098436] EXT4-fs (sda1): re-mounted. Opts: 22:53:29 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0xa1000000}) [ 1498.128427] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1498.140704] binder: 11283:11286 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:30 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0xa100}) [ 1498.171469] EXT4-fs (sda1): re-mounted. Opts: [ 1498.176719] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value 22:53:30 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000980", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:30 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4800000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:30 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x1200000000000000}) 22:53:30 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0xa1}) [ 1498.912299] binder_alloc: binder_alloc_mmap_handler: 11283 20001000-20004000 already mapped failed -16 [ 1498.922381] binder: BINDER_SET_CONTEXT_MGR already set [ 1498.928959] binder: 11283:11320 ioctl 40046207 0 returned -16 [ 1498.934918] binder_alloc: 11283: binder_alloc_buf, no vma [ 1498.940853] binder_transaction: 4 callbacks suppressed [ 1498.940868] binder: 11283:11321 transaction failed 29189/-3, size 0-0 line 2970 [ 1498.954303] binder: 11283:11321 BC_FREE_BUFFER u0000000020001000 no match 22:53:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0xfdfdffff00000000, 0x0, &(0x7f0000000080)}) 22:53:30 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x10fffa, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:30 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}) 22:53:30 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000280", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:30 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000006b6b6b00}) 22:53:30 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x300, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1498.962320] binder: release 11283:11286 transaction 445 out, still active [ 1498.972252] binder: undelivered TRANSACTION_COMPLETE [ 1498.983822] binder: send failed reply for transaction 445, target dead [ 1498.997119] binder_release_work: 13 callbacks suppressed [ 1498.997124] binder: undelivered TRANSACTION_ERROR: 29189 22:53:30 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x100000}) [ 1499.070375] binder: 11328:11333 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:31 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x1000000}) 22:53:31 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000001f000000}) 22:53:31 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000007a80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:31 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x10fffb, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:31 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x2000000}) [ 1499.852210] binder_alloc: binder_alloc_mmap_handler: 11328 20001000-20004000 already mapped failed -16 [ 1499.862230] binder: BINDER_SET_CONTEXT_MGR already set [ 1499.868375] binder: 11328:11368 ioctl 40046207 0 returned -16 [ 1499.874393] binder_alloc: 11328: binder_alloc_buf, no vma [ 1499.880528] binder: 11328:11369 transaction failed 29189/-3, size 0-0 line 2970 [ 1499.888821] binder: 11328:11369 BC_FREE_BUFFER u0000000020001000 no match 22:53:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x60000000, 0x0, &(0x7f0000000080)}) 22:53:31 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000}) 22:53:31 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6c00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:31 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000007000000}) 22:53:31 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000007480", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:31 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x1000fa, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1499.896171] binder: release 11328:11333 transaction 448 out, still active [ 1499.906215] binder: undelivered TRANSACTION_COMPLETE [ 1499.917884] binder: send failed reply for transaction 448, target dead 22:53:31 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x10000000000000}) [ 1499.961248] binder: undelivered TRANSACTION_ERROR: 29189 [ 1499.977022] binder: 11378:11379 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:31 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000001080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:31 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x1000fb, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:31 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000004800}) 22:53:31 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000}) 22:53:32 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x3}) [ 1500.771796] binder_alloc: binder_alloc_mmap_handler: 11378 20001000-20004000 already mapped failed -16 [ 1500.781988] binder: BINDER_SET_CONTEXT_MGR already set [ 1500.787315] binder: 11378:11416 ioctl 40046207 0 returned -16 [ 1500.793688] binder_alloc: 11378: binder_alloc_buf, no vma [ 1500.799364] binder: 11378:11417 transaction failed 29189/-3, size 0-0 line 2970 [ 1500.807070] binder: 11378:11417 BC_FREE_BUFFER u0000000020001000 no match [ 1500.815114] binder: release 11378:11379 transaction 451 out, still active 22:53:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x7400, 0x0, &(0x7f0000000080)}) 22:53:32 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}) 22:53:32 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000004880", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:32 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000002c00}) 22:53:32 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100025, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:32 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x300000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1500.824814] binder: undelivered TRANSACTION_COMPLETE [ 1500.836386] binder: send failed reply for transaction 451, target dead [ 1500.849679] binder: undelivered TRANSACTION_ERROR: 29189 22:53:32 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x300}) [ 1500.912935] binder: 11425:11430 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:32 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000002200}) 22:53:32 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000006880", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:32 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x10}) 22:53:32 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x10002d, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:32 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x1000000000000}) [ 1501.700153] binder_alloc: binder_alloc_mmap_handler: 11425 20001000-20004000 already mapped failed -16 [ 1501.710399] binder: BINDER_SET_CONTEXT_MGR already set [ 1501.715733] binder: 11425:11464 ioctl 40046207 0 returned -16 [ 1501.721756] binder_alloc: 11425: binder_alloc_buf, no vma [ 1501.727386] binder: 11425:11465 transaction failed 29189/-3, size 0-0 line 2970 [ 1501.735153] binder: 11425:11465 BC_FREE_BUFFER u0000000020001000 no match [ 1501.742777] binder: send failed reply for transaction 454 to 11425:11430 22:53:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x6, 0x0, &(0x7f0000000080)}) 22:53:33 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x700000000000000}) 22:53:33 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x40000000}) 22:53:33 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000580", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:33 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x10002f, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:33 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1501.751194] binder: undelivered TRANSACTION_COMPLETE [ 1501.764606] binder: undelivered TRANSACTION_ERROR: 29189 [ 1501.776272] binder: undelivered TRANSACTION_ERROR: 29189 22:53:33 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x3f000000}) [ 1501.832102] binder: 11472:11477 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:33 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'"node_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:33 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x4000000fdfdffff}) 22:53:33 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xffffffff00000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:33 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x2}) 22:53:33 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}) [ 1502.617330] binder_alloc: binder_alloc_mmap_handler: 11472 20001000-20004000 already mapped failed -16 [ 1502.627439] binder: BINDER_SET_CONTEXT_MGR already set [ 1502.633144] binder: 11472:11512 ioctl 40046207 0 returned -16 [ 1502.639440] binder_alloc: 11472: binder_alloc_buf, no vma [ 1502.645064] binder: 11472:11513 transaction failed 29189/-3, size 0-0 line 2970 [ 1502.653402] binder: 11472:11513 BC_FREE_BUFFER u0000000020001000 no match 22:53:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x3f000000, 0x0, &(0x7f0000000080)}) 22:53:34 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x4000}) 22:53:34 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={',node_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:34 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfcfdffff, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:34 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000022000000}) 22:53:34 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x40000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1502.661029] binder: send failed reply for transaction 457 to 11472:11477 [ 1502.670844] binder: undelivered TRANSACTION_COMPLETE [ 1502.682312] binder: undelivered TRANSACTION_ERROR: 29189 [ 1502.694333] binder: undelivered TRANSACTION_ERROR: 29189 22:53:34 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}) [ 1502.735649] EXT4-fs: 51 callbacks suppressed [ 1502.735659] EXT4-fs (sda1): re-mounted. Opts: [ 1502.749819] binder: 11521:11524 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1502.773250] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:53:34 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}) [ 1502.809310] EXT4-fs (sda1): Unrecognized mount option "node_readahead_blks=0x0600000000000000" or missing value [ 1502.834500] EXT4-fs (sda1): re-mounted. Opts: 22:53:34 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000600}) 22:53:34 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000080)={0x8, 0x8, 0x22, &(0x7f0000000040)="0981ec931e9514318428478955720153d17a946296c938e9a5783655e1998bc31d77"}) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x4, 0x0, 0x1}) 22:53:34 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x300, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1502.897591] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1502.923024] EXT4-fs (sda1): Unrecognized mount option "node_readahead_blks=0x0600000000000000" or missing value 22:53:34 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'i"ode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1503.060280] EXT4-fs (sda1): re-mounted. Opts: [ 1503.080629] EXT4-fs (sda1): re-mounted. Opts: [ 1503.089230] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1503.125361] EXT4-fs (sda1): re-mounted. Opts: [ 1503.536800] binder_alloc: binder_alloc_mmap_handler: 11521 20001000-20004000 already mapped failed -16 [ 1503.546520] binder: BINDER_SET_CONTEXT_MGR already set [ 1503.552234] binder: 11521:11561 ioctl 40046207 0 returned -16 [ 1503.558543] binder_alloc: 11521: binder_alloc_buf, no vma [ 1503.565100] binder: 11521:11562 transaction failed 29189/-3, size 0-0 line 2970 [ 1503.573445] binder: 11521:11562 BC_FREE_BUFFER u0000000020001000 no match 22:53:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x4800, 0x0, &(0x7f0000000080)}) 22:53:35 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x44000, 0x0) 22:53:35 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000006c00}) 22:53:35 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x900000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:35 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2200, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:35 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'i,ode_readahead_blks', 0x3d, 0x600000000000000}}]}) [ 1503.581198] binder: send failed reply for transaction 460 to 11521:11524 [ 1503.591000] binder: undelivered TRANSACTION_COMPLETE [ 1503.602540] binder: undelivered TRANSACTION_ERROR: 29189 [ 1503.614659] binder: undelivered TRANSACTION_ERROR: 29189 22:53:35 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0xfffffffffffffffd) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000080)={0x10300, 0x0, 0x1, 0x0, 0x9}) [ 1503.667592] binder: 11571:11572 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:35 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x4000000fffffdfd}) 22:53:35 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x5) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x9}) fcntl$setstatus(r0, 0x4, 0x44c00) 22:53:35 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x3f00000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:35 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'in"de_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:35 executing program 0: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x4, 0x101000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f0000000040)={0x3f, 0x0, {0x0, 0x0, 0xfffffffffffffff9, 0x3, 0x2}}) r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x18, 0x1) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r2) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1504.460172] binder_alloc: binder_alloc_mmap_handler: 11571 20001000-20004000 already mapped failed -16 [ 1504.469847] binder: BINDER_SET_CONTEXT_MGR already set [ 1504.476131] binder: 11571:11612 ioctl 40046207 0 returned -16 [ 1504.482470] binder_alloc: 11571: binder_alloc_buf, no vma [ 1504.488151] binder: 11571:11613 transaction failed 29189/-3, size 0-0 line 2970 [ 1504.495869] binder: 11571:11613 BC_FREE_BUFFER u0000000020001000 no match 22:53:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x7400000000000000, 0x0, &(0x7f0000000080)}) 22:53:36 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x111000, 0x0) pread64(r0, &(0x7f0000000080)=""/240, 0xf0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x5c8) faccessat(r0, &(0x7f0000000180)='./file0\x00', 0x140, 0x1000) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:36 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000003000000}) 22:53:36 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'in%de_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:36 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2000000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:36 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2200000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1504.503815] binder: send failed reply for transaction 463 to 11571:11572 [ 1504.513627] binder: undelivered TRANSACTION_COMPLETE [ 1504.525113] binder: undelivered TRANSACTION_ERROR: 29189 [ 1504.537171] binder: undelivered TRANSACTION_ERROR: 29189 22:53:36 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000010a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1504.592220] binder: 11620:11627 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:36 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x80000, 0x0) 22:53:36 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4800000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:36 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'in,de_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:36 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000006}) 22:53:36 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x1, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1505.379248] binder_alloc: binder_alloc_mmap_handler: 11620 20001000-20004000 already mapped failed -16 [ 1505.388905] binder: BINDER_SET_CONTEXT_MGR already set [ 1505.394233] binder: 11620:11662 ioctl 40046207 0 returned -16 [ 1505.401093] binder_alloc: 11620: binder_alloc_buf, no vma [ 1505.406718] binder: 11620:11663 transaction failed 29189/-3, size 0-0 line 2970 [ 1505.415538] binder: 11620:11663 BC_FREE_BUFFER u0000000020001000 no match 22:53:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x700, 0x0, &(0x7f0000000080)}) 22:53:37 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x20, 0x10400) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000440)="5680e5f5d2141496b3ccc579ca6163d43cf4847cc69c3bedb28717b888c2c7711ca3784bb972479ad6a0ac8b0227b3968b7b97247f9e4401f8abf711e47a42fc5efd018e85c32f1ad41129a39f94498c131c3dba1ae6f14430bcb95533eec52d2f6777e7b39bcfb0cc5ff42e6c7ddbbbd75cf7aacadd18ee902ec35df101fdf99e832ce2b90aa84121e8182660a6757dfc62309eedf7253fa8ef0b32f9c4c716e85b49713a191ee1baa330138bce743718914b453c3e8d1940da32265ff046e8417c9b56a57b5917b8d0286108f7ef845a190dffd90f6eadb60cf5e214b5da9e826f155159d3252ffdb5d9a384e68fdad8dd081e64e25717b4dd7151ec45cfeabe555bf692922c3fc89cc172f2582258df1b2e76be2edc5095846c830763b90cd51d26257df16ef47f442f2dfd1421e6d1763f4f696c5bd6511d241033a88653e789bc5799edc7a413bd623bc755ae366b25791afcae3b56f67d13b0ee04ff427551076c001b1d53741f13a86c37d91dfc1664744d13092710fcc4a831e2b182f8d1acbe610433f2") r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:37 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6800000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:37 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000c79}) 22:53:37 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'ino"e_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:37 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x600000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1505.423406] binder: release 11620:11627 transaction 466 out, still active [ 1505.433347] binder: undelivered TRANSACTION_COMPLETE [ 1505.445008] binder: send failed reply for transaction 466, target dead [ 1505.458225] binder: undelivered TRANSACTION_ERROR: 29189 [ 1505.504784] binder: 11669:11671 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:37 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x2, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000000c0)={0x0, 0x1, 0xffffffffffffffe0, 0x10001}) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000040)={0x4, 0x28, [0x9, 0x10000, 0x7fffffff, 0x263, 0x1, 0x0, 0x1000, 0x1, 0x9, 0x9]}) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0x2000000000000}) 22:53:37 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:37 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'ino,e_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:37 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000060}) 22:53:37 executing program 0: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x40000) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) getpeername$netlink(r0, &(0x7f0000000040), &(0x7f0000000080)=0xc) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000140)={{0x2, 0x1, 0xfffffffffffffffc, 0x3, 0x40}, 0x6, 0x100000000, 0xd3}) r1 = dup3(r0, r0, 0x84000) ioctl$DRM_IOCTL_INFO_BUFS(r0, 0xc0106418, &(0x7f0000000000)={0x9, 0x1ff, 0x4, 0x6, 0x1, 0x400}) ioctl$NBD_CLEAR_QUE(r1, 0xab05) ioctl$ASHMEM_GET_PROT_MASK(r0, 0x7706, &(0x7f0000000100)) memfd_create(&(0x7f00000001c0)='cpuset\x00', 0x1) 22:53:37 executing program 0: r0 = socket(0x3, 0x8000b, 0x9) recvmmsg(0xffffffffffffffff, &(0x7f0000002100)=[{{&(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000140)=""/192, 0xc0}, {&(0x7f0000000280)=""/132, 0x84}, {&(0x7f0000000340)=""/234, 0xea}, {&(0x7f0000000440)=""/83, 0x53}, {&(0x7f00000004c0)=""/177, 0xb1}, {&(0x7f0000000580)=""/117, 0x75}], 0x6, &(0x7f0000000680)=""/180, 0xb4, 0x2}, 0x3f}, {{&(0x7f0000000740)=@hci, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000200)=""/8, 0x8}, {&(0x7f00000007c0)=""/246, 0xf6}, {&(0x7f00000008c0)=""/206, 0xce}, {&(0x7f00000009c0)=""/160, 0xa0}], 0x4, &(0x7f0000000ac0)=""/188, 0xbc, 0x9}, 0x87}, {{&(0x7f0000000b80)=@can={0x1d, 0x0}, 0x80, &(0x7f0000002000)=[{&(0x7f0000000c00)=""/217, 0xd9}, {&(0x7f0000000d00)=""/4096, 0x1000}, {&(0x7f0000001d00)=""/148, 0x94}, {&(0x7f0000001dc0)=""/141, 0x8d}, {&(0x7f0000001e80)=""/12, 0xc}, {&(0x7f0000001ec0)=""/143, 0x8f}, {&(0x7f0000001f80)=""/88, 0x58}], 0x7, &(0x7f0000002080)=""/103, 0x67, 0x8}, 0x8}], 0x3, 0x2100, &(0x7f00000021c0)={0x77359400}) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000002200)={@remote, 0x39, r1}) r2 = openat$cgroup_procs(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.threads\x00', 0x2, 0x0) r3 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/load\x00', 0x2, 0x0) r4 = fcntl$dupfd(r2, 0x406, r3) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000002280)={0x0, 0x80000, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f00000022c0)={r5, 0x80000, r4}) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000240)={0x10300}) write$FUSE_BMAP(r4, &(0x7f0000000000)={0x18, 0x0, 0x3, {0x8000}}, 0x18) ioctl$SG_SET_KEEP_ORPHAN(r4, 0x2287, &(0x7f0000002240)=0xfffffffffffffffa) [ 1506.291976] binder_alloc: binder_alloc_mmap_handler: 11669 20001000-20004000 already mapped failed -16 [ 1506.301650] binder: BINDER_SET_CONTEXT_MGR already set [ 1506.306985] binder: 11669:11715 ioctl 40046207 0 returned -16 [ 1506.313354] binder_alloc: 11669: binder_alloc_buf, no vma [ 1506.319032] binder: 11669:11716 transaction failed 29189/-3, size 0-0 line 2970 [ 1506.326732] binder: 11669:11716 BC_FREE_BUFFER u0000000020001000 no match [ 1506.334692] binder: release 11669:11671 transaction 469 out, still active 22:53:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x7000000, 0x0, &(0x7f0000000080)}) 22:53:38 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) fsetxattr$security_capability(r0, &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v2={0x2000000, [{0x1, 0x400}, {0x5d, 0x5}]}, 0x14, 0x1) 22:53:38 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x7a000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:38 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inod,_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:38 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000002000}) 22:53:38 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1506.344672] binder: undelivered TRANSACTION_COMPLETE [ 1506.355400] binder: send failed reply for transaction 469, target dead [ 1506.371255] binder: undelivered TRANSACTION_ERROR: 29189 22:53:38 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) setsockopt$inet_udp_encap(0xffffffffffffff9c, 0x11, 0x64, &(0x7f00000001c0)=0x4, 0x4) stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_netfilter(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8020}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="0c02007000ffdbdf250300000a08005e05", @ANYRES32=r1, @ANYBLOB="800146003bcd898869efa682ee0bfd76098f1178e2779c44f5a6abdd77654cb9e23dbda152ceb6a2179e8fd112cb4279a6400bf917dbdf96f4c69e2c5f7cdde8f1cb21df56834c85db7148f9f6a406bf3f9a5f0c008700a90500000000000049946e027513359034232abbe797b9ebcd6af68122a12ad803fba9d3135220ac308f0d7c2b84b484431c3d4abf1f9317185c72e73134d64ac9590fe87af321f949c3b03d91b3bdc95c576fd75562335d6a6908aec8c1735cc51287cdfdc26d5f4e08306eced6390c189f62364c7152f5bba10881452c1cad4ec7ebecbc0315b4f08878c2a2efd249dc8a527edf85e8a3cbb95931616c75e1af3e20f07b39317ad52d6dd708c39aac982f0d9761e7fbcc31a32fae2cd7fb6728fcf62dca416ea6940a53e414026d1bb0f878d26bf7d7d4449dcadf9f03dec74858790e27126581463e777b69994a4200b68c811b266f783bf590daa71f3f194db21708003300", @ANYRES32=r0, @ANYBLOB="1c000d002f6465762f6275732f7573622f3030232f303023000000000000c28ae3ca8e8da29c5636535b73f4e3155e7a851495aa65e0e5c22b817ba817ad810dbbaec4e22aaf4cc713803c02a2c4092ed618664a25a5d02c3d63a904b57aaeda9b81d1b97c384e72352753661ef79ff3ba53b7f05b9d192d1dfef61d89fc705eca451fa312f136a08b70c2150000"], 0x20c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) [ 1506.414909] binder: 11722:11728 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:38 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x300000000000000}) 22:53:38 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inod"_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:38 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:38 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x7}) 22:53:38 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000080)={0x80000001, 0x0, 0x80, 0x9}) [ 1506.727160] usb usb8: usbfs: process 11759 (syz-executor0) did not claim interface 0 before use [ 1507.210710] binder_alloc: binder_alloc_mmap_handler: 11722 20001000-20004000 already mapped failed -16 [ 1507.220801] binder: BINDER_SET_CONTEXT_MGR already set [ 1507.226127] binder: 11722:11765 ioctl 40046207 0 returned -16 [ 1507.232599] binder_alloc: 11722: binder_alloc_buf, no vma [ 1507.239567] binder: 11722:11766 transaction failed 29189/-3, size 0-0 line 2970 [ 1507.248570] binder: 11722:11767 BC_FREE_BUFFER u0000000020001000 no match 22:53:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x74, 0x0, &(0x7f0000000080)}) 22:53:39 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inod%_readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:39 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000000000007a}) 22:53:39 executing program 0: syz_extract_tcp_res(&(0x7f0000000040), 0x3c5, 0x1f) r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:39 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2c, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:39 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4800, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1507.255910] binder: send failed reply for transaction 472 to 11722:11728 [ 1507.265806] binder: undelivered TRANSACTION_COMPLETE [ 1507.277322] binder: undelivered TRANSACTION_ERROR: 29189 [ 1507.289502] binder: undelivered TRANSACTION_ERROR: 29189 22:53:39 executing program 0: socket$inet6(0xa, 0x4, 0x6) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1507.350030] binder: 11777:11780 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:39 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:39 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode"readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:39 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000008cffffff}) 22:53:39 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000040)) 22:53:39 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) ioctl$sock_netdev_private(r0, 0x89fd, &(0x7f0000000040)="ef0be0b57922626bf75f82de30f7e6c4ef7e2362fbb9271be362cd97cc2e71614693864e3cb0fe5aef9c0e2a4f10f20af113668347fdd8c89ee1a242125ad4bc90f2e15e7c16fa226b77d5391b2506ef3d689605f5c06e") [ 1507.750233] EXT4-fs: 72 callbacks suppressed [ 1507.750242] EXT4-fs (sda1): re-mounted. Opts: [ 1508.134871] binder_alloc: binder_alloc_mmap_handler: 11777 20001000-20004000 already mapped failed -16 [ 1508.144510] binder: BINDER_SET_CONTEXT_MGR already set [ 1508.149870] binder: 11777:11822 ioctl 40046207 0 returned -16 [ 1508.155849] binder_alloc: 11777: binder_alloc_buf, no vma [ 1508.161490] binder: 11777:11823 transaction failed 29189/-3, size 0-0 line 2970 [ 1508.169904] binder: 11777:11823 BC_FREE_BUFFER u0000000020001000 no match [ 1508.177216] binder: release 11777:11780 transaction 475 out, still active 22:53:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x600000000000000, 0x0, &(0x7f0000000080)}) 22:53:40 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2c00000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:40 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000040000000}) 22:53:40 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode,readahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:40 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='auxv\x00') setsockopt$inet_mreqsrc(r0, 0x0, 0x28, &(0x7f0000000080)={@multicast1, @multicast2, @multicast1}, 0xc) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:40 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3f00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1508.186749] binder: undelivered TRANSACTION_COMPLETE [ 1508.198239] binder: send failed reply for transaction 475, target dead [ 1508.212321] binder: undelivered TRANSACTION_ERROR: 29189 22:53:40 executing program 0: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x20000, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000001c0)={&(0x7f00000000c0)=""/251, 0x100000, 0x800, 0x3}, 0x18) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000040)={0x10300, 0xffffffffffffffff}) [ 1508.270297] EXT4-fs (sda1): Unrecognized mount option "inode" or missing value [ 1508.277451] binder: 11831:11836 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1508.298718] EXT4-fs (sda1): re-mounted. Opts: [ 1508.310452] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1508.344252] EXT4-fs (sda1): Unrecognized mount option "inode" or missing value [ 1508.361005] EXT4-fs (sda1): re-mounted. Opts: 22:53:40 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_"eadahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:40 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000004c000000}) 22:53:40 executing program 0: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r0, 0x114, 0xa, &(0x7f0000000040), 0x1) r1 = syz_open_dev$usb(&(0x7f0000000380)='/dev/bus/usb/00#/00#\x00', 0xfff, 0x10030000) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) r2 = getgid() getresgid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) getgroups(0x8, &(0x7f00000001c0)=[0x0, 0xffffffffffffffff, 0xee01, 0xee01, 0xffffffffffffffff, 0xee01, 0xffffffffffffffff, 0x0]) fstat(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgroups(0x4, &(0x7f0000000200)=[r2, r3, r4, r5]) socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000080)) [ 1508.408715] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:53:40 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x500, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:40 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x80000000, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) ioctl$VT_ACTIVATE(r0, 0x5606, 0x1) [ 1508.551559] EXT4-fs (sda1): Unrecognized mount option "inode_"eadahead_blks=0x0600000000000000" or missing value [ 1508.578599] EXT4-fs (sda1): re-mounted. Opts: [ 1508.624191] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1509.058574] binder_alloc: binder_alloc_mmap_handler: 11831 20001000-20004000 already mapped failed -16 [ 1509.068799] binder: BINDER_SET_CONTEXT_MGR already set [ 1509.074123] binder: 11831:11875 ioctl 40046207 0 returned -16 [ 1509.080562] binder_alloc: 11831: binder_alloc_buf, no vma [ 1509.086188] binder: 11831:11876 transaction failed 29189/-3, size 0-0 line 2970 [ 1509.094438] binder: 11831:11876 BC_FREE_BUFFER u0000000020001000 no match 22:53:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x200000000000000, 0x0, &(0x7f0000000080)}) 22:53:41 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) r1 = getpid() tkill(r1, 0x41) signalfd4(r0, &(0x7f0000000040)={0x6}, 0x8, 0x800) 22:53:41 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x4000000ffffff7f}) 22:53:41 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_,eadahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:41 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x74000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:41 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3f00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1509.102044] binder: release 11831:11836 transaction 478 out, still active [ 1509.114110] binder: undelivered TRANSACTION_COMPLETE [ 1509.125585] binder: send failed reply for transaction 478, target dead [ 1509.137499] binder: undelivered TRANSACTION_ERROR: 29189 22:53:41 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0xfd, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) r1 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x400000) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1509.200879] binder: 11883:11890 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:41 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_r%adahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:41 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x4000000ffffff8c}) 22:53:41 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:41 executing program 0: ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x0, 0x0, 0xfffffffeffffffff}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5335, &(0x7f0000000080)={0x8, 0x1, 0x3, 'queue1\x00', 0x2}) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x2, 0x0, {0x1, 0x8, 0x7}}, 0x28) 22:53:41 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x101002, 0x0) [ 1509.978525] binder_alloc: binder_alloc_mmap_handler: 11883 20001000-20004000 already mapped failed -16 [ 1509.988839] binder: BINDER_SET_CONTEXT_MGR already set [ 1509.994241] binder: 11883:11927 ioctl 40046207 0 returned -16 [ 1510.000656] binder_alloc: 11883: binder_alloc_buf, no vma [ 1510.006291] binder: 11883:11928 transaction failed 29189/-3, size 0-0 line 2970 [ 1510.014457] binder: 11883:11928 BC_FREE_BUFFER u0000000020001000 no match [ 1510.022118] binder: send failed reply for transaction 481 to 11883:11890 22:53:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x3000000, 0x0, &(0x7f0000000080)}) 22:53:41 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x0, 0x2500) ioctl$KVM_SET_IRQCHIP(r0, 0x8208ae63, &(0x7f0000000180)={0x3, 0x0, @ioapic={0x1000, 0x10000, 0x7, 0x101, 0x0, [{0x0, 0x2, 0x3ff}, {0x81, 0xffffffff7fffffff, 0x2, [], 0x101}, {0x6, 0x1, 0x1, [], 0x10001}, {0x4, 0x7ff, 0x8, [], 0x9}, {0x1f, 0x81, 0x2, [], 0xdc}, {0xffff, 0x4000, 0xfffffffffffffffe, [], 0x7}, {0xfe2e, 0x80000001, 0x1, [], 0x6}, {0x0, 0x7fffffff, 0x800, [], 0x4}, {0x66e, 0xfffffffffffffff8, 0xfffffffffffffffc}, {0x3d, 0x401, 0x8, [], 0x3f}, {0xffffffffffffffe1, 0x1, 0x80, [], 0x8}, {0x6, 0x1, 0x9, [], 0xffffffff}, {0xb9, 0x10001, 0x9}, {0x4a84, 0x101, 0x3}, {0x5, 0x748, 0x7, [], 0xca3}, {0xffffffffffffffff, 0x2, 0xfe, [], 0xff}, {0xf0, 0x61, 0x9, [], 0x5}, {0x40, 0x8, 0x3, [], 0x6}, {0xffff, 0xffffffffffffffe1, 0x1, [], 0xfffffffeffffffff}, {0x81, 0x24b, 0x7, [], 0x883c}, {0x7fff, 0x20000000, 0x800, [], 0x401}, {0x5, 0xa1, 0x2, [], 0x20}, {0x80, 0xff, 0x8e90, [], 0x3500}, {0x1ff, 0x0, 0x7f05, [], 0x3bb}]}}) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000140)={0x10300, 0x1000}) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000100)) getdents(r0, &(0x7f0000000000)=""/33, 0x21) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000340)={0x5, &(0x7f0000000040)=[{}, {}, {}, {}, {}]}) write$selinux_validatetrans(r0, &(0x7f0000000280)={'system_u:object_r:man_t:s0', 0x20, 'system_u:object_r:systemd_logind_sessions_t:s0', 0x20, 0x100000000, 0x20, 'unconfined_u:system_r:insmod_t:s0-s0:c0.c1023\x00'}, 0x8d) 22:53:41 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_r,adahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:41 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000048}) 22:53:41 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x600, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:41 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1f000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1510.031945] binder: undelivered TRANSACTION_COMPLETE [ 1510.043083] binder: undelivered TRANSACTION_ERROR: 29189 [ 1510.055728] binder: undelivered TRANSACTION_ERROR: 29189 [ 1510.126667] binder: 11935:11943 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:42 executing program 0: ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:42 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x700000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:42 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000004}) 22:53:42 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_r"adahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:42 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000100), 0x4) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x3, 0x2000000000008001, 0x0, 0x5}) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a85321, &(0x7f0000000040)={{0x4380000000000, 0x5c0}, 'port1\x00', 0x4, 0x4, 0xbe0, 0x59d, 0x481, 0x4000000, 0x8, 0x0, 0x5, 0x1f}) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000140)=ANY=[@ANYBLOB="0000001000c80f77982b6ad0ca6c705dd4fa00000000000000"]) 22:53:42 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000040)={0x4, 0x1f, 0x0, 0x8, 0x5}) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000080)) [ 1510.298578] vhci_hcd: default hub control req: 0300 v0000 i0001 l0 [ 1510.322835] vhci_hcd: default hub control req: 0300 v0000 i0001 l0 [ 1510.898393] binder_alloc: binder_alloc_mmap_handler: 11935 20001000-20004000 already mapped failed -16 [ 1510.908027] binder: BINDER_SET_CONTEXT_MGR already set [ 1510.913680] binder: 11935:11979 ioctl 40046207 0 returned -16 [ 1510.920093] binder_alloc: 11935: binder_alloc_buf, no vma [ 1510.925733] binder: 11935:11980 transaction failed 29189/-3, size 0-0 line 2970 [ 1510.933935] binder: 11935:11980 BC_FREE_BUFFER u0000000020001000 no match [ 1510.941618] binder: release 11935:11943 transaction 484 out, still active 22:53:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x7a000000, 0x0, &(0x7f0000000080)}) 22:53:42 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0xffff, 0x200000) openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/access\x00', 0x2, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x400000000}) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000000)={@rand_addr, @empty, 0x0}, &(0x7f0000000080)=0xc) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f00000000c0)={@local, 0x2a, r1}) 22:53:42 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000000000006c}) 22:53:42 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x300000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:42 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_re"dahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:42 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x68000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1510.951626] binder: undelivered TRANSACTION_COMPLETE [ 1510.963259] binder: send failed reply for transaction 484, target dead [ 1510.976565] binder: undelivered TRANSACTION_ERROR: 29189 22:53:42 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x7dc, 0x1) connect$vsock_stream(r0, &(0x7f0000000100)={0x28, 0x0, 0x2711, @host}, 0x10) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) getsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f0000000080)=""/79, &(0x7f0000000000)=0x4f) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000140)={'veth1_to_bond\x00', 0x400}) [ 1511.030640] binder: 11987:11996 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:43 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x500000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:43 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_re%dahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:43 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000005000000}) 22:53:43 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000040)={{{@in=@multicast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}}}, &(0x7f0000000140)=0xe8) recvmsg(r0, &(0x7f0000000700)={&(0x7f0000000340)=@rc, 0x80, &(0x7f00000005c0)=[{&(0x7f00000003c0)=""/223, 0xdf}, {&(0x7f00000004c0)}, {&(0x7f0000000500)=""/136, 0x88}], 0x3, &(0x7f0000000600)=""/247, 0xf7, 0x3}, 0x100) r2 = getegid() stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RSTATu(r0, &(0x7f0000000280)={0xaa, 0x7d, 0x1, {{0x0, 0x80, 0x1760f40e, 0x6000, {0x2, 0x3, 0x3}, 0x0, 0x6, 0x5, 0x8, 0x15, 'securitytrustedcpuset', 0x15, '/dev/bus/usb/00#/00#\x00', 0x15, '/dev/bus/usb/00#/00#\x00', 0xe, 'vboxnet1vmnet1'}, 0x15, '/dev/bus/usb/00#/00#\x00', r1, r2, r3}}, 0xaa) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:43 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x20000, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000280)=0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x8c41, 0x2, 0x3, 0x1, 0x0, 0x2, 0x60000, 0x0, 0x9, 0xffffffff, 0x2, 0xfa, 0x704f, 0x2, 0x10000, 0x9bfa, 0x53, 0x401, 0x5, 0x7, 0x18bc, 0x7f, 0x7, 0x359, 0xfffffffffffffeff, 0x6, 0x100, 0xb351, 0x0, 0x3, 0x800, 0x3, 0xffffffff, 0x564, 0x800, 0x7, 0x0, 0x3, 0x7, @perf_config_ext={0x6}, 0x1, 0x8, 0x4, 0x0, 0x591000000000000, 0xfffffffffffffffb, 0x8}, r2, 0x1, r1, 0x2) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) ioctl$NBD_DISCONNECT(r0, 0xab08) setsockopt$inet6_tcp_buf(r1, 0x6, 0xe, &(0x7f00000000c0)="8b261a63a4cecc823d42d41d86ba3673384d4b34eff0c8b023cf318e049d86e6db90c47f68df5643b2c466aeb965e2f9a6537aadd0e0725b77c7182c9b7e5b01742c14a127c4c5daaec3950d5071486628c904a1ca06db6b30f3c030e679e575c09943d9cfaea074bf04dd8306ac2d5a4a3482e60191fcd0b2772743d7845e9d09525ef09f729f4918643e0a16ae6b0054e32eb81fdfb776bcd6b705c118077eb2fe94e53d873d087f9def3a8fb59f5390fad679b4c3fcc76a8593b78c595c1a8fcb625acbdbab7e9565357c8dfdb01f5a4aca30fce3b945c4bffd05bc2ad270528ef908252c7dd19302cb", 0xeb) ioctl$KVM_DIRTY_TLB(r1, 0x4010aeaa, &(0x7f0000000080)={0xd9e, 0xfd}) [ 1511.821129] binder_alloc: binder_alloc_mmap_handler: 11987 20001000-20004000 already mapped failed -16 [ 1511.830907] binder: BINDER_SET_CONTEXT_MGR already set [ 1511.836639] binder: 11987:12031 ioctl 40046207 0 returned -16 [ 1511.842995] binder_alloc: 11987: binder_alloc_buf, no vma [ 1511.848654] binder: 11987:12032 transaction failed 29189/-3, size 0-0 line 2970 [ 1511.856353] binder: 11987:12032 BC_FREE_BUFFER u0000000020001000 no match [ 1511.864301] binder: release 11987:11996 transaction 487 out, still active 22:53:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x4c, 0x0, &(0x7f0000000080)}) 22:53:43 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x8cffffff, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:43 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) bind$netlink(r0, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfe, 0x40000}, 0xc) 22:53:43 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_re,dahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:43 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x500000000000000}) 22:53:43 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6c000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1511.874231] binder: undelivered TRANSACTION_COMPLETE [ 1511.885693] binder: send failed reply for transaction 487, target dead [ 1511.899014] binder: undelivered TRANSACTION_ERROR: 29189 22:53:43 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000b, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1511.944332] binder: 12038:12044 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:43 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000000)={0x10300, 0x0, 0xffffffffffffffff, 0x3, 0x3}) lgetxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=@known='security.apparmor\x00', &(0x7f0000000100)=""/62, 0x3e) 22:53:43 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_rea"ahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:43 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x80000000007, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0x4}) sync_file_range(r0, 0x8, 0xab1, 0x6) lsetxattr$trusted_overlay_redirect(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x3) 22:53:43 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4c00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:43 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000005}) [ 1512.737092] binder_alloc: binder_alloc_mmap_handler: 12038 20001000-20004000 already mapped failed -16 [ 1512.747154] binder: BINDER_SET_CONTEXT_MGR already set [ 1512.752849] binder: 12038:12082 ioctl 40046207 0 returned -16 [ 1512.759160] binder_alloc: 12038: binder_alloc_buf, no vma [ 1512.764791] binder: 12038:12083 transaction failed 29189/-3, size 0-0 line 2970 [ 1512.773090] binder: 12038:12083 BC_FREE_BUFFER u0000000020001000 no match 22:53:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x4800000000000000, 0x0, &(0x7f0000000080)}) 22:53:44 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0xffffffffffffffff, 0x4}) 22:53:44 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_rea,ahead_blks', 0x3d, 0x600000000000000}}]}) 22:53:44 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfffffdfd, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:44 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000001f00}) 22:53:44 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfdfdffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1512.780755] binder: release 12038:12044 transaction 490 out, still active [ 1512.790712] binder: undelivered TRANSACTION_COMPLETE [ 1512.802306] binder: send failed reply for transaction 490, target dead [ 1512.815539] binder: undelivered TRANSACTION_ERROR: 29189 22:53:44 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000080)={0x80000000, 0x0, 0x2, 0xc4}) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000000c0)={r1, 0x101}) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) write$P9_RMKDIR(r0, &(0x7f0000000040)={0x14, 0x49, 0x2, {0x0, 0x1, 0x8}}, 0x14) [ 1512.865740] EXT4-fs: 61 callbacks suppressed [ 1512.865750] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1512.866616] binder: 12091:12095 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1512.888746] EXT4-fs (sda1): re-mounted. Opts: [ 1512.894698] EXT4-fs (sda1): Unrecognized mount option "inode_rea" or missing value 22:53:44 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000040)={0x10300, 0x0, 0x0, 0x0, 0xfff}) getsockname$unix(r0, &(0x7f00000000c0)=@abs, &(0x7f0000000000)=0x6e) [ 1512.913403] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1512.934502] EXT4-fs (sda1): re-mounted. Opts: [ 1512.949736] EXT4-fs (sda1): Unrecognized mount option "inode_rea" or missing value 22:53:44 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfffffdfc, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:44 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x4000000fffffff6}) 22:53:44 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_read,head_blks', 0x3d, 0x600000000000000}}]}) 22:53:44 executing program 0: getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@remote}}, &(0x7f00000003c0)=0xe8) mount$bpf(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)='bpf\x00', 0x1200000, &(0x7f0000000400)={[{@mode={'mode', 0x3d, 0x8000}}, {@mode={'mode', 0x3d, 0x5}}, {@mode={'mode', 0x3d, 0x99f0}}, {@mode={'mode', 0x3d, 0x97}}, {@mode={'mode'}}, {@mode={'mode', 0x3d, 0x5}}, {@mode={'mode'}}], [{@fowner_gt={'fowner>', r0}}]}) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e22, 0x9, @ipv4={[], [], @local}, 0x7fff}}}, &(0x7f0000000180)=0x84) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000001c0)={0x80000000, 0x1, 0x200, 0x1, 0x0, 0x7, 0x0, 0x10001, r2}, 0x20) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) ioctl$RTC_WIE_OFF(r1, 0x7010) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000080)={0x3, &(0x7f0000000040)=[{0xdba, 0x7, 0x3, 0x20}, {0x85f3, 0x7fff, 0x200, 0x7}, {0x438, 0x6, 0x7, 0xffff}]}) [ 1513.136054] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1513.153588] EXT4-fs (sda1): Unrecognized mount option "inode_read" or missing value [ 1513.164915] EXT4-fs (sda1): Unrecognized mount option "ö" or missing value [ 1513.210772] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1513.656218] binder_alloc: binder_alloc_mmap_handler: 12091 20001000-20004000 already mapped failed -16 [ 1513.665878] binder: BINDER_SET_CONTEXT_MGR already set [ 1513.671615] binder: 12091:12133 ioctl 40046207 0 returned -16 [ 1513.677594] binder_alloc: 12091: binder_alloc_buf, no vma [ 1513.683248] binder: 12091:12134 transaction failed 29189/-3, size 0-0 line 2970 [ 1513.691229] binder: 12091:12134 BC_FREE_BUFFER u0000000020001000 no match [ 1513.698585] binder: release 12091:12095 transaction 493 out, still active 22:53:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x6000000000000000, 0x0, &(0x7f0000000080)}) 22:53:45 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) ioctl$KVM_SET_CLOCK(r0, 0x4030ae7b, &(0x7f00000000c0)={0x42f75373, 0xefc}) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) openat$ipvs(0xffffffffffffff9c, &(0x7f00000016c0)="2f7016e100000079732f6e65742f697076342f76732f616d656d746872657368005606bed173f41d9a7ca4659030dc1a8611206ad8403970bfbc477ca871eb7a5845782b7aca8f7fcb86d4f608b8ac587bc3505aca1cafc5b9698fc0cbe3117b2f7fd04cf7e3464b2221656167503248824d2ded9b8f91d5ac3cf61947310738fedd4a1186a2ae61a1ba940c2ee67a9833ee099656fae61ae4dd321d6dcb818af8cbd746fc96afe34a88464940eab366b74d30b8346cf82640cbc0c650fc04e097ff26730c5f8cd1a2421d1488e726168730c619f3f267555b2d2c208cf9bda3ff8dc959cfd31a31d6ffe888d52bffad827792c9", 0x2, 0x0) recvmsg$kcm(r0, &(0x7f00000001c0)={&(0x7f0000000100)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000280)=""/4096, 0x1000}], 0x1, &(0x7f0000001280)=""/142, 0x8e, 0x7}, 0x1) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000001380)={r2, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x10) ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f0000000040)={0x7, 0x1f}) r3 = getpgrp(0xffffffffffffffff) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r3, 0x10, &(0x7f0000001340)={0x1}) 22:53:45 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x3000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:45 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_read"head_blks', 0x3d, 0x600000000000000}}]}) 22:53:45 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000006000000}) 22:53:45 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x48000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1513.708228] binder: undelivered TRANSACTION_COMPLETE [ 1513.719840] binder: send failed reply for transaction 493, target dead [ 1513.732820] binder: undelivered TRANSACTION_ERROR: 29189 22:53:45 executing program 0: ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000240)={0x10300}) mq_notify(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x3b, 0x5, @thr={&(0x7f0000000040)="26febcf2917b643defc3381ddd3b624025c17a523e6fa0bb11213c8ee5b1820189b28833e73b56f0cac804ebcf2906d4f35f28347219d56459ea130c70868ca114395fea5a7b0bed7b4c5c14768bd66942d536d66890bb6adfc5ea2531f29795a942f7ac6921570d21828384288d14885b97db9689d7f2ca7878a5a1021e951ad0ace0d6ff242af49b8482fe2bb9039a45add2837543d5d8076bb7d6de340ed31393c563a953d027667c2ccf1043a6a3580ecfa3aafb87a0aa44cb7eca6c", &(0x7f0000000100)="93b53b4e5fe952d881124530f9aad94dbb096a0257872705d6da64ee712303ecec3bb1843515ff60a1ac8ffcc4be8586927432506263961b1fa429caaba26a6b6fe498ad74729c8def4e02fe71f049396de0ebd3a88a8dc608c69a000781368eb723928459974e04bf3f50f65faae13b8529367148a39433274e7c57bf16cfb191c6afbbbf2a2ec39a2716dca98b18f71af8315d4f99a56a20b1ec4452"}}) r0 = msgget(0x2, 0x4) msgctl$IPC_INFO(r0, 0x3, &(0x7f0000000280)=""/104) [ 1513.801185] binder: 12142:12148 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:45 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_read%head_blks', 0x3d, 0x600000000000000}}]}) 22:53:45 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000060000000}) 22:53:45 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x400000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:45 executing program 0: ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000240)={0x10300}) setsockopt$netlink_NETLINK_NO_ENOBUFS(0xffffffffffffffff, 0x10e, 0x5, &(0x7f0000000040)=0xcc, 0xffffffffffffff27) 22:53:45 executing program 0: syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) [ 1514.578766] binder_alloc: binder_alloc_mmap_handler: 12142 20001000-20004000 already mapped failed -16 [ 1514.588403] binder: BINDER_SET_CONTEXT_MGR already set [ 1514.593732] binder: 12142:12183 ioctl 40046207 0 returned -16 [ 1514.600121] binder_alloc: 12142: binder_alloc_buf, no vma [ 1514.605753] binder: 12142:12184 transaction failed 29189/-3, size 0-0 line 2970 [ 1514.614772] binder: 12142:12184 BC_FREE_BUFFER u0000000020001000 no match 22:53:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x4000000, 0x0, &(0x7f0000000080)}) 22:53:46 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) r1 = dup2(r0, r0) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) r2 = getpgid(0x0) sched_getscheduler(r2) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000040)={{{@in, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@local}}, &(0x7f0000000140)=0xe8) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r3, r4) 22:53:46 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_reada"ead_blks', 0x3d, 0x600000000000000}}]}) 22:53:46 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2d000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:46 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x4000000f6ffffff}) 22:53:46 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x74000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1514.622467] binder: send failed reply for transaction 496 to 12142:12148 [ 1514.632368] binder: undelivered TRANSACTION_COMPLETE [ 1514.643558] binder: undelivered TRANSACTION_ERROR: 29189 [ 1514.656532] binder: undelivered TRANSACTION_ERROR: 29189 [ 1514.713473] binder: 12190:12194 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:46 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000040)={0x4, 0xfffffffffffffffe, 0x0, 0x0, 0x2c}) 22:53:46 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000000000790c}) 22:53:46 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_reada%ead_blks', 0x3d, 0x600000000000000}}]}) 22:53:46 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6c00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:46 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'changehat ', 0x0, 0x5e, ['+\x00', '-\x00', '/dev/bus/usb/00#/00#\x00', '/dev/bus/usb/00#/00#\x00', '/dev/bus/usb/00#/00#\x00', 'eth1%lo(}\x00', '\x00']}, 0x6b) syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x7ff, 0x202) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) 22:53:46 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) fchmodat(r0, &(0x7f0000000040)='./file0\x00', 0x80) [ 1515.495571] binder_alloc: binder_alloc_mmap_handler: 12190 20001000-20004000 already mapped failed -16 [ 1515.505235] binder: BINDER_SET_CONTEXT_MGR already set [ 1515.511015] binder: 12190:12234 ioctl 40046207 0 returned -16 [ 1515.517016] binder_alloc: 12190: binder_alloc_buf, no vma [ 1515.523011] binder: 12190:12235 transaction failed 29189/-3, size 0-0 line 2970 [ 1515.531274] binder: 12190:12235 BC_FREE_BUFFER u0000000020001000 no match [ 1515.538906] binder: send failed reply for transaction 499 to 12190:12194 22:53:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x6800, 0x0, &(0x7f0000000080)}) 22:53:47 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_reada,ead_blks', 0x3d, 0x600000000000000}}]}) 22:53:47 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x4000000fcfdffff}) 22:53:47 executing program 0: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f0000000080)={r0, 0x4, 0x4, r0}) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) pipe(&(0x7f0000000100)) 22:53:47 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x68000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:47 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x10, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1515.547258] binder: undelivered TRANSACTION_COMPLETE [ 1515.561148] binder: undelivered TRANSACTION_ERROR: 29189 [ 1515.573057] binder: undelivered TRANSACTION_ERROR: 29189 22:53:47 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x90) ioctl$VT_ACTIVATE(r1, 0x5606, 0xfffffffffffffffd) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1515.627391] binder: 12243:12249 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:47 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000020000000}) 22:53:47 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readah,ad_blks', 0x3d, 0x600000000000000}}]}) 22:53:47 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x5000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:47 executing program 0: ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000240)={0x10300}) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000000) 22:53:47 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000040)={0x10300, 0x0, 0x0, 0x0, 0x20}) [ 1516.419906] binder_alloc: binder_alloc_mmap_handler: 12243 20001000-20004000 already mapped failed -16 [ 1516.429583] binder: BINDER_SET_CONTEXT_MGR already set [ 1516.434921] binder: 12243:12284 ioctl 40046207 0 returned -16 [ 1516.441450] binder_alloc: 12243: binder_alloc_buf, no vma [ 1516.447073] binder: 12243:12285 transaction failed 29189/-3, size 0-0 line 2970 [ 1516.455672] binder: 12243:12285 BC_FREE_BUFFER u0000000020001000 no match 22:53:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x6000, 0x0, &(0x7f0000000080)}) 22:53:48 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xffffffffffffffff, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:48 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) write$P9_RCLUNK(r0, &(0x7f0000000040)={0x7, 0x79, 0x1}, 0x7) fcntl$addseals(r0, 0x409, 0x1) 22:53:48 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000068000000}) 22:53:48 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readah"ad_blks', 0x3d, 0x600000000000000}}]}) 22:53:48 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6800, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1516.464492] binder: send failed reply for transaction 502 to 12243:12249 [ 1516.474259] binder: undelivered TRANSACTION_COMPLETE [ 1516.485848] binder: undelivered TRANSACTION_ERROR: 29189 [ 1516.497911] binder: undelivered TRANSACTION_ERROR: 29189 22:53:48 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) signalfd(r0, &(0x7f0000000040)={0x3}, 0x8) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:48 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readah%ad_blks', 0x3d, 0x600000000000000}}]}) [ 1516.556452] binder: 12294:12298 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:48 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x4000000790c0000}) 22:53:48 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfffffff6, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:48 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x1}) syz_kvm_setup_cpu$x86(r0, r0, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000080)="64660f2e81c5000000c4e26da6f28fe9c0959d815e0f482e0f01cf650f3266baa000b000eec4e3495f203466b882000f00d066ba2000edb9700000400f32", 0x3e}], 0x1, 0x74, &(0x7f0000000100), 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000040)={0x1, 0x1, 0x100000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) 22:53:48 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x7ff, 0x0, 0x4000000, 0x5}) [ 1516.785221] vhci_hcd: default hub control req: ff07 v0000 i0000 l0 [ 1517.344599] binder_alloc: binder_alloc_mmap_handler: 12294 20001000-20004000 already mapped failed -16 [ 1517.354332] binder: BINDER_SET_CONTEXT_MGR already set [ 1517.360032] binder: 12294:12335 ioctl 40046207 0 returned -16 [ 1517.366143] binder_alloc: 12294: binder_alloc_buf, no vma [ 1517.372135] binder: 12294:12336 transaction failed 29189/-3, size 0-0 line 2970 [ 1517.380386] binder: 12294:12336 BC_FREE_BUFFER u0000000020001000 no match 22:53:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x7a00000000000000, 0x0, &(0x7f0000000080)}) 22:53:49 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahe"d_blks', 0x3d, 0x600000000000000}}]}) 22:53:49 executing program 0: 22:53:49 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000004000}) 22:53:49 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6b6b6b00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:49 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2000000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1517.388990] binder: send failed reply for transaction 505 to 12294:12298 [ 1517.397344] binder: undelivered TRANSACTION_COMPLETE [ 1517.409115] binder: undelivered TRANSACTION_ERROR: 29189 [ 1517.422353] binder: undelivered TRANSACTION_ERROR: 29189 22:53:49 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x800) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1517.489333] binder: 12343:12347 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:49 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000000000002c}) 22:53:49 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahe%d_blks', 0x3d, 0x600000000000000}}]}) 22:53:49 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x600000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:49 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000040)={0x10300, 0x2, 0x5, 0x5}) 22:53:49 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000080)={0x100000000, 0x4, 0x1, 0x6, 0x80}) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x111102, 0x0) [ 1517.914367] EXT4-fs: 73 callbacks suppressed [ 1517.914376] EXT4-fs (sda1): re-mounted. Opts: [ 1518.271658] binder_alloc: binder_alloc_mmap_handler: 12343 20001000-20004000 already mapped failed -16 [ 1518.281858] binder: BINDER_SET_CONTEXT_MGR already set [ 1518.287188] binder: 12343:12383 ioctl 40046207 0 returned -16 [ 1518.293548] binder_alloc: 12343: binder_alloc_buf, no vma [ 1518.299334] binder: 12343:12384 transaction failed 29189/-3, size 0-0 line 2970 [ 1518.307047] binder: 12343:12384 BC_FREE_BUFFER u0000000020001000 no match [ 1518.315087] binder: send failed reply for transaction 508 to 12343:12347 22:53:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0xffffff7f00000000, 0x0, &(0x7f0000000080)}) 22:53:50 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x3, 0x0, &(0x7f0000000040)=""/60, &(0x7f0000000080)=""/19, &(0x7f00000000c0)=""/87, 0x10f000}) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:50 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahe,d_blks', 0x3d, 0x600000000000000}}]}) 22:53:50 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x9000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:50 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000074}) 22:53:50 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x40000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1518.324905] binder: undelivered TRANSACTION_COMPLETE [ 1518.336412] binder: undelivered TRANSACTION_ERROR: 29189 [ 1518.349225] binder: undelivered TRANSACTION_ERROR: 29189 [ 1518.387464] EXT4-fs (sda1): Unrecognized mount option "inode_readahe" or missing value [ 1518.411204] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1518.423740] binder: 12392:12397 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1518.425950] EXT4-fs (sda1): Unrecognized mount option "t" or missing value 22:53:50 executing program 0: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x5, 0x214001) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1518.469142] EXT4-fs (sda1): Unrecognized mount option "inode_readahe" or missing value [ 1518.489525] EXT4-fs (sda1): Unrecognized mount option "t" or missing value 22:53:50 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x2) write$P9_RSYMLINK(r0, &(0x7f0000000280)={0xe4, 0x11, 0x400000000001, {0x4, 0x4000000000000006, 0x5}}, 0xffffffffffffffe4) r1 = getpgid(0xffffffffffffffff) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x0, 0xffffffffffffffff, 0x70b, 0x3, 0x0, 0x80000001, 0x1, 0x6, 0x100000001, 0x2, 0x6, 0xfffffffffffff800, 0x0, 0x6, 0xffff0000, 0x0, 0xcaf, 0x1, 0xfffffffffffffffa, 0x1f, 0x9, 0x8, 0x5, 0x20, 0x4, 0xfff, 0x7037, 0x9, 0x521, 0x4, 0xf4, 0xfff, 0x5, 0xb812, 0x2, 0x6, 0x0, 0x8, 0x1, @perf_bp={&(0x7f0000000080), 0x8}, 0x8, 0x8, 0xffffffffffffff64, 0x5, 0xffffffffffffffff, 0x7, 0xfff}, r1, 0xf, r0, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VT_WAITACTIVE(r2, 0x5607) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f0000000140)=[@in={0x2, 0x4e20, @broadcast}, @in6={0xa, 0x4e24, 0x7, @mcast1}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xe}}, @in6={0xa, 0x4e21, 0x9, @mcast1, 0x3}, @in6={0xa, 0x4e22, 0x0, @mcast1, 0x6}, @in6={0xa, 0x4e21, 0x1, @mcast2, 0x7f}, @in6={0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, [], 0x15}, 0x100}], 0xac) [ 1518.513625] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:53:50 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahea,_blks', 0x3d, 0x600000000000000}}]}) 22:53:50 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x700, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:50 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000010}) 22:53:50 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0xefcf}) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000040)={0x3, 0x4, 0x200, 0x476, 0x253, 0x0, 0xfffffffffffffffa, 0xfffffffffffffffd, 0x0}, &(0x7f0000000080)=0x20) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000000c0)={r1, @in6={{0xa, 0x4e24, 0x35b7, @mcast1, 0x7fff}}, 0x80000000, 0x9}, 0x90) [ 1518.704161] vhci_hcd: default hub control req: cfef v0000 i0000 l0 [ 1518.720252] vhci_hcd: default hub control req: cfef v0000 i0000 l0 [ 1518.742266] EXT4-fs (sda1): re-mounted. Opts: [ 1518.754718] EXT4-fs (sda1): Unrecognized mount option "" or missing value [ 1518.763514] EXT4-fs (sda1): Unrecognized mount option "inode_readahea" or missing value [ 1519.202871] binder_alloc: binder_alloc_mmap_handler: 12392 20001000-20004000 already mapped failed -16 [ 1519.213139] binder: BINDER_SET_CONTEXT_MGR already set [ 1519.218865] binder: 12392:12435 ioctl 40046207 0 returned -16 [ 1519.224871] binder_alloc: 12392: binder_alloc_buf, no vma [ 1519.230914] binder: 12392:12436 transaction failed 29189/-3, size 0-0 line 2970 [ 1519.239241] binder: 12392:12436 BC_FREE_BUFFER u0000000020001000 no match 22:53:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x5000000, 0x0, &(0x7f0000000080)}) 22:53:51 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={r0, r0, 0x7, 0x1}, 0x10) 22:53:51 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000002c000000}) 22:53:51 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2c00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:51 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahea"_blks', 0x3d, 0x600000000000000}}]}) 22:53:51 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x200000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1519.246595] binder: send failed reply for transaction 511 to 12392:12397 [ 1519.256475] binder: undelivered TRANSACTION_COMPLETE [ 1519.268011] binder: undelivered TRANSACTION_ERROR: 29189 [ 1519.280128] binder: undelivered TRANSACTION_ERROR: 29189 22:53:51 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x808000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1519.343664] binder: 12444:12451 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:51 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x6, 0xfffffffffffffffc, 0x0, 0x0, 0x5}) 22:53:51 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000003f000000}) 22:53:51 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2d00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:51 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead"blks', 0x3d, 0x600000000000000}}]}) 22:53:51 executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x3, 0x101000) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000280)=""/4096) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) ioctl(r1, 0x4, &(0x7f00000000c0)="444e92ac4e2a56b8e4724e4cd42012d4ebda06102a6b1ef7f872f8b9704ee66ea7a249a128b321433280da4386ac4e83f8394e") [ 1520.128840] binder_alloc: binder_alloc_mmap_handler: 12444 20001000-20004000 already mapped failed -16 [ 1520.138827] binder: BINDER_SET_CONTEXT_MGR already set [ 1520.144502] binder: 12444:12485 ioctl 40046207 0 returned -16 [ 1520.150915] binder_alloc: 12444: binder_alloc_buf, no vma [ 1520.156548] binder: 12444:12486 transaction failed 29189/-3, size 0-0 line 2970 [ 1520.165286] binder: 12444:12486 BC_FREE_BUFFER u0000000020001000 no match 22:53:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x6c000000, 0x0, &(0x7f0000000080)}) 22:53:52 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000040)) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:52 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x74, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:52 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000004000000}) 22:53:52 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead,blks', 0x3d, 0x600000000000000}}]}) 22:53:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xffffffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1520.172935] binder: send failed reply for transaction 514 to 12444:12451 [ 1520.182828] binder: undelivered TRANSACTION_COMPLETE 22:53:52 executing program 0: sysfs$3(0x3) syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) [ 1520.246214] binder: 12494:12499 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:52 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_"lks', 0x3d, 0x600000000000000}}]}) 22:53:52 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x3, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:52 executing program 0: ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185500, &(0x7f0000000240)={0x10300}) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x10000, 0x0) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000040)={0x37, 0x32, 0x8, 0xb, 0xa, 0x0, 0x1, 0x127, 0x5}) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f0000000080)) 22:53:52 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x4000000006b6b6b}) 22:53:52 executing program 0: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f0000002540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002580)=0x14, 0x80000) sendmsg$nl_route_sched(r0, &(0x7f0000002640)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000002600)={&(0x7f00000025c0)=@getqdisc={0x3c, 0x26, 0x503, 0x70bd2a, 0x25dfdbfb, {0x0, r1, {0xc, 0xe}, {0xc, 0xf}, {0xe, 0xb}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000010}, 0x40010) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r2, 0xc0185500, &(0x7f0000000040)={0x10300, 0x7, 0x6, 0x0, 0x2}) connect(r0, &(0x7f0000000100)=@ll={0x11, 0x0, r1, 0x1, 0x200}, 0x80) [ 1521.055031] binder_alloc: binder_alloc_mmap_handler: 12494 20001000-20004000 already mapped failed -16 [ 1521.078024] binder: BINDER_SET_CONTEXT_MGR already set [ 1521.083336] binder: 12494:12537 ioctl 40046207 0 returned -16 [ 1521.089323] binder_alloc: 12494: binder_alloc_buf, no vma [ 1521.094890] binder: 12494:12538 transaction failed 29189/-3, size 0-0 line 2970 [ 1521.117916] binder: 12494:12538 BC_FREE_BUFFER u0000000020001000 no match [ 1521.126192] binder: release 12494:12499 transaction 517 out, still active [ 1521.137665] binder: undelivered TRANSACTION_COMPLETE [ 1521.142935] binder: send failed reply for transaction 517, target dead 22:53:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0xfdfdffff, 0x0, &(0x7f0000000080)}) 22:53:53 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) getsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f0000000040)=""/32, &(0x7f0000000080)=0x20) 22:53:53 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2d00000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:53 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_%lks', 0x3d, 0x600000000000000}}]}) 22:53:53 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000007400}) 22:53:53 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfcfdffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1521.180285] binder_release_work: 2 callbacks suppressed [ 1521.180291] binder: undelivered TRANSACTION_ERROR: 29189 22:53:53 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x8000000000d, 0xfffffffffffffffe) setxattr$security_selinux(&(0x7f0000000040)='./file0\x00', &(0x7f00000001c0)='security.selinux\x00', &(0x7f0000000180)="73797374656d5f753a1f00735f696e697472635f657865635f743a6fd64c13226d46f6b57b4ddb231f68e5c5ea1749107330000000000000", 0x38, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:53 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000040)={0x2f7, 0x4, 0x7ff, 0x9, 0x29}) [ 1521.262806] binder: 12546:12553 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:53 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_,lks', 0x3d, 0x600000000000000}}]}) 22:53:53 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x7000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:53 executing program 0: syz_emit_ethernet(0x10f6, &(0x7f0000001380)=ANY=[@ANYBLOB="080f599032feaaaaaaaaaabb86dd65c1af5910c03200ff020000000000000000000000000001fe8000000000000000000000000000aa0420880b002b0001000504b3b39290f6aa5596071c5759ed7ba1a72498126779daf8f26caf25dafc7eb35b05ab61a3c8f9e1b485fc0900080000037124d1e1c19dcbf350884ea05481d528cdbc1a16af4c4d63bb2e2923b1a4609f41ff9ee12b5e757f220a9065410e7e19d4f6fbdc917130c71cd06956ca75c47b2634f7fdd6ea9dee334ca5821e72e9153d92c652ff19651f810f4bb831b88f8474ef4362b941b6657f9ed2431eaf357ffd76c7d2f11224b95075d046c6f896c9c7c5a5e5301ca25022d9f979e9e03bc3683f7b85ae3791b9d924a0ad26a9088023973be614b64cc3d181b96a645e7a8751a9e47ea5c58df76259899e72ec7d0b56b7f5188f4fe167cdd0b71c92477c52387f05e22cc14cbf4e5f396d845b192b5119131725bf773b9bab7a3f2a267e482c00bd65af8a56cefccc6e385cdd67ef2fb96e58ccf1c79f9bd8309d18effa71d6099e5bb91368a87d96c81783a41bb8f106d37325225719277cf273ab7e258501adf29a66c6001b8ab83a1a887d20aafc78f6346e4776aa5f980943b187ea116949545fe39bd5b43743d918d75aff78276a10ff610730f43c051a9af34a8b4ed5b7f65cee29180278a20c1839d3abe7c7635f971ed6ee9c3153b1ec34ab09e80b734d601f00b8437e597686f0a0de972cafde451d75115bb37dd6d08400aee0ace0acc55b8abab2e50ad365823abff0c1ad409dd654779d02c32e9b3bc32648c87812697f8f2e88bdb71b1b90e1dc1f87431e5914cd42f9526b3d4f8babc9b104d19e17274c20b26983f831dbdaab4f81963b1d1612965b19619b38a13a6d01176302b0c25ea13c986a7ac6be92b79d263df8f57a522e6826486e85028e2d638cd75bba8d418ffe41f17c96876717e0cff2d87e5cc5891fba6c8c33aa82a06ee2c2a3d9d7f2e833c61cd4155111859aa3f544bc2b316ec924cfec3dde363a2b15fcae8e253d86e32e9aac83cc344280bf4bae6aeb236529cc3e54e9cd4d739822ba64a83a0c09084d27b8ed80dec33ff1084f9d0a6c9baa7c61f9272f1d0271234abceeeb8f23dc95f8dab51c29f202dd5e8294936bff36e39d9957d9727d22a90263a51d7426babcb1f9ae99b18bf93adb9cccbaf560744eb54de5e35587c14fa3e56e7beec6bce232a701b8ca274f603b6357f14cedcdd9128b79547216926337e2ffee97cb01c077dc238a4a1feca7dcf0f9131ce83fae85e8851c7688d02c761f5fc34b094afb6ec4c0be829410904d231b09ec7afd829d0aa8e8a17b2f068f69141a083fc849e1ead55fab3f061d6d1872d6a4612190a383c3440b7fdd6795bce35704620ce214c95d14e8d596e52865570bbc059d67d2b66475d307b6a6e2a2c8926816d8d44a64d9ea7b3f0dffe8bb7f32f3462390ca4763eaf9d5f8ae387ef9fda376de5c034c0a9179716254be2071262e693cb3eff752dd863af163e58f77d0988699292e29e72c9069da11d31a651ec0813ff38f5de076fd10221810c939fd0da74ca9fabe36f057a2e7e0505c29edd5644cad83113e2d68a86c6cd54dbe0b6ffed2d8ac780eb31462d740a4d5b8536635cec5ef1318e7b193e865b946708941a5a5f6c9a17867f8950f134acf342d06455cb638bd4f6c873398e22e654a682a9fe4807bcee68394f0fcc542ac8026b0645829e51a8b10cdac56691f1ddbd077e0fa8b0a694256fca8a61b608b3636866d8854519accec414c626d40e3f2989bba478ee4693ecc8cb3d7a97f61ff8d1b88d045607d0f5b8be922cfa3c292721b270c4065df9974709478edf2f4aa2a6b6c9bad48412b41cca4865e034d46aeac1297d76072c3872007fa3c12507b9a36c153d87e17f7359f298b95767b557227c8ce66ab7ddebf393d022b67add4a699b823aea222ee53f3c8c6329d3e47b911b1f94587392d681f6b86cbee6ae02a0aa5e2707103518031370cdaa34af22d7a20f280be9dacc972aacdc401860065e9b6f45b44ae84ceefb9e5b2f8b94b22f3c2288e5d39761a93d794d44585579755f878f70cf423589a265333a8419b18f2b124cf0608a5d62fb954335a1831f7b8b78e7f749086b9deccd41c3bc04e823fd069f61811584e8052dcaf915bedde12993de5998c52df47bbba6713937b07cde4d2b22f36ddba9b92068fe8159836d33cb7b0c42824a5f34efc0ea9d64caf8c774faf77a6551317628aafc45a5902b44a796a8dc5e8968ed7addcdedae2e4b00f959e3c57027275ad297451f6ae49b84b5898ae0e68d89431eb3aa961ab781d771427faadb368c4551d84530e6576224e65e93cda17b4a210ce6b5b653b78b1a4cf1099592fe2ea0b48dff50969b3afb91481de9f13a9da94c3de8e3b840e0c355fee197b9fdc71d69a350f22a720874070aba09b66dec200436a210490c69527d0246f1aa737bb7266f7096195014ec17614e31eef5669171f0e79caa1739c5eae5820ecf77e4eede01fec70ed54c79b86a2b4687ee08118350a15dbc3177df61ab8b47f10e7cf4381fd1393ba2b6c250db7ccbb46aa66f2fb26adc4e61017cdc8c11a067e214d9a6a5c99e00cd21d15cba04a4392975f79d0ca92b6f2f4bdfcd95dd4cb91744a66812d3ddd68fe6c8154f61c4bb38d5c987dcd37e468c970c58bbe784883d86d0d1ede2f548b16e5b9255c6825ef7f0c4bb420d299bc1288ba25c55c006137bb9c4ce1bbd700713a047c4d28918fcf0c75a1bf5b4b7b907b7d20c0ffbd5e4ce7dcbf2a8c63e21dc630e4021008cf92a43709377456dbb8d28085f8e5cd04864a49cc31d4022f9b6c77974227c19bd86ec84c0a42fc8f0f22404235b18fe8610137dc20947a308b2991b9f307a5bae63834a0d8d93892e117ef2ae3db2b8211b716ed7b906c72180ff5ee26acd7d8aa0d2277293eaeabaddd90f514bf71917664bb26563fdebc9fc8a54d3c51a0bf5dee22b7a51ce7624ba3860ce4b2a39212ea3b2961267f94058efae172ea27aad92f05cd94c1b9e535e23e33832df9054e1f632766e3cf1b3c0627764fe69ded7627691bc7b47c04188d34699d02be3907e297fa787a2b9b715c0225b38a4497f00f69792bbc9ebbb180d0a2b9a42a04057c36eaf2b5099434dcd416cecf6896f37ed216698b37dbff95da58deafc47093e7c1bc5c45dacdfe073769c2d2fc82a79618b527970f7be0403b88319c56a386e4b7a84214abaf3ec937c121d4c539c2f6c4156a5c18883dc0897fd26ea6812cbdd269affb81581921879acb7f42094511fb800f8021320840df195d41540e941c741a818bd4b0f96f54a5d832afc8fa8e83c99f20e05158fd76fe6e28491f0e4ace42a3150a3b29e72928c14c3083142b1f463e3dea9612fca8b396f2fa0e7a1db002e1287be4515bf0f6003e74a36c411b89d52ac9e03209cee8915665bf3a1191c5b4a8c04f212e59d5b3e095559981b2628d2e6d20582733d5c6be0458b8609dfa0321d61dd304fa67928e17524003009cb046be174dc0b8bb37c0049f437ddf9be28ef502ec55b92cfdc5c234333d44e3fa71ff9881b5e4bc88b0c22b26b0fb8576048d903b2abbe9f8c1df3212209fb6efa1cd3e364e6da48b90db3d392663c709de06d63a2b9aa7807f9984c8548edd2d5411afbc9e80d721411edd2d7d5d697f5c7d1ae4d239b28957681a10ca316aa45e19506b7be9b6690514e3305742eba71cdba8eb5318120d04ecce423b2a199bd6aab003a607eacf606dcba51c9d94da418fd329c2e25105b572cfea08276772c8b4e668a8d8570a3a3115c3ad5dc836e29c0a0cf2a83b3d875673a840d5aa14880cc372ae534fa94a2129f5e8e724255770ef5a80666758f3b80aa6d8c3c460e6f1f15ad92c70b7792c04c9686c1b6464c2c230dbf522583a7f3ea62514da145db991744958dedf8809592443a7bd0eb60fba4a028587762ddac730a3e6e6772b0e21c518ffd1b8c729752591f3b51f7ad8a83ecb29c5833b554bd120e81f244fb8d3d44163036a537c1b2b5f6c4305c4648c90fcda0809be97c263123406ac94072c59ad0afbd35d1ca2dd078e46d40077a28e2c046989d8ab950fed2aac9ba29d34c10cdbb3de8d47f6145336aa281bf7ddb84385214710b47c60c290b716651640cd9916872a37653bca798bf10692a9063f661fd6c5338351240e7b9f6c4cecd834f41cd0fc89b8da87d35f1be95173a3d56e5606e59c452fa31299ea054dd35540b6715c6797675c76e7f34c9a8bb0d12364a715010ddfeb3fdaf932d00c2511e35e34cad539d0d5d827d8766742cad9eae17fb8d85ea4c23c7bd33d7518dbade27dd74c467a859227cd9de9074e49e126bf7f9160cf1a6a78262da4fcde922569f786618688da98c8b0bccaae1a52a5298d6e60c92c87af596f4267b5045de64275b963b8cce9be725f97ab0a39244356149702bdb2902fc37cbd7de7a23fadf0fbd190fa6415e4bc73b5338aa178d8605cb45b337711104aa23163fe3acbb47c381ba76266ede1f9bd2c1014937ffa12074b9fde93527505fbe32f4f20e31581291c89dbd917b3a866f923bb48f4d72b4d062ad5e858fa15b1ecfbf19402764add5825665367ea4b40a7732c9521fd1723087612da6752649e4e65154e71197afbbbb24f3323a2999ca230156c1731048b9a71522bac7815add1ecff74053d873e312903fa8899aa239ff895e607362d48e43040fe842c6aea92fed0f93fa3bb5230360b8dd4e4d2e5429209bea0c2005e19df9c05c780bedd8ad02867abc6ef816c4ee8d386acf3002d511dc4bea7e8c8fc2f9092931a6159450fd6185bea5c55e650cae728b6c0b632ddf8c04a7d791ac155cb4fafe605a492d98343744d19c35f1eaeaf923d6fb7e6362863c75bb157412465fa2951f42ec3d8a41cbfd8a81d031ffdfb352f7c9342b830c6c371428693a561876f27a1d21394c5597cb6e40600e4b71ddf6c4e4c5b1516e972bbb9cffea0361bd0c8acdcf8bdd842d5ee962eab32ad771531cbef9055f8bf54b17f9ad281e6d28447b1153b0f7c02454b25205c96fb0a05334c75c8bb3d7218dbabde4517c5482a2bac430ea545693c48ec9ea54cc7a85afb145e372d8980ca630863673244ea7813becb18139f2ed084213529ef186cdb9fa79653f113f24196a86f3a45ad8d95c227c63ea36af972a125c01442aa1624bae8fe424d5d20fa82a9dbe7471fe5510000ee5b2ebb8ae6b475007b48dda5e87897c26f41f4d5e99dda8824294b355febacb21e9b3b864909d06bbaf9f04fb89bb08bd9ce12c96016ed401fc0d28e2bf9ab3a112a5a6f74b36d13168e09776c2c9a56069e363e31dd129961345cc92d290f7fb05a4fe29deef4d577600624fdc986d8ed0d50583ce8f6e2cd8ac500ed1a2daf01000000d4d6da9b23ae5afd862daeaa38f75771d970982c4a327f53041be43970ba4f40e862b80404ac6a2c33766c54b73a3a6767536bf414b7262efabe9a63c44d7bfa99455ec315b766678d11af61fc2d80b65fd510bba67b1ac4e4f04c798253661930c9d4d9983e3f352640e6b9bfd489712f9fe90af155412f438fa57afc13469dc4b5d5da12f2d4f4c924861f8164ed5c4ce7138fdf174da526a655229398a99f9bd91f47d60dfcd2e252ebd9043c60fa2e32d2cd9b4b8b846919f5f69bb0e66eb3bc6cd490eaa8fa44ecafde1709eaa5ededce2f68e2deb95d72d12d3089e2ab8b4aa172b810e4ee069de1f6b6d9bd163d4f4635fadd5b2f75f1f849b092291031e505f901cb85fb2f69ae70674fa6394e165d6d418536ca2427ffc23ffe50d428be769911024f5fc05268404e87a4c1fba231b6a53ac751f5df5265118f7c0f56fd811627c22e3ce7f75ac5bab12a60c6ad2ab8bc040086dd85f5080088be000000011b019f090100000000000005080022eb0000000021719603020000000000000100401908080065580000000266d3c59b044643dab34fff91f15f07200eba002eea2c13cb257dd118c35b8a261f2525bad359b1f4dba4c09ac2be1aedbc2a73fb4bfca2f6bf7e0660753c81b13a58d8ce6dcc7c88cf"], &(0x7f0000000040)={0x1, 0x1, [0x96e, 0x77b, 0x31b, 0xcfde]}) r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000080)) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0xfffffffffffffffe}) 22:53:53 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x1000000000000}) [ 1522.044510] binder_alloc: binder_alloc_mmap_handler: 12546 20001000-20004000 already mapped failed -16 [ 1522.054249] binder: BINDER_SET_CONTEXT_MGR already set [ 1522.060470] binder: 12546:12589 ioctl 40046207 0 returned -16 [ 1522.066469] binder_alloc: 12546: binder_alloc_buf, no vma [ 1522.072551] binder: 12546:12590 transaction failed 29189/-3, size 0-0 line 2970 [ 1522.081841] binder: 12546:12590 BC_FREE_BUFFER u0000000020001000 no match 22:53:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x7a, 0x0, &(0x7f0000000080)}) 22:53:53 executing program 0: setxattr$security_evm(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.evm\x00', &(0x7f00000000c0)=@sha1={0x1, "df6572855de43c5174a53fe4cc144b8a979595c5"}, 0x15, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:53 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_b+ks', 0x3d, 0x600000000000000}}]}) 22:53:53 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x3f00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:53 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x600000000000000}) 22:53:53 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6800, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1522.090499] binder: send failed reply for transaction 520 to 12546:12553 [ 1522.100349] binder: undelivered TRANSACTION_COMPLETE [ 1522.111839] binder: undelivered TRANSACTION_ERROR: 29189 [ 1522.123972] binder: undelivered TRANSACTION_ERROR: 29189 22:53:54 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x100000000, 0x0, 0x0, 0x2}) [ 1522.174596] binder: 12596:12602 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:54 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_b,ks', 0x3d, 0x600000000000000}}]}) 22:53:54 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0xffffffff00000000}) 22:53:54 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6c, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:54 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x102fe, 0x0, 0x0, 0x0, 0xfffffffffffffffd}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0xb843, 0x1}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000000c0)={r1, 0x3ff}, 0x8) [ 1522.352992] vhci_hcd: default hub control req: fe02 v0001 i0000 l0 [ 1522.368376] vhci_hcd: default hub control req: fe02 v0001 i0000 l0 22:53:54 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x3, 0x1) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000140)={0x10001, 0x0, 0x41, 0x0, 0xfffffffffffffffd}) ioctl$KVM_ASSIGN_DEV_IRQ(r0, 0x4040ae70, &(0x7f00000000c0)={0x0, 0x6, 0xffffffff, 0x204}) bind$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, {0x1, 0x658, 0x7649, 0x8b, 0x724, 0xf434}, 0x3}, 0xa) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000100)={0x0, 0x0, 0x10, 0xaa, 0x5d0c}, &(0x7f0000000180)=0x18) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000001c0)={r1, 0xcb, 0xffffffff}, &(0x7f0000000200)=0x10) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000280), 0x4) [ 1522.963902] binder_alloc: binder_alloc_mmap_handler: 12596 20001000-20004000 already mapped failed -16 [ 1522.973582] binder: BINDER_SET_CONTEXT_MGR already set [ 1522.979643] binder: 12596:12640 ioctl 40046207 0 returned -16 [ 1522.985635] binder_alloc: 12596: binder_alloc_buf, no vma [ 1522.991616] binder: 12596:12641 transaction failed 29189/-3, size 0-0 line 2970 [ 1523.000255] binder: 12596:12641 BC_FREE_BUFFER u0000000020001000 no match 22:53:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x6800000000000000, 0x0, &(0x7f0000000080)}) 22:53:54 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000080)={0x1, 0x4, 0x3c3, 0x6, 0x8}) socket$inet_udp(0x2, 0x2, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x802, 0x0) 22:53:54 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4c00000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:54 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000022}) 22:53:54 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_b0ks', 0x3d, 0x600000000000000}}]}) 22:53:54 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1523.007670] binder: send failed reply for transaction 523 to 12596:12602 [ 1523.017359] binder: undelivered TRANSACTION_COMPLETE [ 1523.028883] binder: undelivered TRANSACTION_ERROR: 29189 [ 1523.040899] binder: undelivered TRANSACTION_ERROR: 29189 22:53:54 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x5c, @broadcast, 0x4e20, 0x3, 'dh\x00', 0x26, 0x1ff, 0x61}, 0x2c) [ 1523.084704] EXT4-fs: 61 callbacks suppressed [ 1523.084714] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1523.105767] EXT4-fs (sda1): Unrecognized mount option "inode_readahead_b0ks=0x0600000000000000" or missing value [ 1523.119393] binder: 12650:12653 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:55 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x9}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000100)={r1, 0x11, "153d0f53aa91b55843e9aae774e7a48a2d"}, &(0x7f0000000140)=0x19) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000080)={0xd, 0x10, 0x8000000000000}) 22:53:55 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x7a00000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1523.139921] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1523.148463] EXT4-fs (sda1): Unrecognized mount option """ or missing value [ 1523.169516] EXT4-fs (sda1): Unrecognized mount option "inode_readahead_b0ks=0x0600000000000000" or missing value [ 1523.183912] EXT4-fs (sda1): re-mounted. Opts: 22:53:55 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_b"ks', 0x3d, 0x600000000000000}}]}) 22:53:55 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) sendmsg$netlink(r0, &(0x7f0000000180)={&(0x7f0000000040)=@proc={0x10, 0x0, 0x25dfdbfe, 0x4100000}, 0xc, &(0x7f0000000140)=[{&(0x7f0000000080)={0x88, 0x3f, 0x110, 0x70bd26, 0x25dfdbfc, "", [@generic="2d2c7a32648412758188e58f1e0786d1128fb4cdc946e0ce27ca66adc3bf63809ffa316eb68de285234c38b00f0a6e48ed0f3b42ed0e190899c0bc45400fcd04ad566405030ecb1618d311f1a90bf0109fa6f2c386dd43c78decba43b9bd62d05aaaec0dea7d12a49cadbab5ed", @typed={0x8, 0x74, @fd=r0}]}, 0x88}], 0x1, 0x0, 0x0, 0x40}, 0x4041) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) accept$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f00000002c0)={@ipv4, r1}, 0x14) [ 1523.201019] EXT4-fs (sda1): Unrecognized mount option """ or missing value [ 1523.203903] vhci_hcd: invalid port number 16 [ 1523.228111] vhci_hcd: default hub control req: 0d00 v0000 i0010 l0 22:53:55 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x40000000000004c}) [ 1523.283520] EXT4-fs (sda1): re-mounted. Opts: [ 1523.305414] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1523.334925] EXT4-fs (sda1): Unrecognized mount option "inode_readahead_b"ks=0x0600000000000000" or missing value [ 1523.878548] binder_alloc: binder_alloc_mmap_handler: 12650 20001000-20004000 already mapped failed -16 [ 1523.888182] binder: BINDER_SET_CONTEXT_MGR already set [ 1523.894003] binder: 12650:12693 ioctl 40046207 0 returned -16 [ 1523.900099] binder_alloc: 12650: binder_alloc_buf, no vma [ 1523.905726] binder: 12650:12694 transaction failed 29189/-3, size 0-0 line 2970 [ 1523.913735] binder: 12650:12694 BC_FREE_BUFFER u0000000020001000 no match [ 1523.921129] binder: release 12650:12653 transaction 526 out, still active 22:53:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x300, 0x0, &(0x7f0000000080)}) 22:53:55 executing program 0: r0 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x7, 0x10c01) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000100), &(0x7f0000000140)=0x14) setsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f00000001c0)=0x1, 0x4) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000180)={r1, 0x0, 0x1, 0x8001, 0x5}) setsockopt$inet_buf(r0, 0x0, 0x2e, &(0x7f0000000040)="42682adc3b5ae822f2ae4f2aaf4fd75329f22284414923e9e98c513ab697894f74501f78cd8be3d772884c15f507b9f1928145749329a09516785a0957893eed1c7f190feebfc5a07d3bf1777932f7617460a1ba7fab4d", 0xffffffffffffff8b) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:55 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:55 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x400000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:55 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_b#ks', 0x3d, 0x600000000000000}}]}) 22:53:55 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000300}) [ 1523.930829] binder: undelivered TRANSACTION_COMPLETE [ 1523.942372] binder: send failed reply for transaction 526, target dead [ 1523.955370] binder: undelivered TRANSACTION_ERROR: 29189 22:53:55 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x3200000000000000}) [ 1524.009606] binder: 12700:12704 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:55 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x19}}}, 0x1ef, 0x62}, &(0x7f0000000100)=0x90) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000280)={{{@in6, @in=@local}}, {{@in=@multicast1}, 0x0, @in6=@mcast1}}, &(0x7f0000000200)=0xe8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000380)=ANY=[@ANYRES32=r1, @ANYBLOB="27000000f75063f73a2c048bfa027a387bc8078b85b1934ba2939e5b3f5864bbc6e9e0e2216d6576422d1a13d4d756642a99856ff11b608a053f8ec8dc2c21f146fcfed7b6bb4b44210be84fa55e0a892f6750d74239ec873b7cd4c24f10302a84f7978a7e195336783c962c1197d38784fc6f6aa42332f43ac17aac33ee1ae008a5b634276e644026202989b77947b2d5d6334402bb9d8c516c23246e8ab753457424e7e56079290d66ebe559301941eeaaaa234d64aaffdb5be58c0a751becec2b77c9e82c3f4fd13505840000a1dcb5fa736970dc00bf7615753416f7d8464dc79e42277e1870cc19e7834a44421363a54d7fac46bd6b085774a495cf88ea2960062b0a8ad521cb9705773d"], &(0x7f0000000180)=0x2f) openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vsock\x00', 0x80, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:55 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_b-ks', 0x3d, 0x600000000000000}}]}) 22:53:55 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x40000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:55 executing program 0: r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) accept4$inet(r0, &(0x7f0000001300)={0x2, 0x0, @remote}, &(0x7f0000001340)=0x10, 0x80000) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:56 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfffffff6, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1524.793251] binder_alloc: binder_alloc_mmap_handler: 12700 20001000-20004000 already mapped failed -16 [ 1524.807359] binder: BINDER_SET_CONTEXT_MGR already set [ 1524.813302] binder: 12700:12749 ioctl 40046207 0 returned -16 [ 1524.819405] binder_alloc: 12700: binder_alloc_buf, no vma [ 1524.825050] binder: 12700:12750 transaction failed 29189/-3, size 0-0 line 2970 [ 1524.832831] binder: 12700:12750 BC_FREE_BUFFER u0000000020001000 no match 22:53:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x2, 0x0, &(0x7f0000000080)}) 22:53:56 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6, 0x1) fcntl$setflags(r0, 0x2, 0xfffffffffffffffb) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:56 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x100000000000000}) 22:53:56 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_b.ks', 0x3d, 0x600000000000000}}]}) 22:53:56 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4800, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:56 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1f00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1524.840585] binder: release 12700:12704 transaction 529 out, still active [ 1524.850275] binder: undelivered TRANSACTION_COMPLETE [ 1524.861834] binder: send failed reply for transaction 529, target dead [ 1524.874747] binder: undelivered TRANSACTION_ERROR: 29189 22:53:56 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8b7, 0x82) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f00000001c0)=0xff) setsockopt$inet6_group_source_req(r0, 0x29, 0x9809e950c41a1be7, &(0x7f0000000080)={0x8, {{0xa, 0x4e24, 0x20}}, {{0xa, 0x4e23, 0x1f, @mcast2, 0x81}}}, 0x108) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000200), 0x10) ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f00000022c0)="69e49289c7da30e5b6c4984a4306d3fa2419be9b40a2849ec2806e40c4ee3ac6ce1212c35fdf056fcd0c921cf3c42368952ecc0bbfd6edf2aa48fd8e88dd7709431d8430d3bf06f5dbf8f9973ad63a6a3cf62f5c8ff891dffdd0d9653913b5086380f5bc17035a0829762425c6b6c9dcb488de7f26fcc048991ff8840157ab7380e2629bdf3f17a72ab0e03d6da8771412f38bdc8c0fe86e9f066977037d478ee511d2378d33bfc390c06cf5678e9cef497b6119461d9d5e95c34e60759d9b31e828ac3b1ff7bc9099f6cc539baa6d98607fc5e79251b88a0cd632e379e4f085ccc78361c405b175e511c2137f6a5492429be894bff114fc7d2cd096e2f66d0407f2344b1c8ed1115d55e182ace7c263542af928c1387180982d6740f94517343fd04452d9d6a13a65ecab391819e5d63a82688a1b419ca4aec2a6a80b0e3ddefbda25aeacd6bbcf07b14a406b7b0c8c9f9c3e025a281b6236d7e83bb8f2dddd348c207f11bd507f800c4d1a77d6bf58b5acbbb37bf20e51fcfdad63253ea5f5f937e50b650d3234088ec962f41dd1da91996ff75c6b91c1e5ca73c969520deefdcd406cefb653eba1194a81a3e8e93693469e87cf3d0f73cf068ae600e0eae6f866b36dffac014a70749c5f90b42877eac685e4637c7620c32af32035573495c5af319ebfe8bb627191cf42d4511d40bbf21c001b90579aff00c702f47155a98f11ca82b10f7248debb4663bb860e6d931baa61c3f9b629991c3cd974cfa78adee7ba44844f65603057acb9ad640b1364ec4630c17c5acf5a7b721b02905eb5932007c5eba26787f4292330bab1768f16382894ad811ab44f7243bf2799b27570322506dd8a0ed226ce212b428bed02f6f2286021965b1200ee4c1109b29d8e6ac76f1b928062dc5e8f1aa12749a73b24c643a4e152ffdd7c061c51406b2615f816c943b763606cb9df62ad9fa4bc4ae52d2ad064809551bb7b7e849559f04cb78903b58b2a4538eaf42b509dc9bd9f6ed6e6da6abff49a6a68f89eb63b28a95a4d6164237a24a1d1a46861c8ad6b4689508bbeada7565b68da09d3c01bdf03528e29aa33da54e85a6bf52f9190609e25f02a10a04f6e070c2c1cbb0056b8f6964057c9597f8950206570d784e268080aa4ce4c953dda7136633b259e9dead7dae84d0a3672f23fe11c8ff2865623a1507cb5c6b7009fe5b3c4c0052628b67e824b8345227e93780a30f5f0a6eafc06a06a5ae73e4e0ba6ff8e0f1b7159c02dd23b450137c2d0c0feac28652aee88d711d3528b5d2f24109f043725af6427a2164974ef7b9d22078ec74688cc4cf7c6b13718246cd2c59744a21a1aa07d81f1d706ac3b8db400165e0896f65b54b2a6f8723c7ea89a7c42369857508f43bfb7d654e24be79cf3fd2833cbecbb8816ba42ca44bed0b43c096b456dd1b3d69c6913cabc7a740192f874b35cadbbaa52734af016f8e8424e23eee551f50f7c765904d95e29bda199de7ba98cad7029cea3bd1b24ba46cfa04d7b1386a62fb8782db73b428e34519f4b0306a50f77bbdea5c9f7e8699b8d0df140a91f8463db00b2b21bfe67d629487da1f9277b8b3495499a2dad473fd9a72d94460a6ac04e75dbed5aaedf37a3ae3cfeab47bd807d6d2419196b067e91922b3c71c82bf589a31cf718993d2dc5b6193ac234f2d726f43edb3fdd217095517179d2876e227fc268f8d73df5af7aa4ec6666ce5da68e7f77e3ff66cdd2e9c70004ab199fa8f8e21c6d688ecfff0a76dad150397f99377ee37d19f9c49ee679700345840b58e29d0ed00c0dfb223021f5e8cef30d756f2182963d9a21fa0a524d74f237f106acf609fd4da5a1232e7b39181a36efbfcd1be52febb3c8e9b23c0447744743e898d229f01e8048356a7172f1e3744f549aff017d42faf0358bac08260cd9662b57be3133f3a11c44f076685c35d8b114c47926a2dd2c9eb7443055aabdb528d2442b2c89f2f706c7c929c792051e8e4c2856807fbca7431c1115e59f39d1e55b6a55480d6724a17970d07448cc644e81192af498adde503dccaa6addfac75b1a8ea5778a5f84009f040d5ba26fc22d581f8662d253be7c43bb20a47a75813fb766bb52b229019e90a3a9c6ac2d10448e31cff3f0bff3ebfe241a15de0976e9e4c1da952df1097461c0ee083849ce515850a84f46e93079cee8c7659703e8938bf661f988427927d6fa20b0560ae89245b852ef7c3acc4d3b9f70b1d1706ac5327e84f23912369b65ddaf6437126102cbff5315f335dd50fc7273ddb75fb42726f10413cb3abd6ef1c78420bb82b995107dcb082149ec895f9213654dae2be82d8a1d7eff0107e9405123acfe366a2552a1e7e847aead3dd66816a4da19ac4d47c4550ebcc14adb94bb5d18ec454949a13a101f3ff6d0c02f8761101d6850c82982ccdd109714b579864a4b6405755390b0d73fa437a6c4d94731a2a2acd9827ccefa73bd8032f520f2f71e50c23301bd248bd46b1e30802f23cee638755806ce324dc70c8afd21b0b53d54d813fb4e0fd800b5d40b13790ab33267dabfb7f1d11bb8a12684dedff373d42dcc65608f210a6e44f9ef104c109efb255b70aa918b28d5c0570b09cb57b27941010aef04fdb162010c32d6d482df4eb2aabc1eb9e5680d24210130ff811e675cabaa6d299747739a51665cb7794315f813f374c0420787c856c7eb0fb7dacb2c7f839debb548704d69b3c9f09b7c556a20457953be24cad707c8f6e2a748da07874e6901e846c6d251b6b17f6641c38325c5ac74a1606b4412e11314b0a5efbe46f619648da3a86fba3c36cbf9aadbf509192e4898bbdc61329b3e6e8d030ec4a8c03b26aad34e793064c44f0635d8975822a88e6c136c993b8fbfa9f1009717b39dc3da1ff927e674ebda3bee5a201b4ea06e16dcb5508a15590bb37e180fd4d79ded1010577d8af5e500229a14174ea34da517f6dc5c216efb8da1efba65a8536cb438c25a1cc5804bf608ef72c8574a78f4d4c6d7468ff315a7389570e786fc790e770a8db7540d517affe74984ff5f943ef820f841fcddcb8d33b299f46b03fc86ba7895f60402221527ae278c9d9cea49cf693a3aa960a04e2fcd4be08c7d81484552113abe0ce419f3541b2592663c758ff2ec59920d0e25a347eb617f06de5bbcf26c698d8eff6b72a7c30a3c6c72df46efaa22a870c226761c1c56da2b743f80e97fa4240fdfd814d6a3a7e8de540e82ea00e10a3b7a40580b644ec4dca16b49c87c32ac900c4fee315210b57f0465ed5decd6387d89a054c239a68520c4f3fec7b3f5f4c2bc1de5faafbbb180b0206adf0bcb3b0b27da211592336810d64f633c82b1c83f9e7bbdc4bea19d1dab72826b1022284f7e6da7be2dc7a06a46c603acc68d1a9b078fb2ebc7d8c246b46adf92c22fded8ec316e72bb775065c02460028f3c3aecee179ed1aebf50dcae8d11e24d554e0f0cee6dd928698ea88cee4680cb3b46dc3674d00f1bfe8b489b3b2dad60365bbf3de49a12bc78d13dd3660cd76686abf869c69ee75de475727b9f9dc37a35bf547a0e224d73f089c00a5d958e60f88c5b3ab2c2f271877720a5c7fda5b356aced06c2805cb0ab2f374756f6c8b1d333c0edfaa79acfe7738a88160daa33c0458da320ff94201057ab9969f291065b9174b4559aff9e2eaf9f4f0d8bbaa415278f002aabe809746472bcd6cb3d2d85fba0cf76e157ed298c8ab865bb76a91bec57ff486cbd5bd6543ae186927b92f797132ab95c02de481640d95da2b9fd50a273a7ba0dcafa9baf6033c47b36104d24c3d90fcc838a0a1b9e0ad81a3d5fb0ab35798f0658365612bd90e6506bff13d69a0614dddfa27fb4069c60b51ec75b2f5c846e0a40f7a2fa04561245bb65b443ad3a3ccbe496bbd7657bcb860419636476859c7938dbc9e771f8351733ba7e38e26aa1bd4ada108c730ad9c7cfc909592caa69800dd3fe04f968ea1a0fdf72639106f9179c8243116cacd748e22243e041e5904292fc4eee52e645087913c14f44f816c7c39e5d7dca8bdf589db3aecb539b2a72b756785a23decff60b5fc925066815004f90f152b9803ec1cb1f38c175e0288145a5b2062df6022d37a855acf9a7ee79bfce105559a0cee37e52ca7520b37f7b96a86368da34d72456aef1125e918db5bd86ac1c5f809da387014b584c9efb245fb6f21af1ed6d149cee27f049b13654c5fad474be301352618e27625408add30aa742eafacda00d7babe1f736eb365ad119b9e8ae6f35a408eb448d2fdfa8ae865be7209889dcce1541534f528d246e27f72ca596ff09186589088d44d0d77be5b468b91862505a930b10e68fa17b799b0b5e46a03496987a453b31a075a10bd3145380e5d2b9aeaf69cd3c4a0884779f7671c069f1830882aed316c9531b643bb3281e8728206eb996400a05065d1ce43ece98ffebdc75a9610bb62bc8e972b1fabf28990f7606729e52f9ae7087c2502d193d8e4303ac61f8ede34f19a78299d025bceec2935fe9d9e43f29764d7e19c45802b7e7c092c86bd58113883c75be31ea1ed8364bdbd10cfceb27c37f521288427dd356a9e4beb8db7fef911ef3af9b4f0f5544c28fe558253a8d0d65b0b152bd82c3576f590acc4e559ff1f801556dc8191c73eb6cb4561007673eab2b399176862b70a4192ec6ec89c9e2947da47e09ea367c4f7517785fa29459aeb71d65686f5578176f21ef3a6c6afeabbb703e06639db37a52fd2f89e86bdd4086a28fecb8fbb159bec712cd43c1e781bc53685ee3b99e09b7c201e7b5806a10663e4b409b2861eff038c2ef6cb46f866bf0e243c701e905ec541bc59cbd25df86f4f40c2bd570575829b67f94df3fb219be9f1b6b23d34c7dc0224832dc66e16b20f74df047ce1b301398a537db53e804d5921f7be187decbf19290dcea28898b05b083a39e17f717fa0ace72cc5045c5f8c58e7074d684e08c1364d427dd0addc1c0f1a8af242841e1afcd46ee0c89fb5915bb98b79b7cc508fbdeace72ca6b6870189289aba17726e00af5da562630be22bac68739985410855b6353aff37597779f2c81a49cfb0033fdbb4ab422cb95e5f50623df585931b03e77058a0597dd52926b4d3d358823e42bcb9c7148cc7e189b08442d7806fff1b6220d1e655a9b3800df4e2c3b76e40cb8f2b8658e6f61aa70458fe79bc83fc48a97f0e2fe822764e29e3fb98827f328f4d66115f30b39b4774f1fe8f1f07c1f6f2c99d63b751903060855da7dccf2c93381185f8cb1c1f4815d518683cd4c654a2ab3e3970cd43a32a1e66befc882dfc48bca4d39a3a86c5d91cb2141e6ab64d037ce2531296f311021db47883e5d97af7b4eece5fa4aee77ce06a4284111bc5eff6bc3c8ba3c0b1187380772d4531dd7df13524a164e7721f625ee695e87f6becd72125b4769325a97fbf1c7d43f9e3d4a5c658f3e7f5c688470cdcd8b408287a69c210f2de0c1be213baac4f905f6a59866251a1aeea9d434328be3f0dd84e4923f87340c5585810dcf5e7f1ae35eca52b036563fa27bd6a43713138cee69f6e23843510035b83175ad115e8de7236b5137ebaeb58607cb2c69675ea80afbb78b94352e5d342870070a3574de61a8f3ab4b11e1f0bbaee131923665e9fd01349b97c965f0a685fe43d3608597497b6c1571ac4a460af866a2b086baa51a4f29906e1845a8e2f92f1af8d0a6d472135e1e2bc956cd0350e7d25f000f6430721add41bcf3a809bfcd7c4ae857397a9c1fdcb") r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x47f, 0x40001) fsync(r0) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f00000032c0)=""/30) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f0000003640)=0x8) write$UHID_INPUT(r1, &(0x7f0000000280)={0x8, "1020f60143d30f62ed6aeb116e68cae88a400ce4f911800fd862dea0f6620e9da26e74674ae37ec9cb83eab7eb59b6f4e0e5e26b3bda7fde347571bd56914bc553dc28b24dc45585fc9cc99bf4045cb1dab51373c552b706455b3f5371669351c4094cf213e094accfacfaac0ea194e7b5fd5aa1764ad304b83c345a4176de00ab8a96fe847411368733d039fa066a87034b7d794bd54857d6c454c3a54dd1378efae511ca593b1c9b16b886580f9bb09fd44ef85a840d5231dab1724abcc049aae3b7824cccb8e208851c654d0107564f605ebb3600369484a1428832c90c408bc44e3e44059fa5fdefbc5d07e95b6d27fcf3e2622eadfa2ca7119ab7083302ec82c886837881980b30c8c64333ef53a8a7f47d863f427906109ce04c2fe2761c785aeced9fc7b53747c71ec6168b97541bb5263d2016c2cc86217609577dda636a9d35b1b0fe66c394ef9acbbd7c301e84f569a1f76e78d36146c97750eae9bc4fd0ff60f0c981ef729a8e25a76b1852c5aa28a70e54fd1dabacb9232416c9feadd6a0ef3de8152b3654a4265b5e614af0ccaa622ac290e2cdf13b42527b0e1dd3d367a3abdc73616099768e3d534974cfc0a89f0c50f623e726b7f71b77ccb40322a07bfa450e5a87902d8843dcc42f151d8900e4f9ac5addc55ce6f52312676335f1d673c32611f1f7a6d88860dd7291cdac8b7323902a03d6b7f100486dafefdf3fb4b57fe75ec01bb4ba7cd47c155b0bc73cea488baad65f120476611801ffb35b2dabd2c85c043e265ec4de7aa36976648dbbe5fc25502ca592e4972980ad4f7d84600a85e8df03add649f4ef72be6a1e1fbe3c15dc535ee6f3f2538c501585383cb0595ce2be72b4314138742ac834ca10e100a2e3cd1291f033440e86c62df50c25d81f8107639813d918f7aee118117b6e1c1c8b9cf4ab367120b23e73a31a6eb8b0be2cac69e53f9f0455c4304798ba5ab221cfa0b30bdc218f1852c0c2d48833b91fa21e9435598b022cc90ea599ea4ffefd4a8fe1d2a46743884ec514a1fe111b81e02a17c063507c265de4dd80c61eca99eb66b49df4a9c0eed757a39805c68fbfa6e3892ec68db0e842fee739c4c108b0c10f3265707ac57e60cddd5893f4cd5110c73bad130bccb1785fbbea5c634056699f8d70ef6b056a3ff1a8ba692c61e2ece1ad338fed51bf26748fb2ab325a372cfa7abab6094be1723b45ed97a0564845a51aa21ae345fb3444920c787f2a5f6c7e9ebee314b754ec85b52269d89637e9aaecd9a77cca982a3ced6a1523e8a4a6a27e6df090b47c624c17c9c179d5dfb07b37bf68b2a23f3633dc4411dd30831f7276e1352989c0a5942fa78983dba1946a2ed9b2483ae1ddfde969e2dc31d6cb4fd7b859705401daa0af94d6d2652a349f34082e02c98e781b7077ccc0a1fe4fd1655912de5f99f9304c802ca2912cfa84dc42da47f335be98ff43a555bcb3a7cd9b81493d5964ec659e633409d06237523dbba94d3ff4937d56dd3d8ca1272ed62422a2361e3315ad50915e208a5148604566f94f4977fc0c9d332d8dbd8ce6c2989f34d85b01af05b343672a19b8f747ae34378a86613c7e0381d8e02b011ea4b71e187cfb46fbe8a0c0b84b478664aaa5fd83c28f5bbe63e942dd4fd4bb8716507fbd3fa64b457ab972ca20a8d183a95054b6e580263acc6a3688fe8fb1330f622bb1bc3ff354bb6c19f56b3912429226a7226e9eb389da5e40888a26bf6fa6fb1f0cf757c0a80af2f68fbafcb3de2ee8eb91726803e3f2b12a03f2eef0c6284a6a7a4eb407011c36df2f7c7fcdabb9b7a5f8163324c941c906dadec461ccae90b9646a5f45f6806d88775f755fd13c02f40c4c6a237391fe89b232071bf21924e123ecd58dbaa81f54ee580e8251459687731f5d7b18f22e17af29b975b7fcfe3910b93e21cf9fa5a2fabd4d636f6ff15e2ce4c09dff963f78056fdadac82aad1faefd09e62e19d69676a5313cc95a52ca2ae52d74a6b6d3fc23f8a1b025f11b9469892cce4c661d536f3f32c09d354adf6c0ffeccbfd52c65a42558d4cbfd63065d01c6f36280ba01d6df46d4564eb27c0ef7b77437e6c8e5981fcba691e0510abbdac38b383efcc8181fc10f695c80a29cd78f82fd96750819775fa2565c9bd87b45eeca4ffabc73a3d8d29f6cfde7b31d1c8dea3bdd6148bc5f009f40219aedcf81d7d9b8f9e8538ab68058cbfb8743019e4b3d43dfe95065a93540afa9f45b65614e44c32226d45b175c3bba262152e3ec7b4da92b1feb158f575d54b79ea965d3b857ab65725ab94155b3fa943fd98003effcbacfe34af8b771f4310af03a9b8649ac029efa7382d6d2122c05e6566cedf29c6384f7132317cd5f12ed7cf50148194221f648311dad4aea116a5714e4b30028daea994be02ccb188335d47eb7c811add17319948fbddd4f1c7a319b91e4620271650192e202e165790e6dcaf80a3db35cd8a68030e0a52f5137ded5cd4b3581ee2281da17edda4926b9db3ee14222d5fcb7083f28c149e24ba6b052bdfc6c2997b9304572338a06aece29996f5d0fe1a6a8f756b3f672423267c8bc5c6d3560b3173971ddb075f0ffc71b933a595ff34835d6790b615c136f979585cecd643136754c29c74a08236305919ca198f37c6adf0b4e68945d02160c5d97bf99f78298756b4d387ea322618a4da443e048e57c27575aa96d16433033fffd8705a9bc3e0027aca689f1c52b51e70943417bac4482d9e56c319a1fa5a974ef145ec431344f0df85ad62302e610a368ce23d4cfc8808d93082d903a88749401627866114411eb1f046a98a67ac99ae0989aca901c47fc7838133eaabfcbd897b0257ee36a30d5ca78d290cb216ccb475efa1981e70b75f11949ae777e7099484edf0ee1ab291cad64809614dfafad0e5383efcfa951bb0725b907e154604b379027d147c86e8d8f757e9c0423837184961ff86e9fb0df52909fc0df4c8069b76acadb5c8abd3deff16a03b26f0b7010cbbc97b32bf3e9f00299e975214bb8afb82e832e59cb27c8ae68349e24b0fa2c199673af7b81c8f603b9d76f1ee9ce4f438f1e8cc56678bc04dfadc6ec248f645ed6496cdf64d583c402c4abec4da4caf5be8f25d8646eee75c38eeed64452dac2ccb67097a7a9c739b08a1d9626e9246bbd1f8e9faccb854b7922c14579af2f87ac2468af3e846ef5d67dc5ac602006ce8a372d15135b1f90067350983cc0dae0c968a0dab262f278c2bca2357981b0fa5e23f46b8156561ee46231ad52ee50115f8ce055c4bdab6b42d0b28f114a3ff2b6856035abe49d09061e80efc12b4341ceda2e1f6feebe6f1baeed3b01583fcfcba1e790218af73f6be8e69828be4bfa8ca0d81392fd66b13a4c4e59205d2d0c37e52f6d5c385b238d9f98434ae5270cc81029d65021dbbe21aa6605ec6c569a4ef626c7b5f2a6a779a9d636397c08a8a28266c19be0831e61f31c5e81aa5d32c20780e22b8e9ccdcc2628b07dea4662e83bf905e3b2d682d3c6a4fb34db1174ba4e4ee503f5e245ddd2eca8e3ca2d05b4a39cb6f70675f361bc52f54576373530696369d7ea2af7e69ca917936964484a377cb0eef9c7512a2518f90d2cd438a4fb9defe7aabcc99bc4a3b2d9e150d3cf2eec74f8155f83ae1feaa5415351c87771d1f141e3c11603e94a7c29f2e2d9bc47a2a831231db148b1de4cc859db69c0b1445ef539679000e6cf5a0749b639e84d89f20512a341ede3665732710c2a086e4b01303f62e6474e2cfe062eb1b0fc068f8128645d142a6ff4f88e81764edd10d89864e0975a5b25cdea7771037693bc96d6a60783456758f5569ff1e7d284ff0d23ff8ad1ed21136328ce92751aca753373cb1c9136b7414773682ca374e61794c52dab613eb771ea55f560f5a8e76acacfaef9f99b1c4cf0d576330dbc234068032eb30b54a028a97785aad50d7f9d48c73f5aae2dbc9188f7bc5e5f23d86f0fe01edd6f8be019fc5d4ce7efa1ee14924499afe46d53b95bc99cfe4c0ef35ecd983f7e60d9a67065645571dbfdede0200f75afd89893c995ab9d2fc06c11ea5db50451b3232498491a0ca23aa5d1608bf7c0e7b22a4ca31c49dcb844155cdcb90a495b3088a31f90b94583826cb7e8c30fbedbaaa5b7fadd3e48452068365d3c3a66c66d6433ab5fb524d2c344290c2f47872250b2084960cf43b641cf177a4db7619d46ee2d4ef11e15ebeb74735c139f21663b0b3a706d8385fb9fadfff9e390ac273f1ed64f85925990386b850feee5e6086a82e81d77d7c24bfa439f0d317fc254a07244f3822a527edcb03f8a0203e3b1d26c48bd862b22e2dc9714007f7456dc277b53e44205e102c1475ed275f393f4604351841430395d5ba9f03dfa953a7cf5c13f40613f94c90400b18f14c49eb471c296f865abda8ca70b665049f8f9a0a6bf343ce0291502780ba38d9b4cafcba3de483d925647e1dbdea06e5073a17db04eeef056f52a2d8c14444851b220a8dfdfa88ec5d20d974bf9de88d905f380f2ae8e027706312b1fddafd8056d5d8377b51511f7270fff3b83f66e6a2581eeb25199d8a46818f9f02a1da16d52ca05de34d294a5238f2215f3e3be5d43df834d835a676e74b236ac9bb48e7a0bf40a3b6a8dca471414cfdf167b5ea852c67e62c5a8b607ee48c5c28e0035e4d887459908ca3a4a221b3a5160af4cae018eb49ff380ace554be98fda60d48744b90e712debd9b57ab328477a75ff397a29ef53317b53cda09912e054213ba0da88f3317120d3016d772a28528401a934278aa0912ea3f70eb55af9927a9af188952a8cd6250bc339c877426517bb36eb9291f5783f7459ade3e3683caf333b3e92285eb04084ab9f2f4763b7f7212e091318081854f0ef21a44e89539d9ff984fb4cb19867724ad1536f19830c80d8e0abf11a79c4e5f2c04ca49a50de481652b0c3418fff4b52180205d0f4d07d6acb6aefa8d8253634eeba6118ecddca7cd1b1f8a28047e37a6b7bad39ee3f8f0c9e1d2616e6e15ec806ce6d7130822aba62f7417306b0e08854aa48a95da084ded4576cd34c756bb585f0d07aec4bcc3ebcf68cac0da64ed306a505d45fd9ff0d82172d006e82d432db03c6bf0fcb64dd97eaa08771c342c139c558c72a550443acffc30a65c05905b69564e52c4b2421d76f44b1652cf716b92ce3147ae2728236f657924214793c2159e48bc8523f0a601ae8962a9080b75d33c9adf7307edc9ed6618472b4469894ebcf877ed0f86d77f45a242177eb5b9cda6ebf4fc8a23f792ef5b8a4ec2574dc218affd3bbe63593ed562eff0d9e1b673e6a528467b34f506a9bd8307f04aab4badac7153955889cc5f8dda361018355c82f20a6c56b6acc09c1138b706f63ed7e2d9b14ebbfe5e26654a1784800d148f6c225b09778dd0271e2768ca43b2709e4494b4b27b75a0b74a5402075bfbdfe78123fb92821a06ca53b54e1a42d261e2a1fdf8fa8c1afccc2bae3a94b3755741801b816c5a5e9fa0fc0dce1fd23c1a5c62171a72da351cc1159538709650b276a3a8ae02106044ab2b943e96feb5c6292acbd854f69c74b4567858e2bd9e3ff59915ef1b79ba9245f6e2a017e5e215060242ddf22e149659217e2a555b5b41fbf04120b807a2c950294fb42d57eea00e7c40129daba2ac493abdbedb0bf6f4d4373e0078ef2c1d825d2de5e63574c0f4a9696f1b792f1e188c94c18b52a93d9fc2e92be46576e9ba4ce013294403337944172be46bee05", 0x1000}, 0x1006) ioctl$DRM_IOCTL_SET_UNIQUE(r1, 0x40106410, &(0x7f0000003700)={0x36, &(0x7f00000036c0)="6dee87c9d298c0b3ddf6cac00b39fcdebf3d3f4996d929d7854f13a6cae375e49d24c6d97aef46397f54cd2ba401efcbfd0c3b3411dd"}) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000003300)={{{@in, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f0000003400)=0xe8) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, &(0x7f0000003680)) stat(&(0x7f0000003440)='./file0\x00', &(0x7f0000003480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f00000035c0)=@dstopts={0x5e, 0x7, [], [@enc_lim={0x4, 0x1, 0x7}, @padn={0x1, 0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x28, {0x776, 0x8, 0x5, 0xfea, [0x7f, 0x101, 0x65f4, 0x2]}}, @ra={0x5, 0x2, 0xefa8}]}, 0x48) write$P9_RGETATTR(r1, &(0x7f0000003500)={0xa0, 0x19, 0x1, {0x200, {0x40, 0x4, 0x7}, 0x10, r2, r3, 0x8, 0xe68, 0x80000000, 0x7, 0x4dd, 0x10000, 0x0, 0x9, 0x0, 0x0, 0x100000000, 0xd038, 0x1fffffffe0000, 0x10001, 0x7fffffff}}, 0xa0) read$FUSE(r0, &(0x7f00000012c0), 0x1000) [ 1524.943812] binder: 12759:12763 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:56 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_b*ks', 0x3d, 0x600000000000000}}]}) 22:53:56 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000180)=ANY=[@ANYBLOB="4e7270d3cb24cd737688a66a5432bf"]) 22:53:56 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x48, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:56 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x3, 0x820000000000083) socket$inet_tcp(0x2, 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000000)={0x1}) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000140)=0x3) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300, 0x0, 0xfffffffffffffefe, 0x9c}) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000100)) fsetxattr$security_capability(r0, &(0x7f0000000080)='security.capability\x00', &(0x7f00000000c0)=@v2={0x2000000, [{0x1, 0xfffffffffffffff8}, {0x80, 0x8}]}, 0x14, 0x1) 22:53:57 executing program 0: r0 = accept$inet(0xffffffffffffff9c, &(0x7f0000000080)={0x2, 0x0, @broadcast}, &(0x7f00000002c0)=0x10) setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f0000000100)={0x7, {{0x2, 0x4e21}}, {{0x2, 0x4e21, @loopback}}}, 0x108) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000040)) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000280)={'ip6gretap0\x00', {0x2, 0x4e24, @multicast1}}) [ 1525.725565] binder_alloc: binder_alloc_mmap_handler: 12759 20001000-20004000 already mapped failed -16 [ 1525.735648] binder: BINDER_SET_CONTEXT_MGR already set [ 1525.741542] binder: 12759:12801 ioctl 40046207 0 returned -16 [ 1525.747535] binder_alloc: 12759: binder_alloc_buf, no vma [ 1525.753663] binder: 12759:12802 transaction failed 29189/-3, size 0-0 line 2970 [ 1525.761937] binder: 12759:12802 BC_FREE_BUFFER u0000000020001000 no match 22:53:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x48000000, 0x0, &(0x7f0000000080)}) 22:53:57 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x7a, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:57 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2000000, &(0x7f0000000100)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f00000000c0)=ANY=[@ANYBLOB="fab7fe66f69cb799d2c74b5e7d567c4cbd2f4759e21dd0261af7740794a97e09b9"]) 22:53:57 executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x507d, 0x420400) ioctl$KVM_SET_MP_STATE(r0, 0x4004ae99, &(0x7f0000000080)=0x8) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f0000000240)={0x10300}) 22:53:57 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_bl,s', 0x3d, 0x600000000000000}}]}) 22:53:57 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x600, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1525.769587] binder: release 12759:12763 transaction 532 out, still active [ 1525.779252] binder: undelivered TRANSACTION_COMPLETE [ 1525.790685] binder: send failed reply for transaction 532, target dead [ 1525.804214] binder: undelivered TRANSACTION_ERROR: 29189 22:53:57 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000040)={0x0, 0x0, 0xef50, 0x8, 0x9, 0x5}, &(0x7f0000000080)=0x14) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00000000c0)={r1, @in6={{0xa, 0x4e23, 0x251, @loopback, 0x100}}, [0x2, 0x6, 0x6, 0x0, 0x8, 0x3, 0xd7, 0x6, 0x0, 0x5, 0x40, 0xa58, 0xffffffffffffff00, 0x400000000000, 0x20]}, &(0x7f00000001c0)=0x100) [ 1525.883622] binder: 12812:12818 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:57 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2c000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:57 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_bl"s', 0x3d, 0x600000000000000}}]}) 22:53:57 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f00000003c0)=ANY=[@ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYPTR64=&(0x7f0000000180)=ANY=[@ANYPTR, @ANYPTR64]], @ANYRESHEX, @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYRES64, @ANYRES32, @ANYBLOB="c3025910b0837e19d04a960820f10693f2b60c35cd0e0407de6cbd7a3727f603bed781396d28455fc69dd36f2912f91cb0363052fd680ac2569273b77e95a2506828ccf7aedb8732621991a3727e1b55cd7bf4ff3ab2ab33872a09cac3cec49a7fd6d891255df33ba73573d057a2a00a1b1fa14661", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYRES64=0x0, @ANYRESOCT, @ANYRES64], @ANYRESDEC], @ANYPTR=&(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES16, @ANYRES64, @ANYRES32=0x0, @ANYRESOCT, @ANYPTR64=&(0x7f0000000300)=ANY=[@ANYPTR64], @ANYPTR, @ANYRES64=0x0], @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYRES32, @ANYRES32, @ANYRESHEX, @ANYBLOB="e9a79e5a490b8a7716f9184232c16f77fe0fb9d48a716d711a65cde1e445c59c0ae6c2e57570cc9188e29803c7a6be91e25ba886f582dceb9202d3405505da5b56a26e485abb4e3f8042e4c708567b2318393fb507bd6b483b075c4fa84fed4685b3cdd6d8d5dfe39245ad48eb27c8930bea73c3a1a0cf133ca50464c4ce7d7d16c9ec5b6246a0bf"]]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:57 executing program 0: syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x1) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/exec\x00', 0x2, 0x0) r0 = getpgid(0xffffffffffffffff) ptrace$setopts(0x4206, r0, 0x24, 0x28) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x2000, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185500, &(0x7f00000000c0)={0x10301, 0x1, 0xfd, 0x3}) 22:53:57 executing program 0: r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x10000) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000240)={0x10300}) [ 1526.659192] binder_alloc: binder_alloc_mmap_handler: 12812 20001000-20004000 already mapped failed -16 [ 1526.668826] binder: BINDER_SET_CONTEXT_MGR already set [ 1526.674155] binder: 12812:12852 ioctl 40046207 0 returned -16 [ 1526.680185] binder_alloc: 12812: binder_alloc_buf, no vma [ 1526.685819] binder: 12812:12853 transaction failed 29189/-3, size 0-0 line 2970 [ 1526.693696] binder: 12812:12853 BC_FREE_BUFFER u0000000020001000 no match [ 1526.701091] binder: send failed reply for transaction 535 to 12812:12818 22:53:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x4c00000000000000, 0x0, &(0x7f0000000080)}) 22:53:58 executing program 0: socket$unix(0x1, 0x1, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000000)=""/75, 0x4b}], 0x1) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)="4c0000001400197f09004b0101048c590188ffffcf3d34740600d4ff5bffff00e7e5ed7d00000000c8550000000000002758d60034650c0326356cdb47f6aaaa956086cbfe0db35200af4486", 0x4c}], 0x1) 22:53:58 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4c, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:58 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_bl%s', 0x3d, 0x600000000000000}}]}) 22:53:58 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x20000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:53:58 executing program 1: mkdir(&(0x7f0000001440)='./file0\x00', 0x800000) mount$bpf(0x20000000, &(0x7f0000001540)='./file0\x00', &(0x7f0000001500)='bpf\x00', 0x2001001, &(0x7f00000014c0)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000000)=ANY=[@ANYBLOB="00f5e875699762803beac455c5ce1b184d392543a533b9644750b22915ebac24b48bd82b1c17b54c0941761a892803d63374fa108d459a"]) syz_mount_image$nfs(&(0x7f0000000180)='nfs\x00', &(0x7f00000001c0)='./file0\x00', 0x7fc0000000000000, 0x5, &(0x7f0000001380)=[{&(0x7f0000000200)="e4d86f348331cbbfc5a873f2c2d6815aab4faba76d4f4022f9e15feeb5221836b9e9ad6c1d", 0x25, 0x777b20d4}, {&(0x7f0000000240)="23b1aee53c58461dd3bb3c3ced526411782ba0bd861b89ee1fbf215135e3b5e9f129919ee4a4bb1b2a18a7516026147e2578c060be9981d375d81d6e80a3609bf28d1960e63eb3708b2f3a99fae4c306f56db552f904f1410973928e915af22e5ad7db2b2c218297d9a6a05dbdf7d9f760", 0x71, 0x5}, {&(0x7f00000002c0)="5e8c123422b538bf3f6e75b3c34614ec637ec2a72bd8861532975121dd29e8d5d5ea4f001dcb05b5035e68e6c28cfeeb32d53e1b03d7b2e5277d781aa609eb4463c73259bad97c81cc76e551214bcfa8cc22851a", 0x54, 0x2}, {&(0x7f0000000340)="043542ddc5da0d9693ebe52f042aecb7dcf2fe69", 0x14}, {&(0x7f0000000380)="43a9a00a16497bdc78531c1592951e072081417b4040e0d45516f99120d2c8903712f85614c777dfcbc5382988b830ed8d17bdacb2cac650de57b3b93ff72ac70812dd2cd0c712b5fc5dbb3433c6f2a788441d0e8a636758d45fef4f35f9d718d5a375682c6054b70b93028982306f0191712f522b0e2ee8ee77592487afc4908427d7ab5db48200b51031d429b2526bff332ae991ee5b27bb788ecfc09a1eca5393084af9edc9bd5e571e25ee39a63a925aa0a405c23c43f7cab91bb0ec0a038eeb2a732bf96ea52502b2d894d0fe5e8039daaa5963aca9dc2c9968a18eaf5c48c5dc88c524d2633097b0239ea932a1a45ca5f70d5c3f3c9f2c6d2afbdc189fb206dd00cb9b6e38acb1dddd90f9565e6f074a40d9298520e0dd17eb930face7f47be4871cffb3eadd03d811a075c8e24cbf57b1f44e844bb345691508381a271372ef2ce136fc9110a4ff27ac01ceab21b46289d43d1652d7f53f1a22e8e90bdd422dcb7aa73ae9af1417994bcf810e89f855244e69b99bd4df4f3ec57083d4120a9cd00fb229b7d70d367a75bd927a7a7550694942583e1bdf28d82589d967e924abea494f88ddfb3051ac3d403e7e65452021abdf2c7c2dea8758bee91d694088c755f6fec72e84003d4ca94146fc32e8c2059f581af03cfea9523651c8d856e059a2f581adbcfe3bb9ab9dc343e71b8833513b886ae750941672cac981b8b7d7f4f619eb8628117417bd2a18a81d54b66545e68e276d23de861cf994d109439784c25b8033716444a449444de92969c1f1c9d93d4b8392aa255d2b09db6f8085616bb5299162108e5300a8f41e4a2c3d5ea609d3346584c76c667220fd1154c1be78d24f1a8fa6f30bd1b041f0098c1ebe6d0b5a7c90ffa8a5386b1360b820814f69ecc64985610d08d8f6f65d10ebcfb64f9ad603080e8ac775719f849b8d57a220315bf7549cd7145c9f173062ab0633364eb1a85c3cea8086a514581322daae4d82ff9737102f7309882eeaafdb70daf36325e7b5a5dd24c5fb6ed1ca240a9420b92258cf016dd2d20589bcc70b80caeb9151a969358c0a7946bb8d977b24d32c3e0446c93e6eb904ab71041413577bf9b8552e7df3cb8fc7a9351c36097f2a903f55344d6fd5b71aedf8f251421e41de26082a109efead45d8f3a931ee4649b7edaca17b1b42cdc3075eaa7fcc257d6ec8f566308e7eb84eddc093d051093d2a41770be01662a5fc60c97e6c199e0298a25870fb6cbddf9ee15c29e48470a6da6dbf445a93d7ba45ad34f6ac78783244b87011fdcbcb231111111e7082dbfc9785976813ac0eb174773f4aa54fefe0765e48aecf4adcf1374588220ea4d9d2adde899a57715383cc562722e20c77fffdb73c9b6c165f6e39790b02fdb97740eaa58cdcbfc3dc589a828de94b407473dd63126174af2946f75cdff0a5ecb76b143b192ea499863948ba853af2dd9b467e0c6a8073b4c6c777edc9db449cdbac72f88083b27d31173908f0324f1fcb85c9e85a46704b1828ed6bb5d049329bc0375fd4c4284b57aa4b091cdbc5b92197843f5893f10f31b5988d88176257c01c96594e1e77a4a63ce36785dee786b64f24b869e42fbf9c7f9f9131d2c2039e615d18d5c9d440100723ecca8592a6763a8017b843d604b935e54e89a37631d9e3e86d49d3218c1fcbcb052f5b4aaee082056bbafcecda1874249574519f670d67b3c579d754c356aea2783591af2d6247de085a1a9a00168befe0b6e043635be1ebc300c1fc791f376530d71cedcd6fc7dbc1a894eb4a8b51c93a072876a3e295a4395b67fd4cc485e50f8d419cac20edbac5e3766a8f1a0cde5d13995ccd8be8c97ea3a291a327cf50a5d878b6b576ce0f97e035298fa2f612a8daba5659b3ec3fec412947de1deb2e76287ddccafd865288093df9b456d0f00796b356ea8d4dd6888522d260c9366109919d2ab9d3bad5ec87cb1143346de51883bce767b0478f7aecb6540576b76c97848314e0457c876642e568d3ed56df1695fb73d8ef2d282cb9345e19d27d3c43f909709caf48abddd37962a0456da98c9800ac54ec0ac37d779b124e8015d4ed13e16b3e69a5090b36744311a2f48ffea11a161fd43db49e4db5ad72ba5c3923d66258bb969f995cd4fe8dc89d3049764e489ec8ca074c7229bc40f9fbffc80985ad77658358f4ece72ab2d93efbca6d329be6757ececb43603be7be13e6630680f5a5d3cc899f05190fb8f01161495ca7d5322ef661749b749ff805e73d79a09126facacc914f524db6d9702415470d67cd6a933511c16cb7add67fee9f8b76418991f1300b594109f9d6982740242be4d639056545b355703a49425a6d76d54bd2dbb3ec7a30e9c05d016c2d64232267cdb6b0a17cdc5b2a6a31bf7d395ffbf25bb59570736d80c0aa4490cf6a0ac55b5b6030b845a1fafb4b1d08dc28d42e6a7f8663a411c32d61a65aafcd1fa606bfd5e4099fc7beded50ab55419c5e0598434c08d5a54556de123ba66a7a0abc2c74d94329f7e0de22ff68bac93683578d199f67f4ad072076e1697596e20943d5b251485cc361e6dc43ced0887e07400ffe1c948bc5dd6265dfb3bfe4a02c619e6c45901b4b84ca0c71689d8287691217895a3a1f5d1221d305fe98457b17881c907c9dd5f71caaab94b039df60924d44f037a8a80efd6a5e3213df18ccdfc9e0f9e561ddafa8afde39a9dfd6877e6fda49a8bb0d474dd938b99c9ec396d155090a12b8ea02b677213073b1f575cdb4b9f4497b336f404e598241f88906e40f6af494543e247fcf3a2920a0ec631739b62851433eb8e3229c60d8e5175c24158eb52e737aa338bb0e4b5abd1663ab62a8ad3b62a86262d01c43ddea2aaf8dc7655f70db0ba82810ea23f3d8ce4e4e4a5cb37e9437a4b5ce15b9196d0193df5cd787eede2890e4de9a28165176e430da81ec6637e2bd64154e2084e90fd17de151b16019d8671fb23dc0b6df65a83269d7c3f7fefa14e14209f54de260871ede069165e6da942444cda7059e5831fbbfd2e406c4c35545eb1d56c254199c17756703579f9594c3337e0cbe050d8f0d37d94b57223a679ffa40c9c8baf5eb1d38ed2d6c8811148105133849eb12ab20da6768b6bf81ff07eb528ec785f359e6943190ad7cdc4f860bb936fa40e271be4827f413b764f3c8806ec782b314feb5c58729b8b7a799ee3a3630f4fe9bfec988c2bc606d3b2da1c4b0ee622d936895c1ef8408358a66381586cf6fc5bdc0af4ced10b8c7e23270241b9e7d00df7eea93f002c68a2891c45582d799a73f9ee6c5f4dffe191f44d3caf90fc3133371549cc7e03d00246eab5175f975c6755de70624adca35bf1dbdfdc47967215960646edea10711f6eaf3043172a00728f3deabe796095a93d1c49b36371cac705185d162243c6398354c122eec374ac210dc17738397e3656307391331cc92a539e09ba41edb627dbf31ac7bb9574b426f0d34c247678be53346640b11d08f663a234d6ae3f68cb6ae99b37012b8a6f695973b947939558bc9b9e43ddd16031db24baf420d65e1570d93a6ca1897693a935e801f2fd4c5fef57326e3c2dfc8857d53c282e5754a6ff1a4c2f534905793511d4fc628ff4ba4cab48197d8b7e8dc91c00a417174e6fc5201aa5d4c3f5973e6b8a0cc5155f5330bc460b65bccb0f353b4757b234378bc57ffe20653cce976dee3fd4a0342d562873eb79543d3a07603154c65a578c5edd73ea811c852256f97bab1125d354ec6acb908cd5adfa1aaf840a633c67431fb88a06eb34c889380a13c07bdc85c1f20fc5a8a42b3c5372c3ff23dd8d39d704a851534f9ca01324ae793b85f9c1dd5875f014b91b9abc7c2613d03c6282e32101978140b10a028b161ea062171b8c9e1fc89b70a4266d2430e1b0e4eec08ceea4f0d37f0ebe223821aea14ea992fa058f707e46082c39d5457dc4bbd7bb7e5ea8ffa865f2dbdf263b657cb3b3994f74967dcf751ccca93a189f55ee063a5cb9b3ac67dc882299a6a8ad9e7fe6528d9dac4e26071efff544829bc3fca85090d9f2145faa1bb5a58bfccdc8721db808e965e1cb0c0687150421ca0c3715248dd4b9aacc576f51981611540026d1e7d6af85dfb4a369ec921a45a3baac3e8d76de08af24be066f21f4091be458621ef9376df43996e865fbc04d54df3e7fac8808dcc4dc083b87a3a85034626eb93194c9e0872d9be50eb6aa2af46725966be04c08a6342be31c0c4bba10d1499df82c203d4a4ae4b27bd108a47334c3a5de540ff2e1eb8a3318d28e32f258e91d6cf7e31e1881069bd8e975d72b69e23c60b9d5f8a93739dc7de15fc518c9e831507ad2920e405a82fad142c96f3c2af21c65ba5e31b5d0a1a73b13948c589c819b92195451f045ade95375ca63a1be564468fe77e6bac79194929f7a6b9cb6f9f4b07f3024829cd7183dfd6038f5f6c9725e0703b2111e560c014b16f6c66fc709dfd97f02c349e3eede623211f9183e20569bd0a08588675f84d185cfaf7fc29ee1a79a4fbb8a7ad27f562f5073968c99a9beb66b159fd2b6fd69ae8d288073ac03b07bc83e3145768f03daa5fabcc5458f723cca094a210865b025d6068df9eb574a17983309d9dd37bcd0c5740eb1e018e4ab43367fac3bb4dc1b64ef114967d164d49b8516c6868a968e55cfe622f5719f3472671ea7aefc97ef13b163a319b82fc60c6253d398fa077296552c6b14717b69134ff2648586e76169d253467fba8482faa259f60ecb6bf44570475c0e89370a28d0fe03d02175246cb14b515049f76ff52cc3f3ca6ad71c3e2674717852587fd98a7577b73e7962dceba98f19e6f585d3272eea004719eb6be4cda924c29286e7df4c6b7d94870fd191df6bccbe03e9f6a8a3875ca4066d48cc58d05277d4bbfaf9d63f205d7b23f7c3904f94830fa082781b27e8bb1f34bbc53da40080bd5a4820ae82de8ca158dacccca39bf51552f06d7237b422aa53e082441a70c960fa3c573979fad141d8b41dd62daa1786d9e5da1fe5a8fc0230fba36ebdd170ae29b1a3c09e692fdbcbf1c38817b7be5126620e4c2d5d59278c573948ce8465c0d5fa374570e0e4b41844e0f2249735afc5b4f7016e368e2a5b952d78329b8fad666e84d572c99cfd5d4d2e8eb354f1a84f8b2e6cd6ed46f9a18d4fedab0b2641a0a72f0941d5292fefe52758c4eb4ae567bf330d6f49fa08e89e07dec5f5d345263aa3c8d52513dca6440766683c3e17e4762c8d36bff25feab190e724d3ca36e9a4bd393819fb1e720afec64c80d2a7f83e96d1ee7d1dbeb419ed8d02ae9c87c1b1a1ce282834d115fb2b8d4783da00bf1e92039d6040bfb252f30aedfa37c5b6d779d5d2bb85a879036044e2fc1764afb5c6d10bf95001914b4baa70d668cef2ee84add5e312ab90587b161bc182eb7668e2e8362e6d0980c6ad89cea729fa1b30ad2f55920d7efd92e4323326ce7d5908031023a79db4798c5391d23d7ce0f3fc33a43c2212a98f4aa676e003ff6348eb854a5cfd602b532c34518324f3261ab6a9d51bd284350c52f0f307643aec4e03fa02a13bdc9bc54411926d3667b4f9b6b29893f6315b71bbf24d5e807a563fc9949ad7a1910821168b6474f273483fb574305d583516cc9bfde1376eca392b1667b103a2f1185d997e703e9fd9518183b30e882df67f9ba0c27da6e9a3225ae9df8bce6f421f3dfac8d5b1091660e79f6bfe8131e8509044315ed6acfd21bb5e7b013176c2f3f0455b30975ad0", 0x1000, 0x4}], 0x21, &(0x7f0000001400)='wlan0mime_type)*securityGPLself\\\x00') [ 1526.710800] binder: undelivered TRANSACTION_COMPLETE [ 1526.722383] binder: undelivered TRANSACTION_ERROR: 29189 [ 1526.734099] binder: undelivered TRANSACTION_ERROR: 29189 [ 1526.784895] binder: 12859:12868 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:58 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:53:58 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blkc', 0x3d, 0x600000000000000}}]}) 22:53:58 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x790c000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:58 executing program 1: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getpeername(r0, &(0x7f00000002c0)=@vsock, &(0x7f0000000340)=0x1d9) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:53:58 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:53:58 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1527.578253] binder_alloc: binder_alloc_mmap_handler: 12859 20001000-20004000 already mapped failed -16 [ 1527.587874] binder: BINDER_SET_CONTEXT_MGR already set [ 1527.593599] binder: 12859:12903 ioctl 40046207 0 returned -16 [ 1527.600068] binder_alloc: 12859: binder_alloc_buf, no vma [ 1527.605682] binder: 12859:12904 transaction failed 29189/-3, size 0-0 line 2970 [ 1527.614633] binder: 12859:12905 BC_FREE_BUFFER u0000000020001000 no match 22:53:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x700000000000000, 0x0, &(0x7f0000000080)}) 22:53:59 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blk+', 0x3d, 0x600000000000000}}]}) 22:53:59 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x3f000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:59 executing program 1: r0 = dup(0xffffffffffffff9c) ioctl$KVM_ENABLE_CAP(r0, 0x4068aea3, &(0x7f00000002c0)={0x81, 0x0, [0x7, 0x0, 0x4, 0x5c397494]}) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="5717afdb80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000000)=ANY=[@ANYBLOB="c9c507838218d700"]) r1 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x2, 0x200) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000200)={&(0x7f0000000180)='./file0\x00', r1}, 0x10) 22:53:59 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:53:59 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x790c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1527.622314] binder: send failed reply for transaction 538 to 12859:12868 [ 1527.632050] binder: undelivered TRANSACTION_COMPLETE [ 1527.643577] binder: undelivered TRANSACTION_ERROR: 29189 [ 1527.655731] binder: undelivered TRANSACTION_ERROR: 29189 [ 1527.716494] binder: 12914:12919 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:53:59 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) close(r0) 22:53:59 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:53:59 executing program 1: mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='bpf\x00', 0x108010, &(0x7f0000000200)={[{@mode={'mode', 0x3d, 0x2}}, {@mode={'mode', 0x3d, 0x3}}, {@mode={'mode', 0x3d, 0x100}}, {@mode={'mode', 0x3d, 0x5}}, {@mode={'mode', 0x3d, 0x5}}, {@mode={'mode'}}, {@mode={'mode', 0x3d, 0x100}}, {@mode={'mode', 0x3d, 0x1f}}, {@mode={'mode', 0x3d, 0x100000001}}], [{@func={'func', 0x3d, 'PATH_CHECK'}}, {@fsname={'fsname', 0x3d, "0000000080"}}]}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000340)=ANY=[@ANYBLOB="2763ac8db479900d284afe7d"]) 22:53:59 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blk%', 0x3d, 0x600000000000000}}]}) 22:53:59 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) close(r0) 22:53:59 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x80000000000, 0x40000) r1 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x40, 0x40) fanotify_mark(r0, 0x20, 0x10002, r1, &(0x7f0000000200)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0xfffffffffffffffe) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000240)={r0, 0x0, 0x1e, 0x10000, 0x6}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1528.105940] EXT4-fs: 67 callbacks suppressed [ 1528.105954] EXT4-fs (sda1): re-mounted. Opts: [ 1528.180853] EXT4-fs (sda1): re-mounted. Opts: [ 1528.502545] binder_alloc: binder_alloc_mmap_handler: 12914 20001000-20004000 already mapped failed -16 [ 1528.512210] binder: BINDER_SET_CONTEXT_MGR already set [ 1528.518305] binder: 12914:12954 ioctl 40046207 0 returned -16 [ 1528.524318] binder_alloc: 12914: binder_alloc_buf, no vma [ 1528.530377] binder: 12914:12955 transaction failed 29189/-3, size 0-0 line 2970 [ 1528.538499] binder: 12914:12955 BC_FREE_BUFFER u0000000020001000 no match [ 1528.545816] binder: undelivered TRANSACTION_ERROR: 29189 22:54:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x3f00, 0x0, &(0x7f0000000080)}) 22:54:00 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) close(r0) 22:54:00 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2d, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:00 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blk-', 0x3d, 0x600000000000000}}]}) 22:54:00 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000180)='./file0\x00', 0x0, 0x361, &(0x7f00000002c0), 0x10001c, &(0x7f0000000280)={[], [{@appraise_type='appraise_type=imasig'}, {@euid_eq={'euid', 0x3d, r0}}], 0x400000000000000}) 22:54:00 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x68, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1528.551691] binder: send failed reply for transaction 541 to 12914:12919 [ 1528.567695] binder: undelivered TRANSACTION_COMPLETE [ 1528.578563] binder: undelivered TRANSACTION_ERROR: 29189 [ 1528.632492] binder: 12961:12966 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1528.643131] EXT4-fs (sda1): Unrecognized mount option "inode_readahead_blk-=0x0600000000000000" or missing value [ 1528.654280] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:54:00 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:00 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x200000, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000001c0)=[{0x3, 0x400}, {0x2, 0x100}], 0x2) [ 1528.679358] EXT4-fs (sda1): re-mounted. Opts: [ 1528.688612] EXT4-fs (sda1): Unrecognized mount option "inode_readahead_blk-=0x0600000000000000" or missing value [ 1528.713275] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:54:00 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:00 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blkp', 0x3d, 0x600000000000000}}]}) [ 1528.751400] EXT4-fs (sda1): re-mounted. Opts: 22:54:00 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x68, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:00 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7400000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1528.785720] EXT4-fs (sda1): re-mounted. Opts: [ 1528.841889] EXT4-fs (sda1): re-mounted. Opts: [ 1529.432554] binder_alloc: binder_alloc_mmap_handler: 12961 20001000-20004000 already mapped failed -16 [ 1529.443394] binder: BINDER_SET_CONTEXT_MGR already set [ 1529.449158] binder: 12961:13006 ioctl 40046207 0 returned -16 [ 1529.455157] binder_alloc: 12961: binder_alloc_buf, no vma [ 1529.461193] binder: 12961:13007 transaction failed 29189/-3, size 0-0 line 2970 [ 1529.469259] binder: 12961:13007 BC_FREE_BUFFER u0000000020001000 no match 22:54:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x60, 0x0, &(0x7f0000000080)}) 22:54:01 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:01 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000280)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000240)=[{&(0x7f00000001c0)="767b711bcb6c0ea3305a67a263fcf6a301e3b372f438fb48a845b4e32d682570e390fc5c63da126660786ec287dcf0bc0ad0d6aa68dac717dd7d5477b218b366a3c45386fd32383084b7474047d457a93e", 0x51, 0x5}], 0x100020, &(0x7f00000002c0)={[{@data_journal='data=journal'}, {@noinit_itable='noinit_itable'}], [], 0x400000000000000}) r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0xa92, 0x100) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x8) 22:54:01 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blki', 0x3d, 0x600000000000000}}]}) 22:54:01 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x7, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:01 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3f000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1529.476591] binder: send failed reply for transaction 544 to 12961:12966 [ 1529.485966] binder: undelivered TRANSACTION_COMPLETE [ 1529.497382] binder: undelivered TRANSACTION_ERROR: 29189 [ 1529.510467] binder: undelivered TRANSACTION_ERROR: 29189 22:54:01 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1529.570356] binder: 13016:13021 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:01 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:01 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blko', 0x3d, 0x600000000000000}}]}) 22:54:01 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) pipe2(&(0x7f0000000180)={0xffffffffffffffff}, 0x84000) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x1000) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:01 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x1000000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:01 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1530.359868] binder_alloc: binder_alloc_mmap_handler: 13016 20001000-20004000 already mapped failed -16 [ 1530.370103] binder: BINDER_SET_CONTEXT_MGR already set [ 1530.375812] binder: 13016:13054 ioctl 40046207 0 returned -16 [ 1530.382203] binder_alloc: 13016: binder_alloc_buf, no vma [ 1530.387888] binder: 13016:13055 transaction failed 29189/-3, size 0-0 line 2970 [ 1530.395588] binder: 13016:13055 BC_FREE_BUFFER u0000000020001000 no match 22:54:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x6c00000000000000, 0x0, &(0x7f0000000080)}) 22:54:02 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:02 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f0000002500)='./file0\x00', &(0x7f0000002480)='bpf\x00', 0x2001001, &(0x7f00000024c0)=ANY=[]) syz_mount_image$minix(&(0x7f0000000180)='minix\x00', &(0x7f00000001c0)='./file0\x00', 0x69, 0x5, &(0x7f0000002400)=[{&(0x7f0000000200)="0f3143bf688281be809659000869a0c417959fb45a850783df145dd6b37c985c43e466fd5a81c9dbe516e7ddee0ee5530ce3a236595d21a22aa3ff51fc066824d122038b7b63baa4f25c07103b356dd52ca38c23b3a9defd5a77b85842b60a16adee3f912436b042121dc1912d6422269f03a45e345bc0e41c36e386ac54c9dda46c124e35d6bdb9a50f56d81b9239cce7b1511a1a255ac1813ed7dd7665bae6833a1a4204a327ff10ebee665ce15dc21cac99df402efcc29ce84cca5eca910eca72c1891411b30506a9f4c38888b4", 0xcf, 0x819}, {&(0x7f0000000300)="c112528e1d397f1249c18f870101e46487f3bb5727e1c2d4654a4c6dcca573d55bfd3b8d485efebc696673dd93027619d5ee5838556464aa1d2f70ea04d98d047363d56053b02b7e9ae263b75e2e8012a3dead393d44855a1976007b6324dfc48529f14482f5a0a490c109fb7543cff93e6a49872a34b2a217f3d2f20c4f1c010359c800964a3a63eb8496a82860c9cd4a47", 0x92}, {&(0x7f00000003c0)="108e8735b9afe85d29f2d38fd5c7cd10c34dbacf02e2cc96db68a2739b798dcb89006970a7635bf786d14a365da5da8ae2ac82bc8856b72540ba91e85af2e2cbe35ff7e8d08f2581cf7e63b94538d4830c114d03b5d9b358f21da109336bd5e1503edd8cc3ccb86d4cb8160f85e7503bf68dde07268f6b3c006e98cf1e9970b9b87073a4463cfb33cec1ef30f218906a977c456bc99aa41619a068ef841c46c8383a0940c04e40474fe6002816d8cb66864d469bce017b47ea22951d287cf54ad4c04b12e40dd9be0a278610413b3cb5edb94fab4e13de11699b2cbd06fe56cd28cb117d04bb4f53735be9eff943e3e5d65c5473cacfb25b046131a15a61d002a0de1cafab40de2b20fbd2411ec22c29b56b0f50109fc6d03a1701b9e2e1ab6f471dabdc722c86cbe8d86f0b976d9c9057046323159abf6308c107b80c8a4967ad955561bae2cd707d82719bff07e1225d0795a82ae2ade612fde385dfe53c79e1416d0ee8d20f96df9e716be6d7d8e72f85159b4569db0f45684b4fdb6c99a15611b339c8a8ce421976d453b6a1d38afbbd139ba45728e99a2aa24df30ec42949d7ab422d6682f1e1786bfafd4f8f07514d4bbd45c7f7340ad86eb540214aa1fd4c2c01af61c38d9a7940ce9d3ac6b7da5bc24df64994cc79614e68d215a086015b85f51e236edb4cf7e48abbc267bc40065f14f31d913eacabb14d53a3611356c0612d01cf43153065b5e1ccd9fcb266573d4a30bde4bcd85a3817c678dba22a30ce342fd524efc27f99f75987716c784292efac6b6af0157003a3be39848f624911b23f169d192b085751f27075cdfe55bdb52a882d15c62545f0e3c2c0f1b0e43c4f571340d6d9e68cb84dadf5ffc69b116ff1b468ebff82110de573a361e798f5bcfea06062e1909ea9f5b5f77b4dd9ce3b8f80cd0ffdab5e2e45996db6e9f3a5e42ac9d8f768fde3e785c791d13a97db601be0bf750e82819e66d230df462fd90f89fe3444ed21e7f39c915d412fdc5352911a9dc3fc33495e670df47f274d00088af27c628d69924080627f370347c64f8fc33a887bb5e669a6018ba0f7494620623465e124acd4c7261f09e7609d5c2f2f7c172e38c582dd5ec224d073b26921570a7beee45e6a7953022ec95c7adc1c470de68e8bee3ca0f5af549a388ac097aafcbede4cfe60fde7a21f5becb7bcdc82f171a27a5da9b2b3c27315ac1a0569f609b34d10986663b210eb755cc0354dee1ee47aeeda9f6e9af81c3c1c7278839c778051c46e8da97a8104fa664bbc0b56be046923e848ab333e1da511a23a881e5df04b916f475e3627bbcabe7f9bd0c7d8b0ebf44c83c3ccc1407313a7a5c3322b779f137fee68763fba60645bcb1e79650d7aac3971c2603533b352e2151cfb605db739d18600003b98f03c3be8a460b2db178d30b6854f448cc90fae89f3b512b41b00e7afe4b83609dced42068ce75a6970b9926215e970c007348c9f0b91f30ab2a778941f182479fe2b35ff606aebd7f54f33c63d8ff3893024e16ffa40b6e933866f79f8625c6c94a0989eb3b43c3a6b8afd4cb4a148b5751b4de5beabc507a2072f3f758baf75d96de9643627dbc68ca848b02ddc8eb316a62bf46523120da6fa87d2f8f60c65947faf6124ef076895c1c7124be2ff11664377fefb21f4d72f717b3a3b1ba90c1bfbcf5865114b72b671d65f2a20f7196baffbcef3e407af89d18005d070c2c0070e241797789b177621258cd3dc19a1a2f85a18c9bfdac7ee0a4ae3667858b1808d201da59cc96f5b629800cc996ef282e3e21f136e38a9441470173c4ce116c660eb0fa4d47587c29d818516b7e815500cc652908a1b9e5791a086fea646b1f0e388df30262eb606e5f1d7fb2d0ca3a14c2c3e8952e74e645fe27447a00f2b8d77ea31febd7a3e65e86cd820faedfd63dee7b801e81a1d5e175ec572d3ab301512777d143ac2f33f688a0d9d38af80e88cd60bbb41a3c9aaeb12c1032f0b570f9082483b730aa198953727c8a84aa79d1e3f460b20aee5b59422c5f9ed015afd1d005381ed9396528d1b2eedfd8ebfb83501394f6ec598834fd73a123b0c6d762be448bc11c8819d6471ef9fc98dfedd7987a8b30ff8ecdbe5afce0655e01307eeb5656f88c343ebd653f616a595fdc323c7a93b028d1401caa9f636f45439b0027eb3e6ec1f239e909734e4fd8d54296e06ae41d04b149a418ceafc5571487aacd7e4cbf597954a900363e634d9fa04d3f9a4da9184e6f0d86cf1d836c6fce0dc35d19e3c2efedb951567c38c2cd83b3b00dee71072963e4c9851905604caeaa6e5739f5b518ad6f17973aee394b264a1b1830e0845759bb8fca925c2b1aeac1e8c3676a7189819deb24f51f7b93b7cf1ff7d89f25c3d27070e2f8a2414df4835bdf3fb475b196fb3e0d66642a377764b02beff47f5369d82cc91b99d72682ca29937602a345140cbff0517a1ee2213a120496ccf1e6e7c253669e5ac2e217d8ddaac97bb778daea3f8fbb1066646577fecb1876360f3b467118e11c0b2b1f8927c2cba86754486d72ad4162e0dc0e8abd07197ed9ca8f51f9568a4a6be94634e859d26dce7c236c0ce5fc615f61441d4c4a1a3a5bc86a095746adc3ee55a8724f09e41a401df4988d8398b462948e0c3fb483fd6e572134cac52b4a5a2f239264aa5b35c973434c0d2ae08796c54d7b1f875febbf9a81c77777819f4958496ec81e2a93dbe4c5b8d90f8d7316552fad85d16895ef67df8fb52f9f0602346b26722fe3b0430c12693e02f2a782277bd2feebedb1565b931cd7853a91172b889edc817f9c23b359f288f6ac9691e5bf403ad557804f4df3d538d023522f8feb296ea5bbc7670b603b34dfe113053cc40bdd4e6cc46a02d21d068f1e9b360646457d36d9f1bfab280d095fe8ca0806ae6f9cbcc9a801ff8935e123d0f239b83ebcdf48d825f6f3a0c660e343132a59c0eeaf739ac1ec9c3a7e58fd5b5a629fe02f73a342a67e8a85cf38b8b0f723ca97e4ece2ca0cfb902a9f37f0f2de080d94a5f76e2355efa8302ab80914f41f9cc613fd58c76fe713276c0aace0479c2e600af95c46b955144391fdb5eadf3ee99578f915c732d23af24c77f692e9d2e452f2fa9fb52b75dd1120d6216851c395e82b3450a0ead9a6f0ebee571862e430c1da3a38e192da03babaa4126363ec4d65a3b71d71f3e37d6ed9bd1b42c7a18ca7a813924fd919d0dbdefa3defaee5e75efb214734d19b397be12e2d823260f9b02feb0cf2e275f10e002a6cf348c2ad6af6716d2b5945198354d614f9cfe09ac0d80312cf7cfd260c393632adefe45af250b17605da1cdeb5f43cff4e05f542329e9968ef424ac77669fe040db1ced817deea8c1978a5a9d0f6e829d4bc223343bfb7b89b315133fdad3c8963d3ba069851bd00dd0d107efa2981325380ed65c1be6ddfb695dc0a7f3452071e3fa8e04bac5513969281cf1d9ad89b79d934e76be482ed300740c6d38fc010ab057e60e092b78e9d2372a701dbf5f17bb280f7285cd59f966a6e2ce30e06dedeaf2831bbd1619a14a13d5bcb323235a1acbc35ac3dc1d1a14de8a92647e93a9e692cd12a3d797c282f30e950810e8933f1d3511dc12b04f777edbda2b9f410d51459dcdcaf0bc8be593e190de585550e1a645b4c4787f0f94f0c9f0c0c4b72ab9ba5afeafbbd5aa30ebae0fb35196984dd7fcf8450f67d4d7ce58d19fad42e124342b94e0fdd063d59551ce47cf91caf43b8052d8515c47dc923dda6da46c0e3ecb2c092e07c71609d30ea69dec11d7b9d8bf8b3679a9536c400b1455b1cc4457ddaae5471220891a3220688d821ad5170df990fbf5f97ba152d078e565389929d93cccc48c75cea2b976b660b70c2fea3031316d7f0dad48cdbb2c1b9e50af58b5f570b15a59cff7d8d9598edbae7267acd884ca53da84379b570fdc8e81d04e09651aea55389048388eaf5ae3e7c24714d8fc424dd2e97adfc520a36b276eb0787bb7c5221cbffd11eee9991110c73b9452ba716d7fd6b885cf8c3b1f7e8c8ea57d9fef354f9e4ecbc6b78c9279e4a5d185d47fe9dfd23bcef96cfe56309087ab4cecaa5a83b5ed8b6617e48185650734cf2e9390cdfe8b34a631d1ee9fc5561e1230b9ef2311db2e2a7228cff4090d47783a895f34bee5db33d1390017efd6fe87e5974eda06f53a2c6b5725a6ada4ab00d4cedda115aec7aa87086dc3f5f1058e777ea3b69105fbf0e0e76803845c4c0e77c7401529e4b5f9508a294d496b8a99b64d3e8cde7f4fbc5ec42fc388be2f1110578f56c22cb87fcc9eae4c926df5b093491c8d44ad538d31bd66461f639c7f23631828390555a5c6ac5bed971a2d23e128bb37a520a450e3df0282e396bfea00841e1b8365dfdf1ec907fefababeb010d08a0fc9e98e4283af5e7a98585100417b0c50637dd85e2b35203b5f7672e429ab16ac62c64963027de6ea6fadbcbd28fe5aaafa34c86592b6258ed6aba5019a1e4f1cb2926cc5848a263e806c9bd2d6a839feb801a51eeb37dff9adc4674628f55f0965aa94eae723cf9964c6d3f7cdf5ff22b2d54d0ccb189907cae1d040e1d29e4176aa0095f2579938b831725867c8dbeb932342d65e855376425089563d7f8f561ffcf25c963d9b0107222a16d030f692f91e8b64120f91731b6668145822771871f54d210c4fb883649f6685ac8843972e967dcc7397f6006ff99f6944b0d9e7caf37c0c067db88bd8c74c5e916036687f72dcd16b8130b2db988c309c5bdeed125b3e386ef9777965a792437b63ab0f4664409d1e11312fc9a2bd6cea96b49d999c0b88b80e1ce282744e6f27767eff26418b69066ea4559ae82974824a1b19a70c22b2fea3c6edca6bfd6072089e25d43762f900a408b3cc25ea3bc10bf8d74d84c85cab7db0c39e7f493cc512d4324433a301e83e5460201012bfa12778b5103d3b64f04d9eff0ffeb0fed3719f9dccaa513167e0f65f8ed644a21256ecedc7c24eb5fe2d795d8489c9c3df9cb34e3bfa30c49597548ad706a910ae1e0bfd87344bf6bb38b63f17c6673de336c38cc7389fd5297a13ae756a2edd04503fd59d2a875db3db9a7a5cbc07173184c603cb80eccd962fcb01f6636103abd0ed14e8cf2f3a969a45b8700aa99c872bb1a01acbdb0bd71c460ae65b58268d97f1efbc99f2725b845850926521e1d003bfeda3ee42d23414fcb4fdb0982f98e2ad2320cb926e4909f087ec59d22af8a0659e7f87ec417b05a1c1a8891c0e31fd17670e6379e5a95f1fa10b1e252bb7ce5c5c5526e2f491cbb9103a116373e7dcbe37f88e96a67ecf29c30ddccd3abefcd173ead9a2cd1b16dc75aab4004a1d238d522f3970d6bc8d1e77cb2aa91a4b4b55a5ef6ce139ecde262621ecd0f2b83ea619f8d0e518e86530b850aafd7705ae41bdd2d540160f543f8020e807480f81783937c7ce912cc2b2cbe0e7c295a6df3bd3f9e001e6e20752dccbe5124496c0dae5ffbedc830a3131d323217a3133a263e7337333414a280e601fd91f02befe44229667ece75b8fa0aaaa4ce004aed02e2086396566095185c74a32ce6592a9ea89e01ffb4950ec9fd47c4a0f2990ce4a2d96fd9cfef079bbcc1f78896f85d78e78fabec05a3bf37f07693acc9772dc0c5dcc4f0098f7db8fe843c98a10c26b6bf5f861ae9b02aeae3c8488818ae966dce57984f89c142324c3ac37505085d916797f0c8ba170e204a6e1a8147352bb4862899233707ac441eb9cb6656b2644", 0x1000, 0x80}, {&(0x7f00000013c0)="c5a56b2896048d70eb4c9cd1ce573cc550c963699e9e7e6452fa0d393163ae534f7fd1e6dbbaaf1f44e488f93571232141a2248ad4ec93cd03954795ff135c64d66694a8f2e14a0e16e03083721a5fbc08d9cd31294f3e9fea1b7e6aef7a0067262786160239828b0b5b353d15626f3e1514d82ae554eea6cb4b0d971941a4cce183514affe958acb609cdec91791bee9638dd4dbbfa7de233fdc538339935322cd7c914119b3678a844d5ca977681fd6562c1615a2e63cbc8f7bec15b1d4f2c224e64aa5a1381580fe43a33e2affe62acec1cb8196c9789fcb00bf341a505aa111d7f6149f0ea7895006b4e07a711a3ac30fdb646716a2257c50377ddd099654c09c2e11c3a82a078c90cac595770addcd609de1072c2c46979e2434f9e8000d32d969e289b70f14e2b9dda54474023fe03801c03fe47014f7e545eb5c3909aed6b4c3fd61f4238bc6f778182de3a8285c237866130886307e6c6496bd74b180db2d64437d791fb72bf5c947943b981880e2ece2684b1bcc3d329c76ad8153a1efcd66ed1c490c29fab4cf37a20948197c69696e0c0c43eac75e550f7c3aaef12b7b20e805d5d6415a63007825ba7965105f6ccd30fdf590e1030bd2527162ba8b243c5102a5c8451025d25cbada21776541dca3d04fe0b392edf8383ce4fd3dff6fc4648e7b7c520fa4d09e3bb61d1ca89a7eee6207f637254c1c689fb26180ce7fd9428227dc7efa7c69b6fb85f82a91694d3a488a67799da77a7ae0806ac32655794c8764ea83eed727f5772c343ac0a7ee62301b1e9715ab73e4a364be604a618f46fbe47aa8be1b1c5d97a057c37a3d1b8651a42e561743803391f800028f0ebcd8beea173b0a4b795a0a79d9be1701c75e3b53be3f67ff98df82797090159f40a89d5a3f5a04bcc5f398dfa56dd4387ab5b64929358e7414c07d6846be82c6f88782bcfda1fddf8576b577fb2c8dfe8db5ebffd488094101f8183c2cebdd81cf905559bebb4444d461f94652c4080dc281afed028cf5f9a76667079839ac89e1cb495b1b414061b71fc9fbde50cbc43b740c5caeac2e53280a219ed8ea8949db8891d9827a7481e583c0af98b7bce4857c28ced46bfad6922b9bee481d00ec1efe625e0b55cd30e5a56ad6bb2994e1d71015f004b5849e1b4255c1dd4612b6cc7d70e7a47eadda9bfe55cdaf817015c5e65d9e19e6f8e588e9573e05186fa85eef2e8babbae6d20925ba9cc5dd632cefb3f4db30bed92e7073320a871c9780f441053a7890f935a4ed5384b950d8176f808d1d7f374f5aa8223ca28e7c22a825dca9d9c4e03cf68c32a41590a2e1fb3d0b8008fd6c1e526632fb66f8c659f241fb3efbb7007dc298a633b054adceca7437eb6115ebedd0bb71e34cf842916efaeedaac070d41b521496fbf1104a315f7fdd78d45d29fa571334a68ecf9cbecbc3159d2adf91f3edb5db4aaf3f939f6070c86976a738d80543805336a13dbe9458821f103f491cd334cf5bd55ad6edd8fef3e4301ae33b579229a5814aa895956558b9252045a653c46f862de85d081a52e85672ec9baba332ba0c75e7df14968581e3a1d045352ac747f5f589681bcd2976985f53962615cf9a6156fec22ec796728ef5f1f95f123e7af664547c475e3246c13c18e4c6d2a584211f4f3b2576e6b74f7b62d425ba84fc28465f8b93e2e7770d83fdc33bd2a1e3ab4182fa19ec3ebf5a743f7a797ac70bcd5251fd821407d5eed2b1ef016a21b1fb4406a4d1f6301822acb2aa8a3d4445188aadc7b0c24a127f3e195715675aeb1b66da3db9b9d7abac53f33b2152c26ab45957ae859a2a8312e5aa74a1136e399e186c17b09865c664542aeb851e24d8e68076221ae7ae575347df9ee3933aa448df7022750a8c94a4994521ffac5431e68b8d06eb4cd52b22a4e7067827f5de5d14d67cfbc1a470817e1935b904e03db397f0b5276b58116e2a617eae58e3862b77c597290ab44f574ebc27a4806b7d0514ef4de0a0c8f672d94e3bda14379b97cbc580e80f3641c00826f58d86b8015f1937519884dcbf98eeebf12db450f7dc7acd591182d5cf32c8316be4cd2e4baf0918b5c9152c8b726562d26280ade7b33f1bc90cc6245a7c78e1454a4f3f5afc9051881bc9ff01f01520a7550c600e6d004dd74a0d8ce8aecd41e8c0d9929b452594f9f08972d83a8315d862858278da41bef6d3a54d193e82ed879d2b77aa3ee9f459bef3171cd7c21208f63d3c59a86ba98d11c8d45918c31bfbf1f82935965929a181f4e7056802c23f7812e1fac0b5274cd2af6273550235dbf32d033f8d9da875dc6b890de628b6f13afd84337354d5af4980ed7721ae747e51e3273f5b864db27027fd98807131f77e36a911fe4fbc85e345f8811c931ff48e9f84bdc88028cd9a3bf88cb3ada4d199c040c47746f84be71d05bf616934211cf5fb46ec65e2e8273bf86e2f865e5880b46790a2aecc477c6087ba81645fc2e4a1fba44b08bb63283f0de697945da817efd4617a4ccc77fe01814e7c52e94662d9098855cd8ce1ba31859a6bac917cbb62bc3eddc720aee62e49cc4d7afe8e5329914fca2c3e400ada7a3cecf072eff1bedd72ef458dc64fee0c39c8896d9d463a8255e456335a4f5cdb5397311a31634be4459c7096e35a59a093595b3de4923b7d95531763ace6fc3274590076d7ef6266a158fab4590e4232ee6111143b105fd66bb4e977f096f8d740be014c57118b88701ecca9c3bcfdbba232c59231a4d2678f9c8c56a7d2b8711b26049a971c837de1d29efc238f3fab790bcde25dd679fdf35c67fc20b7402e74eac2e7e379007b27bdb1fd0bf2db8a4fbcebad03d8ec316da491fcace74557fa94d09f39d61b3c926f1089a3725e80ceefbe8aeb2ed0f1337ab19e65fcdac1193d674416fab2d0e50222279d638f01b7629d18754ae9ad6c47f67ce9c313b9bb32af4c600e0110448fe6f54b072f35f6b5ce35bd3f3119da0341cda8904ff0fc4ee830c2aaa649f055312e7d67db458921d919da0af6e7296a316a866dcc32db176e349f6a14b358d6120d3751341670f747871403660ca58a4d53734d255e09b0741a0a794db87ed65d7689b96a51ef04dafc3e503bc11ec9486d2bb8a40224a4f5050b4485cd2844c4d82957342cc61d5bdf8dc51fc30a7f7b14d98f194c92a2c1bf1d5b5aad7048311746a0a4b750235e4039c6a13fd7ad0b646d33f0740ac1eee32c3981fe30bd6017dff2e0c6738db4c52dd85ad9041398de24df6beb347b948f24ab6f94687a72fc8682029a22827189600cf6f9bc4be50b4ed85cfe313dc1f59829b27a4f1b133df94a4ace3b1f9171310109a65c4d4a491e8b1516cc8b13774dad13929327cfb9ccaa119d6c4f372f929bb32f9ebde112e8afed75b136b255d53dc634c4f18adf51b4b6997f5515fc87c8fb647e8415531811cc7103606a3679d3e0d9fcea1813a362595e26921e116045fca29cd409b7c5e594bee9201e0b608a34805d8f602cc88458385b7fe2d99746c11b213fa871bf2689a985c79432cff02cc01b0534d4221bc107ada4b6fdcf7c31c5615abf21ae3f77e576516fb652c44f115ea356ce206bef93a6d0541f87ffa1119bbc1408e99863fbec77274ce1b1553caca30fbc6d638be5f6015ef1659da963f0d07792b3c6b17784e56a540261871db66e48f0fd2a63abba1debc4ce855a1f1ee118bf243ea244630bbfcb484c3d9c166dd6eebc7d0ce3068a16fea51d9e470d45c534b5a76b2adbd4944e29456c9931c0e57f7678b1a4d84f4e27a0bfea337bbb6e74a2646e72cc2fa2750b88d93ff3647a615a4747c327d1962875abecbbdc3db8c0a3f25256ad0fc3e0bc078eecf8cd03861fa12b1ddfc23af91656715eea8efae69994b7334fc9b38243abfa19f1334ddfc3f43cfaa1cd4ea83635fdd14b6958a7214779cbb822bec1761c34b09cbed048db189066e9514eae068d856edba7118186c46d13389bd55f630dcdc9555f943d601dc42a184857b511007560bb27b7e94c86af1d87b7c17b4dc04b1aab22e8be33587e029ae325a31ba3a05fcac2d2b624ee9e6d6da80018fe50838add7ff9f7b1040515d217d0eda4a22642b0ae4cfacd2768405f9a1a3aaa14b107c280414bb7b8428dad4c5df45a1f3f29e416cb3357d276e2e29a44e65052393a4e8ff867bfed33aa925ea1d377152e368d3dae98ec705e144e3a48e3d5893e80e2abf6846bb590bfa6e43e567c70362caadae0eb360c17dc5391180f37dd8a364f756e4b9b502e378964c63a4b3e0f799e078765f18f653f5b0b03c77b170ef9bb637cfb0a7ba6a05ed6331f0672bfd085a576962e6fd67987085cae383b0de3fd3bd4d906dffcc9921a756ca62528ee09fed15363e9c74af1ad7b26a53dc19165effcda040e8e5dc23eb590f77e86ac746b4496fdaa3ef5530a9977686ab4ff032191f2211481443ec1c788179f611f46f187e2901500f28dfa64b29ef9dfd2e6c06bba5d580c5f42bd8c80d85378a2d73912f512692fc77218a16055e23df5972d07c95dba7d30ffce5f136cab72571c664f1da5613296b55129e920b4b244a3632b6a15f853649f6539ee0174d04bc5a7e0ac2cd6df6b943a33689ce80968ed8f595664e7b1ef2ba2b9b8ce221006f1bde911b00ac2fa662cd9d1c3257e03de1868e1ad38528d11f133797368d2ea36742420ee5cd253af22b7f026955fb79e882c96375a8db63cc2027304a999f871f8226e6ebd134c93469db918a13f1a2256de9447a0e468174056b15ca20f0cfabe971e227ed9467f81002bad2c2f226b44b41fae8d112846a2b8a005edd890a715a218b78f27b9e013212b96e569b77fdb2fe700553f193ae5af75b2135a9afa9ea9b8410c7694170339d941236d24c5bff7464e906bcaaa98bbbc03f64207b869e32cb8fc28ebd900e65d63f0364fd7155e0022ab7604ad863ecd8c47f762f3f05df9927e39b2ffba9fe303b27b93cb07f398646e638db8f22f8e88db12ed7fb8c3b128daca948a7089090a085c5f95ea24a9fee3b45559080050e6f15b0c408cb055520c4ca1c85ad50902b1e8b4962df98fd57e1c7938ee7933605dc10a927f7462a34e36e14754d139508fe0e96de044bebe9cf49db05981e8f8271bdd21a9bccf24ade03f731b07d1c86b9bcb7076baa19ac81e381cb3a0069e6dfdb4c8e2dbe38e85079931a350f1dc12d0d6cb7beea9f7b458bad4557fc850bfd372b6502e92d1c7a031c6b60b55b373a4c08af678aec6cf6938d3cc943058c8cfe28f0956f4f08c86bfd443102327b8f64528495c0540394166aca189fefdc40f7c405ef8ef16229d04ff1238ddc76b19dd225eaabb519fdd7c6f8b3a77377b5553cddefc05029435d6a55a528570c5d1a91a8782216ca60bc962e984f5b57c6079c6e407ca0a317a6aa683f120059936ff6f6cf7c64ea571eb060148d67dd3fdad5c77d92565b5eab0b36b56151c69c5ae99ebd6d84a553e6283000ca05b6095d1a657f1f4c881975bc98a2a440d772bf9f58a8b6a08763bf131a7947b399b55d23f9496a8fe6c1bce5ad3a3c79bfe249b3df478123d1b3c445b3316559b750b42ceeee95d660b00eb01710f986990d9f6c994e47633b62fb8711c6768f7c3809e7e21159a2ca015e9b9d3f7425d87ea3b274428048202b5cc618de4151100499e5acb62149568f32179cdcc1fe3667c8e586f46f844553bd7e9ae87ebf02206137bcb17ebc8c734f480a9657c9ba59f1a13c4244b", 0x1000, 0x5}, {&(0x7f00000023c0)="567cb3cd8a13feb33a1d9491e5ca4947e7e5ebcb378f25", 0x17, 0xfffffffffffffff8}], 0x8002, 0x0) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:02 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blk#', 0x3d, 0x600000000000000}}]}) 22:54:02 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x8cffffff00000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:02 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x5000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1530.403581] binder: release 13016:13021 transaction 547 out, still active [ 1530.413534] binder: undelivered TRANSACTION_COMPLETE [ 1530.425108] binder: send failed reply for transaction 547, target dead [ 1530.438351] binder: undelivered TRANSACTION_ERROR: 29189 22:54:02 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1530.483224] binder: 13059:13064 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:02 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:02 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xf6ffffff00000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:02 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blkl', 0x3d, 0x600000000000000}}]}) 22:54:02 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = syz_open_dev$midi(&(0x7f0000000180)='/dev/midi#\x00', 0xd725, 0x2) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0xfffffffffffffff8) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:02 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1531.269655] binder_alloc: binder_alloc_mmap_handler: 13059 20001000-20004000 already mapped failed -16 [ 1531.279339] binder: BINDER_SET_CONTEXT_MGR already set [ 1531.285054] binder: 13059:13103 ioctl 40046207 0 returned -16 [ 1531.291420] binder_alloc: 13059: binder_alloc_buf, no vma [ 1531.297135] binder: 13059:13104 transaction failed 29189/-3, size 0-0 line 2970 [ 1531.305217] binder: 13059:13104 BC_FREE_BUFFER u0000000020001000 no match [ 1531.313125] binder: release 13059:13064 transaction 550 out, still active 22:54:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x2000000, 0x0, &(0x7f0000000080)}) 22:54:03 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:03 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2200000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:03 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blk"', 0x3d, 0x600000000000000}}]}) 22:54:03 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x800, 0x200200) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f00000001c0)=0x1) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) bind$netlink(r0, &(0x7f0000000200)={0x10, 0x0, 0x25dfdbfc, 0x800000}, 0xc) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:03 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfffffdfd, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1531.323033] binder: undelivered TRANSACTION_COMPLETE [ 1531.334612] binder: send failed reply for transaction 550, target dead [ 1531.347730] binder: undelivered TRANSACTION_ERROR: 29189 22:54:03 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1531.400430] binder: 13111:13117 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:03 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f00000003c0)='bpf\x00', 0x2000ffe, &(0x7f0000000340)=ANY=[@ANYRES64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRES16], @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYPTR64, @ANYRESHEX], @ANYRES32, @ANYRES64, @ANYRES32], @ANYRESDEC, @ANYBLOB="b78a8a9be670b27ec028e2d71419497459c9ed22c877f9951ddeb7d932de870218c0e586028ef503"]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:03 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:03 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blkd', 0x3d, 0x600000000000000}}]}) 22:54:03 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:03 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1532.188565] binder_alloc: binder_alloc_mmap_handler: 13111 20001000-20004000 already mapped failed -16 [ 1532.198299] binder: BINDER_SET_CONTEXT_MGR already set [ 1532.203637] binder: 13111:13150 ioctl 40046207 0 returned -16 [ 1532.209653] binder_alloc: 13111: binder_alloc_buf, no vma [ 1532.215283] binder: 13111:13151 transaction failed 29189/-3, size 0-0 line 2970 [ 1532.223308] binder: 13111:13151 BC_FREE_BUFFER u0000000020001000 no match [ 1532.230809] binder: send failed reply for transaction 553 to 13111:13117 22:54:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x2000, 0x0, &(0x7f0000000080)}) 22:54:04 executing program 1: mkdir(&(0x7f0000000380)='./file0\x00', 0x8) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) r0 = memfd_create(&(0x7f0000000180)='\x00', 0x1) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={r0, 0x6, 0x1, 0x200, &(0x7f00000001c0)=[0x0], 0x1}, 0x20) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000240)=0x1, 0x4) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000000)=ANY=[@ANYBLOB="6e67c77a963f581153c136844d05d0eb0ba1b771106fc6727eceef9df71ff65dfbfee095f72768ea7e63a368f428cb2966cd85ace1c11c5250e4063f22"]) 22:54:04 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xc79, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:04 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:04 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blk,', 0x3d, 0x600000000000000}}]}) 22:54:04 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xfdfdffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1532.241241] binder: undelivered TRANSACTION_COMPLETE [ 1532.252778] binder: undelivered TRANSACTION_ERROR: 29189 [ 1532.264961] binder: undelivered TRANSACTION_ERROR: 29189 22:54:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(0xffffffffffffffff) [ 1532.313371] binder: 13157:13163 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:04 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blku', 0x3d, 0x600000000000000}}]}) 22:54:04 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x10000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:04 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:04 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:04 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1533.103283] binder_alloc: binder_alloc_mmap_handler: 13157 20001000-20004000 already mapped failed -16 [ 1533.113307] binder: BINDER_SET_CONTEXT_MGR already set [ 1533.119033] binder: 13157:13199 ioctl 40046207 0 returned -16 [ 1533.125028] binder_alloc: 13157: binder_alloc_buf, no vma [ 1533.131044] binder: 13157:13200 transaction failed 29189/-3, size 0-0 line 2970 [ 1533.139348] binder: 13157:13200 BC_FREE_BUFFER u0000000020001000 no match [ 1533.146719] binder: release 13157:13163 transaction 556 out, still active 22:54:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x74000000, 0x0, &(0x7f0000000080)}) 22:54:05 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x900, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:05 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blkx', 0x3d, 0x600000000000000}}]}) 22:54:05 executing program 1: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000180), &(0x7f00000001c0)=0x4) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000240)={0x0, 0xa4, "a896fa3fe6ab6040c1abf6ed0b8c577ad862c5d351dda59658c03d06b1b6da58e6c4ebe06726d1f285fc7417f25364b56d7cbaf2da52c53073ff40f03db65a69ab8c8fbd768287a609d0d104e0f100831a3b1681fcd101560309650966c19763502ffcff214a1b156506a91809db01d3d6070d4447d39c8b112bffb176dbd04b672388eded9595ac47b8afaba1370d7a1ea6948e51841bb34e272bcc2249c49370700d26"}, &(0x7f0000000000)=0xac) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000300)={r1, 0xd0, "499a75cff1f25702b714b54f069082e2c3b19d04f9c7b3735a4140c8bc78166d2a9c35904d877e2ff76fa17052e3845b62477ef5403ed88a7965e7fe74481e829f48647d40837e64d79a4a20a2234a971dc8b2e1d509ad65cc8dd0535b581667215a757397fb99762afcde3fecdb136dd649c0f23a1e118db50225ddbed3b6c31ef249f42fd3baa254c7e208a94672059a375287eabbf24db262e525979e2b38fc5c7d4996fc94a71c038d4f517fb50eb7cc66dc2633d87df76f25f72b693af42e8076938d4d02b669e50c2a6a4b1ac7"}, &(0x7f0000000400)=0xd8) msgget$private(0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:05 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:05 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4000000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1533.156739] binder: undelivered TRANSACTION_COMPLETE [ 1533.167963] binder: send failed reply for transaction 556, target dead [ 1533.181866] binder: undelivered TRANSACTION_ERROR: 29189 22:54:05 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:05 executing program 1: rmdir(&(0x7f0000000180)='./file0\x00') mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1533.235336] EXT4-fs: 56 callbacks suppressed [ 1533.235347] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1533.244035] binder: 13207:13212 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1533.270413] EXT4-fs (sda1): Unrecognized mount option "inode_readahead_blkx=0x0600000000000000" or missing value 22:54:05 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1533.328962] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1533.345108] EXT4-fs (sda1): Unrecognized mount option "inode_readahead_blkx=0x0600000000000000" or missing value 22:54:05 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blk*', 0x3d, 0x600000000000000}}]}) 22:54:05 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2200, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1533.418820] EXT4-fs (sda1): re-mounted. Opts: 22:54:05 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1533.566779] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1533.585983] EXT4-fs (sda1): Unrecognized mount option "inode_readahead_blk*=0x0600000000000000" or missing value [ 1533.635323] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1533.653315] EXT4-fs (sda1): re-mounted. Opts: [ 1533.659903] EXT4-fs (sda1): Unrecognized mount option "inode_readahead_blk*=0x0600000000000000" or missing value [ 1534.023704] binder_alloc: binder_alloc_mmap_handler: 13207 20001000-20004000 already mapped failed -16 [ 1534.033864] binder: BINDER_SET_CONTEXT_MGR already set [ 1534.039770] binder: 13207:13247 ioctl 40046207 0 returned -16 [ 1534.045772] binder_alloc: 13207: binder_alloc_buf, no vma [ 1534.051744] binder: 13207:13248 transaction failed 29189/-3, size 0-0 line 2970 [ 1534.059788] binder: 13207:13248 BC_FREE_BUFFER u0000000020001000 no match [ 1534.067114] binder: release 13207:13212 transaction 559 out, still active 22:54:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x6c00, 0x0, &(0x7f0000000080)}) 22:54:05 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) socketpair(0x2, 0x3, 0xffff, &(0x7f0000000180)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000001c0)={0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000200)=0x20) chdir(&(0x7f0000000100)='./file0\x00') syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000240)=ANY=[@ANYBLOB="eb700c8b08f7362ce4db86fc8a58c603d8c096a98de04959feef9dbc702e4311f51661a26a7e00a11e0a9226232545b4c430dbd0a96fc3e3fc547d8034bfd70bfb119e384091f18166d1c9f90c6a36eff962f33c26d4226692b4696a2858de0fceff7b0e827d6f0aeb155ed3e9b4ca1a44c30a81717717d819af680cadbe789b738cea4013b6249bcb113f"]) 22:54:05 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:05 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4000000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:05 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blk.', 0x3d, 0x600000000000000}}]}) 22:54:05 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4c000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1534.077279] binder: undelivered TRANSACTION_COMPLETE [ 1534.088965] binder: send failed reply for transaction 559, target dead [ 1534.102311] binder: undelivered TRANSACTION_ERROR: 29189 22:54:06 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:06 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1534.156270] binder: 13255:13260 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:06 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blk0', 0x3d, 0x600000000000000}}]}) 22:54:06 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) r0 = semget(0x0, 0x3, 0x20) semtimedop(r0, &(0x7f00000000c0)=[{0x3, 0x8, 0x1000}, {0x1, 0x2, 0x800}], 0x2, &(0x7f0000000140)) 22:54:06 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x7400000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:06 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1534.943065] binder_alloc: binder_alloc_mmap_handler: 13255 20001000-20004000 already mapped failed -16 [ 1534.953174] binder: BINDER_SET_CONTEXT_MGR already set [ 1534.958547] binder: 13255:13294 ioctl 40046207 0 returned -16 [ 1534.964534] binder_alloc: 13255: binder_alloc_buf, no vma [ 1534.970186] binder: 13255:13295 transaction failed 29189/-3, size 0-0 line 2970 [ 1534.978167] binder: 13255:13295 BC_FREE_BUFFER u0000000020001000 no match [ 1534.985521] binder: release 13255:13260 transaction 562 out, still active 22:54:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x3f00000000000000, 0x0, &(0x7f0000000080)}) 22:54:06 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:06 executing program 1: acct(&(0x7f0000000180)='./file0\x00') mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:06 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blkX', 0x3d, 0x600000000000000}}]}) 22:54:06 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6c000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:06 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x790c000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1534.995450] binder: undelivered TRANSACTION_COMPLETE [ 1535.005566] binder: send failed reply for transaction 562, target dead [ 1535.020077] binder: undelivered TRANSACTION_ERROR: 29189 22:54:06 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1535.084559] binder: 13297:13309 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:07 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x22, 0x600000000000000}}]}) 22:54:07 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x20000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:07 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = add_key(&(0x7f0000000200)='rxrpc_s\x00', &(0x7f0000000240)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$revoke(0x3, r1) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f00000001c0)={'dummy0\x00', 0x9}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:07 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:07 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1535.856941] binder_alloc: binder_alloc_mmap_handler: 13297 20001000-20004000 already mapped failed -16 [ 1535.866641] binder: BINDER_SET_CONTEXT_MGR already set [ 1535.872752] binder: 13297:13342 ioctl 40046207 0 returned -16 [ 1535.879083] binder_alloc: 13297: binder_alloc_buf, no vma [ 1535.884699] binder: 13297:13343 transaction failed 29189/-3, size 0-0 line 2970 [ 1535.893028] binder: 13297:13343 BC_FREE_BUFFER u0000000020001000 no match 22:54:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x100000000000000, 0x0, &(0x7f0000000080)}) 22:54:07 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000180)={0xffffffffffffff9c}) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f00000001c0)={{0x67, @multicast1, 0x4e22, 0x1, 'wrr\x00', 0x10, 0xfffffffffffffff9, 0x63}, {@empty, 0x4e24, 0x4, 0x5, 0x3, 0x80fd}}, 0x44) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000180), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:07 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x25, 0x600000000000000}}]}) 22:54:07 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfdfdffff, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:07 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:07 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x400000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1535.900681] binder: release 13297:13309 transaction 565 out, still active [ 1535.910600] binder: undelivered TRANSACTION_COMPLETE [ 1535.922107] binder: send failed reply for transaction 565, target dead [ 1535.935682] binder: undelivered TRANSACTION_ERROR: 29189 22:54:07 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1536.002766] binder: 13350:13358 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:07 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:07 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) syz_mount_image$minix(&(0x7f0000000100)='minix\x00', &(0x7f00000001c0)='./file1\x00', 0x7, 0x3, &(0x7f0000000380)=[{&(0x7f0000000200)="320855123bb91ef2f1c2da5ed7c7bf16a85d9ab0480949b480308e681a0a235a6f0d701eef18158044cb391c562f4f0e1f96c07a9ff591", 0x37, 0xfffffffffffffffd}, {&(0x7f0000000240)="8b951e85ff61b6fa040afab15d5d6fbac341d8d71675401279ed8377fe737469afb05fafbcb889eeeb249d6169af1ce6894ac5b8d22b85d4ed54ad79dfc33ad30a03c286ff3211cb5d9a", 0x4a, 0x1}, {&(0x7f00000002c0)="d5ea9ac73349a0ba88d7ce8348eeb1dfbf959adc2a2c5491f8db0abc67839ed12e193f3543af183681470db5fc198f27b9f85b66e63dea4c75a125a6ed884e67e57bbd96e27a3a0adf1c4d8322c4d399e43de571ac47ef4c55622ec6c09ace7d6492c24a6ede42f7ef99f27ec40ccc809694e6601d6e3b34edf7f2a93c72e19eb767c82c1d37cabd2a3153cce03d988810b4c8d19f416b3df0a704", 0x9b, 0x7}], 0x80, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000180)={[], [], 0x400000000000000}) 22:54:07 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x2c, 0x600000000000000}}]}) 22:54:07 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:08 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1536.209911] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device loop1. [ 1536.780999] binder_alloc: binder_alloc_mmap_handler: 13350 20001000-20004000 already mapped failed -16 [ 1536.790704] binder: BINDER_SET_CONTEXT_MGR already set [ 1536.796928] binder: 13350:13391 ioctl 40046207 0 returned -16 [ 1536.803280] binder_alloc: 13350: binder_alloc_buf, no vma [ 1536.808960] binder: 13350:13392 transaction failed 29189/-3, size 0-0 line 2970 [ 1536.816698] binder: 13350:13392 BC_FREE_BUFFER u0000000020001000 no match 22:54:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x6000000, 0x0, &(0x7f0000000080)}) 22:54:08 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:08 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x2d, 0x600000000000000}}]}) 22:54:08 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x9, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:08 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x206802, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000200)={{{@in=@rand_addr, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000300)=0xe8) r2 = getegid() fchownat(r0, &(0x7f00000003c0)='./file0\x00', r1, r2, 0x1000) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) connect$inet6(r0, &(0x7f0000000340)={0xa, 0x4e24, 0x3, @mcast1, 0x80}, 0x1c) accept4$unix(r0, &(0x7f0000000480)=@abs, &(0x7f00000001c0)=0x6e, 0x80000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:08 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xf6ffffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1536.824688] binder: release 13350:13358 transaction 568 out, still active [ 1536.834696] binder: undelivered TRANSACTION_COMPLETE [ 1536.846243] binder: send failed reply for transaction 568, target dead [ 1536.860077] binder: undelivered TRANSACTION_ERROR: 29189 22:54:08 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x0, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:08 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x0, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1536.923025] binder: 13399:13405 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:08 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000004c00}}]}) 22:54:08 executing program 1: mkdir(&(0x7f0000000200)='./file0\x00', 0xfffffffffffffffc) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000000000)=ANY=[]) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x1, 0x0) mkdirat(r0, &(0x7f0000000280)='./file0\x00', 0xc) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x4480, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ppp\x00', 0xa000, 0x0) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r1, 0x118, 0x1, &(0x7f00000001c0)=0x8f, 0x4) openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/relabel\x00', 0x2, 0x0) 22:54:08 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x100000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:08 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x0, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1537.713032] binder_alloc: binder_alloc_mmap_handler: 13399 20001000-20004000 already mapped failed -16 [ 1537.723226] binder: BINDER_SET_CONTEXT_MGR already set [ 1537.728928] binder: 13399:13440 ioctl 40046207 0 returned -16 [ 1537.735900] binder_alloc: 13399: binder_alloc_buf, no vma [ 1537.741918] binder: 13399:13441 transaction failed 29189/-3, size 0-0 line 2970 [ 1537.750217] binder: 13399:13441 BC_FREE_BUFFER u0000000020001000 no match 22:54:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x68000000, 0x0, &(0x7f0000000080)}) 22:54:09 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:09 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xf6ffffff, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:09 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x60000000000790c}}]}) 22:54:09 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = syz_open_dev$usb(&(0x7f0000000180)='/dev/bus/usb/00#/00#\x00', 0xc3e, 0x200) syz_open_dev$usb(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0x5, 0x641) r1 = socket$inet6_dccp(0xa, 0x6, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000001c0)={0x20000000}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) setxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='security.ima\x00', &(0x7f0000000300)=@ng={0x4, 0x10, "78ca48eb1f9d5a627f0bd42db8ee3d"}, 0x11, 0x0) accept4$packet(r0, 0x0, &(0x7f0000000200), 0x80800) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) lsetxattr$trusted_overlay_upper(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='trusted.overlay.upper\x00', &(0x7f0000000480)={0x0, 0xfb, 0x34, 0x6, 0x2, "da7cb81ad858f2d62be5b441caf2af9e", "6fb88042fe096ba95d0eaf15bcaff056bcf57c78b30205cfcce8f11d031de9"}, 0x34, 0x3) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000003c0)={r2, 0x1, 0x6}, 0x10) 22:54:09 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1537.757576] binder: send failed reply for transaction 571 to 13399:13405 [ 1537.767495] binder: undelivered TRANSACTION_COMPLETE [ 1537.779051] binder: undelivered TRANSACTION_ERROR: 29189 [ 1537.791175] binder: undelivered TRANSACTION_ERROR: 29189 22:54:09 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:09 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1537.857495] binder: 13451:13456 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:09 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:09 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x7400, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:09 executing program 1: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/qat_adf_ctl\x00', 0x410100, 0x0) ioctl$KVM_SET_GSI_ROUTING(r0, 0x4008ae6a, &(0x7f0000000240)={0x2, 0x0, [{0x8, 0x1, 0x0, 0x0, @irqchip={0x2, 0x784}}, {0x7f, 0x7, 0x0, 0x0, @adapter={0x1, 0x4, 0x1, 0x3, 0x8}}]}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x8000, 0x0) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x5) ioctl$DRM_IOCTL_MODESET_CTL(r1, 0x40086408, &(0x7f00000001c0)={0x10000}) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:09 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000006}}]}) [ 1538.400253] EXT4-fs: 55 callbacks suppressed [ 1538.400264] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1538.643555] binder_alloc: binder_alloc_mmap_handler: 13451 20001000-20004000 already mapped failed -16 [ 1538.653477] binder: BINDER_SET_CONTEXT_MGR already set [ 1538.659296] binder: 13451:13487 ioctl 40046207 0 returned -16 [ 1538.665290] binder_alloc: 13451: binder_alloc_buf, no vma [ 1538.671258] binder: 13451:13488 transaction failed 29189/-3, size 0-0 line 2970 [ 1538.680278] binder: 13451:13488 BC_FREE_BUFFER u0000000020001000 no match 22:54:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0xffffff7f, 0x0, &(0x7f0000000080)}) 22:54:10 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0xc79, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:10 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:10 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$KVM_ASSIGN_DEV_IRQ(r0, 0x4040ae70, &(0x7f00000001c0)={0xb2, 0x9, 0x6, 0x1}) 22:54:10 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000002}}]}) 22:54:10 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x7a00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1538.687939] binder: send failed reply for transaction 574 to 13451:13456 [ 1538.698136] binder: undelivered TRANSACTION_COMPLETE [ 1538.709541] binder: undelivered TRANSACTION_ERROR: 29189 [ 1538.722973] binder: undelivered TRANSACTION_ERROR: 29189 22:54:10 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1538.787368] EXT4-fs (sda1): re-mounted. Opts: [ 1538.803452] binder: 13498:13501 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1538.807072] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1538.856271] EXT4-fs (sda1): re-mounted. Opts: 22:54:10 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:10 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000020000000}}]}) 22:54:10 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = syz_open_dev$midi(&(0x7f0000000180)='/dev/midi#\x00', 0x2ea, 0x2000) accept4$inet(r0, &(0x7f00000001c0), &(0x7f0000000200)=0x10, 0x800) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1538.931256] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:54:10 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x1f000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:10 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1539.056695] EXT4-fs (sda1): re-mounted. Opts: [ 1539.104993] EXT4-fs (sda1): re-mounted. Opts: [ 1539.123087] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1539.166124] EXT4-fs (sda1): re-mounted. Opts: [ 1539.187353] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1539.572678] binder_alloc: binder_alloc_mmap_handler: 13498 20001000-20004000 already mapped failed -16 [ 1539.582925] binder: BINDER_SET_CONTEXT_MGR already set [ 1539.588643] binder: 13498:13536 ioctl 40046207 0 returned -16 [ 1539.594648] binder_alloc: 13498: binder_alloc_buf, no vma [ 1539.601602] binder: 13498:13537 transaction failed 29189/-3, size 0-0 line 2970 [ 1539.609982] binder: 13498:13537 BC_FREE_BUFFER u0000000020001000 no match 22:54:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x68, 0x0, &(0x7f0000000080)}) 22:54:11 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:11 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = syz_open_dev$usb(&(0x7f0000000180)='/dev/bus/usb/00#/00#\x00', 0x5, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f00000001c0)={0x0, 0xe7, "75706f64c473e314c268466c20e5d0c3b954d5c30e4405824d2c69fd2d7e907c684549dec73503d359b773c7d90dbd1129031a41493ef5ec40e64ed2162d9e31a10c62408340411a9d2f0b378254fc1ca6010aa7aada29ffee84ea38ae14dc2febfd6d3ed2bd1551ebdb9570ecec661bb7327d69c98e932780461b0d9332337af55b9989c3f72c2d2c25aa5ad0a41dad9a29c1be4103755dda0e8dd96089698e2db04fea82560b3b5702e5b7c26791924c4a6d67d29ba47b15036994a880ba4ed978bbffcf4997677de200f82790ee610f7517a3560fa539e4d70a2b3cade51fa46c246a62a8df"}, &(0x7f00000002c0)=0xef) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000300)={r1, 0x7f}, &(0x7f0000000340)=0x8) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000000180)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:11 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000006000000}}]}) 22:54:11 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x5, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:11 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1539.617327] binder: send failed reply for transaction 577 to 13498:13501 [ 1539.627234] binder: undelivered TRANSACTION_COMPLETE [ 1539.638837] binder: undelivered TRANSACTION_ERROR: 29189 [ 1539.650917] binder: undelivered TRANSACTION_ERROR: 29189 22:54:11 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1539.701131] binder: 13548:13551 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:11 executing program 1: mkdir(&(0x7f0000000180)='./file0\x00', 0x4) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:11 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:11 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x10, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:11 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:11 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000300}}]}) [ 1540.499638] binder_alloc: binder_alloc_mmap_handler: 13548 20001000-20004000 already mapped failed -16 [ 1540.509675] binder: BINDER_SET_CONTEXT_MGR already set [ 1540.515019] binder: 13548:13586 ioctl 40046207 0 returned -16 [ 1540.521194] binder_alloc: 13548: binder_alloc_buf, no vma [ 1540.526849] binder: 13548:13587 transaction failed 29189/-3, size 0-0 line 2970 [ 1540.534741] binder: 13548:13587 BC_FREE_BUFFER u0000000020001000 no match [ 1540.542537] binder: send failed reply for transaction 580 to 13548:13551 22:54:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x500, 0x0, &(0x7f0000000080)}) 22:54:12 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:12 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) r0 = syz_open_dev$admmidi(&(0x7f0000000340)='/dev/admmidi#\x00', 0x9, 0x90c02) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000380)="2904d1d1ab63b17043a289fd4208dfb359c24146fa38cdfec54e2fa31dcc8e096fb0b720100ebbab8947b477f743d712c6714bf24aab15d8a1c425de52ab3eb3435bea64d92549dbf40c523745d7f387fb6522c66088a999204680bbe041c2258f8a7644fe1cb05146199ef5f6e0b423e725a27a73d1aeb546a292beac3359801da3a7d17c69a265bb3fc8e08177b58221edf97308b78dcf3c0f", 0x9a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f00000005c0)={@loopback, 0x4b, r1}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000440)=0xc) mount$9p_tcp(&(0x7f0000000180)='127.0.0.1\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='9p\x00', 0x488b, &(0x7f00000002c0)={'trans=tcp,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@access_uid={'access', 0x3d, r2}}, {@aname={'aname', 0x3d, 'posix_acl_access&'}}], [{@smackfsroot={'smackfsroot'}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}, {@dont_measure='dont_measure'}]}}) sendto(r0, &(0x7f0000000480)="881e76bc9e0a034c2f632f9867250d0a66892a4cebe2c277c77656188fdbbca65ba29c12aa8fbf77bb7a5b29795ec3ac4f7cb7eb2bfcfe8ec3657d0a73ac0e5819d6846517016e18b9803917f44278a54676e3b4b5cfb9c017d36b49147a163cba3a708a6b9ea4360ee1592c724e3eeccb6152a6027a5967c38ef1f45553c0b3cbc314633ce4ecc8208ad56247641c99095d3e13db47df746281daf8de", 0x9d, 0x4048810, &(0x7f0000000540)=@in6={0xa, 0x4e20, 0x3, @dev={0xfe, 0x80, [], 0x1d}, 0x95d}, 0x80) 22:54:12 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6b6b6b00000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:12 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x3f00000000000000}}]}) 22:54:12 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x700, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1540.551083] binder: undelivered TRANSACTION_COMPLETE [ 1540.562485] binder: undelivered TRANSACTION_ERROR: 29189 [ 1540.575636] binder: undelivered TRANSACTION_ERROR: 29189 22:54:12 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100), 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1540.620365] binder: 13593:13598 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:12 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x1000000000000000}}]}) [ 1540.689674] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 22:54:12 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x1000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:12 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100), 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1540.777593] 9pnet: p9_fd_create_tcp (13609): problem connecting socket to 127.0.0.1 22:54:12 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100), 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1540.839679] 9pnet: p9_fd_create_tcp (13609): problem connecting socket to 127.0.0.1 22:54:12 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x3) r0 = memfd_create(&(0x7f0000000100)="0000000080", 0x3) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000001c0), 0x106, 0xf}}, 0x20) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setfsgid(r1) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000240)=ANY=[@ANYBLOB="844fa385c867ef6b7077aa2061db89a92ee99bee9ae3c7d1ad048517128f30ce556c072af0b5613205b0cfa803c2030091dbe996c116bb38b2bc030655299665062013cf8656f4c6d2f01cbbd61cfe4b381cc6ea532babbaa7e04f46e385ab6dfb2b782bdbf4"]) socket$inet_tcp(0x2, 0x1, 0x0) [ 1541.410133] binder_alloc: binder_alloc_mmap_handler: 13593 20001000-20004000 already mapped failed -16 [ 1541.420825] binder: BINDER_SET_CONTEXT_MGR already set [ 1541.426168] binder: 13593:13634 ioctl 40046207 0 returned -16 [ 1541.432278] binder_alloc: 13593: binder_alloc_buf, no vma [ 1541.437948] binder: 13593:13635 transaction failed 29189/-3, size 0-0 line 2970 [ 1541.445664] binder: 13593:13635 BC_FREE_BUFFER u0000000020001000 no match [ 1541.453390] binder: release 13593:13598 transaction 583 out, still active 22:54:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x6c, 0x0, &(0x7f0000000080)}) 22:54:13 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:13 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x5, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:13 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000002c00}}]}) 22:54:13 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfdfdffff00000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:13 executing program 1: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f00000001c0)="0000000080", &(0x7f00000005c0)='./file0\x00', 0x0, 0x5, &(0x7f0000000540)=[{&(0x7f0000000200)="cc0c7302d36cc5d1bf2cae98b4762d8c9f07b1d099e877536fe44330b5ba3a164e6d5dfc4460e4be624a7881c058bd07c0b886de4541c09261b675ce2d0485c12e1f048b8b6193288ba4ff650938a0584ffaf9d62bcd0580803119b81a9cb2ffbb23268b460ec60105f40a81fee724c59e3ce650f137ec0d2c7c762b5e62129b22748d2f6665db7606b278ef63b1ee570924983a71df843a3161a8829e8703c180eb6f69891a13eec772d2092a7b8b5ced3507bc5617ab4fb87521f18f8ddc1a72fbc7e2f66c353b", 0xc8, 0x5}, {&(0x7f0000000300)="30fc1c519141894c1ac58404eb723a7ac1fc78f2fe8efef7b6719fca4e535ee741528e4d119c40b5638c5fe671bec0da36f414ec9d67df1c768af55bca57e8a2ad3b13d78da30ef18dd6926853cd4567e6489f747e0ba7a280d9a1b9c5fc09def7dcc98e3f6373d8cf71e29136f6dfb828e74b078bd67ca7397722dcf2e0afb7f33f3a11bc2d75fa1d5db087c7de4f36144a736188cd619943f3", 0x9a, 0x6}, {&(0x7f00000003c0)="7c35f0d1ede38217057efdd66fc997a34aeedf6c185927587da427978c3aebbcca0c107cc9492dad230a18092a6f166799f345d6b063cd0ea7398c993800ba08724f93722b3ef0a4cab1089420e5b33e19f13b5ce5ec7c", 0x57, 0x9}, {&(0x7f0000000440)="54af0b8eb79efef4b76d5893d1bc3c358342104b633416edf648453db0dfe0dca18fab00ea0ba2640ce84f63d503610a06a665592e94042ce1561934daf9379b779c8d4d9eb92d6c9e22856e0cd5259b185dac2652e5805610e7a0cdaf500ddb761bc4e3f18e89f8f8b774c5adb491a4520f06db8a8615519db7dceac25f9e051f5e1483", 0x84, 0x2}, {&(0x7f0000000500)="a1e11d20447783ffb23de528f346b94a0b493b3e0bdcd51cfb44fb7145b40828376433ecc78bf8c5", 0x28, 0x6}], 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1541.463136] binder: undelivered TRANSACTION_COMPLETE [ 1541.473424] binder: send failed reply for transaction 583, target dead [ 1541.487573] binder: undelivered TRANSACTION_ERROR: 29189 22:54:13 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1541.551268] binder: 13641:13648 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:13 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:13 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x6000000fdfdffff}}]}) 22:54:13 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6b6b6b, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:13 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140), 0x0, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:13 executing program 1: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)=ANY=[@ANYBLOB="10"]) [ 1542.329268] binder_alloc: binder_alloc_mmap_handler: 13641 20001000-20004000 already mapped failed -16 [ 1542.339235] binder: BINDER_SET_CONTEXT_MGR already set [ 1542.344569] binder: 13641:13682 ioctl 40046207 0 returned -16 [ 1542.350966] binder_alloc: 13641: binder_alloc_buf, no vma [ 1542.356597] binder: 13641:13683 transaction failed 29189/-3, size 0-0 line 2970 [ 1542.365887] binder: 13641:13683 BC_FREE_BUFFER u0000000020001000 no match 22:54:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x7, 0x0, &(0x7f0000000080)}) 22:54:14 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140), 0x0, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:14 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x6, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:14 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x48000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:14 executing program 1: stat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_xen(&(0x7f0000000580)='^\\\x00', &(0x7f0000000540)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x8010, &(0x7f00000005c0)={'trans=xen,', {[{@afid={'afid'}}], [{@uid_eq={'uid', 0x3d, r0}}, {@euid_gt={'euid>', r0}}, {@appraise='appraise'}, {@subj_type={'subj_type', 0x3d, '!'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '/proc/self/net/pfkey\x00'}}, {@obj_role={'obj_role', 0x3d, "0000000080"}}]}}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x10202, 0x0) ioctl$DRM_IOCTL_SET_VERSION(r1, 0xc0106407, &(0x7f0000000280)={0x8, 0xb6b1, 0x6, 0x401}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRES32]) userfaultfd(0x80000) rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./file0\x00') syz_mount_image$ext4(&(0x7f00000002c0)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:14 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000007}}]}) [ 1542.373597] binder: release 13641:13648 transaction 586 out, still active [ 1542.382847] binder: undelivered TRANSACTION_COMPLETE [ 1542.394331] binder: send failed reply for transaction 586, target dead [ 1542.408639] binder: undelivered TRANSACTION_ERROR: 29189 22:54:14 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140), 0x0, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1542.459799] binder: 13692:13695 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:14 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:14 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000048000000}}]}) 22:54:14 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1542.528315] 9pnet: Could not find request transport: xen 22:54:14 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:14 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) [ 1543.255371] binder_alloc: binder_alloc_mmap_handler: 13692 20001000-20004000 already mapped failed -16 [ 1543.266587] binder: BINDER_SET_CONTEXT_MGR already set [ 1543.272705] binder: 13692:13730 ioctl 40046207 0 returned -16 [ 1543.279012] binder_alloc: 13692: binder_alloc_buf, no vma [ 1543.284643] binder: 13692:13731 transaction failed 29189/-3, size 0-0 line 2970 [ 1543.293088] binder: 13692:13731 BC_FREE_BUFFER u0000000020001000 no match 22:54:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x500000000000000, 0x0, &(0x7f0000000080)}) 22:54:15 executing program 1: mkdir(&(0x7f0000000400)='./file0\x00', 0xfffffffffffffffd) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) pipe(&(0x7f0000000180)={0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f00000001c0)=@sack_info={0x0, 0x287, 0x9}, &(0x7f0000000200)=0xc) link(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='./file0\x00') setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000240)={r1, @in6={{0xa, 0x4e21, 0x74e9cebc, @empty, 0x7}}, 0x0, 0x5, 0xbe8e, 0x4, 0x4}, 0x98) connect$rds(r0, &(0x7f0000000380)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f0000000440)={0x57, "968e068fdac5434cda2fe745c27dfe8a5354fdbd46693c59fcad98e5ec3a048c0806987bd604ef91d2b2b85891c5dbb2142a5a4e4dfb0d1ebe8ddd8647220ee7f1de46a8d90756de529c9b5fe86cc37454dbcea16a44c6"}) 22:54:15 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(r0) 22:54:15 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x2, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:15 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000500}}]}) 22:54:15 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7400, &(0x7f0000000100), 0x100020, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1543.300750] binder: release 13692:13695 transaction 589 out, still active [ 1543.310701] binder: undelivered TRANSACTION_COMPLETE [ 1543.322303] binder: send failed reply for transaction 589, target dead [ 1543.335573] binder: undelivered TRANSACTION_ERROR: 29189 22:54:15 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000080)={0x2, 0x84e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000001140), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100)=0x7, 0x4) sendto$inet(r0, &(0x7f0000000140)="d4", 0x1, 0x8000, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) close(0xffffffffffffffff) [ 1543.388982] binder: 13735:13746 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:15 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000006c00}}]}) [ 1543.442283] EXT4-fs: 37 callbacks suppressed [ 1543.442293] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, 22:54:15 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$vfat(&(0x7f0000000180)='vfat\x00', &(0x7f00000001c0)='./file0/file0\x00', 0x401, 0x1, &(0x7f0000000280)=[{&(0x7f0000000200)="1c796be9f3b94a1d24ec1c2fe89053ddbde2509819a84ce70f87f10bf4f4b86b33d19085a78126445cce6cd291d25cb5edc60f52e85a366df709f59befd2831118e557ad6985e6b24667a98ebea3d26bec7d9c4e9263ddf1e83a", 0x5a, 0x3}], 0x204048, &(0x7f00000002c0)={[{@numtail='nonumtail=0'}, {@utf8='utf8=1'}, {@numtail='nonumtail=0'}], [{@fsuuid={'fsuuid', 0x3d, {[0x75, 0x31, 0x7f, 0x63, 0x0, 0x7d, 0x65, 0x39], 0x2d, [0x33, 0x38, 0x37], 0x2d, [0x30, 0x66, 0x62], 0x2d, [0x77, 0x3b, 0x3d, 0x67], 0x2d, [0x39, 0x37, 0x77, 0x67, 0x33, 0x38, 0x35, 0x62]}}}, {@defcontext={'defcontext', 0x3d, 'staff_u'}}, {@subj_user={'subj_user', 0x3d, '-'}}]}) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:15 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x1f00000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:15 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x4000000000000000, &(0x7f0000000380)={&(0x7f0000000300)={0x2, 0x2, 0x0, 0x9, 0x10, 0x0, 0x0, 0x0, [@sadb_x_sa2={0x2, 0x13, 0x2}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @mcast1={0x11e, 0x17, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x17}}}]}, 0x80}}, 0x0) [ 1543.587317] FAT-fs (loop1): Unrecognized mount option "fsuuid=u1c" or missing value [ 1543.641110] EXT4-fs (sda1): re-mounted. Opts: 22:54:15 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000900}}]}) [ 1543.695457] FAT-fs (loop1): Unrecognized mount option "fsuuid=u1c" or missing value [ 1543.710543] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1543.736426] EXT4-fs (sda1): re-mounted. Opts: [ 1543.796432] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1543.818356] EXT4-fs (sda1): re-mounted. Opts: [ 1544.177566] binder_alloc: binder_alloc_mmap_handler: 13735 20001000-20004000 already mapped failed -16 [ 1544.188016] binder: BINDER_SET_CONTEXT_MGR already set [ 1544.193363] binder: 13735:13786 ioctl 40046207 0 returned -16 [ 1544.199731] binder_alloc: 13735: binder_alloc_buf, no vma [ 1544.205875] binder: 13735:13787 transaction failed 29189/-3, size 0-0 line 2970 [ 1544.214029] binder: 13735:13787 BC_FREE_BUFFER u0000000020001000 no match 22:54:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x7a00, 0x0, &(0x7f0000000080)}) 22:54:16 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='cpu.stat\x00', 0x0, 0x0) r2 = socket$inet(0x2b, 0x1, 0x0) sendfile(r2, r1, 0x0, 0xffffffff80000000) 22:54:16 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/hash_stats\x00', 0x0, 0x0) mkdirat(r0, &(0x7f00000001c0)='\x00', 0x2) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000480)={0x0, 0x2}, &(0x7f00000004c0)=0x8) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000780)) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000500)={0x0, 0xf2, 0x4, 0x8, 0x1f, 0x74a}, &(0x7f0000000540)=0x14) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000580)={0x0, 0xff}, &(0x7f00000005c0)=0x8) sendmsg$inet_sctp(r0, &(0x7f0000000740)={&(0x7f0000000200)=@in={0x2, 0x4e23, @loopback}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000240)="9e25cd44361215a41290377e8aa05b3b46b985c602ee81cb17f9e520e74fe193e4ddf9d51d6fbdd52990846328ad31b59c767e2e15051dea281079f0f42bcabb0e69acbfa0f272a4fe9556f228d9c611f38ff2f313810fc3bd04bba6ffecf04a1f6b94f9fd13c030be813382758975fa19547b9579ce5e0091a35ceb8a4a3d1cbb0cd6ded32f6dcb44edf7d04ebbdc61c3263932450121c7481b6acdc8fded290be30333c924ac008babf4f0121701992eeb29085898f1a9c9ce5a5ed97aa7bb8c91027c2aac8ab7fb6bdd69489b994ebd84ca54e8359f5a4069bb713ab3cd68af098d9766a4cf49075c80da7b2d59ab2a43a105f6b3f5993a", 0xf9}, {&(0x7f0000000340)="06c6c8e01be2548be17563c177aa080299976118a2782c242288aeb004fbfdfaf3df7c2addb1fe4cd48209b43e5b3251e09269776ef3d0b1f0ed61a1af1369369b83c9aa21856a3779322a090658f90943d1e9ad0ca782550c8701f99509894aab930c97a17937731a57dede308f958d03b5dab6597153ef2f6b0ac9255971050686a25b51", 0x85}, {&(0x7f0000000400)}], 0x3, &(0x7f0000000600)=[@sndrcv={0x30, 0x84, 0x1, {0x3, 0x7, 0x2, 0x8, 0x0, 0x0, 0x1, 0x101, r1}}, @init={0x18, 0x84, 0x0, {0x817, 0x61, 0x0, 0x47b9}}, @sndrcv={0x30, 0x84, 0x1, {0x3, 0x4, 0x200, 0x400, 0x7fffffff, 0xfffffffffffffffc, 0x3, 0x8, r2}}, @authinfo={0x18, 0x84, 0x6, {0x2}}, @init={0x18, 0x84, 0x0, {0x100, 0x7, 0x4, 0x3}}, @init={0x18, 0x84, 0x0, {0x2, 0x0, 0x4}}, @dstaddrv4={0x18, 0x84, 0x7, @loopback}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x8}}, @sndinfo={0x20, 0x84, 0x2, {0x1ff, 0x8, 0x4000000, 0x1, r3}}, @dstaddrv6={0x20}], 0x130, 0x10}, 0x80) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000400)=r3, 0x4) 22:54:16 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x6c00000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:16 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x1000fd, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:16 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0xb00000000000000}}]}) [ 1544.221967] binder: send failed reply for transaction 592 to 13735:13746 [ 1544.229448] binder: undelivered TRANSACTION_COMPLETE [ 1544.234620] binder: undelivered TRANSACTION_ERROR: 29189 [ 1544.251474] binder: undelivered TRANSACTION_ERROR: 29189 22:54:16 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r1, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r1, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) fcntl$dupfd(0xffffffffffffffff, 0x0, r0) sendto$inet6(r1, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1544.298472] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1544.327081] binder: 13794:13802 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1544.335789] EXT4-fs (sda1): re-mounted. Opts: 22:54:16 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x60000004c000000}}]}) 22:54:16 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x200000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1544.361554] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1544.399586] EXT4-fs (sda1): re-mounted. Opts: 22:54:16 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x1000fe, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:16 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x100) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:16 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r1, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r1, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) fcntl$dupfd(0xffffffffffffffff, 0x0, r0) sendto$inet6(r1, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1545.095323] binder_alloc: binder_alloc_mmap_handler: 13794 20001000-20004000 already mapped failed -16 [ 1545.105441] binder: BINDER_SET_CONTEXT_MGR already set [ 1545.111252] binder: 13794:13841 ioctl 40046207 0 returned -16 [ 1545.117259] binder_alloc: 13794: binder_alloc_buf, no vma [ 1545.123446] binder: 13794:13842 transaction failed 29189/-3, size 0-0 line 2970 [ 1545.132646] binder: 13794:13842 BC_FREE_BUFFER u0000000020001000 no match 22:54:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x4c00, 0x0, &(0x7f0000000080)}) 22:54:17 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000004000000}}]}) 22:54:17 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x40000000000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:17 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x10fffd, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:17 executing program 1: mkdir(&(0x7f00000002c0)='./file0/file0\x00', 0x0) r0 = syz_open_dev$audion(&(0x7f0000000180)='/dev/audio#\x00', 0x5, 0x2) lseek(r0, 0x0, 0x2) recvfrom(r0, &(0x7f00000001c0)=""/9, 0x9, 0x0, &(0x7f0000000200)=@un=@file={0x0, './file0\x00'}, 0x80) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)=ANY=[@ANYBLOB="f1"]) 22:54:17 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r1, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r1, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) fcntl$dupfd(0xffffffffffffffff, 0x0, r0) sendto$inet6(r1, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1545.140050] binder: send failed reply for transaction 595 to 13794:13802 [ 1545.149627] binder: undelivered TRANSACTION_COMPLETE [ 1545.161267] binder: undelivered TRANSACTION_ERROR: 29189 [ 1545.173087] binder: undelivered TRANSACTION_ERROR: 29189 [ 1545.261146] binder: 13857:13858 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:17 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) r0 = creat(&(0x7f0000000200)='./file0\x00', 0x8) write$FUSE_OPEN(r0, &(0x7f0000000240)={0x20, 0x0, 0x3, {0x0, 0x5}}, 0x20) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x208400, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000001c0)) 22:54:17 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000002000000}}]}) 22:54:17 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x22000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:17 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x10fffe, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:17 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r1, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r1, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) fcntl$dupfd(0xffffffffffffffff, 0x0, r0) sendto$inet6(r1, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:17 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x111000, 0x0) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000300)={0x2}, 0x1) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f0000000200)=""/226, &(0x7f0000000140)=0xe2) mount$bpf(0x20000000, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000180)='bpf\x00', 0x1008000, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00']) [ 1546.059171] binder_alloc: binder_alloc_mmap_handler: 13857 20001000-20004000 already mapped failed -16 [ 1546.069203] binder: BINDER_SET_CONTEXT_MGR already set [ 1546.074538] binder: 13857:13896 ioctl 40046207 0 returned -16 [ 1546.080931] binder_alloc: 13857: binder_alloc_buf, no vma [ 1546.086568] binder: 13857:13897 transaction failed 29189/-3, size 0-0 line 2970 [ 1546.094651] binder: 13857:13897 BC_FREE_BUFFER u0000000020001000 no match [ 1546.102757] binder: send failed reply for transaction 598 to 13857:13858 22:54:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0xfffffdfd, 0x0, &(0x7f0000000080)}) 22:54:18 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x1000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:18 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000003000000}}]}) 22:54:18 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r1, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r1, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) fcntl$dupfd(0xffffffffffffffff, 0x0, r0) 22:54:18 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100025, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:18 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) mkdir(&(0x7f0000000180)='./file0\x00', 0x180) [ 1546.112566] binder: undelivered TRANSACTION_COMPLETE [ 1546.124053] binder: undelivered TRANSACTION_ERROR: 29189 [ 1546.136100] binder: undelivered TRANSACTION_ERROR: 29189 [ 1546.204909] binder: 13907:13911 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:18 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x6000000fffffff6}}]}) 22:54:18 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x4c000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:18 executing program 1: lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@random={'btrfs.', 'em0-:+\x00'}, &(0x7f0000000200)="5c70726f632b2aa700", 0x9, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)=ANY=[@ANYBLOB="04"]) 22:54:18 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x10002f, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:18 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000004}}]}) 22:54:18 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) r0 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x2, 0xa000) ioctl$KVM_ASSIGN_SET_MSIX_NR(r0, 0x4008ae73, &(0x7f00000001c0)={0x3}) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) [ 1546.990334] binder_alloc: binder_alloc_mmap_handler: 13907 20001000-20004000 already mapped failed -16 [ 1547.001412] binder: BINDER_SET_CONTEXT_MGR already set [ 1547.006756] binder: 13907:13953 ioctl 40046207 0 returned -16 [ 1547.013161] binder_alloc: 13907: binder_alloc_buf, no vma [ 1547.018831] binder: 13907:13954 transaction failed 29189/-3, size 0-0 line 2970 [ 1547.026537] binder: 13907:13954 BC_FREE_BUFFER u0000000020001000 no match 22:54:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x48, 0x0, &(0x7f0000000080)}) 22:54:18 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x22, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:18 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100058, &(0x7f0000000100)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:18 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x13e, &(0x7f0000000100), 0x100020, &(0x7f0000000200)={[], [], 0x400000000000000}) 22:54:18 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000004000}}]}) 22:54:18 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1547.034748] binder: release 13907:13911 transaction 601 out, still active [ 1547.044654] binder: undelivered TRANSACTION_COMPLETE [ 1547.056308] binder: send failed reply for transaction 601, target dead [ 1547.069543] binder: undelivered TRANSACTION_ERROR: 29189 22:54:19 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xffffff8c, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1547.124107] binder: 13965:13969 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:19 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000040000000}}]}) 22:54:19 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2000ffe, &(0x7f0000000040)=ANY=[@ANYRESOCT]) syz_mount_image$ext4(&(0x7f0000000380)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x7, 0xe0, &(0x7f0000000240)=[{&(0x7f00000002c0)="deac3db9c3c1a03e3c342ef9e73a3d796c748326d2030a86fcf84c21158892a5c56dc0a8bae53bdac5a67fe5c3f7e1995fe449769a610c84521c703c0a16f8082eec8f4aafdfb5796cdae6fd0c5d15ca28bd9217a06fba69f49e0998d96023f6f342b3cca8dc91563c54b954293f9b7bb1460ca193dbbb1706f78b191ac3dfa13a75a970dae91dcf7d3e4e5ee437b90d43e894a583dbd9d470e81f31968689c2e9ceba3cf386b4aae0feba9ba020d9c135d0320ad7c832", 0x1fc, 0x7}], 0x100020, &(0x7f00000003c0)={[], [], 0x400000000000000}) r0 = accept4$alg(0xffffffffffffff9c, 0x0, 0x0, 0x800) sendmmsg$alg(r0, &(0x7f0000001100)=[{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000400)="7f3ee3c51cb6abb1b77f8835281146c796892c69929ff77da246ef5ab6e8431e680abac4655fe60923bf3525c7587be2733975b5291dc0537bd71c3f2836f386e9c2f4891444a5a898629f0996e8a23ac924523b9324d0f887e9580ac73cfa06cb1397160924eb0273bda9f01e51229f2f2bbd6d50320699b1db028a66523deab0607e64d3d604ef0b2ed5c6ec6c4db7ebe8ee82e242f4b5130de7bfd580ae2af5c0b490e80a876b06626fa27ff898404e63022ddeddd875f4f77eab793bc265b03ba14cbdc0515a4be8b2f4524649f6c4a1d1521e7c2b385d5a", 0xda}], 0x1, &(0x7f0000000500)=[@assoc={0x18, 0x117, 0x4, 0x80000001}, @op={0x18}, @iv={0xf0, 0x117, 0x2, 0xd8, "2f920f66eebe9a7768c17624f1fbc35b24b71f8d2c090ab7d8e0f80ca0016dfb799aaf84360fde5ee13997f923f31601b469d9967dfd2c0f48c930590b47fa2c7beaa9468570677d9e65a829f8860157870f598fb0f33876c95cfc88a9d0037a65af60fa6ce9c78d1fcaa2a0e584b491298e68a789cd0c21cffe959f06cf1c01a8d659ea158a317715a83e1fe4fab406175a508bbf756c4c06ac727498d80fe77c1d65a742781fd38e3ff98d14c7af270f6340fa9fb5975e73993109cc6210fe70fb60710162476ba4228e63927c89665f99d3b5f7d3dc17"}, @assoc={0x18, 0x117, 0x4, 0x1f}, @op={0x18, 0x117, 0x3, 0x1}, @op={0x18}, @assoc={0x18}, @iv={0x60, 0x117, 0x2, 0x48, "7adb0933c47fdec4d9d3270c3618f5701a21c4e1fdce3e310d4eced4770d056e08d72e2ff543620331ece02a056bb7c3591617704c563c7d9e6f29fdddb897b53639c05a322a93b1"}, @op={0x18}], 0x1f8, 0x8084}, {0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000700)="37afb8649cb41bfd901be2c8b305e682fd8d2445d5582eb0d69e6fd97ccc1abb0e4fd22720e506d7ba43402f9edd31057d38d18121291aacc5d7f124f1d3f360ab184ca0db8f60850445c73f63a5d9ef915e1fcbfe550ac10c81facd8a00749f8a0c5a284990d80145db0206289ccc8c647936d85c2c1d5d98ca4a2c654ddb48bb2e6c211b62d7294df976c77308186c6c57a7964c0d829adb88fec9fe7264240f1d955e31b7cdbcb51f1df966cca9b4fb2c87a0f0183006b5c793f41cb301c007cd893a1a1dd8caf1c84cbaa2b15f273c94bad436e7af8467a1177c92f77141e00962d521831630fe1c7cc8abed", 0xee}, {&(0x7f0000000180)="efca74e58fadeafc802f85fc037cb22de041b2185d024d9092e08219e660e2ad6f8a766ac71ef32d232b48b6719f5deabf034937d11b89d58dbdfd0585d6", 0x3e}, {&(0x7f0000000800)="48dec82152025055f2c565aebc8fe7b6d0cba5153f1b602fb187a2ef0003a87549a6ac23898d01eeef0ec5d40d578ef60748c4855661491cdb897e7d39ea69e709e2d21a935266f43bfd7212635aac2f1bd6bde0e1af872632f1b53359fc18bac40b27ea7ed8d2235361dcfe3a90821495c67a46c189b136d98a8874deb02bbb9009f60ac6b539d385c43cdeeb7c423b2515b5b7c8581518088e93d14a5f34a1ff92077c2ed73aed28bdbc04f9cbcb5e221d66b37115e40074cc7366d4883d8c60171877e6f9634822c90d8c12ca92d3b10cdeffd827c605b3f404dac8558654ed78ca0dce1d6f5474de5157176d30", 0xef}, {&(0x7f00000001c0)="836f", 0x2}, {&(0x7f0000000900)="5b52208c1975d049cbe908b4ee9474a0edfe095341037542bdec25975fd7893c11af24eff96071983b745dd4aaa226ce46143da368dd37b260d9e55ac72119a8e4b7a213ab560ae4b33cdca1f2352c00b8f55856983848393b0e29c7d9f14e96a723d9dba418e1937db13dffd78ca786784b24c5a9930415645ba09b8870831e9a62b706b6edcbeea1e0941b8407ce0bab04638bfc1469bd85e3da9ace0b0c903cdaae60096b4ff578138142d31560225f446ddb6e19068ea0c21af5dea57bd0b1b49cc6d471662272f4", 0xca}], 0x5, 0x0, 0x0, 0x4004}, {0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000a80)="a6d2ea91cee5349c1981428896b7400df71a74a1240f058def59facfa8069bd0230f8f0795a2d8c0e5bb0f1690b17e5402eb507ae933f49cc8e1d7e517fe5a55daaca00a8ccb1f93911cb5a9f7f63c41640c31d1b44449d4096b96ab286cab8d52daee8cbbd7f832b9afc92e24034a8ba73dd743ac78ba4e3dd42d6e14b30840cae8fc73aebc7b0ababdb6fbdd2c6acc378219d64b1adb42a3886c89889833ff98634856533ff3ecd63800ed14c5ac3b7a5e0b07c4241672710da8278b140d7cc1f5eaa41971e650eae73582e0c4e77e50c667b5f42e217201cb394cc1c464177e114f", 0xe3}, {&(0x7f0000000200)="829c875551faa0356b32c152acea0573b7789f2312909b0064f37ab8396eb5ec72ff83", 0x23}], 0x2, &(0x7f0000000b80)=[@op={0x18}, @iv={0xf0, 0x117, 0x2, 0xdc, "e19c959a6d6f9f457f67823383481c2f2a59ec671ba6f7e88ea0f366cf7123a29683c47912ad0e79cb1b8a7c4ab22409b62e5b48d89d3cad4b4cec8798e23ac3b88173c482dcb3e6c33609c1ce1516180fd18c6c0fdabc609b86f1c232e23f52b89a8af467872e8e1a853b717b07eb3f5ab3e29f84aa90f4b9878a84520cb3f1b16143311cf7b8c70a3ce0a1ac8923a7b13623a4175353ad5b82e809cc3b0cc11d01f566c133eb76a356f2fd5e9c534465cfe53ebf5629b0bcd2e11ff22ffdd28b964e9de609e03f8b1a180d21b95ff02f8fe67cb71925a515f1d9a5"}], 0x108, 0x20000090}, {0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000cc0)="16a3343a80971cf2477375f7d51201db194788cb53945a4c54f3bcba7dab87d9f84ffc86453b831077afa7a22aa94a4da688d3d229fb5b9e71fd6f4d8a7aea65c4fdbaf9f470343d9774293f4ac461ab40a08cf09ebda793349f7ba7e6bb67b0ec23d7d02d6bcdcc929eb50fde041e3c7c7a7616b8e88ab83d1e", 0x7a}, {&(0x7f0000000d40)="69d48c08a121c1e5417146e85b724ada2396441ecb049073665765298da87f686681760cb8e2e05efeadbd7d7c80d6c238ad62be00782206b8baf55bf57ff8ad83e9ffd5c72e755ca62a997cf4f9282070fc199aa7a07da49b7397", 0x5b}, {&(0x7f0000000dc0)="347b938397c56fdb22e9da2b718048125957a4bfdb1db885e444a3d3353c4a6a28204086ae2dad25d93d5bde86a28e9bdba14215c08edc5070b4dfa223b66c8ae868e3bb29662d54048d497ffe65c5d90ca464e009b9bd367ad70ca33905a5d11aa3f6e3960e6beceb503b4a2c0095800bd5dfcce506f968ecba471c1f420b2ba1df6ed6f24640057f", 0x89}, {&(0x7f0000000e80)="164820117b2a5c28ba980aac8d6f6447ae682838227f7d4a9da4feaef95ed518b4112a86f1c05352632dfb07f13308e308caacd485f7e99c625fa9474f4297700d9384d6811da414cdc2f83f7ac299c2653ff14103b2751e7098c7c147371dd1cac6e8628fd26ae48585c68960589bf8e23407e861af4eff179fd6181c858fdbce4bd37e0ede0b873d1e4ff32d2e9ccbddd2c3792e51106bc918fe5a326d684a856c60ee827b74ede13115b7f1154a1cfb8898f55c0e8db8b91681d9af0c082308f39caa493e919377fc474c46348b1b0b94b463bf1685a36b24d2ca583436fdd2c8ec228833c89bf887e711e480808a99d5ee5f8a21", 0xf6}, {&(0x7f0000000f80)="893b33e984d6396492b80201b4e149f039cf0c5914c5a34b0905da8e26b23621099591f2c9f375bf5e10cb63ccc9cbf02677d0d8f5ba7389b18077106caab91660e8f5fc6168467b7cf3ec1e495895dc02eb9ae60dea2ba4ac0f2cbc3c855500f099c86de590665503f4001f07d1b29beb0ede7930c1d50fe99d02bdf9a7f7ec26a7886fa2cae2e03da651c38445921ee3a4668b83dcf5045cf352e675608193f5002f522cdb59495a539a3b66fe722aca912060eb275da67aec589b056573c2a95f8b13983fe499ef81c015cd0ba75260b7ff7d4a809f14e67cd125dcc12959e6d769", 0xe3}], 0x5, 0x0, 0x0, 0x20000000}], 0x4, 0xc817f60da7838631) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000001200)='/proc/self/net/pfkey\x00', 0x410000, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001280)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000001380)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x78, r2, 0x228, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x58, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'irlan0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x6}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) 22:54:19 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x300000000000000}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:19 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:19 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0xfcfdffff00000000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1547.920700] binder_alloc: binder_alloc_mmap_handler: 13965 20001000-20004000 already mapped failed -16 [ 1547.931099] binder: BINDER_SET_CONTEXT_MGR already set [ 1547.936452] binder: 13965:14010 ioctl 40046207 0 returned -16 [ 1547.942836] binder_alloc: 13965: binder_alloc_buf, no vma [ 1547.948520] binder: 13965:14011 transaction failed 29189/-3, size 0-0 line 2970 [ 1547.956230] binder: 13965:14011 BC_FREE_BUFFER u0000000020001000 no match [ 1547.964261] binder: send failed reply for transaction 604 to 13965:13969 22:54:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x5, 0x0, &(0x7f0000000080)}) 22:54:19 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x60000003f000000}}]}) 22:54:19 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = accept$nfc_llcp(0xffffffffffffff9c, &(0x7f0000000180), &(0x7f0000000200)=0x60) clock_gettime(0x0, &(0x7f0000001d00)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000001c80)=[{{&(0x7f0000000240)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f00000015c0)=[{&(0x7f00000002c0)=""/57, 0x39}, {&(0x7f0000000300)=""/194, 0xc2}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/46, 0x2e}, {&(0x7f0000001440)=""/120, 0x78}, {&(0x7f00000014c0)=""/172, 0xac}, {&(0x7f0000001580)=""/44, 0x2c}], 0x7, &(0x7f0000001640)=""/167, 0xa7, 0x9}, 0x1}, {{&(0x7f0000001700)=@can, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001780)=""/45, 0x2d}, {&(0x7f00000017c0)=""/53, 0x35}, {&(0x7f0000001800)=""/235, 0xeb}, {&(0x7f0000001900)=""/153, 0x99}, {&(0x7f00000019c0)=""/87, 0x57}, {&(0x7f0000001a40)=""/133, 0x85}, {&(0x7f0000001b00)=""/242, 0xf2}], 0x7, 0x0, 0x0, 0x8}, 0x9d4a}], 0x2, 0x41, &(0x7f0000001d40)={r1, r2+30000000}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:19 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:19 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0xffffffff00000000}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:19 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x790c0000, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1547.974073] binder: undelivered TRANSACTION_COMPLETE [ 1547.985583] binder: undelivered TRANSACTION_ERROR: 29189 [ 1547.997699] binder: undelivered TRANSACTION_ERROR: 29189 [ 1548.051780] binder: 14015:14025 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:19 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)='bpf\x00', 0x20b8001, &(0x7f00000003c0)=ANY=[]) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0)=0x0) sched_setscheduler(r0, 0x5, &(0x7f0000000140)=0x1000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)=ANY=[@ANYBLOB='!']) 22:54:19 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000003f00}}]}) 22:54:19 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x1f00, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:20 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:20 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x20000000}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:20 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000006800}}]}) [ 1548.837451] binder_alloc: binder_alloc_mmap_handler: 14015 20001000-20004000 already mapped failed -16 [ 1548.847777] binder: BINDER_SET_CONTEXT_MGR already set [ 1548.853358] binder: 14015:14064 ioctl 40046207 0 returned -16 [ 1548.859817] binder_alloc: 14015: binder_alloc_buf, no vma [ 1548.865546] binder: 14015:14065 transaction failed 29189/-3, size 0-0 line 2970 [ 1548.873900] binder: 14015:14065 BC_FREE_BUFFER u0000000020001000 no match 22:54:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x4c000000, 0x0, &(0x7f0000000080)}) 22:54:20 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f0000000400)=0xc) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="b5f7eb06ea8e045661022aabdf3a4b0010b2f8f448d72c30732c359723fb083b5d3dfb6909dfdec74cd5ec08c4f3a7bbf52a784508697036157ef5491185339be435d750366917d3388f00156a5ea043a126d1cede60a1f568225bf200ca2e07fe6557968979b7", 0x67, 0x81}, {&(0x7f0000000200)="18aebe4d9582bc3641aacb012d2d8089e45d33dcf2a62a7b7f816eb336e2f48fb9b7852e127fc3041390e95fec8b1f40b8c43f648993058d5d57c151ce09b7f992ab429ea72f8d863edf36f15af4fe6f34fd8b7134e18e6d78ab4888f73545be95ec1d1ab349674f0493c35d55240b081734ce95ba058c738dc221c281a6bc59b1", 0x81, 0x800}], 0x100020, &(0x7f0000000440)={[], [{@mask={'mask', 0x3d, 'MAY_WRITE'}}, {@pcr={'pcr', 0x3d, 0x3}}, {@dont_measure='dont_measure'}, {@dont_hash='dont_hash'}, {@smackfsdef={'smackfsdef', 0x3d, 'bpf\x00'}}, {@uid_eq={'uid', 0x3d, r0}}], 0x400000000000000}) 22:54:20 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x790c, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:20 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:20 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x3000000}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:20 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000068}}]}) [ 1548.881526] binder: release 14015:14025 transaction 607 out, still active [ 1548.891391] binder: undelivered TRANSACTION_COMPLETE [ 1548.905189] binder: send failed reply for transaction 607, target dead [ 1548.917132] binder: undelivered TRANSACTION_ERROR: 29189 [ 1548.968318] EXT4-fs: 38 callbacks suppressed [ 1548.968329] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1548.976537] binder: 14072:14076 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1548.989874] EXT4-fs (sda1): Unrecognized mount option "mask=MAY_WRITE" or missing value [ 1549.004173] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000010, [ 1549.014594] EXT4-fs (sda1): re-mounted. Opts: 22:54:20 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000009}}]}) [ 1549.080696] EXT4-fs (sda1): re-mounted. Opts: 22:54:20 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x5, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:21 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x4800}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:21 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000000240)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) 22:54:21 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1549.220610] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value [ 1549.255528] EXT4-fs (sda1): re-mounted. Opts: [ 1549.273806] EXT4-fs (sda1): re-mounted. Opts: 22:54:21 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x3, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1549.296266] EXT4-fs (sda1): Unrecognized mount option "inode_re" or missing value [ 1549.335137] EXT4-fs (sda1): re-mounted. Opts: [ 1549.759377] binder_alloc: binder_alloc_mmap_handler: 14072 20001000-20004000 already mapped failed -16 [ 1549.769018] binder: BINDER_SET_CONTEXT_MGR already set [ 1549.774352] binder: 14072:14119 ioctl 40046207 0 returned -16 [ 1549.780815] binder_alloc: 14072: binder_alloc_buf, no vma [ 1549.786448] binder: 14072:14120 transaction failed 29189/-3, size 0-0 line 2970 [ 1549.794575] binder: 14072:14120 BC_FREE_BUFFER u0000000020001000 no match [ 1549.802182] binder: release 14072:14076 transaction 610 out, still active 22:54:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x1000000, 0x0, &(0x7f0000000080)}) 22:54:21 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:21 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x7a00}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:21 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000010}}]}) 22:54:21 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='pids.events\x00', 0x0, 0x0) openat$cgroup_ro(r0, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) 22:54:21 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4000000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1549.812254] binder: undelivered TRANSACTION_COMPLETE [ 1549.823572] binder: send failed reply for transaction 610, target dead [ 1549.837744] binder: undelivered TRANSACTION_ERROR: 29189 [ 1549.888897] binder: 14127:14132 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:21 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:21 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x6000000f6ffffff}}]}) 22:54:21 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000180)={0x2, 0x0, @rand_addr}, &(0x7f00000001c0)=0x10, 0x800) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000280)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f0, 0x398, 0x398, 0xc0, 0x0, 0xc0, 0x458, 0x458, 0x458, 0x458, 0x458, 0x6, &(0x7f0000000200), {[{{@uncond, 0x0, 0x98, 0xc0}, @TTL={0x28, 'TTL\x00', 0x0, {0x1, 0x7ff}}}, {{@ip={@loopback, @multicast1, 0xff, 0xffffff00, 'ipddp0\x00', 'bridge0\x00', {0xff}, {}, 0x6c, 0x1, 0x10}, 0x0, 0xb8, 0xe0, 0x0, {}, [@common=@socket0={0x20, 'socket\x00'}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x1, 0x1, 0x2}}}, {{@ip={@remote, @broadcast, 0x0, 0xffffff00, 'teql0\x00', 'gretap0\x00', {}, {0xff}, 0x73, 0x0, 0x40}, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x8}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x0, 0xffffffffffffffe0, 0x1}}}, {{@uncond, 0x0, 0xe8, 0x110, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x2}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x4}}]}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x8}}}, {{@uncond, 0x0, 0x98, 0xc0}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x28d, 0x1ff80000000000}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x550) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2000ffe, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000800)=ANY=[@ANYBLOB="97530e668fcc77128e89335700"]) 22:54:21 executing program 0: r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:21 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x10}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:21 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x200000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1550.677490] binder_alloc: binder_alloc_mmap_handler: 14127 20001000-20004000 already mapped failed -16 [ 1550.687202] binder: BINDER_SET_CONTEXT_MGR already set [ 1550.692920] binder: 14127:14173 ioctl 40046207 0 returned -16 [ 1550.699233] binder_alloc: 14127: binder_alloc_buf, no vma [ 1550.704868] binder: 14127:14174 transaction failed 29189/-3, size 0-0 line 2970 [ 1550.713721] binder: 14127:14174 BC_FREE_BUFFER u0000000020001000 no match 22:54:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x4, 0x0, &(0x7f0000000080)}) 22:54:22 executing program 0: r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:22 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000022000000}}]}) 22:54:22 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f00000005c0)='/dev/vcs#\x00', 0xfffffffffffffffb, 0x135502) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000600)={0x0, 0x13, "35222d76f99e95f4b7a01f0d13e0147b7500b9"}, &(0x7f0000000640)=0x1b) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000680)={r1, 0x2, 0x3, 0x3ff}, 0x10) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) quotactl(0x2, &(0x7f0000000100)='./file0\x00', r2, &(0x7f0000000300)="0f8b257bfa66488cf5d69f1d82cc503be2e955630d5f2c77cfcd3b32ffe238157def390943c406e30677064044c7f4ab9ab1d711adcd9d805c7b25be7b1cec322165867090007fd3547ec0fcca2e4fb127fd42c8eae3bb3ee2ceb27228533b32a56c1e08400ae9fef3c0e7ec1cf6b1461f25513dd068a188038753177fd5adbc97fcd963c09bfb6e506846d59219f3910195925e52ae233f33f549335de01e66f0148139c5cd00ae5b2d8ca2848dfacb6707") r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000440)='/dev/audio\x00', 0x8000, 0x0) r5 = perf_event_open$cgroup(&(0x7f0000000480)={0x7, 0x70, 0x10001, 0x3, 0x2, 0x7, 0x0, 0x6, 0x80000, 0x9, 0x4, 0x7f, 0x4, 0x4, 0x1000, 0x6, 0x4, 0x80000001, 0x7, 0xb14, 0x7f, 0x200000000000, 0x3f, 0x14a52201, 0x31e, 0x20, 0x9, 0x10001, 0x3, 0x3, 0x7, 0x7f, 0x1, 0x4, 0x6, 0x800, 0xd3c, 0x80000001, 0x0, 0x5, 0x5, @perf_config_ext={0x3, 0x6}, 0x1000, 0x2d2, 0x8, 0x7, 0x2, 0x3, 0xfff}, 0xffffffffffffffff, 0xe, 0xffffffffffffff9c, 0x9) mount$9p_fd(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='9p\x00', 0x2080, &(0x7f0000000500)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@debug={'debug'}}, {@dfltgid={'dfltgid', 0x3d, r3}}], [{@fowner_eq={'fowner', 0x3d, r2}}]}}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000000080)=ANY=[@ANYPTR=&(0x7f0000000040)=ANY=[@ANYRES16, @ANYPTR64=&(0x7f0000000180)=ANY=[@ANYRES32, @ANYPTR, @ANYBLOB="e62413088c4d97aa69c2da5acee06218d96f9cdc3adbf10a1da4ea710197b28a2fc12d7bc5b626b1c0f874a3a208809eac882987c8d354daf019cac6f0a08751ed2d092e", @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYRES16, @ANYRESDEC, @ANYPTR64, @ANYBLOB="e28fd9980207e637d6520f7bcb2f0ac31a1cb20393c9b6b5ef5de64e"], @ANYRES32], @ANYRESOCT, @ANYRES32, @ANYRES16, @ANYPTR]) 22:54:22 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:22 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2000000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1550.721426] binder: release 14127:14132 transaction 613 out, still active [ 1550.731346] binder: undelivered TRANSACTION_COMPLETE [ 1550.743008] binder: send failed reply for transaction 613, target dead [ 1550.772381] binder: undelivered TRANSACTION_ERROR: 29189 22:54:22 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) r0 = socket(0x0, 0x806, 0x1) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x80000000, 0x4) 22:54:22 executing program 0: r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1550.820737] binder: 14182:14188 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:22 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x7a00000000000000}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:22 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000004800}}]}) 22:54:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:22 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x790c, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1551.599087] binder_alloc: binder_alloc_mmap_handler: 14182 20001000-20004000 already mapped failed -16 [ 1551.608720] binder: BINDER_SET_CONTEXT_MGR already set [ 1551.614507] binder: 14182:14225 ioctl 40046207 0 returned -16 [ 1551.620918] binder_alloc: 14182: binder_alloc_buf, no vma [ 1551.626531] binder: 14182:14226 transaction failed 29189/-3, size 0-0 line 2970 [ 1551.634623] binder: 14182:14226 BC_FREE_BUFFER u0000000020001000 no match [ 1551.642368] binder: send failed reply for transaction 616 to 14182:14188 22:54:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x2000000000000000, 0x0, &(0x7f0000000080)}) 22:54:23 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000240)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@broadcast}}, &(0x7f0000000340)=0xe8) mount$9p_unix(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='9p\x00', 0x190030, &(0x7f0000000380)={'trans=unix,', {[{@access_any='access=any'}, {@access_uid={'access', 0x3d, r0}}, {@cache_none='cache=none'}, {@fscache='fscache'}], [{@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@subj_role={'subj_role', 0x3d, '+[proc@'}}, {@permit_directio='permit_directio'}, {@subj_user={'subj_user', 0x3d, '/'}}, {@fsuuid={'fsuuid', 0x3d, {[0x35, 0x35, 0x64, 0x38, 0x77, 0x31, 0x32, 0x65], 0x2d, [0x2d05b151377d4427, 0x39, 0x37, 0x37], 0x2d, [0x66, 0x31, 0x36, 0x7f], 0x2d, [0x77, 0x37, 0x77, 0x33], 0x2d, [0x38, 0x0, 0x0, 0x61, 0x0, 0x77]}}}]}}) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/policy\x00', 0x0, 0x0) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000480), &(0x7f00000004c0)=0xc) 22:54:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:23 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000002d00}}]}) 22:54:23 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x100000000000000}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:23 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x2d00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) [ 1551.652307] binder: undelivered TRANSACTION_COMPLETE [ 1551.663783] binder: undelivered TRANSACTION_ERROR: 29189 [ 1551.675650] binder: undelivered TRANSACTION_ERROR: 29189 [ 1551.742817] binder: 14236:14238 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer [ 1551.752804] SELinux: security_context_str_to_sid(staff_u) failed for (dev sda1, type ext4) errno=-22 22:54:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:23 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0xbd07000000000000}}]}) 22:54:23 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x1f00, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:23 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) pipe2(&(0x7f00000015c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000001600)=@assoc_value={0x0}, &(0x7f0000001640)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000001680)={r2, 0x3}, 0x8) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x31, 0x4) ioctl$UI_BEGIN_FF_UPLOAD(r1, 0xc06855c8, &(0x7f0000000200)={0x4, 0x5, {0x55, 0x1, 0x7f, {0x0, 0x8}, {0x400000000, 0x4}, @cond=[{0x66ea8899, 0x9, 0x1f, 0x9, 0x1, 0x9f45}, {0x9, 0x6, 0xff, 0xc3, 0x1, 0x6}]}, {0x57, 0x9, 0x8, {0x6, 0x3}, {0x400000000000000, 0x8}, @const={0x8, {0xce7c, 0xbd3e, 0x44, 0x3ce}}}}) open(&(0x7f0000000180)='./file0\x00', 0x10403, 0x30) [ 1551.829133] SELinux: security_context_str_to_sid(staff_u) failed for (dev sda1, type ext4) errno=-22 22:54:23 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x3f00000000000000}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1552.522641] binder_alloc: binder_alloc_mmap_handler: 14236 20001000-20004000 already mapped failed -16 [ 1552.532909] binder: BINDER_SET_CONTEXT_MGR already set [ 1552.538980] binder: 14236:14280 ioctl 40046207 0 returned -16 [ 1552.544966] binder_alloc: 14236: binder_alloc_buf, no vma [ 1552.551858] binder: 14236:14281 transaction failed 29189/-3, size 0-0 line 2970 [ 1552.560124] binder: 14236:14281 BC_FREE_BUFFER u0000000020001000 no match 22:54:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x400000000000000, 0x0, &(0x7f0000000080)}) 22:54:24 executing program 1: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x42, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@dev}}, &(0x7f00000002c0)=0xe8) stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='fuse\x00', 0x110820, &(0x7f0000000440)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xf000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}, {@allow_other='allow_other'}, {@default_permissions='default_permissions'}, {@blksize={'blksize', 0x3d, 0x800}}, {@max_read={'max_read', 0x3d, 0x5}}, {@allow_other='allow_other'}, {@blksize={'blksize'}}, {@max_read={'max_read', 0x3d, 0x6}}], [{@audit='audit'}, {@dont_appraise='dont_appraise'}, {@dont_appraise='dont_appraise'}, {@uid_gt={'uid>', r3}}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}]}}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)=ANY=[@ANYBLOB="80"]) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f00000005c0)={0x5, 0x7, 0x2, 0x0, "140ea27e756b999136c8a86cd54ba26a3e7f564e12203e77eaa313a02309f516"}) 22:54:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:24 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x60000000000004c}}]}) 22:54:24 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x7a, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:24 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x48000000}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1552.567479] binder: release 14236:14238 transaction 619 out, still active [ 1552.577452] binder: undelivered TRANSACTION_COMPLETE [ 1552.587759] binder: send failed reply for transaction 619, target dead [ 1552.602534] binder: undelivered TRANSACTION_ERROR: 29189 [ 1552.670787] binder: 14291:14296 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:24 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x2) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) mount(&(0x7f0000000040)=@md0='/dev/md0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='nfs4\x00', 0x106004, &(0x7f0000000180)='\\\x00') 22:54:24 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000000000022}}]}) 22:54:24 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x8cffffff00000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:24 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0xc79}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) 22:54:24 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x400000000000000}) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x20000, 0x0) mknodat(r0, &(0x7f00000001c0)='./file0\x00', 0x10, 0x100) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000200)={'NETMAP\x00'}, &(0x7f0000000240)=0x1e) [ 1553.458416] binder_alloc: binder_alloc_mmap_handler: 14291 20001000-20004000 already mapped failed -16 [ 1553.468045] binder: BINDER_SET_CONTEXT_MGR already set [ 1553.473379] binder: 14291:14334 ioctl 40046207 0 returned -16 [ 1553.480746] binder_alloc: 14291: binder_alloc_buf, no vma [ 1553.486366] binder: 14291:14335 transaction failed 29189/-3, size 0-0 line 2970 [ 1553.494577] binder: 14291:14335 BC_FREE_BUFFER u0000000020001000 no match 22:54:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x51, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r2}], 0x20000000, 0x0, &(0x7f0000000080)}) 22:54:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:54:25 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x600000010000000}}]}) 22:54:25 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x8, &(0x7f0000003a40)=[{&(0x7f00000026c0)="1c1df2bf2d6c8d3a64343322a69d7f4ab05ea032d420c880001da161759a717da4d7cb02d07a9bf69587b351e37de482c33f5c91fa915dc9ccd99817199ea23f667c96bc812e23fba684f1dfb5c13609c09c934bf6f67586c91c1d4bef890c78a59c06edb39d6bea5e63dd1695c8ec989824c9f15a9341667a93959da99eba71525dd57957a042bc0273c882e481ca35ebc0db90682f4b40fb286471ce5c384bae39626df71e64fac3fc7757d906824055dc966cebdf7bcd681eda232130412f6629979effdee5745efde58511853f3bb9ed2ad609020ce94916f0f36ca9dec386c2d1d3eb1bb22dea6d971d772cecc41fb09c17a3451de1c575a7ecb115af6659145b9cc578bf68fa323de9071355a0c83ed2ffb7fcb8fd779f936c50a540c116cdead26ccc4b9e701e601ed3460e2b08c15a5674c53607a69629c0bec61291283a520bba79873f3433aec99f342a9fb089d565f51afae8fa4896bb66da08787e43c335bc418361a67070027aed4c4b2c6400c5cc65a750cdc59e484e6bec8ff20c9dffe7c9678dc472d95b647aae65a8930a8ab6f5f056c3ea0ae66287d5e4f654c1786ab055cacbdfd8966cb8be3b54a511ac700f1e8429c4fbc0abbb1fa136fc368a4da654ea1fecda602ab90d77713e7d0e8540b502d9785c1b0bac78a012636be0a3fe5327adf84e9e2a227364942e1014ed339b958a9ed13a4b0a61ff714802fae6574d832a063ef0a40f2e51f720dd71cd450ea89fad3cfb5941773be87bd76201ced339545f195fe9371225c8398c550b7ddb5eb5b23bd460511f6e4e3bc569aa5bb9d0df459a30db2a9636a5a09d88f64549e1042cae323ffdeb46bda24903d183545e1c2d6a3d59e525b9d61f75975585c1837e48d1e69deb6bf022f767d13f685c3dd7811681c532eeb0ce4e9e9890459233675d89f3fa06ba14e23e508cb9d9f097dbb4c9c0a8999095818aa0b86ee0361fe6e92ac720783163d75a93c54adcf97de807db90899753b7c6ffee901d8e0dce7db48983fee52a60d546b7d4afc8fcb875a1fa409cd6e16361eef3d410ef3e4f4f11691dfb636e219df69c0833522e5f9202f5ab40ce4bb7db08b4edd96224b6a204295f21e53e957a8fbedc4fb2ba6ca584324d81997c30281252e1640db71c5044538608c8fa98e8990c7870beaac6cb4dcfb2004c153f1eea5368afc83c7f4586314c458a90ef4a013c6200b5ad44134115b645959db3858fa201008a80ccfdaf9abbe299a63b86c1f1e264a02331a2df66a52cab1773b27d4edb96766f03d40141d447d8c417eb205a58111884c6671526282724a66a9eb8a445a6b3c1ebdf7270309bb0110fd944bf5dfaf241dd9057eba4b56cc45dc7d81f5f2bf22cc742865029fb762745c464ffd559851bd1415710eefdad4ad3f4dfd16eca9f1ec0a280885dc771bbd7b823675e8466ba0a2e28a8d6d5ba9ec2c6afa30d1751d757248dc2a166607081b3129202942e4c43a27c6454192e5cafd4f79d441c05b593e4019f3ef9f93a8f9494f3f6dfb83565149ee37da97c2c8fc7f9aefaac0c5434649d871bbd624c878720e539bffd4b67858377d65b74db880f277209a70e5d4df14f3d6ff7bcd0852f5cf1a3cfd3c4d42b170f83f2f4bf6f751317fc5f3ffed9e4ddb3c6f64c1a65ae77e6f83750464f486f311dfede0f6ab788a9509e5bfa88f216476625136b630ce8bb75c9fb11de1849afc916c069e82e4edc15e2bc76c025623d8990205de7552ea95ec7882f03485808155cea27f59463fc901aecb9822eca4a0af5b8c22d11446c8a48ba36fa756c4030f658073c6159dbd63eba86a1f358efc84e061d761d5975ede910cfc05fff1d4c39b9183681a1a3b090a2fdc9f82cff6339448f32f68bcc4d0c19bd2b34df423b14da5d9b7e886803e61e0785777ebcdfe0179dc9856301e24dda6be6365a49c8ea0819278f3c0ebf9be4b3ed6bafe398bb9a0a5617ce04c2bc617b03d2239dbf0974edf898823d56b187ef14197e9d184bed8da808818c87bb0906ca26b390b3130b8b385001e096c174cf8cd57abb77a78fcd596bf3eba9054c9f0eca08cc8dfbc3c7f1f3aee9bb0049c70f8eb2059163bdfcf0aa1f3140b506ee189f8b076a35a7940f64a30a40d5378b03058a2d4fee20011216eebc0da89eb2219855f3712f9b2260e5b68a123e0aa6166ce59cdce10767e08121b6d5c9809816f9dffda5351264e44e3cb9a0df15d71147af2919c260ffdd9a8077fd36ac733e20081afd1184178312c8f996ed2bd960abbd3c0aadd0b216bee5e6ec6aa02835ad205491997fda64782870183425329073f9fbb0285a8acd3a223ea3ede7275569d003fcc7184ade4eb51320c772f55f05716196b84303818c8b781d0ee7ed04b3fdfc4694787c54a1b77c38930f3e6a68adcf4d155f921359353ba0930cdb55104c5017ec8317dd81defd93b8639a905e0878c44acb49f64de452b98ec41ef3269d36f786232c7103c11c9180b4dfd2f65252fdb64f0c43874b9c41901b86d37237a72c2efd8bb89abf3e5b68a227a537dfbb19859bff2f48a12c530d4fe8be601bafb29c4bf0952f5e3699913f40be7836698dc593fab912f89b81280f191f6a4fc58503e9569340961092e9ef2fa2096a1310b5d3b229c77e53415124254ecceced3262b50d146f9abc25a7f0421c8e9de8a398b6f6f7beed165a2903e5918f9145346940900b6fddd2cf45ebb1208169343d40564b416a1a021f39859d2a3e47ad767116df810af48f5f3c156c65836fdcdd5e314102b7a399c913fff575c4b276b9562f87224f68f4d78446fa4705f3e50cb1f6da2fac85a0b9f533666cb3fbc7823837c3e1788b3a04417ed93772c4b682e513cb34f39049d79b867f06868606650942885c4567e15db660a75c4d2eae4fbcfb57f7ab866944a807b1f2ae046db6dc4c8cf2de315c2c9cd45f777165ad126f993b9ab5609eec9f7f58e04a7fa19e3559a35e5d1d3870b8b3121faa989fb3a605fc6d82fca4b9319c10c7f7fcdc43abd73397df5290914cf73a913469c9cf3ac9958e35266f85a640063bfc8c421eb6fd9b4434778ef67000142d41b8ab0895691e2b8be6da097bb82ad2299c6645c258da5d0963b0ef4b13e549e77b515b46232c9e67f1e1f900654b1a85d701765c3995ba2b28bccdee468f686fc0629e13e0fcc1448e0be2bfac9b641809f0ac25fcd428e4bfa6682cea936bde159280c53cb9506cf1a949eb2e838c346e0b4afa61676deb6fc8dde6d9f1e8b455d41cc49b55e2928007746992b6b7a89d469bd3d4d9d9d5a81921a742980ffa26c8b7812542dad730eaebf1bbc88615a85d33369b0b3f5bd1f11fa07f514e339c7c58ee419c2aa9f95fc88c3f87855651c4cdb131bd972dc0570c5b584148a7b21562deab067c380ba59de134b59aade31b651a2a5fc5ed6bbf01c5e6fe7f72651a07b1b0b6ae3cd0f9b70589207f7c063eaff2ecfc5ec19c79c4f8aa5b333d3dad1b187481a2db5ca501137061b236d5aeb41053389b38241688e94282dab76e7b9a2d523154a84182e5d0d4d71ffab4f5ccdfa4eb6b9e175d50ce70cc1dcd4d473103703d3e43e6dedfeeca14d2b38b8b0496a5bec345fc51e65f579406fc114b697c3c631f118539dcdddb4fb69a2a0e2a4b4bbea44a87578cbb64dabbab8eaaf891ae03855f76620e550eae4b0ac2a801ef4506bb6612352b6acaf33a4acb2b424702d0fecfa5a88ca52086d7d53901869a769ee1928b561528339bd4b405a181c90828691d9605ff130d4bef4c1468f2ae6b9ee5ae9537427240ac27005bf68bff56c414268b585f801ec748fe13044f61540e14cb7540b26b18a9ca171cbae5b4ee597e5b6555aa60097253301a8058f34c0c60f46bedf1f94e02961bffa4e87ea6e26dc2a8a9bdc8f07d7e67f98c3197c89765cc3638f3e6e50119d8a5bd8b35fdcf77517920d909f843f5ba34920989ddcd46a2f4d62af3d314fb4d05e7d227c24425b427f5514bab711adefd88a8a312f78f48cd5227226c44be76fcc9220a470c03335669163857c8f3c49c3acff466d6e74405df8ff9e8798c619d426e3da89673ad105b205aed5727a9561626a4af70bc6e98828f6697083a2da956c621f05931629a00c0a8dfeb4472faa07455a2e2fe1137b8ac42ab1c451615cbea18f1457515998029fd3ac6c1cf5d8e2c270a9520e618abf9dfd26dfae57b6cf291fe7fb80d2a3dccf1f29eff1cdbea6b177185863fb372b103a2511905467c5f04fac9446b9909cf26afe8af793665bf13de6bcfd982a96fa4c76ff0e481013ee14e77d435c5ee3e7d06647e1f1754af77315c9113ca3d1984652c80336750ab7e0a7fa9a348f6ea9a55854ad0fbb9f725605e7c49cbafdf94cd8529885997b5fad4669fd0cbb323fcfa8c3f736cc8a9c6f6b3ab1a90a63887047495400bcd3e4031a51ace23e5cd590dba2d18eda1d914fc6cdb6ffff6ba78eff45339f4c0926208ce8141a7755f6bb54da2653bd3a212e094a3b8b926bb24829a97d21df232225928417474450dbaf0f72607bf17bb301eadac874bc5ebf3f075118dfba0d62ff80965c58fa5501966aa4234e701066930e01143634066008dc75205be5db37440daa31d44b386be4e919e2d6e382bcaa2df77d9a3db7c0fd3d6e90a70c26515d8f2925b31e22a8d6b0f6e04e8d16392f06242497677595626d17b9bdafc089ed0b0b8f669759d22f6b85c9ab3c043f88a6b7414913aef389deba14a75e4389e08cd2025f38978d0124cec22158a2e7e913a32d609be9909fe1364e430f7fda6966d04253b69b030cafa2fc9d315571b0d78480ea54dd8a16d090732ffbfc99b5821210265504265ea09d251c19c63a45997174f94cf97ccb073c49e2e5edee91fe3c8f921d05e12ec765f330dece799f9416c4654033ef6347d59c44a2e5564c6925bbce36b20d94b181e67a32144859fb478fe471e0be821a0d7eb8aad23f6c26143ac4423e845ecd2394ca533b256563eecdad5f1f532da94a8b3f959501c1017f5105accd9b7d695a646999dea6fabf9d8aa062bc1fcfa66f5e970da626212a96f6d8743684bf425ed578545137a2457f06b681b7840740fbda21713c53ec1cfd60d1e60619e214c65d7af35f71609d7a7a3ce622d403f02306e24536c7cf6666ff7c4473ba06e7d337c38e06e2f032781cf6254ee155d4a2d97197e94629bb61c91048fe82d27b8d903ecf7e529fad56bedb245e510eb13912be87797370af968e202b8cc9158efe63067d725d49ccafe58a05a57638782b66b014b2c183e1410902c215d4cb161964765234251d0a2025ab39ee40fcd9e52122735834c5420f61f73a789c135c40613bf2cbf038b6619fcd2ff476be083a4573fd8550c7e98b36120e3ace629019b67cbb5896fc9bd9f40d645bfca2ce822a1e670cce27911be674f574428a73c9adceb7644924224ecd2aeee43f613472bacb439ba5354c774351feed9c6d1123d2cdb42de671e39a979e99b6f34750a57d59a154ad0099b32d985f8ef9850ae06183f87e65cdf38afe66e1d9e6171e9180d78417f3fdfbb1deb440077e4ceb9e5e1585d771fcd0fcbadccf3c88519c8024fe72495eef71bfa5f762b15f75cd836a7b617f629713dcf71a09cc1caa5bdd31727647ebb41a1ef39c2518b215eb74c898058673a918722b5de05c3ca55b99395062ebf9b73f2a567aaf504ce189fef14af8bdadde36b708bef0a733935f96235719d16dfe7535f", 0x1000, 0x442}, {&(0x7f00000036c0)="26714f4deadf07655fdae06483c5e69520194f02247982acf61e0ae24a4fc5c22bf66b97f10f06865b3f66c87e2825890e6d06f485d031f6963430c84d94d0df678f11", 0x43, 0x1}, {&(0x7f0000003740)="b45a7ac637852b5eee7f134a0345c35246c91b51f1728485f6c9e146390447f5", 0x20, 0x4cfc}, {&(0x7f0000003780)="a63729d76993875f419e538bbba396d0278606bd40ebf48c5cfcf41d9c38eea31dea0d2d92e9d27ea0b284df3a9fc59ebec8c2a36b55fa8c465afa2294ec8fe13594b9db3c2f47d8390cf7959382", 0x4e, 0x401}, {&(0x7f0000003800)="8c4e660814ba03f1ae192645c632eb822fbc808dec58b970dfdf58ac9005efe1aacbd88b47c2e5d74b4d7344bb9ccc281c29ca0d9671b3aae5ac0095249499b798aab8fe703fb0635d7b0b29c2ab8b42faca2b09d872e9f2047f2c209005eca9355d77fb46774a8c8e1182ad", 0x6c, 0xcbf}, {&(0x7f0000003880)="f96c0d82a2303e0214b46da4d3a835730daa", 0x12, 0x320fcf55}, {&(0x7f00000038c0)="ec0f9b28ac1e542049058d7f2eecbd37623f66fe0787499590496f9c26992183ed37342c1cf22154256dcd7ddab20bf6d70edf106b0b054675df8412fe31b8373ed284ba71971d07857d6207f32a543ac7cfaf433bf87743c1b23cbc0301a585e2e17f73253fc8a3b2573dad1960e5b24d76d4733e00aeb652059535a2516da7c47f338713bc5be51a0d4b4cb3857ea4a4", 0x91, 0xfffffffffffffff7}, {&(0x7f0000003980)="c28761c7185181ef82703422a7bdee0f0686418afc33502e8c52b255991e6f512046f25103222b1065abd13886135911ec8d0144d590d15ac973e5db976c2922245e1d8b99490d02d5245bb6fc1a008d2149526e8d0403846829f94dcc4850d34373e4546b1fe8fa1a84c0f8894c082108b35fce7cdd78b2055e9d4d26a00016681070", 0x83, 0x800}], 0x100020, &(0x7f0000003b00)=ANY=[@ANYBLOB="e38796ca6e83ea5d6600"]) r0 = memfd_create(&(0x7f0000000f80)="0000000080", 0x6) connect$inet6(r0, &(0x7f0000000fc0)={0xa, 0x4e21, 0xf32, @mcast1, 0x6}, 0x1c) r1 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffff9c, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) setsockopt$inet_mreqn(r1, 0x0, 0x0, &(0x7f0000000280)={@empty, @multicast1, r2}, 0xc) sendmmsg$alg(r1, &(0x7f0000000ec0)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)="222b31a76813adf61eca54370384dfc1a0ed923300f9ef1781ee0e724ca3836e0016573b76c94c36cd19c3082be6c20e3475c6ecad20b808b37ea06a2a40cb699c7f51ad581f44d7103001551ebeb282e3c4bbef18b9271440c75671d554c5bbfca7036f5ebc29ed726e9757119af51bd3dff9ccde7567dd2a7cff231d5839cae81e739575cbcc93f55a99a7e75024ef51a1cc53c1901c54b9a527f6adc7daa2368c019a3ce00d44d907ad3610f5a454aa36358f5456ee6d", 0xb8}], 0x1, &(0x7f0000000300)=[@op={0x18, 0x117, 0x3, 0x1}, @op={0x18, 0x117, 0x3, 0x1}], 0x30, 0x8014}, {0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000340)="675857f218e07c7e05264acd016f16c2c5fa53c2d5231e65d15cf8f777e3209c5f4999c5771851d6471c19857749abfc94f8a5f0ba7a368d34491a29b948382de575b4ea481e8effd23423fc9965d6f4b236ab1a829493552d23f79440defbedcd07fa4f2eff7656a2bb354c35247d3fb3b5edaa04ec472eaa74527c59da36c8656b908b95afa5fa409901564e031173da4189dc5819d86057c5fadda364f17f64426a776ea2e8869deca8716dfe691efebb592e2d9f2a3483030a026f31cda66258ced8cbeb6a01b0c40acbe80df675e6ef3ae053ee34f983ec355833a701275e295fb267", 0xe5}, {&(0x7f0000000440)="781e9ea1767f856298c9d2c2bd22563c46a4916d5302fcf18db3b6afc7b3e7095bac9c1494c322f34d78c82171ca61dfd6b0243be58f40079274326e1193ceb0c00f85abe49bfc0bf5fcdf6334fa03af3d678d6a93cd75069328d732b523b8992bf64de8e555aa0305a9a1d72e64e54e4b98ad497dcae161ab4f71adb6fa2dbb2108a8b960b6d0770ab8cc07ab2d38b35fbc2679b2bcd8f0d2a53eafa9534e0c8e62967dae004349755c895adfcdb229d90239efe981040b63f2", 0xba}, {&(0x7f0000000500)="cb657ce4c6c51135dedabbcb9a10843b77cece48ac211e3859ab89d7076ed8ce98c96bffeca08a531c89edea3969fed9210929b332a7ce86d826b09cfa2f0237c4c489be3ee8dc5ca205bd514b9cce4abe1d4bb094f17d9b435dfaca75f34fc1e040af76118db0e1e978c7be21a911486e9a372e4afd3de1e784b30fa2326e48677828b978e7b13c7fcc2014d64e391b48a4c35515b9bce074f052fa634ee3d176272280b231445f6351755d7473ada10d790698f1646f0ac13a125b5c9bbab8abe2eb749666aeb9948da75bfe1246d0d560fe181aff209d805330c0a37d431ffc037fd078429dc25eb8", 0xea}], 0x3, &(0x7f0000000640)=[@assoc={0x18, 0x117, 0x4, 0x1}, @assoc={0x18, 0x117, 0x4, 0x9}, @iv={0xd8, 0x117, 0x2, 0xbe, "2946d1796ecc855dfcffd254bf76b7410f0c460c7d20939fdb5a05ef31cca8c3c5ea3e84b1ce708a7ef85642b5985e3fc5b273c516c674df5269f9648ae4ef587ac5fead7f1b4ac2b589f6d2984c01f225d6881b0f251b4eb91c8b404e216a00bcc30b713345ba3858065e7b05615cb624a321eeeb15c3b38114fce1ae90da208cf974fcb3704afb3816e64bd75c6aa24983855c7d60fc14efd11a583ea62a4a7489b645cc021ce2f3b7303b66d6881ccc260b0628b36dc7111f84465c54"}, @iv={0x28, 0x117, 0x2, 0x14, "243a608817d4b23405f8322db4888b237d0c8519"}, @iv={0xb0, 0x117, 0x2, 0x9b, "99d14b3ef99b1f1b8d6c23da9e85210d9dc5e4bb998c492ca006b13e22ab41e75ee3d56a38644c95c0aa4b1de2790b7aa39171a670e933d2600174365ebc171e0b467d9d36202106b3bcc3413939419c4794bbbcc0a8d6608fcc956bbc652d2db0f7ab121ba66b047d745bc7142255d676d017faa8d3594be2d5a4cc60a8f54cfca47277d6a3aff3b59dc053818c0ae213ca51691b0aec051040ff"}, @op={0x18, 0x117, 0x3, 0x1}, @iv={0xa8, 0x117, 0x2, 0x8f, "386325fd72b9b85715b0530b68186b9b7a14898ad29606dc247da3079dbf7288f865d24cbb4921061f3bfccc2ebc5efcf776e643d4756218b2b1d37153749960a1fd101ce7ec46d72a7f54c2006ebf231200d1256ca9fac0451fb072e6dfb7e0c42bbd91c674fd414431834b0eca0a19b0f66ac7886b7e62db36c75aa658acec86ad7b83d82865452bf318a24339bc"}, @assoc={0x18, 0x117, 0x4, 0x2}], 0x2b8, 0x20000000}, {0x0, 0x0, &(0x7f0000000e00)=[{&(0x7f0000000900)="9b33e083458f6e1bb920184a31ae84b9ff112b", 0x13}, {&(0x7f0000000940)="18fa8c98a138515c9b67323b0ff06879ded2eb926f3c36a66f4eba09cb878f", 0x1f}, {&(0x7f0000000980)="9e3ba79778fe62c796fe28d1928291b44e1298e606f24bcff932ee8de5be00fba93e73152be53d19ba8236c3cdb2f04ec4b051af8c0c60b0baf35086cefd1598c288802c3768194d70f2fd5af4f5da883851b1509ed90699d9350b737a1e3c5a67cb6f3c55d857880d7cdec9fcb339f1b407ba1d500b", 0x76}, {&(0x7f0000000a00)="58d6f516c5a1320bd3010a8aac9351a3affe9a449ff94622201945bc7e3597bebe3b22830eae42ee43d5fa5633039da34c7134632480200d546e9b44cfeef8960c2e350853d3878900dcd30c3d129de99f8d9bd6d6e443ced5706b9b4703d646c9e8690e680d7ba0d2aad1e6ca80d0f7f8ad4af9098c3cd52b1ec246ef227f23cbc8581d098090110e3eb123948a45b9f36e171c4f8de59480b5b3111b8fd46e07e85ba4f38406eaadcfb0041138c96c30520f93997bc33ce278b5b1727af8d57a2b0c245c7e86ba81167edc3d040bc2d599bb8a4b727160d6aad503ad38314719c656a5d7cb7e5499faa79d9a", 0xed}, {&(0x7f0000000b00)="afd9ba672fbbfdaee957791f69a2a9f228", 0x11}, {&(0x7f0000000b40)="0cf43874f3094885aa83f5ea14e80f593bc213ecc32a17baddb8fc6a0e4b79afcd2accdc28fc3dc26085d25630463488565a6a8c0f4af43553ff315a024868aa49675495706c214d1840416d2f6ccf33196fba73d0d7075261ff130ba9c2a09ca8fc51edc896b58b4cb9eab5fda9ac94cbfad3ef9e14ee0369158e9b01115d4064d114a8538ef9f90e49c8d7cfb74e05998c58b876536aa43b37cd7e76a130d825bcda3e2a69c8b1f02f2b084f8b2deb120e3d2603f7005f89ca37da970ece2fac93085cde1bc9124cd9ac34e56b", 0xce}, {&(0x7f0000000c40)="2f6a18", 0x3}, {&(0x7f0000000c80)="254c8bbe148e5c289e23c210ad086e22d36675cf2f70ea59d9378b1a91ec800199e96a78abff3dbe79682b653c22fe825f5c825c2c28ec547dbf5bb9e9c5a39654e55a3de93a9ab60d6fd484", 0x4c}, {&(0x7f0000000d00)="617fd32b29ee67693f6e8955631e8e799b17c9fa5e0862a4c052c4b0c235fb4c9fcd8ddb0cae38cb451ce43b1c5c508ebd2d044b2e9a43258395d44b7a8d75da61b3e6b2a3c20943063f95ef1e71060e5233c0e378a8f1202dba430ee917c5986b220607b9da0c367582c085de6916efd3c8e706dfd50604bfa2d9201658954a60a8b7d8216c0c127707bc698aafae96040fb4c675f4f0b89a96f98daf10d1d4ddcbdf5ac23087e208d8bce868347aa161b934ccfc78fc3e899c0693407857dbe1e1af9245b282a579782c09569063bc7f3e633ae3d717cc8e4c5e3d75c8619d8412d1b2d6a8fe0fd157f42b6848b4d7", 0xf0}], 0x9, 0x0, 0x0, 0x4000000}], 0x3, 0x4044) r3 = open(&(0x7f0000000180)='./file1\x00', 0x0, 0x80) write$selinux_create(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB="73797374656d5f07000000000000005f723a73797374656d645f6e6f746966795f657865635f743a733020e64185536e66696e65645f753a73797374656d5f723a696e736d6f645f743a73302d73303a63302e633130323320303030303030303030303231343734383336343800"], 0x6e) syz_genetlink_get_family_id$team(&(0x7f0000002680)='team\x00') 22:54:25 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x4c00000000000000, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x10}}]}) 22:54:25 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140), 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000580)=0x10000) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[], [], 0x10000000}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000f40)=ANY=[], 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000006c0)=0x4) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000840)={@remote}, &(0x7f0000000880)=0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) r0 = syz_open_dev$dmmidi(&(0x7f0000000500)='/dev/dmmidi#\x00', 0x10001, 0x0) ioctl$TIOCSBRK(r0, 0x5427) [ 1553.502261] binder: send failed reply for transaction 622 to 14291:14296 [ 1553.512210] binder: undelivered TRANSACTION_COMPLETE [ 1553.523762] binder: undelivered TRANSACTION_ERROR: 29189 [ 1553.535864] binder: undelivered TRANSACTION_ERROR: 29189 22:54:25 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffa) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000200)={[{@journal_ioprio={'journal_ioprio'}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xa997}}, {@journal_checksum='journal_checksum'}, {@nolazytime='nolazytime'}], [], 0x400000000000000}) [ 1553.596523] binder: 14344:14349 BC_FREE_BUFFER u0000000020001000 matched unreturned buffer 22:54:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x1) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x40, 0x4) sendto$inet6(r0, &(0x7f0000000280)='9', 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 1553.691918] ================================================================== [ 1553.699332] BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x2f6a/0x3d70 [ 1553.706524] Read of size 4 at addr ffff8801a4db491b by task syz-executor0/14364 [ 1553.713963] [ 1553.715595] CPU: 1 PID: 14364 Comm: syz-executor0 Not tainted 4.19.0-rc6+ #51 [ 1553.722864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1553.732214] Call Trace: [ 1553.732234] dump_stack+0x1c4/0x2b4 [ 1553.732252] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1553.738427] ? printk+0xa7/0xcf [ 1553.738439] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 1553.738458] print_address_description.cold.8+0x9/0x1ff [ 1553.738474] kasan_report.cold.9+0x242/0x309 [ 1553.761387] ? ext4_xattr_set_entry+0x2f6a/0x3d70 [ 1553.766238] __asan_report_load4_noabort+0x14/0x20 [ 1553.771176] ext4_xattr_set_entry+0x2f6a/0x3d70 [ 1553.776795] ? __find_get_block+0xf20/0xf20 [ 1553.781147] ? ext4_xattr_inode_get+0xa20/0xa20 [ 1553.785819] ? zap_class+0x640/0x640 [ 1553.789541] ? jbd2_write_access_granted.part.8+0x23d/0x410 [ 1553.795252] ? lock_downgrade+0x900/0x900 [ 1553.799399] ? zap_class+0x640/0x640 [ 1553.803115] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1553.808918] ? ext4_get_group_desc+0x1c6/0x2c0 [ 1553.813502] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1553.819035] ? __ext4_get_inode_loc+0x470/0x1330 [ 1553.823796] ? jbd2_write_access_granted.part.8+0x264/0x410 [ 1553.829507] ? jbd2_journal_file_inode+0x660/0x660 [ 1553.834441] ? ext4_block_write_begin+0x1870/0x1870 [ 1553.839490] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1553.845027] ? jbd2_journal_get_write_access+0xa5/0xc0 [ 1553.850305] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1553.855843] ext4_xattr_ibody_set+0x8a/0x2c0 [ 1553.860254] ext4_xattr_set_handle+0xb8f/0x1650 [ 1553.864932] ? ext4_xattr_ibody_inline_set+0x2c0/0x2c0 [ 1553.870242] ? security_sid_to_context_core.isra.12+0x17a/0x2f0 [ 1553.877231] ? security_sid_to_context_force+0x38/0x50 [ 1553.882517] ? lock_downgrade+0x900/0x900 [ 1553.886677] ext4_initxattrs+0xbd/0x120 [ 1553.890660] security_inode_init_security+0x1d1/0x3d0 [ 1553.895851] ? ext4_init_acl+0x300/0x300 [ 1553.899912] ? unregister_lsm_notifier+0x20/0x20 [ 1553.904674] ? ext4_init_acl+0x1d6/0x300 [ 1553.908739] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1553.914275] ? check_preemption_disabled+0x48/0x200 [ 1553.919302] ext4_init_security+0x34/0x40 [ 1553.923454] __ext4_new_inode+0x4a6a/0x65b0 [ 1553.927787] ? ext4_free_inode+0x1a10/0x1a10 [ 1553.932195] ? zap_class+0x640/0x640 [ 1553.935910] ? debug_smp_processor_id+0x1c/0x20 [ 1553.940576] ? perf_trace_lock+0x14d/0x7a0 [ 1553.944807] ? lock_downgrade+0x900/0x900 [ 1553.948955] ? zap_class+0x640/0x640 [ 1553.952669] ? security_compute_sid+0xe71/0x1f40 [ 1553.957421] ? lock_downgrade+0x900/0x900 [ 1553.961570] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1553.966589] ? ebitmap_contains+0x233/0x520 [ 1553.970911] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1553.976870] ? ebitmap_cmp+0x227/0x2c0 [ 1553.980764] ? zap_class+0x640/0x640 [ 1553.984479] ? avc_has_perm+0x469/0x7e0 [ 1553.988475] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1553.994017] ? avc_has_perm_noaudit+0x630/0x630 [ 1553.998697] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1554.004243] ? __dquot_initialize+0x629/0xdd0 [ 1554.008752] ? dquot_get_next_dqblk+0x180/0x180 [ 1554.013425] ? may_create+0x263/0x530 [ 1554.017228] ? selinux_dentry_init_security+0x2c0/0x2c0 [ 1554.022594] ext4_symlink+0x4b7/0x1130 [ 1554.026491] ? ext4_orphan_del+0xec0/0xec0 [ 1554.030726] ? selinux_inode_symlink+0x22/0x30 [ 1554.035309] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1554.040851] ? security_inode_symlink+0xde/0x110 [ 1554.045606] vfs_symlink+0x37a/0x5d0 [ 1554.049327] do_symlinkat+0x242/0x2d0 [ 1554.053137] ? __ia32_sys_unlink+0x50/0x50 [ 1554.057375] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1554.062739] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1554.068204] __x64_sys_symlink+0x59/0x80 [ 1554.072266] do_syscall_64+0x1b9/0x820 [ 1554.076952] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1554.082317] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1554.087250] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1554.092096] ? trace_hardirqs_on_caller+0x310/0x310 [ 1554.097127] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1554.102154] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1554.107689] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1554.112705] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1554.117551] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1554.122735] RIP: 0033:0x4572a7 [ 1554.126030] Code: 64 8b 5d 00 e9 14 fd ff ff 4c 8b 74 24 30 64 c7 45 00 22 00 00 00 bb 22 00 00 00 e9 fd fc ff ff 0f 1f 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 bd b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1554.145010] RSP: 002b:00007ffcaac01628 EFLAGS: 00000206 ORIG_RAX: 0000000000000058 [ 1554.152731] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004572a7 [ 1554.159997] RDX: 00007ffcaac016a7 RSI: 00000000004bcfd0 RDI: 00007ffcaac01690 [ 1554.167259] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000017 [ 1554.174526] R10: 0000000000000075 R11: 0000000000000206 R12: 0000000000000000 [ 1554.182745] R13: 0000000000000001 R14: 0000000000000b01 R15: 0000000000000000 [ 1554.190017] [ 1554.191637] The buggy address belongs to the page: [ 1554.196560] page:ffffea0006936d00 count:0 mapcount:0 mapping:0000000000000000 index:0x1 [ 1554.204699] flags: 0x2fffc0000000000() [ 1554.208584] raw: 02fffc0000000000 dead000000000100 dead000000000200 0000000000000000 [ 1554.216465] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 1554.224336] page dumped because: kasan: bad access detected [ 1554.230035] [ 1554.231651] Memory state around the buggy address: [ 1554.236576] ffff8801a4db4800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1554.243930] ffff8801a4db4880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1554.251287] >ffff8801a4db4900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1554.258636] ^ [ 1554.262777] ffff8801a4db4980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1554.270132] ffff8801a4db4a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1554.278137] ================================================================== [ 1554.290347] Kernel panic - not syncing: panic_on_warn set ... [ 1554.290347] [ 1554.292584] kobject: 'loop3' (0000000004a660c1): kobject_uevent_env [ 1554.297737] CPU: 0 PID: 14364 Comm: syz-executor0 Tainted: G B 4.19.0-rc6+ #51 [ 1554.297745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1554.297750] Call Trace: [ 1554.297770] dump_stack+0x1c4/0x2b4 [ 1554.297790] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1554.304245] kobject: 'loop1' (00000000a26aa196): kobject_uevent_env [ 1554.312838] panic+0x238/0x4e7 [ 1554.312858] ? add_taint.cold.5+0x16/0x16 [ 1554.324814] kobject: 'loop3' (0000000004a660c1): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1554.328377] ? preempt_schedule+0x4d/0x60 [ 1554.328393] ? ___preempt_schedule+0x16/0x18 [ 1554.328424] ? trace_hardirqs_on+0xb4/0x310 [ 1554.328441] kasan_end_report+0x47/0x4f [ 1554.328458] kasan_report.cold.9+0x76/0x309 [ 1554.337358] kobject: 'loop1' (00000000a26aa196): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 1554.340034] ? ext4_xattr_set_entry+0x2f6a/0x3d70 [ 1554.340054] __asan_report_load4_noabort+0x14/0x20 [ 1554.340068] ext4_xattr_set_entry+0x2f6a/0x3d70 [ 1554.340094] ? __find_get_block+0xf20/0xf20 [ 1554.356149] kobject: 'loop3' (0000000004a660c1): kobject_uevent_env [ 1554.356847] ? ext4_xattr_inode_get+0xa20/0xa20 [ 1554.356864] ? zap_class+0x640/0x640 [ 1554.363928] kobject: 'loop3' (0000000004a660c1): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1554.365389] ? jbd2_write_access_granted.part.8+0x23d/0x410 [ 1554.365405] ? lock_downgrade+0x900/0x900 [ 1554.365420] ? zap_class+0x640/0x640 [ 1554.370327] kobject: 'loop1' (00000000a26aa196): kobject_uevent_env [ 1554.373688] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 1554.373701] ? ext4_get_group_desc+0x1c6/0x2c0 [ 1554.373720] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1554.379119] kobject: 'loop1' (00000000a26aa196): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 1554.388431] ? __ext4_get_inode_loc+0x470/0x1330 [ 1554.388453] ? jbd2_write_access_granted.part.8+0x264/0x410 [ 1554.388477] ? jbd2_journal_file_inode+0x660/0x660 [ 1554.408026] kobject: 'loop1' (00000000a26aa196): kobject_uevent_env [ 1554.413552] ? ext4_block_write_begin+0x1870/0x1870 [ 1554.413571] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1554.413585] ? jbd2_journal_get_write_access+0xa5/0xc0 [ 1554.418550] kobject: 'loop1' (00000000a26aa196): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 1554.421929] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1554.421948] ext4_xattr_ibody_set+0x8a/0x2c0 [ 1554.421966] ext4_xattr_set_handle+0xb8f/0x1650 [ 1554.538471] ? ext4_xattr_ibody_inline_set+0x2c0/0x2c0 [ 1554.543752] ? security_sid_to_context_core.isra.12+0x17a/0x2f0 [ 1554.549814] ? security_sid_to_context_force+0x38/0x50 [ 1554.555114] ? lock_downgrade+0x900/0x900 [ 1554.559270] ext4_initxattrs+0xbd/0x120 [ 1554.563249] security_inode_init_security+0x1d1/0x3d0 [ 1554.568440] ? ext4_init_acl+0x300/0x300 [ 1554.572502] ? unregister_lsm_notifier+0x20/0x20 [ 1554.577612] ? ext4_init_acl+0x1d6/0x300 [ 1554.581679] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1554.587219] ? check_preemption_disabled+0x48/0x200 [ 1554.592242] ext4_init_security+0x34/0x40 [ 1554.596391] __ext4_new_inode+0x4a6a/0x65b0 [ 1554.600813] ? ext4_free_inode+0x1a10/0x1a10 [ 1554.605308] ? zap_class+0x640/0x640 [ 1554.609023] ? debug_smp_processor_id+0x1c/0x20 [ 1554.613692] ? perf_trace_lock+0x14d/0x7a0 [ 1554.617925] ? lock_downgrade+0x900/0x900 [ 1554.622080] ? zap_class+0x640/0x640 [ 1554.625798] ? security_compute_sid+0xe71/0x1f40 [ 1554.630554] ? lock_downgrade+0x900/0x900 [ 1554.634700] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1554.639715] ? ebitmap_contains+0x233/0x520 [ 1554.644033] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1554.649049] ? ebitmap_cmp+0x227/0x2c0 [ 1554.652946] ? zap_class+0x640/0x640 [ 1554.656660] ? avc_has_perm+0x469/0x7e0 [ 1554.660653] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1554.666194] ? avc_has_perm_noaudit+0x630/0x630 [ 1554.670872] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1554.676761] ? __dquot_initialize+0x629/0xdd0 [ 1554.681266] ? dquot_get_next_dqblk+0x180/0x180 [ 1554.685938] ? may_create+0x263/0x530 [ 1554.689743] ? selinux_dentry_init_security+0x2c0/0x2c0 [ 1554.695116] ext4_symlink+0x4b7/0x1130 [ 1554.699010] ? ext4_orphan_del+0xec0/0xec0 [ 1554.703242] ? selinux_inode_symlink+0x22/0x30 [ 1554.707824] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1554.713365] ? security_inode_symlink+0xde/0x110 [ 1554.718126] vfs_symlink+0x37a/0x5d0 [ 1554.721839] do_symlinkat+0x242/0x2d0 [ 1554.725644] ? __ia32_sys_unlink+0x50/0x50 [ 1554.729874] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1554.735236] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1554.740690] __x64_sys_symlink+0x59/0x80 [ 1554.744750] do_syscall_64+0x1b9/0x820 [ 1554.748654] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1554.754018] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1554.758943] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1554.763783] ? trace_hardirqs_on_caller+0x310/0x310 [ 1554.768801] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1554.773818] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1554.779687] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1554.784704] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1554.789553] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1554.794752] RIP: 0033:0x4572a7 [ 1554.797940] Code: 64 8b 5d 00 e9 14 fd ff ff 4c 8b 74 24 30 64 c7 45 00 22 00 00 00 bb 22 00 00 00 e9 fd fc ff ff 0f 1f 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 bd b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1554.816840] RSP: 002b:00007ffcaac01628 EFLAGS: 00000206 ORIG_RAX: 0000000000000058 [ 1554.824546] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004572a7 [ 1554.831811] RDX: 00007ffcaac016a7 RSI: 00000000004bcfd0 RDI: 00007ffcaac01690 [ 1554.839082] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000017 [ 1554.846352] R10: 0000000000000075 R11: 0000000000000206 R12: 0000000000000000 [ 1554.853621] R13: 0000000000000001 R14: 0000000000000b01 R15: 0000000000000000 [ 1554.862065] Kernel Offset: disabled [ 1554.865701] Rebooting in 86400 seconds..